JPH0581055A - Duplex system for electronic computer - Google Patents

Abstract

PURPOSE:To set the scale of a fault tolerant computer system to be large and to improve speed so as to secure high reliability without stopping the system owing to the occurrence of a module error and a bus error at the time of constructing the fault tolerant computer system using CPU where plural modules are connected with different protocols. CONSTITUTION:Two acp modules are provided with operation control processors (ACP) 31-34. System control units (SCU) 21 and 22, main memories (memories) 11 and 12, bus control units (BCU) 41 and 42 are respectively duplexed. Furthermore, two signal lines from two acp modules in the operation control processors (ACP) 31-34 are provided from the respective system control units 21 and 22 to the main memories 11 and 12 and the bus control units 41 and 42 in parallel, and the coincidence/non-coincidence of two pieces of line data is compared/ judged.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a duplication system of an electronic computer which improves the reliability and availability of the system by duplicating the components centering on the CPU when constructing a fault tolerant computer system.

[0002]

2. Description of the Related Art Generally, in order to realize a fault-tolerant computer system with a complete hardware configuration, the internal components of a CPU are duplicated.

As an example of this system duplication, a system in which two modules each constituting the system are used and a bus line connecting the duplicated modules is duplicated has been put into practical use.
It has been practiced to duplicate the internal circuits of each main module, including the CPU, and compare the processing results between the duplicated circuits.

FIG. 6 shows the configuration of a conventional fault-tolerant computer system based on a duplex system. A set of computers including a CPU 61, a memory 62, a magnetic disk controller 63, a magnetic disk device 64, and a communication controller 65. The system is duplicated as it is, and each of them is connected by a duplicated bus line. Then, inside each of the CPUs 61, 61,
Two more ACPs (arithmetic control modules) 66a, 6
6b is provided, and the internal circuits of the memory 62, the magnetic disk controller 63, and the communication controller 65 are also duplicated. In this case, due to the duplication of the bus line,
Each module has two outputs to the bus and two inputs from the bus to each module.

In this fault-tolerant computer system, since the comparison of the processing results in each module is normally performed at the final output stage of each module, the error occurring in the module can be detected almost certainly. it can.

That is, for example, assuming data transfer between the CPU 61 and the magnetic disk controller 63,
When the CPU 61 reads data from the magnetic disk device 64, the magnetic disk control device 63 is in an output operation mode for the bus.

At this time, the processing result in the magnetic disk control device 63 is compared immediately before output to the bus and is output to both buses after confirming that the two systems of data match.

Further, the CPU 61 is a magnetic disk device 64.
On the other hand, when writing data, the CPU 61 compares the data from the ACPs 66a and 66b at the final stage of outputting to the bus and performs the error check.

In this case, if no data error is detected by the CPU 61, the data transmitted to the input stage of the magnetic disk control device 63 will rarely have an error other than the cause of noise on the bus.

Therefore, the data transmitted from the CPU 61 via the two buses is transferred to the magnetic disk controller 63.
The above duplicated data is compared at the output stage from the magnetic disk control device 63 to the next stage module, that is, the magnetic disk device 64, without performing the comparison at the input stage of the above.

In this case, an error caused by data input from the bus to the magnetic disk controller 63 is caused by one comparison process.
Further, it is possible to detect an error due to data processing in the magnetic disk control device 63. Here, the cause of the error occurrence on the bus line will be described.

For example, a module in output mode
Error checking is performed on the data output to the bus. Therefore, originally, erroneous data will not be output on the bus.

However, in the case of an error due to a failure of the gate directly connected to the bus of the module in the output mode, crosstalk noise of signals on the bus, etc., error detection in the output module is interrupted. No
It will be detected in the processing result comparison stage on the input module side. Such a data error on the bus is a fatal injury that causes an error in both of the duplicated modules.

That is, when a data error occurs in both of the two buses, it is input to whichever module, regardless of whether there are two system modules or the internal duplication of each module. An error also occurs in the data, the processing result becomes abnormal, and this computer system becomes an error.

If a data error occurs in only one of the two buses, one of the circuits duplicated in the input module processes using the incorrect data. Therefore, a difference occurs in the processing result of the duplicated internal circuit. Therefore, the comparison result at the output stage of both input modules becomes abnormal, and this computer system becomes an error.

In recent years, the processing performance of electronic computers has been remarkably improved, the basic clock for system operation has become higher in frequency, and the elements used have steep rises / falls of signals.

In addition, increasing the scale of the computer system not only increases the number of modules connected to the bus, but also extends the bus itself and tends to impair the reliability of signals on the bus.

That is, intermittent errors due to crosstalk, signal reflection, etc. are likely to occur on the bus, and it is difficult to connect a large number of modules via the bus as the CPU speeds up. It has become.

[0019]

Therefore, the conventional fault-tolerant computer system is suitable for configuring a microcomputer having a small system scale, but a minicomputer is required due to the demand for large-scale system and high-speed processing. When constructing a computer of a class or higher, it is necessary to connect a plurality of buses having different protocols via a system control unit (SCU), and therefore, it is not possible to apply it as it is to a dual bus configuration.

The present invention has been made in view of the above problems,
When building a fault-tolerant computer system using a CPU in which multiple modules are connected with different protocols, a large scale and high speed are achieved without causing a system stop due to the occurrence of module error or bus error. It is an object of the present invention to provide a duplication system of an electronic computer that can ensure high reliability.

[0021]

That is, the duplication system of an electronic computer according to the present invention comprises an arithmetic and control processor equipped with at least two arithmetic and control modules, and two arithmetic and control modules of the arithmetic and control processors.
And the other system control unit connected via two signal lines, and the first and second protocol conversion control units individually connected to the two signal lines in each of the two system control units. And one and the other main memory connected to the first and second protocol conversion control units in each of the two system control units via two signal lines,
Between the two operation control modules in the operation control processor, between the first and second protocol conversion control units in each of the two system control units, and between the two signal lines in each of the two main memories. A comparing unit provided between the input / output units and for determining match / mismatch of the data signals input / output to / from each other, and one side and the other side for connecting the arithmetic control processor and the two system control units, respectively. Two signal lines in the arithmetic control processor, and a shut-off means provided in the first and second protocol conversion control units for shutting off two signal lines when the comparison unit determines that the data signals do not match. The arithmetic and control module is interposed between the one-side input / output section and the other-side input / output section of one side or the other side. The signal passing state and a blocking state in response to stem state is constructed by a gate circuit which is selectively set.

[0022]

That is, inconsistency determination of the data signals in each of the comparison units is detected as a module error, and the disconnecting means or the gate circuit is controlled to disconnect the connection with one system in which the error module exists, and By connecting the other system in common to the connection cutoff unit, it is possible to prevent the entire system from being stopped.

[0023]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 shows the configuration of a fault tolerant computer system based on the duplication system of an electronic computer according to the present invention. In FIG. 1, 11 and 12 are duplication main memories (memory L, memory R), 21. , 22 are duplicated system control units (SCUL
, SCU), 31 to 34 are internal redundant operation control processors (ACPs), and 41 and 42 are dual bus control units (BCUL, BCUR).
, 51, 52, ... Are distributed control processors (DCPs).

FIG. 2 shows the arithmetic control processor (ACP).
31 shows the internal configuration of 31 to 34, and the arithmetic control processors 31 to 34 are respectively provided with duplicated acp modules 311 and 312, and one acp module 311 is connected to one side from the signal line 31a via the gate circuit 313. Connected to the X port of the gate circuit 314
Connected to the other X port. Also, the other a
The cp module 312 connects the signal line 31b to the gate circuit 3
It is connected to the other Y port via 14 and is connected to one Y port via the gate circuit 313. A comparison circuit 315 is connected between the duplicated acp modules 311 and 312.

The comparison circuit 315 compares the data input / output to / from each of the two acp modules 311 and 312, and permits the data input / output only when the respective data match each other. The gate circuit 313 for controlling connection / disconnection of the ports X and Y is set such that the port X from one acp module 311 is in a bidirectional passage state and the port Y from the other acp module 312 is in a one-directional passage state in the output direction. In addition, the gate circuit 314 for controlling connection / disconnection of the other ports X and Y is
The port X from the cp module 311 is set to the one-way passing state in the output direction, and the port Y from the other acp module 312 is set to the two-way passing state.

Here, the two X ports corresponding to one acp module 311 of the arithmetic control processor 31 are
Corresponding system control unit (SC
UL) 21, (SCUR) 22 signal lines 21e, 2
It is connected to the first control centers 212 and 222 via 2e.

The two Y ports corresponding to the other acp module 312 of the arithmetic control processor 31 are connected to the signal lines 21 of the corresponding system control units (SCUL) 21 and (SCUR) 22, respectively.
It is connected to the second control centers 213 and 223 via j and 22j.

In the second to fourth arithmetic control processors 32 to 34, the two X's are processed in the same manner as in the case of the first arithmetic control processor 31.
The port is the signal line 2 of the corresponding system control unit (SCUL) 21 and (SCUR) 22.
Two Ys connected to the first control centers 212 and 222 via 1f, 22f, 21g, 22g, 21h and 22h.
The port is the signal line 2 of the corresponding system control unit (SCUL) 21 and (SCUR) 22.
It is connected to the second control centers 213 and 223 via 1k, 22k, 21m, 22m, 21n and 22n.

Here, each arithmetic control processor 31-34
Each of the gate circuits 313 and 314 performs a switching operation according to the normal / abnormal state of the processor itself, the normal / abnormal state of another module to be connected, or the memory copy mode after the main memory abnormal recovery. Then, for example, when an abnormality occurs in one of the connection modules (SCUL) 21 or (memory L) 11 or (BCUL) 41, both ports X and Y of the one gate circuit 313 are set to the cutoff state, The ports X and Y of the other gate circuit 314 are both set to pass in both directions.

Further, for example, one main memory (memory L)
In the memory copy mode after the abnormal recovery for 11, the ports X and Y of one gate circuit 313 are both set to the one-way passing state in the output direction, and the ports X and Y of the other gate circuit 314 are both. It is set to pass in both directions.

Each system control unit (SCU
L) 21, (SCUR) 22 first control center 2
12, 222 and the second control centers 213 and 223 are the arithmetic and control units (ACP) 31 to 34 and the main memory (memory L) 11, (memory R) 12 or the bus control unit (BCUL) 41, which are duplicated. (BC
Access control between the first control center 212, 222 and the second control center 21.
3, 223 and the comparison circuits 211, 22 respectively.
1 is connected.

The comparison circuits 211 and 221 compare the respective processing result data of the corresponding first control centers 212 and 222 and the second control centers 213 and 223, respectively, and verify the match / mismatch. , The control centers 212, 222 to 2 by this comparison circuit 211, 221
When the processing data of 13 and 223 are coincident with each other, the processing result data is the processing control data 31 to 34 or the signal lines 21a, 22a and 2 to be accessed.
1b, 22b to the main memory (memory L) 11, (memory R) 12, or the signal lines 21c, 22c,
The bus control unit (B
It is output to CUL) 41 and (BCUR) 42. The main memories (memory L) 11 and (memory R) 12 are composed of gate / comparison circuits 111 and 121 and control / storage unit 11 respectively.
2, 122 are provided.

The gate / comparison circuits 111 and 121 are connected to the system control units (SCU L) 21 and (SCU) via signal lines 21a, 21b, 22a and 22b.
R) 22 first and second control centers 212, 213, 2
22 and 223 are compared with each other for matching / non-matching of data input / output, and control / control is performed only when data matches.
Data input / output to / from the storage units 112 and 122 is permitted.

The control / storage units 112 and 122 each have a RAM, and data write / read control is performed through the gate / comparison circuits 111 and 121, and an error correction signal (ECC) is generated / checked. Done. Figure 3 shows the bus control unit (BCUL)
The internal configuration of the first external bus 4 is shown in FIG.
Only the configuration relating to 1a is shown.

Bus control unit (BCUL) 4
1, (BCUR) 42 are two external buses 41 each
a, 41b, 42a, 42b are provided with two sequence control units 411, 412, 421, 422, and the system control unit (SCUL) 21,
(SCUR) 22 duplex signal lines 21c, 21
Data input / output control and protocol conversion control are performed between the first sequence control units 411 and 421 and the signal lines 41c and 42 from the first sequence control units 411 and 421.
c is a gate circuit 41 for the first external buses 41a and 42a
3, 423 and the other signal lines 41d, 42
d is a gate circuit 41 for the second external buses 41b and 42b
4, 424. Also, one of the signal lines 41e and 42 from the second sequence control units 412 and 422 is
e is a gate circuit 41 for the first external buses 41a and 42a
3, 423 and the other signal line 41f, 42
f is a gate circuit 41 for the second external buses 41b and 42b
4, 424.

Here, the first sequence control unit 411,
The first comparison circuits 415, 42 are provided between the one signal line 41c, 42c from 421 and the one signal line 41e, 42e from the second sequence control section 412, 422.
5 is provided, and the first sequence control unit 411,
The second comparison circuits 416, 42 are provided between the other signal lines 41d, 42d from the 421 and the other signal lines 41f, 42f from the second sequence control units 412, 422.
6 is provided.

The first comparison circuits 415 and 425 are for comparing data match / mismatch between the signal lines 41c and 42c and 41e and 42e, which are connected to the first gate circuits 413 and 423, respectively. The determination signal is sent to each of the sequence control units 411, 412, 4 through the signal line 41h.
21 or 422, or to the first gate circuits 413 and 423 via the signal lines 41g1 and 42g1.

In this case, when the coincidence determination signal is output through the signal line 41h, each sequence control unit 41
1,412, 421, 422 respectively corresponding to the first
When data can be output to the gate circuits 413 and 423 and the coincidence determination signal is output via the signal lines 41g1 and 42g1, the first gate circuits 413 and 4
23 to the sequence control units 411, 412, 421,
Data can be output to 422.

The second comparison circuits 416 and 426 compare data on the other signal lines 41d and 42d and 41f and 42f connected to the second gate circuits 414 and 424, respectively. The determination signal is sent to each of the sequence control units 411, 412, 4 through the signal line 41h.
21 and 422, or to the second gate circuits 414 and 424 via the signal lines 41g2 and 42g2.

In this case, when the coincidence determination signal is output via the signal line 41h, each sequence control unit 41
The corresponding second from 1,412,421,422
When the data can be output to the gate circuits 414 and 424, and the coincidence determination signal is output via the signal lines 41g2 and 42g2, the second gate circuits 414 and 4 can be output.
24 to each sequence control unit 411, 412, 421,
Data can be output to 422.

Distributed control processor (DCP) 51, 52
Are two input / output ports 51L, 51R and 52, respectively.
It has L and 52R to connect the first external buses 41a and 42a from the two bus control units (BCUL) 41 and (BCUR) 42 to peripheral devices (disks and the like) not shown. In the control processors 51 and 52, the input / output ports 51L and 51R,
52L and 52R are connected to the corresponding gate / comparison circuits 511 and 521, respectively.

The gate / comparison circuits 511 and 521 are for comparing the match / mismatch of the data input / output with the first external buses 41a and 42a via the input / output ports 51L, 51R, 52L and 52R. Then, the data input / output to / from the control units 512 and 522 is permitted only when the data match.

The control units 512 and 522 control communication with various peripheral devices (not shown), that is, two acps provided in the arithmetic control processor 31, for example.
The same data that is simultaneously output from the modules 311 and 312 via one X, Y port and the other X, Y port, respectively, is set in parallel to the system control unit (SCUL) 21 and (SCUR) 22 by two data each. Through the bus control units (BCUL) 41 and (BCUR) 42, the first gate circuit 41 thereof is provided.
After being converted into 1 data in 3 and 423, the data is given to the distributed control processors (DCP) 51 and 52 via the first external buses 41a and 42a, and communication control with peripheral devices is executed.

Here, the respective redundant operation control processors (ACP) 31 to 34, system control units (SCUL) 21, (SCUR) 22, main memory (memory L) 11, (memory R) 12, bus control. Units (BCUL) 41, (BCUR) 4
2, and distributed control processor (DCP) 51, 52
In both cases, the clocks are hardware-synchronized with each other, and they are operated by the same OS (operating system).

Further, the arithmetic control processors 31 to 34 are
Two acp modules 311 that operate the same
312 is provided with a comparison circuit 315 for comparing the output data thereof, and an error occurring in the acp modules 311 and 312 is instantaneously detected, and any of the arithmetic control processors 31 to 34 detects an error. In some cases, O
The control operation is continued by any other arithmetic and control processor under the control of S.

Further, the fault tolerant
The computer system is provided with four operation control processors 31 to 38, which are internally duplicated, and therefore functionally have four functions.
A multi-processor configuration is obtained.

System control unit (SCUL
) 21, (SCUR) 22, and the duplex control centers 212,213,222,2 for performing protocol conversion processing.
Comparing circuits 211 and 221 are provided between the respective units 23, and bus control units (BCU L) 41 and (B
By providing the comparison circuits 415, 425 and 416, 426 between the sequence control units 411, 412, 421, 422 which perform protocol conversion processing in the CUR) 42, errors in protocol conversion can be accurately and instantaneously performed. To be detected. The distributed control processors (DCPs) 51 and 52 are input / output managed by the support of the OS and are duplicated as a set of two units. Next, the operation of the fault tolerant computer system having the above configuration will be described.

Here, four arithmetic control processors (AC
P) First arithmetic control processor 31 of 31 to 34
A case will be described where the processing is mainly performed.
Further, in each redundant configuration module, when one module and the other module operate in the same manner, the main memory (memory L) 11 and the system control unit (SCUL
) 21, Bus control unit (BCUL) 41
The operation on the side will be mainly described.

FIG. 4 shows an arithmetic control processor (ACP) 31.
The internal operating states are shown in FIG. 3A, which shows the operating state when the system is normal, FIG. 2B which shows the operating state when the system control unit (SCUL) 21 is abnormal, and FIG. Shows the operation state accompanying the memory copy at the time of failure recovery of the main memory (memory L) 11. First, the normal operation of the fault tolerant computer system will be described.

In this case, as shown in FIG. 4A, the port X of one gate circuit 313 in the arithmetic control processor (ACP) 31 is in the bidirectional passage state, and the port Y is in the unidirectional passage state in the output direction. Further, the port X of the other gate circuit 314 is set to the one-way passing state in the output direction, and the port Y is set to the two-way passing state.

That is, when a signal is input from the system control units (SCUL) 21 and (SCUR) 22 via the X port of the gate circuit 313 and the Y port of the gate circuit 314 of the arithmetic control processor 31, the comparison circuit 315 causes The coincidence / non-coincidence is compared and determined. In the comparison circuit 315, each system control unit (SCUL) 21, (SCU
When it is determined that the signals from R) 22 match each other, the processes are executed in parallel in the corresponding acp modules 311 and 312.

On the other hand, in the comparison circuit 315, each system control unit (SCUL) 21, (SC
If it is determined that the signals from UR) 22 do not match, it is determined as "ACP31 failure" from the comparison circuit 315 to the system control units (SCUL) 21, (SC).
UR) 22 is notified of the failure.

Then, the connection with the arithmetic control processor 31 is cut off at the first and second control centers 212, 222, 213 and 223 of the system control units (SCUL) 21 and (SCUR) 22, respectively. The operation mode is changed under OS management so that the processing is continued by the arithmetic control processors 32 to 34. In this case, it is possible to separate only the operation control processor 31 having an abnormality and perform the continuous processing.

Next, the arithmetic and control processor (ACP) 31
From the main memory (memory L) 11 and (memory R) 12 to the acp module 311,
The data output from the data 312 is subjected to the coincidence confirmation by the comparison circuit 315. When the comparison circuit 315 obtains the coincidence determination, the output data from the first acp module 311 can be output to the X ports of the gate circuits 313 and 314. System control unit (SC
UL) 21, (SCUR) 22 each signal line 2
It is sent to the first control center 212, 222 via 1e, 22e. The output data from the second acp module 312 is sent to the system control unit (SCUL) 2 via the Y port in each gate circuit 313, 314.
1, (SCUR) 22 signal lines 21j, 2 respectively
It is sent to the second control centers 213 and 223 via 2j.

On the other hand, for example, the arithmetic control processor 31 is used.
If it is determined that the data does not match in the comparison circuit 315 of the above, it is treated as “ACP31 failure” in the same manner as above, and each system control unit (SCUL) 2
1, (SCUR) 22 first and second control centers 21
2, 222, 213, 223, the OS is connected so that the connection with the arithmetic control processor 31 is cut off and the processing is continued by any of the arithmetic control processors 32 to 34.
The operation mode is changed under control.

Then, the first and second control centers 212,
213 executes the protocol conversion process between the ACP and the main memory, respectively. The data after the protocol conversion process in the first and second control centers 212 and 213 are confirmed to be coincident by the comparison circuit 211. It is output to the main memory (memory L) 11 via the corresponding signal lines 21a and 21b.

If the comparison circuit 211 determines that the data does not match after the protocol conversion processing in the first and second control centers 212 and 213, the data output to the signal lines 21a and 21b is prohibited. , The arithmetic control processors 31 and 32, the main memory (memory L) 11 and the bus control unit (BCU).
L) 41 is notified of "SCUL error".

Then, to the gate / comparison circuit 111 of the main memory (memory L) 11, the signal lines 21a, 2
When the data is given via 1b, the matching is confirmed, and then the data for one system is output to the control / storage unit 112. As a result, in the control / storage unit 112, an ECC (error check code) is given to the given data and written in the RAM.

On the other hand, when the gate / comparison circuit 111 determines that the data obtained via the signal lines 21a and 21b do not match, the output of the data to the control / storage unit 112 is prohibited, and A "memory error" is notified to the system control unit (SCUL) 21 via the signal lines 21a and 21b.

Next, when data is read from the main memories (memory L) 11 and (memory R) 12 to the arithmetic control processor (ACP) 31, the data read from the RAM in the control / storage unit 112 is gated.・ Comparison circuit 111
When the data is sent to, the read data is separated into two identical data, and a match / mismatch is determined.

When the gate / comparison circuit 111 obtains a coincidence determination, the read data is output to the system control unit (SCUL) 21 via the signal lines 21a and 21b, and a non-coincidence determination is obtained. If so, the above data output is prohibited, and a "memory error" is notified via the signal lines 21a and 21b.

The data or error notification signal sent from the main memory (memory L) 11 to the system control unit (SCUL) 21 via the signal lines 21a and 21b is the first control center 212 and the second control center 212. The control center 213 performs a protocol conversion process, and the comparison circuit 211 determines the match / mismatch.

In the comparison circuit 211, when the data matching judgment after the protocol conversion processing is made, the first
And the data signals from the second control centers 212 and 213 are sent to the arithmetic and control processor 31 via signal lines 21e and 21j, respectively.

On the other hand, if the comparison circuit 211 determines that the data does not match after the protocol conversion processing,
The output of the data signals from the first and second control centers 212 and 213 is prohibited, and instead, the "SCU error" is notified to the arithmetic and control processor 31 via the signal path similar to the above.

Here, the data signal from the signal line 21e of the system control unit (SCUL) 21 is a bidirectional port X in one gate circuit 313.
The data signal from the signal line 21j of the system control unit (SCUL) 21 is sent to the first acp module 311 via the gate circuit 313.
Rejected at output port Y at.

On the other hand, the system control unit (S
The data signal from the signal line 22j of CUR) 22 is
The data signal from the signal line 22e of the system control unit (SCUR) 22 is sent to the second acp module 312 via the bidirectional port Y of the other gate circuit 314, but is rejected at the output port X of the gate circuit 314. To be done.

Thus, the duplicated acp module 311,
312, separate main memory (memory L) 1
1, data processing from the (memory R) 12 is executed in parallel.

Next, the system control unit (S
A case will be described in which data is transferred from the CUL) 21, (SCUR) 22 to the distributed control processors (DCP) 51, 52 via the bus control units (BCUL) 41, (BCUR) 42.

First, the data signal from the arithmetic control processor 31 or the data signal from the main memory (memory L) 11 is used during the data transfer operation between the arithmetic control processor 31 and the main memory (memory L) 11. The data signals supplied to the first and second control centers 212 and 213 via similar signal paths are provided to the bus control unit (BC).
(UL) 41, the protocol conversion process is performed, and the comparison circuit 211 compares and determines the match / mismatch.

When the comparison circuit 211 determines that the data signals match each other, the data signals from the first and second control centers 212.213 are transferred to the signal line 21.
Bus control unit (BCL
L) 41 is sent to each sequence control unit 411, 412.

On the other hand, when the comparison circuit 211 determines that the data signals do not match, the output of the data signals from the first and second control centers 212 and 213 is prohibited, and the "SCU error" is calculated instead. Control processor 3
1 will be notified.

Bus control unit (BCUL) 4
1 has two sequence control units 411 and 412,
Two output signal lines 41c, 41d, 41e, which correspond to the two external buses 41a, 41b, respectively.
41f, the signal lines 41c and 41e correspond to the first external bus 41a, and the signal lines 41d, 4
If is associated with the second external bus 41b. In this case, the first external bus 41a and the second external bus 41b are distinguished according to the address when the peripheral device is accessed.

That is, each of the above sequence control units 41
When the peripheral devices connected to the first external bus 41a are selected as the transfer destination address of the data signal in the state in which the protocol conversion processing has been performed to correspond to the external buses 41a and 41b in 1, 412, The data signal is output to the signal lines 41c and 41e and sent to the gate circuit 413.

The comparison circuit 415 determines whether the two data signals sent to the gate circuit 413 are coincident or non-coincidence. When the comparison circuit 415 determines that the data signals coincide, the gate circuit 413 is executed. To the signal line 41g1, a match determination signal is output to
Data signals for the system are output to the distributed control processors (DCP) 51, 52 via the first external bus 41a.

On the other hand, when the comparison circuit 415 determines that the data signals do not match, the gate circuit 4
The output of the data signal from 13 to the first external bus 41a is prohibited, and the "BCUL error" is notified to the arithmetic control processor (ACP) 31 through the system control unit (SCUL) 21.

In this case, the distributed control processors 51, 52
Then, the other bus control unit (BCUR) 4
The processing is continued in accordance with the data signal transferred from 2 through the other first external bus 42a.

Next, for example, the first external buses 41a and 42a
Data signal from the arithmetic control processor (ACP) 31
Alternatively, main memory (memory L) 11 and (memory R) 12
When a data signal is applied from the first external bus 41a to the gate circuit 413 of the bus control unit (BCU L) 41 in the case of transfer to the data line, the data signal is separated into two data signals of the same system. 41
In addition to being output to c and 41e, the comparison circuit 415 determines the match / mismatch of the data signals.

In the comparison circuit 415, when the data signal separated and output from the gate circuit 413 is determined to be coincident, the coincidence determination signal is sent to the signal line 41h.
Is output to each sequence control unit 411, 412 via the signal line, and the data signal from the gate circuit 413 is subjected to protocol conversion processing so as to correspond to the system control unit (SCUL) 21, and the signal lines 21c, 21d.
Is output to.

On the other hand, when the comparison circuit 415 determines that the data signals do not match, the mismatch determination signal is output to each of the sequence control units 4111 and 412 via the signal line 41h and used for the protocol conversion processing. The output of the accompanying data signal is prohibited, and "BCU
L error ”is the system control unit (SCUL
) 21 to notify the arithmetic and control processor (ACP) 31.

The procedure for transferring the data signal or error signal from the system control unit (SCUL) 21 to the arithmetic control processor 31 is the same as the procedure for transferring data from the main memory (memory L) 11 to the arithmetic control processor 31. It is carried out.

Next, as the data is transferred from the arithmetic control processor 31 to the distributed control processor (DCP) 51, each bus control unit (BCUL) 41,
The gate / comparison circuit 5 from the (BCU R) 42 via the first external buses 41a and 42a and the signal lines 51L and 51R.
When the data signal is input to 11, the data signals obtained via the two external buses 41a and 42a are matched /
If the disagreement is compared and judged, and if the coincidence is judged, 1
Data signals for the system are sent to the control unit 512.

Then, in the control unit 512, the gate
According to the data signal given from the comparison circuit 511, the control processing of the peripheral device (not shown) connected to the destination is executed.

The distributed control processor (DCP)
51, the gate / comparison circuit 511 and the control unit 51.
2 has been shown as a single configuration, the bus control unit (BC
UL) 41, (BCU R) 42 may be duplicated.

On the other hand, when the gate / comparison circuit 511 determines that the data signals do not match, the output of the data signals to the control unit 512 is prohibited, and the control processing of a peripheral device (not shown) connected ahead of the data signal is prohibited. Will not be executed, and a “DCP error” will be displayed on the first external bus 41.
a, 42a to bus control unit (BCUL)
The arithmetic control processor (ACP) 31 is notified via 41, (BCU R) 42, and system control units (SCUL) 41, (SCUR) 42.

Next, the distributed control processor 51 is relayed,
Data signals from peripheral devices (not shown) are transferred to the first external bus 4
When the data signal is sent from the control unit 512 to the gate / comparison circuit 511 to be sent to 1a and 42a, it is separated into two identical data signals to correspond to the signal lines 51L and 51R in two systems. Match / mismatch is compared and determined.

When the gate / comparison circuit 511 makes a coincidence determination, the data signals separated into the two systems are sent to the first external buses 41a and 42a through the signal lines 51L and 51R, respectively. become.

On the other hand, in the gate / comparison circuit 511,
If a mismatch is determined, the output of the data signals separated into the two systems to the signal lines 51L and 51R is prohibited, and instead, a "DCP error" is output from the first external buses 41a and 42a to the bus control unit ( Notification is sent to the arithmetic control processor (ACP) 31 via the BCUL) 41, (BCUR) 42, and the system control units (SCUL) 21 and (SCUR) 22. Next, the arithmetic control processor (AC
The case where P) 31 fails will be described.

At the time of outputting the data signals from the first and second acp modules 311 and 312 of the arithmetic and control processor 31, a data mismatch judgment is made in the comparison circuit 315, and the "ACP error" signal is sent to the system control unit (SCUL) 21. Each signal line 21e, 21 of
When it is given to the control center 212, 213 via j, the control center 212, 213 causes a failure ACP31.
The operation mode is changed according to the abnormal processing function of the OS so that the connection with the above is cut off and the processing is continued by any of the arithmetic control processors 32 to 34.

In this case, for example, the arithmetic control processor 32
The data signal from is output separately to the two signal lines 21f and 21k, whereby the protocol conversion processing in the first and second control centers 212 and 213 is normally performed, and the system control unit (SCUL 2) to the main memory (memory L) 11 or the bus control unit (BCU L) 41.

Therefore, since there is no change in the data signal transfer procedure after the system control unit (SCUL) 21, the error detection accuracy of the protocol conversion processing in each comparison unit does not decrease. In addition, the failure ACP 31 is caused by each control center 212, 213,
Since it is completely cut off at 222 and 223, there is no influence of noise when the ACP board is replaced.

Next, a case where any of the main memory (memory L) 11, system control unit (SCUL) 21, and bus control unit (BCUL) 41 fails will be described.

For example, a “memory L error” from the main memory (memory L) 11, a “BCU L error” from the bus control unit (BCUL) 41, or a “SCUL error” from the system control unit (SCUL) 21 itself. Accordingly, when an error notification is issued from the system control unit (SCUL) 21 to the arithmetic control processor (ACP) 31, as shown in FIG. 4B, both ports X and Y in one gate circuit 313 are connected. The gate circuit 314 is set to the cutoff state and the input / output to / from the SCUL side is cut off, and the other gate circuit 314
Both ports X and Y are set to pass in both directions.

In this case, the data signal sent from the other system control unit (SCUR) 22 to the arithmetic control processor 31 is simultaneously input to both the acp modules 311 and 312 via the gate circuit 314. As a result, the acp modules 311 and 312 can perform the same processing on the same data signal as usual. And each of the above ac
The comparison result of the processing result data from the p modules 311 and 312 is judged by the comparison circuit 315, and when the judgment is made, the respective acp modules 311 and 31 are processed.
The data signal from 2 is again sent to the system control unit (SCUR) 22 via the gate circuit 314.

Therefore, each arithmetic control processor 31-
34, the other system control unit (SC
Input / output of the data signal via (UR) 22 allows the processing to be continuously executed.

Next, one of the above main memories (memory L) 1
1, system control unit (SCUL) 21,
When one of the bus control units (BCUL) 41 recovers from the failure, the contents of the other main memory (memory R) 12 are copied to the one main memory (memory L) 11 where the memory access was interrupted. The case will be described.

That is, for example, as shown in FIG. 4 (B), one system control unit (SC)
The gate circuit 313, which has been set to the shut-off state for the (UL) 21 as shown in FIG. 4C, at the time of this failure recovery, both ports X and Y are connected to one system control unit (SCUL) 21. One-way output mode is set.

Here, each ac of the arithmetic control processor 31
Main memory (memory
The read / write control for all addresses of L) 11 and (memory R) 12 is sequentially executed. In this case, the gate circuit 314 on the side of the other system control unit (SCUR) 22 has both ports X and Y. In the two-way transfer state, and the gate circuit 313 on one system control unit (SCUL) 21 side outputs unidirectionally from each acp module 311 and 312 to the one system control unit (SCUL) 21 for both ports X and Y. Since it is set to the transfer state, only the data signal from the other main memory (memory R) 12 is read from both acp modules 311 and 3 when reading the data.
12 is read out, and at the time of writing data, the read data is stored in both main memories (memory L) 11 and (memory
R) 12 will be written simultaneously. As a result, when the system is restored, the arithmetic control processor 3
By using 1 as a relay, the duplicated memory can be easily copied.

Therefore, according to the fault tolerant computer system having the above configuration, the arithmetic control processor (ACP) is provided with two acp modules for internal duplication, and the system control unit (SCU), main memory (memory), bus The control unit (BCU) is duplicated, and two signal lines from the two acp modules 311 and 312 in the duplicated arithmetic and control processor (APC) 31 are connected to the duplicated system control unit (SC).
UL) 21, (SCUR) 22 to redundant main memories (memory L) 11, (memory R) 12, and redundant bus control units (BCUL) 41 and (BCUR) 42, which are arranged in parallel with each other, and the acp module is provided. 31
Since an error occurrence in each individual module is detected by comparing the processing results obtained from the two signal lines between the first and third 312 and in the individual protocol conversion units,
The location of the error can be easily specified.

Moreover, a of the arithmetic control processor 31
Gate circuits 313 and 314 for selectively setting the transfer direction and interruption of data signals are provided at the input / output ports between the cp modules 311 and 312 and the system control units (SCUL) 21 and (SCUR) 22. Therefore, the system control unit (SCU) on the error generation module side is disconnected and the data signal from the remaining system control unit (SCU) is input to two acs.
It can be commonly supplied to the p modules 311 and 312 to continue the processing.

Further, the first and second control centers 212, 213, 222 of the duplicated system control units (SCUL) 21, (SCUR) 22 respectively.
223 is provided with a function of shutting off each of the arithmetic and control processors 31 to 34. Therefore, the arithmetic and control processor (ACP) 31
If a failure occurs, the connection with the failed ACP 31 can be cut off and the processing can be continued with the other arithmetic and control processors (ACP) 32 to 34. Therefore, even if an error occurs in any module in the system, the entire system is not stopped.

In this fault tolerant computer system, the arithmetic control processor (ACP)
On the other hand, since the bus connection structure is not used, a large-scale high-speed processing system can be constructed.

In the above embodiment, the duplicated external buses 41a and 42a from the duplicated bus control units (BCUL) 41 and (BCUR) 42 are connected in the distributed control processors 51 and 52 through the gate / comparison circuit 511, and the DCP input is performed. We also performed error detection at the output stage,
For example, as shown in FIG. 5, the distributed control processors 51, 5
2, ... Does not have the function of comparing the duplicated data signal, the duplicated bus control unit (BCUL)
41, (BCU R) 42 First external bus 41
The a and 42a may be configured as a common bus, and the second external buses 41b and 42b may be configured as a common bus. In this case, error detection will be performed using the parity signal.

[0104]

As described above, according to the present invention, an arithmetic and control processor provided with at least two arithmetic and control modules, and two arithmetic and control modules of the arithmetic and control processor via two signal lines. One of the connected system control units and the other of the two system control units and the above-mentioned 2
First and second protocol conversion control units individually connected to the two signal lines, and connected to the first and second protocol conversion control units in each of the two system control units via two signal lines The one and the other main memory, the two arithmetic control modules in the arithmetic control processor, and the first and second protocol conversion control units in each of the two system control units, and the two mains. A comparator provided between the input / output sections of the two signal lines in each of the memories and for judging the match / mismatch of the data signals input / output mutually, the arithmetic control processor and the two system control units. The two signal lines on one side and the other side that connect the The first to cut off when the has been made
And a shutoff means provided in the second protocol conversion control unit, and one side or the other side system interposed between the one side input / output unit and the other side input / output unit of each of the two arithmetic control modules in the arithmetic control processor. A fault tolerant computer system using a CPU in which a plurality of modules are connected by different protocols is configured because a gate circuit in which the signal passing state and the cutoff state are selectively set according to the state is configured. At the time of construction, a large scale and high speed can be achieved and high reliability can be secured without causing a system stop due to occurrence of a module error or a bus error.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of a fault-tolerant computer system according to an embodiment of a duplication system for an electronic computer of the present invention.

FIG. 2 is a block diagram showing an internal configuration of an arithmetic control processor (ACP) in the fault tolerant computer system.

FIG. 3 is a block diagram showing an internal configuration of a bus control unit (BCU) in the fault tolerant computer system.

FIG. 4 is a diagram showing an operation state inside an arithmetic control processor (ACP) in the fault tolerant computer system.

FIG. 5 is a block diagram showing the configuration of a fault tolerant computer system according to another embodiment of the present invention.

FIG. 6 is a block diagram showing the configuration of a conventional fault-tolerant computer system based on a duplex system.

[Explanation of symbols]

11, 12 ... Main memory (memory) 21, 22 ... System control unit (SCU), 31-34 ... Arithmetic control processor (ACP), 41, 42 ... Bus control unit (BCU), 51, 52 ... Distributed control processor (DCP), 111, 121, 511, 521 ... Gate / comparison circuit, 112, 122 ... Control / storage section, 21
1, 221, 315, 415, 416, 425, 426
... Comparison circuit, 212, 213, 222, 223 ... Control center, 21a-21n, 22a-22n, 41c-41
h, 42c to 42h, 51L, 51R, 52L, 52R
... signal lines, 311, 312 ... acp module, 3
13, 314, 413, 414, 423, 424 ... Gate circuit, 411, 412, 421, 422 ... Sequence control unit, 41a, 41b, 42a, 42b ... External bus,
512, 522 ... Control unit.

Claims (1)

[Claims] 1. A computer control duplication system for constructing a fault-tolerant computer system using a CPU in which a plurality of modules are connected by different protocols. An arithmetic control processor provided with at least two arithmetic control modules. And one and the other system control unit connected from the two arithmetic and control modules of this arithmetic and control processor via two signal lines, and the two signal lines in each of the two system control units. And the first and second protocol conversion control units connected to the first and second protocol conversion control units in the two system control units, respectively, and one and the other connected to the first and second protocol conversion control units via two signal lines. In the main memory and the arithmetic control processor Between the two operation control modules and between the first and second protocol conversion control sections in each of the two system control units, and between the input / output sections of the two signal lines in each of the two main memories. A comparison section is provided which determines whether the data signals input to and output from each other are coincident with each other, and two signal lines on one side and the other side which connect the arithmetic control processor and the two system control units, respectively. Shut-off means provided in the first and second protocol conversion control units for shutting down when the comparison unit determines that the data signals do not match, and one of each of the two arithmetic control modules in the arithmetic control processor. One side input / output section and the other side input / output section are provided, and the signal communication is performed depending on the system state of one side or the other side. And a gate circuit in which an over-state and a shut-off state are selectively set, and a duplication system for an electronic computer.