JPH0630069B2 - Multiplexing system - Google Patents

Description

Description: TECHNICAL FIELD The present invention relates to an information processing apparatus, and more particularly to a multiprocessor system including a plurality of processors.

(2) Description of Prior Art Microprocessors have been applied in various fields as their performance has increased. Above all, very high reliability is required in fields such as bank online terminals, communication network controllers, and medical electronic devices.

When configuring a system that requires high reliability with conventional microprocessors, a method of transferring data with an error correction code or using the same microprocessor several times to perform the same processing on them simultaneously is obtained. There has been proposed a method for detecting malfunctions (faults) by comparing the outputs.

In particular, the latter method provides high reliability, but requires a circuit for detecting a match / mismatch for each output of a plurality of microprocessors that simultaneously execute the same processing for each output pin.

Also, as a microprocessor system considering multiplexing, the operating mode of the processor in the main mode is monitored by the processor for the monitoring mode by using the processor for the main mode and the processor for the monitoring mode, and the malfunction signal is output when the malfunction is detected. Some do.

However, in such a multiplex system, after a malfunction is detected, the malfunctioning processor that caused the malfunction must be cut off, and a reset signal must be ordered to restart the system.

That is, if a malfunction is detected in the system,
The reset signal is used because it is necessary to stop the system as soon as possible to prevent the system from being destroyed. However, the reset signal causes the entire system to be initialized. In order to continue the processing before the malfunction, the hardware for storing the processing state of the system before the malfunction is required. Further, as processing immediately after reset, it is necessary to determine whether the reset signal is for the original initialization of the system or due to a malfunction. Conventionally, this processing has been executed by software, which has a drawback that the load on the software is heavy and the execution speed is slow.

(3) Description of Object of the Invention An object of the present invention is to provide a system that executes a process after detection of a malfunction at high speed without burden of software in a multiplexing system that requires high reliability.

(4) Structure of the Invention According to the present invention, a plurality of processors are used, at least one of which is a main processor and another processor is a monitoring processor, and a malfunction signal from the monitoring processor, (EN) A multiplexing system including a judgment circuit for judging malfunction, and a sequence processor for stopping malfunction processors, reconfiguring the system, and restarting.

Here, the main processor means a processor that executes a given program, and the monitoring processor means a processor that has a function of monitoring the operating state of the main processor and generating a malfunction detection signal when an abnormality occurs. According to a preferred embodiment of the present invention, the supervisory processor has a function equivalent to that of the main processor, that is, a function of executing a program executed by the main processor and a function of monitoring the execution state of the main processor. It is provided. The monitoring function compares the processing of the main processor with the processing of the monitoring processor itself (these are the processing of the same contents),
This is realized by generating a malfunction detection signal at the time when the midway mismatch processing is detected. The sequence processor receives this signal and stops all the processors. The determination circuit receives the malfunction detection signal and recognizes the abnormality. However, it is necessary to check whether this anomaly has occurred in the main processor or the supervisory processor. According to the preferred embodiment of the present invention, this is examined as follows. That is, at least two monitoring processors are prepared in the system. Each of these two supervisory processors performs the same processing as the main processor and also performs a comparison with the processing of the main processor. In this case, when the malfunction detection signal is generated from the two monitoring processors together, it can be seen that the abnormality has occurred in the main processor. On the other hand, if the malfunction detection signal is generated from only one of the monitoring processors, it can be known that an abnormality has occurred in the monitoring processor itself which generated the malfunction detection signal. Therefore, in the former case, the judging circuit judges that the main processor is down and informs the sequence processor that one of the remaining two monitoring processors is to be used as the main processor. on the other hand,
In the latter case, the sequence processor is informed that the monitor processor which has generated the malfunction detection signal is disconnected from the system. The sequence processor controls disconnection of the abnormal processor, rebuilding and restarting of the system accordingly.

(5) Effects of the Invention According to the present invention, it is easy to detect an abnormal processor and separate it, and the system can be reconstructed without incurring the burden of software. Moreover, if there is no abnormality in the main processor, the program processing can be continued after the system is rebuilt. Further, when the main processor is down, at least one of the monitoring processors can be treated as the main processor, and the program processing can be restarted at high speed. Therefore, the system down can be minimized.

(6) Description of Embodiment First, a conventional multiprocessor system will be described with reference to FIGS. 1 and 2. N microprocessors 1 having the same function to achieve high reliability
01 to 103, and each processor has m output pins. M comparators 104 to 106 corresponding to each pin
Is provided. The same output pins of n processors are connected to the input terminal of the comparator, and a total of n signals are input. The inside of the comparator is as shown in FIG. That is, n input signals are input to the NAND gate 201 and their inverted signals are input to the NAND gate 2
It is input to 02. The output of each NAND gate is input to the AND gate 203. Therefore, if at least one of the n input signals is mixed with other signals, the AN
A malfunction detection signal is generated from the D gate 203. The malfunction detection signal is sent to the system controller (not shown) via the OR gate 107 in FIG. When the system controller receives the detection signal from the OR gate 107,
Sends a reset signal to all processors to bring the system to a halt. System recovery is controlled by the system controller and software. Therefore, the load on the software is heavy, and it takes a considerable time to recover.

On the other hand, according to one embodiment of the present invention, the system is configured as shown in FIG.

FIG. 3 is a block diagram showing a configuration of a triplex system as an embodiment of the present invention. In the figure, 301,30
2, 303 are processors having the same function, and 3
Reference numeral 04 is a memory and an I / O device. Each processor is connected to the memory and I / O device 304 by a bus 305. Address, data and control signals are on this bus 3
05. 306 is a system control unit,
A sequence processor 307 and a malfunction processor determination circuit 308 are included.

Processors 301, 302, 303 are processors having a main mode in which they perform information processing based on a program, and a monitor mode for monitoring the operation of the processor operating in the main mode, depending on the signal input to the M / C terminal. The main mode and the monitoring mode are switched. In the monitor mode, the processor compares the execution states of other processors operating in the main mode with the execution state of itself, in addition to the operation of the main mode. A processor running in watch mode when a different operation occurs between another processor running in main mode (which is assigned as the future program processor) and a processor running in watch mode. The ER terminal becomes active and a malfunction detection signal is generated. Also, these processors are ERH
It has an ALT input terminal, and when this terminal becomes active, the processor stops processing. Then ERHAL
When the T terminal becomes inactive, it operates differently depending on the state of the C / E terminal (continuation / failure). That is, when a signal indicating "continue" is input to the C / E terminal, the interrupted instruction is continued, and when a signal indicating a failure is input to the C / E terminal, a predetermined program is executed. .

A sequence processor (hereinafter, referred to as a sequence) 307 of the system control unit 306 controls stop of all processors, system reconfiguration, and restart under the control of the determination circuit in response to the ER signal sent from the processor operating in the monitor mode. Take control. The malfunctioning processor determination circuit determines a malfunctioning processor based on the ER signal from the monitoring processor and generates information necessary for system reconfiguration.

The operation will be described below.

It is assumed that the processor 301 operates in the main mode and the processors 302 and 303 operate in the monitor mode when the system is started. When even one of the processors in the monitor mode detects an operation different from that of the processor in the main mode while the processing is in progress, the ER signal of the processor becomes active and is notified to the system control unit. ER
Upon receiving the signal, the system controller starts up the sequencer 307. Sequencer 307 activates all HALT1, HALT2, and HALT3 signals to minimize system disruption. These signals are input to the ERHALT terminal of each processor, and in response to this, each processor immediately stops its operation. Then the sequencer 307
Reconfigures the system based on the information generated by the determination circuit 308 of the malfunctioning processor.

FIG. 4 is a format diagram of information generated in the malfunction processor determination circuit 308. If only one of the monitoring mode processors 302 and 303 detects a malfunction, it means that the main mode processor and the other monitoring mode processors are performing the same processing, and therefore the monitoring mode in which the malfunction is detected. The processor itself has failed. Therefore, the processor is disconnected from the system and the system is restarted. Further, in this case, since the main mode processor may continue the interrupted instruction, it outputs a signal indicating "continue" as the C / E signal of the name processor.

On the other hand, when both the monitoring mode processors 302 and 303 output the ER signal together, the main mode processor 3
01 has failed, and the main mode processor 301 is turned off. At this time, 302 can be used as the next main mode processor. Processor 30
The main mode instruction signal may be given to the M / C terminal 2 of FIG.
Also, in this case, since it is necessary to execute the malfunction analysis program when the interrupted instruction cannot be reunited,
A signal indicating "fault" is output as a C / E signal to the processor.

When the reconfiguration is completed, the sequencer 307 restarts the system.
It gives a signal to make the ALT terminal inactive.

As a result, the system is reconstructed with unfailed processors, and each processor starts operating in response to the signal on its C / E terminal. That is, if the C / E terminal receives a signal indicating "continue", the interrupted instruction is restarted, and conversely, if a signal indicating "fault" is received, the malfunction analysis processing program is executed. The malfunction analysis processing program determines whether or not the instruction in which the malfunction has occurred can be re-executed, and if it can be re-executed, re-executes it. Rebooting is performed in an appropriate processing unit such as processing.

After the above processing, the operation is started as the duplex system. At this time, the processor 301 operates in the main mode,
The processor 303 operates in the monitor mode. When the processor 303 in the monitoring mode again detects a malfunction, it is impossible to determine which processor has a failure. Thus, the sequencer 307 halts both processors and minimizes system disruption. The above-mentioned state transition of the sequencer 307 is shown in FIG.

Although the case of the triple system has been described here, the same idea can be applied to the expansion when the number of processors is further increased.

(7) Description of Effect of Embodiment As described above, in this embodiment, when a malfunction is detected, a multiplexing system is configured by at least one main mode processor and a plurality of monitor mode processors. Immediately halts all processors, removes the malfunctioning processor from the system, resumes interrupted instructions if the main mode processor is normal, and monitors mode if the main mode processor fails By switching one of the processors to the main mode and executing the malfunction process, the system recovery process after the malfunction is detected can be executed easily and at high speed.

[Brief description of drawings]

FIG. 1 is a configuration block diagram of a conventional multiplexing system. 101, 102, 103 ... Microprocessor,
104, 105, 106 ... Comparator, 107 ... OR gate. FIG. 2 is a circuit diagram of the comparator shown in FIG. 201
... NAND gate, 202 ... OR gate, 203 ...
… And gate. FIG. 3 is a block diagram of a triple system as an embodiment of the present invention. 301,30
2, 303 ... Microprocessor, 304 ... Memory and IO device, 305 ... Bus, 306 ... System control unit, 307 ... Sequencer, 308 ... Malfunctioning processor determination circuit. FIG. 4 is an information format diagram generated for system reconfiguration after detection of malfunction. FIG. 5 is a flow chart showing the state transition of the sequencer of FIG.

Claims (1)

[Claims] 1. A normal mode in which three or more processors are interconnected via a common bus and execute a program to perform information processing, and the same program as a processor designated in the normal mode is executed. Three or more processors each having a monitoring mode in which the execution state of the processor designated as the normal mode is compared with the execution state of itself and an abnormal signal is generated when the two do not match, and among these processors. One of the processors is designated as the normal mode and the remaining plurality of processors are designated as the monitoring modes, respectively, and each of the processors designated as the monitoring mode is designated as the normal mode when the abnormal signal is generated. Disconnect the processor from the system and put one of the processors specified in the monitoring mode in the normal mode and the other in the monitoring mode. The system is reconfigured by designating each in the monitor mode, and when one of the processors designated in the monitor mode generates the abnormal signal, the processor is disconnected from the system and the remaining processors are designated in the respective modes. And a control means for restarting the device.