JPH07200334A - Duplicate synchronization operation system - Google Patents

Abstract

PURPOSE:To reduce the service interruption time by applying interrupt control to a processor of an active system of its own equipment when a hardware fault is detected so as to release the active system display thereby avoiding the start of the standby system through interruption of the service on the occurrence of the hardware fault. CONSTITUTION:Each of two sets of processor systems 11 is provided with a device monitoring a data error in an inside of a bus interface 3 as a fault detection circuit detecting a hardware fault by which the operation of its own equipment cannot normally be continued. Each processor system 11 is provided with a control means which executes interrupt with the output of the fault detection circuit when its own equipment is designated to be an active system so as to unlock the synchronization state and to stop the display of the active system, and also provided with a control means which starts the display of the active system with the output of the fault detection circuit of the opposite system when its own equipment is designated to be a standby system so as to continue the operation in the single mode.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention is used in computer devices of medium scale or larger. The present invention relates to a method of synchronizing a plurality of processors and operating them in parallel in order to ensure the reliability of a computer device.

[0002]

2. Description of the Related Art Conventionally, two equivalent processor systems are operated in synchronization with each other by the same instruction and the same data input, and one of the two processor systems is designated as an active system and the other is in standby. There is known a technology in which a standby system is newly designated as an active system when the system is designated and operated and a failure occurs in the active system, and the operation is continued.

In the conventional system, when a failure occurs in the active system, the active system drops the active system display of its own device and stops, and waits for an action from the device which has been the standby system until then. Further, the device that has been operating as a standby system until then sets itself as an active system and operates so as to disconnect the device that was previously an active system. In this case, in order to prevent software runaway, if the hardware continues to display the active system for a certain period of time on both systems, or if both systems continue to display the standby system for a certain period of time, The operation is stopped and the operation restart process is executed as hardware.

Prior art synchronous operation systems are disclosed in JP-A-3-25502, JP-A-64-70847, JP-A-63-299438 and the like. Even when a part is disconnected, one processor (CPU) controls the disconnection as a higher-level device, which is different from the interrupt processing by the detection output from another failure detection circuit as in the present invention. To do.

[0005]

SUMMARY OF THE INVENTION The above-mentioned conventional technique is based on the active processor (CPU) and the main memory (M).
When a hardware failure occurs in M), the software cannot operate normally, the display indicating that it is an active system cannot be dropped, and switching cannot be performed smoothly. That is, in the active system, in principle, when a failure occurs, the display of the active system is autonomously dropped, and the standby system cannot be switched to the active system unless the display of the active system disappears. At this time, according to the operation, the synchronous operation is stopped and the restart activation process is executed, while the service is stopped.

The present invention has been made against such a background, and even if the display of the active system cannot be dropped due to the hardware failure of the active system, the operation is temporarily stopped. It is an object of the present invention to provide a method capable of newly operating the standby system as an active system by processing for a short time.
It is an object of the present invention to shorten the service suspension period when a failure occurs.

[0007]

In the system of the present invention, a hardware fault monitoring circuit is provided in addition to the conventional fault monitoring by software, and when the fault monitoring circuit detects a hardware fault, it automatically performs The active system processor of the apparatus is controlled to interrupt the active system display so as to drop the active system display.

That is, according to the present invention, two substantially equivalent processor systems are operated in synchronization with each other by the same instruction and the same data input, and one of the two processor systems is designated as an active system. On the other hand, the other is a duplex synchronous operation system designated as a standby system, and each of the two processor systems has a failure detection circuit for detecting a hardware failure to the extent that the operation of the own device cannot be normally continued. It is provided. Then, when the own device is designated as the active system, each processor system executes interrupt processing by the detection output of the fault detection circuit of the own device to remove the synchronization state and stop the display of the active system. And a control means for activating the display of the active system by the detection output of the fault detection circuit of the partner device and continuing the operation in the single mode when the own device is in the state designated as the standby system. It is characterized by

Control means for causing each of the two processor systems to execute a fault factor isolation process, a fault information accumulation process, and a peripheral device stop process by the detection output of the fault detection circuit of the self device or the partner device. Is desirable.

The fault detection circuit may be based on a means for detecting an abnormality in the output signal with the output bus interface.

[0011]

With this configuration, even when it is conventionally necessary to stop the display of the active system autonomously as a hardware failure and it is necessary to stop the operation once with the assistance of the operation, the autonomous operation is possible. It is possible to turn off the display of the active system, and activate the standby system as the new active system. According to the present invention, it is possible to shorten the service stop time when a failure occurs.

[0012]

Embodiments will be described with reference to the drawings. FIG. 1 is a block diagram of an apparatus according to an embodiment of the present invention. FIG. 2 is a flow chart for explaining the operation.

FIG. 1 shows an example in which the processor device 1 controls the peripheral device 2 via the bus interface 3. In this example, the processor device 1 and the bus interface 3
Are duplicated and operated synchronously to control one peripheral device 2. That is, two substantially equivalent processor systems 11 are operated in synchronization with each other by the same instruction and the same data input, and one of the two processor systems is designated as an active system (A system). The other is designated as the standby system (S system). The processor device 1 includes a storage device 12, a register file 13, and a restart control device 14, respectively.

A feature of the present invention is that each of the two processor systems 11 is provided with a bus as a fault detection circuit for detecting a hardware fault to the extent that the operation of its own device cannot be normally continued. A device for monitoring the data abnormality is connected to the inside of the interface 3. Then, each processor system 11 executes interrupt processing by the detection output of the failure detection circuit of its own device when the own device is designated as the active system, removes the synchronization state, and stops the display of the active system. The control means and the control means for activating the display of the active system by the detection output of the fault detection circuit of the partner device and continuing the operation in the single mode when the own device is designated as the standby system .

When the active system and the standby system are operating normally, the two processor systems 11
Synchronize with each other, execute the same instruction, and write data to the storage devices 12 of the own system, but the data contents of the storage devices 12 of both systems match. Also, the contents of access to both buses are the same. The bus interface 3 monitors the data sent to each bus. The status of each processor device 1 is displayed in the register file 13.

In this register file, there are registers that indicate faults detected in the own system, and there are registers that indicate faults that have occurred in the own system. In addition to the faults that have occurred in the own system, , A failure that occurred in another system, that is, a clock signal disconnection of the partner system that is notified via the bus
There is a fault interrupt register that indicates a parity error during access. Each system also has a mate failure interrupt register that represents the value of the failure register of the other system. In this way, in the register file 13, it is possible to see the failure of the partner system as well as the failure of the own system.

Here, the fault detection circuit is provided in the bus interface 3, and when the bit data in the storage device 12 is monitored and its parity error is detected, the processor system 11 is detected.
When a parity error is detected in the output of the above, when there is no access within a fixed time after the bus is hunted, an interrupt process is executed for its own processor system 11 as a hardware failure.

This control is shown in the flow chart of FIG.
That is, when the fault detection circuit provided in the bus interface 3 detects the above-exemplified fault, interrupt processing is executed to desynchronize and the active system display is erased. After that, a program that isolates the cause of the failure is started, and related failure information is collected and saved. Peripheral devices are stopped, and the active system display disappears as software. On the other hand, in the partner device (startup standby system), the failure of the active system device is executed by interrupt control, and then a program that isolates the cause of the failure is started, and the failure information is saved in the same way. Stop the peripheral devices under its control and reset the partner device. Then, the self device is displayed as the active system, and the peripheral device is restarted.
After that, the operation continues in single mode.

In the apparatus of the present invention, each processor system 1 is equipped with a restart controller 14. This is a device for executing resuming control autonomously when a factor that conventionally requires the operation to be stopped and started with the assistance of the operation is detected. This restart control device 14
By including the above, when a temporary failure that can be easily started by the assistance of the operation occurs, the restart control can be autonomously performed without the assistance of the operation each time.

[0020]

As described above, according to the present invention, even when a fault is required to be stopped once and started by the assistance of the operation, an interrupt is generated by the detection output from the fault detection circuit. Since it is possible to execute processing to drop the display of the active system in which the failure has occurred, it is possible to effectively reduce the period during which the service is stopped due to the failure.

By configuring the register file to incorporate the fault of the partner system, the search for the fault factor becomes easy,
There are many obstacle factors that can be detected.

Further, by providing the bus interface with the fault detection circuit, it is convenient that the hardware of the processor system does not need to be changed.

[Brief description of drawings]

FIG. 1 is an overall configuration diagram of an apparatus according to an embodiment of the present invention.

FIG. 2 is a control flowchart of hardware and software when a failure occurs to the extent that processing cannot be continued in the active system.

[Explanation of symbols]

 1 Processor Device 2 Peripheral Device 3 Bus Interface 11 Processor System 12 Storage Device 13 Register File 14 Restart Control Device

Claims (3)

[Claims] 1. Substantially equivalent two processor systems are operated in synchronization with each other by the same instruction and the same data input, and one of the two processor systems is designated as an active system and the other is operated. In the duplex synchronous operation system designated as the standby system, a fault detection circuit for detecting a hardware fault to the extent that the operation of the own device cannot be normally continued is connected to each of the two processor systems, Each of the processors is a control unit that, when its own device is designated as an active system, executes interrupt processing by the detection output of the fault detection circuit of its own device to remove the synchronization state and stop the display of the active system. When the own device is in the standby system, the active system is displayed by the detection output of the fault detection circuit of the other device. Duplex synchronous operation method which is characterized in that a control means for continuing operation in the single mode as well as dynamic. 2. Each of the two processor systems is provided with a detection output of a fault detection circuit of its own device or a partner device,
2. The duplex synchronous operation system according to claim 1, further comprising control means for executing a fault factor isolation process, a fault information accumulation process, and a peripheral device stop process. 3. The duplex synchronous operation system according to claim 1, wherein the fault detection circuit includes means for detecting an output signal abnormality of the output bus interface.