JPS63191240A - Multi-processor system - Google Patents

Abstract

PURPOSE:To prevent the total discontinuation of a multi-processor system by separating logically only a processor having a fault from the system CONSTITUTION:When a processor P has a fault among plural processors, a fault occurrence signal is delivered to a system state monitor signal line from the processor P. An optional processor monitoring the state of said signal line decides the occurrence of the fault with detection of the fault occurrence signal. A processor detecting means calls successively other processors to detect and specify a faulty one and gives the control commands to the faulty processor for stopping, resetting, interruption inhibiting actions, etc., based on the address signal of an address bus (a) and the data of a data bus (d). Thus the faulty processor stops the operation of a CPU, etc., resets each part and inhibits the interruptions supplied from an input/output control part, etc., based on the given control commands. Then the faulty processor is separated logically from a multi-processor system.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a multiprocessor system configured by connecting a plurality of processors via a common bus.

[Conventional technology]

A multiprocessor system has a configuration as shown in FIG. 4, for example, and includes a plurality of processors (Pl),
(Pri, ..., (Pga) (hereinafter collectively referred to as (Pl)) are organically connected by a common bus (B) consisting of an address bus, data bus, control bus, etc., and this common Multiple input/output control units (I
OQ) - (IOCm), -, (IOCm) (hereinafter collectively referred to as (IOC)) and common memo IJ (M)
are connected to each other to provide processing power greater than that of each individual processor (1').

By the way, in the multiprocessor system, if a failure occurs in one processor (1'l) among the plurality of processors (P), there is a risk that the entire system will malfunction due to runaway of that processor (Pl, etc.). Therefore, other normal processors detect this situation and stop the system, and the faulty processor is identified in order to repair such a faulty situation in a short time.

For example, in the former case, as shown in FIG.
Both signal lines (sl, (ri'ir) are connected to the positive power supply terminal (+■) through pull-up resistors, respectively, and both signal lines (S).

frl e is maintained at a high level (hereinafter referred to as "high").

When a failure occurs in any processor (month) and this is detected by the failure detection child actor of each processor (P), a "high" failure occurrence signal is output from the means, and the open collector type driver fl+ The signal line (81) is driven to a low level (hereinafter referred to as "low").

Therefore, in each processor (Pi) that monitors the state of the signal line (S), when the signal line (Sl) becomes "low", a "high" fault detection signal is output from the first knot circuit (2I). , Lamp, LED according to the signal.

A display/notification means such as a buzzer is activated to notify a human such as an operator of the occurrence of a failure.

Furthermore, in the arbitrary processor (P), the l-th AND circuit (3
) outputs a "high" reset command signal, and the reset signal line () is driven from "high" to 10 watts via the open collector output NOR circuit f41'z.

As a result, in each processor (P), the signal air) is "
By becoming “low”, the second knot circuit (5)
At this time, the reset circuit does not output the power-on reset "high" signal, and the third knot circuit 16) continues to output the "high" signal. “High” from 2-AND circuit (7)
A reset signal is output to each reset circuit,
Each processor (Pl stops operating.

In addition, in the case of a player, the configuration is as shown in FIG. 6 as an example.

That is, when a fault occurs in one processor (fP) among the plurality of processors (P), this processor (P) outputs a fault occurrence signal in the same manner as described in m1 and turns on the open collector driver fll'i. System status monitoring signal 1(s) is driven to 'kr low'.

Then, one of the processors (Pl) that is not faulty among the plurality of processors (IP) detects that the signal line (8+) is driven to "low" via the inverter (2), and as a result, the CPU (s+ is interrupted,
The CPU (83 is the faulty processor ()'l k
Execute the specified program and operate as if it were attached.

That is, the normal processor old one.

First, each gate circuit rI&c(z) of each processor fPl other than itself is sent, and each processor (output is called).

Accordingly, each processor (Pl) uses a common bus
When the address data on the address bus (al), which is formed by the (to) is opened.

In comparison, when the fault processor (Pl) is called.

Through the gate circuit 32, the fault occurrence signal is sent onto the data bus tdl constituting the common bus (Bl'!e), so that the normal processor [Pl] receives the sent address data and the fault occurrence signal on the data bus fdl. The 11W processor (E'l-detects).

In this way, the faulty processor (P) is identified.

[Problems to be Solved by the Invention] However, in the conventional configuration, the entire system stops due to a failure in a part of the system, that is, a failure in any processor (P), and the mean time between failures decreases. M'H3F(mean time bet -w
There is a point at which the temporal stability, or reliability, of the system's functionality decreases.

On the other hand, the mean repair time (MTTR)
eto repair) can be made sufficiently small by the above-mentioned means of specifying the RW generation processor cost, but MTB
F and MTTR, the availability rate (MT h
In order to increase lF/(MTBF+MTTJ), the aforementioned MTBF''k must be increased.

By the way, existing multiprocessor systems aim to increase processing speed for specific applications (for example, numerical calculations such as fluid analysis), making it difficult to build a general-purpose operating system and using multiple processors. In order to prevent system malfunctions in the event of a failure in one of the processors, it is necessary to stop the entire system after acknowledging the drop in MTBF, that is, the drop in availability, as described above. I didn't get it.

However, in recent years, it has become easier to construct multiprocessor systems due to improved functionality and lower prices of microprocessors, and as a result, it has become necessary to apply multiprocessor systems to general (general-purpose) applications. With this trend, there has been a need to increase the availability of multiprocessor systems.

This invention was made with the above points in mind,
The objective is to logically disconnect a faulty processor from the system without stopping the entire system, and to provide a means to prevent the fault from spreading to the entire system.

[Means to solve all problems]

This invention connects a plurality of processors by a common bus, connects an old input/output control unit, a common memory, etc. to the common bus, and when a failure occurs in any of the processors, the processor Based on the address signal of the address bus constituting the common bus and the data of the data bus constituting the common bus, means for giving control commands such as stop, reset, and interrupt prohibition; and a control command for disabling interrupts from any of the processors provided in each of the processors and input from the input/output control unit or the like via the common bus. The invention is characterized in that it includes a means for prohibiting the above.

[Effect]

Therefore, according to the present invention, when a failure occurs in one of the plurality of processors, the known means
For example, a fault occurrence signal is output from a faulty processor to a system status monitoring signal line, and any processor monitoring the state of this signal line determines that a fault has occurred by detecting the fault occurrence signal, and then The faulty processor is identified by sequentially calling each processor in order to detect the faulty processor, and the faulty processor is stopped, reset, or stopped based on the address signal on the address bus and the data on the data bus. Gives control commands such as disabling interrupts.

As a result, the faulty processor stops the CPU, resets each part, and prohibits interrupts from the input/output control part, etc., according to the control command given.

The processor is logically separated from the system.

8. Interrupts from the input/output control unit, etc. that should be input to the faulty processor are handled by the dog processor, for example, according to instructions from the designated processor.

[Embodiment 1] Next, the present invention will be explained in detail with reference to FIGS. 1 to 8 showing embodiments thereof.

First, the first factor is address bus (a), data bus +d
l, control bus (C1, interrupt bus (il)
Among the plurality of processors connected by a common bus +H1 consisting of z and system status monitoring signal line (S),
The main parts of one processor (Pl) are shown.

2 in the same figure, (8) is a CPU whose data terminals, address terminals, and control terminals such as read/write are bus buffers (9), C0, and tll11, respectively.
21 is an AND circuit, one input terminal receives a "high" fault occurrence signal from the fault detection means provided for each processor (Pl), and the output terminal receives the signal via an open collector type driver fl+? It is connected to the line (S).03 is the first control circuit whose output terminal is connected to the other input terminal of the AND circuit +121, and normally outputs a "high" signal, and the power is turned on when the power is turned on. It outputs a "low" signal only when an on-reset signal or a fault output stop signal from a second control circuit, which will be described later, is input.

■ Monitors the status of the signal line [51 and indicates a fault occurrence signal, that is, a signal! This is a detection circuit that detects the "low" state of +31 and outputs a fault detection signal, and does not prohibit the detection of fault occurrence signals using the "low" fault detection control signal that is output during self-diagnosis immediately after power is turned on. is always in the detection state. (+61 is a second control circuit, into which a fault detection signal from the Yokode circuit and an interrupt request signal from an interrupt gate circuit (to be described later) are input, and the CPU is controlled according to the input of each input signal.
(An interrupt signal is manually input to the interrupt terminal 81.

Here, the second control circuit field is, for example, the detection circuit 041
It consists of an OR circuit 3 and a latch circuit to which signal lines for multiple interrupts such as a failure detection signal 2 interrupt gate circuit or an interrupt request signal from The configuration is such that the data latched by the latch circuit is input to the data bus as well as being input to the interrupt terminal, and the signal for any interrupt is input to the CPU (fg) via the OR circuit. Then, the latch circuit latches the state of the signal line for interrupt according to the interrupt response signal from CPU +81,
CP [J Reads the data latched by the interrupt processing program executed by fg1 in response to the interrupt signal, and determines the cause of the interrupt.

In other words, the system is designed to determine whether the signal is a fault detection signal or an imprint request signal.

Alternatively, the second control circuit (15) is composed of an OR circuit to which a plurality of interrupt signal lines are respectively connected, a priority encoder, and a gate circuit that outputs the encoder output onto the data bus, Alternatively, signals for any number of interrupts can be routed to the CP via an OR circuit.
When the CPU fg1 is manually operated, the gate circuit is opened by the interrupt response signal from the CPU fg1, and the CPU
(81 reads the encoder output from the data bus,
It selects and executes an interrupt processing program, and accepts interrupt requests with higher priority.

8. Some types of CPU have multiple interrupt request reception terminals, and when using such a CPU and there are fewer interrupt requests than the number of terminals, the signal line for each interrupt is The second electric IJ defect circuit (16), which is connected to the reception terminal, as described above, becomes unnecessary.

By the way, each processor CP+ has 8 digits C ]' U
(This will be explained in detail in 81, but when the failure detection signal interrupt is input, the address data is sent out on the address bus (al) and the other processors are sequentially called, and the faulty processor ( Plt-data bus (dl) It has a function that detects the failure based on data on the data bus (dl) and sends control command data such as stop, reset, and interrupt prohibition to the faulty processor (P) over the data bus tdl. ◎ ae is an interrupt gate circuit that receives an input/output interrupt signal on the interrupt bus [iJ and outputs an interrupt request signal to the second control circuit Q51. 5 input force controls m (,
1 (JC-go (IOCs)) is provided,
Interrupt bus (iJ is each input input control g1i (IUCl)
It consists of five interrupt request lines for each ~(IOCs), and each processor fP is provided with five imprinted gate circuits (16θ~(!ri) for each request line.

1 Normally, interrupts from one input/output leg (IOC) are set to be accepted by one processor (P) and not accepted by the other processors, so each processor (In 1'l, the interrupt control circuit (17
The opening and closing of each interrupt gate (b) path (161) to (16s) is controlled by the interrupt control signal output from 1,
Only interrupts set in advance in each processor (Pl) are allowed to receive ft.

The decoder is an address decoder, which takes in the address data output from C)' U f8] of each processor (the decoder for each 1'1 is any processor that accepts the interrupt of the failure detection signal), my processor tl'
Regarding the address data for 1, a call signal is output to a gate circuit or a third control circuit, which will be described later. That is,
When constructing the system, addresses are set in advance for the gate circuit and third control circuit for each processor (P),
More each processor (Mon gate circuit.

When the address data of the third control circuit is output, a calling signal is output from the decoder to the corresponding gate circuit and the third control circuit.

+191 is a gate circuit which is opened by a call signal from the decoder (181) and sends out the fault occurrence signal onto the data bus Cdl, and ω takes in and holds the control command data on the data bus Cdl at the timing of the call signal from the decoder αa. and the third control circuit to be analyzed, ff
114? According to the analysis of Jul command data, Cl'
Stop signal to U f81 etc., reset signal to each other circuit,
Failure output stop signal to i1 control circuit 031 2 Interrupt gate input of input/output interrupt to Mt161? Outputs each interrupt disable signal to be disabled.

Next, the operation of the embodiment will be explained.

First, after the power is turned on, each processor (Pl) initializes itself and outputs a power-on reset signal to the first control (6flI) path (OJ) and the third control (b) path. 1lII control IgJ path (by the "low" signal from 13, AND circuit a2g and driver +Il
The signal Y#tSl is passed through IJ IJ-, and all signal outputs from the third control circuit 4 are stopped.

Next, the initial program is loaded and the system starts operating.

At this time, the processor old that handles each interrupt of each input/output control unit (IOCI) to (IOCs) is determined in the initial program, and
Then, the 6th interrupt gate IP! is activated by the interrupt control signal from the interrupt control unit 1I60η. Circuit 06. )～(1
6s) are controlled to open and close, respectively, and one input/output control section (
Only one processor fP) is set to accept interrupts from the IOC).

In a system that has started operating in this way, if one of the multiple processors (tl'l) fails, the failed processor (hereinafter referred to as the failed processor) (P) , a fault occurrence signal is output, and at this time, since the "high" signal has been output from the first control circuit (131) after the initialization, the fault occurrence signal is input to the driver +11 via the AND circuit az. and the signal line (Sl) is driven "low" by the driver il+.

Then, among the plurality of processors (1'l), one of the processors (Pl) (hereinafter referred to as the detection processor (?)) which is not faulty is C, through the detection circuit a41 and the second control circuit a51. When Uf81 detects that the signal line fs+ is driven low, the corresponding CP
U (81 stops the program that has been running up to that point, calls and executes the program shown in FIG. 8.

That is, the detection processor (Kalpa) first sends out the address data e 1111 of each processor other than itself (each gate circuit (191),
Call k.

Therefore, in each processor (P), the address bus f
a) When the above address data is stored in the address decoder (181) and the address data given to its own gate circuit field is taken in, a call signal is output to the gate circuit Q91, thereby opening the gate circuit. .

Therefore, when the faulty processor IP) is called, its gate circuit Q9'? Since the fault occurrence signal is sent onto the data bus Cdl through the detection processor (P)
Now, we will detect a faulty processor based on the sent address data and the fault occurrence signal on the data bus Cdl.
Step ■).

2. The operation of detecting a faulty processor is basically the same as that described in the prior art.

At that time, the detection processor sends control command data such as stop and reset to the detected faulty processor along with the address data of its third control circuit 4 onto the data bus Cdl (step 2). .

Therefore, in the faulty processor (1'), the address data stored in the address decoder outputs all outputs to call the third control circuit, and the third control circuit receives the data on the data bus Cdl by this calling signal. , that is, all control command data is lost, it is held and analyzed, a stop signal is output to CPU +81, etc., a reset signal is output to other circuits and devices, and further j8
1 A fault output stop signal is output to the control circuit 03.

Here, the W11 control circuit +13 outputs a "low" signal in response to the fault output stop signal, so the drive of the driver fl+ is stopped via the AND tg fluz '1, and the signal #H3l becomes "high". Return to state. Since this condition is detected by the detecting processor (P), the processor (P) can confirm that the faulty processor (P) is correctly controlled.

Next, the detection processor (Mon) is the fault processor (Pi).
Determine whether or not the processor (P) handles interrupts from the input/output control unit (IOC). Shift to ■, drive some kind of display/notification means such as an LED display, printer, console/terminal, etc., display which processor (P) has a problem and which processor (P) has a problem, and notify humans such as operators of the problem. .

Also, if the condition of YES is satisfied in step ■,
Next, control command data for inhibiting interrupts is outputted to the faulty processor (P) together with the address data of the third system # circuit group (step 2).

As a result, the fault processor tP) holds and analyzes the control command data in the third control path 4 and interrupts the interrupt gate 1g.
Since an interrupt prohibition signal is output to path uO, handling of input/output interrupts is prohibited, and the system is logically disconnected from the system.

In that case, the detection processor (P) is the faulty processor (P
) is used to handle interrupts from the input/output control unit (IOC).
). This determination is normally made for a spare processor (P) for input/output interrupts, and is arbitrarily determined if there is no spare processor.

Then, the detection processor (P) performs step II to determine whether or not it is supposed to handle interrupts.
), if YES, the CPU fs+ outputs all the setting signals to its own interrupt control circuit 071 (Step ■), and the newly provisional interrupt input/output control unit (
Interrupt gate circuit α61 corresponding to IOC) opens dJI
ill, and move on to step ■.

Further, if the judgment in step ■ is NO, the determined processor (C of Pl)'U (step ■) to output the data of the setting command to 81,
The interrupt control circuit (+71) controls the opening of the corresponding interrupt gate circuit Oa, and the process moves to step (2).The CPU of the detection processor ()', which has thus completed the program shown in FIG. (83 starts its own program again, and the system continues to operate without stopping in the faulty processor (Ple disconnection state).

In addition, if this system is in an operating state and a problem occurs in another processor (P) other than the disconnected processor (P), the affected processor (P) will be logically removed from the system by the above-mentioned operation. It is isolated and operates normally as a system.

In other words, even if there is a multiprocessor system in which n processors IPI are connected via a common bus (B), and up to (n-1) processors (P) fail and become inoperable. , the entire system will not stop and will continue to operate.

In the embodiment, each of the plurality of processors (Pl) is provided with a detection circuit 1141i that detects that the signal StS+ is driven to "low", and the respective C1'U(
8) has the function of executing the program shown in Figure IIA, but the detection circuit 1 is only installed in an arbitrary processor (P).
141 etc. may be provided, and in this case, if this arbitrary processor (Pl is one), the processor (L
Since the system may malfunction due to runaway or the like when a failure occurs in 'l, it is better to provide a detection circuit I or the like to two or more arbitrary processors tp+.

[Effects of the Invention] As described above, according to the multiprocessor system of the present invention, even if a failure occurs in any one of the plurality of processors, only the processor in which the failure occurs can be logically separated from the system. As a result, failures can be prevented from spreading to the entire system, the entire system will not stop, and reliability will be dramatically improved.

[Brief explanation of the drawing]

1 to 3 show one embodiment of the multiprocessor system of the present invention, FIG. 1 is a block diagram of the main parts of one processor, and FIG. 2 is a detailed block diagram of a part of FIG. 1. , the third factor is a flowchart for explaining the operation, FIG. 4 is a block diagram of a general multiprocessor system, FIG. 5 is a block diagram of a part of a conventional multiprocessor system, and FIG. 6 is a diagram of another conventional multiprocessor system. FIG. 2 is a block diagram of a portion of the system. CP+, CP+) (PFI)...Processor,
(IOC), (IOC,) ~ (IOCm)...Input/output control unit, (M)...Common memory, iBl...Common bus, IsI...System status monitoring signal line, il+...
- Driver, (8)... CPU, L12... detection circuit, Q61, (16+) to (165)... interrupt gate circuit. Agent Patent Attorney Fuji 1) Ryutabe No. 2 Figure Chi Rikiketsu Figure 4 Figure 5 Figure 1! J6 diagram

Claims (1)

[Claims] (1) Connect multiple processors via a common bus, connect the input/output control unit, common memory, etc. to the common bus, and identify the faulty processor when a fault occurs in any of the processors. In a multiprocessor system configured to enable the processor to stop, reset, or interrupt the faulty processor based on address signals on an address bus that makes up the common bus and data on a data bus that makes up the common bus, means for giving a control command such as prohibition, and means provided in each of the processors to inhibit interrupts input from the input/output control unit or the like via the common bus by a control command for prohibiting interrupts from the arbitrary processor; A multiprocessor system characterized by being equipped with the following.