RU2634189C1 - Multi-channel self-diagnosed computer system with reserve substitution and method of improving its fault-tolerance (versions) - Google Patents

Abstract

FIELD: physics.

SUBSTANCE: method of increasing fault-tolerance is proposed by diagnosing the operability of the active channel by the processor of the channel itself, forming the health pulses of the active channel, by the analysis results and the sequence period of which a sequence of logical signals is formed, converting them into logical signals of opposite polarity, which are then converted into sinusoidal voltage and into a constant voltage to control the switch for disconnecting the voltage of the secondary backup channel power source. A sequence of logical signals is formed by the analysis results of the health pulses and their sequence period, they are converted into current signals of the opposite direction, then into logical signals of opposite polarity, which are then converted into sinusoidal voltage and into a DC voltage to control the switch for disconnecting the voltage of the secondary backup channel power source.

EFFECT: increasing the reliability and fault-tolerance of the computer system.

5 cl, 5 dwg

Description

The present invention relates to computer technology and can be used in systems for various purposes, which require increased reliability and radiation resistance, in particular in space rocket and aviation technology.

In products of critical use to date, to ensure increased reliability and fault tolerance, mainly multichannel on-board digital computer systems (BTSC) are used, the principle of which is based on majorization, i.e. using 2n + 1 channels and a voting scheme that selects the output that represents the majority.

The most widely used are the three-channel BCVSs with the choice of the correct information according to the “2 out of 3” rule [1, 2].

Improving the reliability of the system considered in [1] is ensured by simultaneously performing calculations on all identical computing channels connected in parallel and implementing the same function of comparing the results of calculations obtained at a fixed point in time at the output of the first and second, second and third, the first and third channels, choosing the right information on a majority basis.

The systems used ensure operability in case of failure of one of the channels.

The use of BCVS in various complexes of spacecraft (SC) has shown that they have the required reliability when operating in a wide range of changes in ambient temperature, mechanical, electromagnetic effects. The disadvantage of these systems is the accelerated failure of all channels in conditions of increased radiation.

In the multi-channel computing system considered in [2], an additional channel (an additional face) located in the “cold” reserve, which is less susceptible to radiation, is added to the three computing channels. The used channel health monitoring unit analyzes the channel health and, in the event of failure of any two channels, connects a backup channel.

It should be noted that an increase in radiation resistance is possible only when the radiation resistance of the channel operability monitoring unit exceeds the radiation resistance of the channels. In redundant systems with replacement, the control unit is a sequential link between the channels and can become crucial in the reliability of the system. To ensure high reliability of determining channel failure, the complexity of the control unit may exceed the complexity of the entire system. When exposed to increased radiation, all channels of the BCVS and the control unit can simultaneously fail, since they are in active mode and equally exposed to radiation. In this case, the backup channel will not connect.

A known method of ensuring the fault tolerance of computing systems [3], which consists in masking failures by redundancy and including determining the presence of failures, identifying and blocking faulty channels, to mask failures, use independent simultaneous operation of N channels, the number of which is one more than the multiplicity of masked failures, whose signals give to the common output, and according to the signals received from the failure detectors included in each channel, the signals from the channels in which x failures occurred, and is passed to the output of the signals from the serviceable channel which comes first in time.

Since all channels are simultaneously in operating mode, the use of this method does not allow to increase the radiation resistance of systems.

In [4], a self-diagnosed three-channel redundant computing system (prototype) is considered. Improving the reliability, fault tolerance is ensured by diagnosing the health of the active channel by the processor of the channel itself in the process of periodically solving the diagnostic problem at fixed time intervals, similar to the standard one with the given initial data, comparing the result of solving the diagnostic problem with a previously known result, and, if there is a match, forming the processor the health pulse of the active channel, the analysis of the period of succession of health pulses and the formation of the signal I backup channel connection, in case of failure of any working channel.

The disadvantages of the prototype are the need to use a device for generating signals for channel sampling, emergency start devices, which, if they fail during aging or radiation exposure, does not allow you to connect a backup channel and, therefore, reduces the reliability, fault tolerance and radiation resistance of the system .

The technical result of the proposed solution is to increase the reliability, fault tolerance and radiation resistance, simplify the multi-channel computing system, as well as increase fire safety by providing the possibility of channel spacing across the facility.

The technical result is achieved in that in a multi-channel self-test computer system with redundancy substitution, containing three identical channels, each of which contains a secondary power source, memory, system generator, the output of which is connected to the first input of the processor; the initial installation circuit, the output of which is connected to the second input of the processor, a power cut-off device, a memory access device, the output of which is connected to the memory, and the input is connected to the first output of the processor, a backup device, the first input of which is connected to the output of the initial installation circuit, is introduced into each channel , the second input is connected to the second output of the processor, the third input is connected to the output of the system generator; the first output of the backup device of the first channel is connected to the first input of the power-off device of the third channel, the second output is connected to the first input of the power-off device of the second channel; the first output of the second channel backup device is connected to the first input of the first channel power-off device, the second output is connected to the second input of the third channel power-off device; the first output of the backup device of the third channel is connected to the second input of the power-off device of the second channel, the second output is connected to the second input of the power-off device of the first channel; the third output of the processor of the first channel is connected to the second input of the second channel memory access device, the fourth output is connected to the second input of the third channel memory access device; the third processor output of the second channel is connected to the second input of the memory access device of the first channel, the fourth output of the second channel processor is connected to the third input of the memory access device of the third channel; the third output of the processor of the third channel is connected to the third input of the memory access device of the first channel, and the fourth output is connected to the third input of the memory access device of the second channel.

In addition, the backup device contains a frequency divider, the first input of which is connected to the system generator, and the second to the initial setup circuit, the first input of the first pulse counter, the first inputs of the first, second, third and fourth logical elements 2I; the first output of the frequency divider is connected to the first input of the second pulse counter, and the second to the first input of the logic element ZI; the output of the second pulse counter is connected to the second input of the logic element ZI; the second input of the first pulse counter is connected to the processor and the second input of the second pulse counter; the output of the first pulse counter is connected to the third input of the logic element ZI, the output of which is connected to the input of the logic element NOT, the second inputs of the second and third logical elements 2I; the output of the logic element is NOT connected to the second inputs of the first and fourth logical elements 2I.

In addition, the backup device contains a frequency divider, the first input of which is connected to the system generator, and the second to the initial installation circuit, the first input of the first pulse counter, the first inputs of the first, second, third and fourth logical elements 2I; the first output of the frequency divider is connected to the first input of the second pulse counter, and the second to the first input of logic element 3I; the output of the second pulse counter is connected to the second input of the logic element 3I; the second input of the first pulse counter is connected to the processor and the second input of the second pulse counter; the output of the first pulse counter is connected to the third input of the 3I logic element, the output of which is connected to the input of the LVDS transmitter; the output of the LVDS transmitter is connected to the input of the LVDS receiver; the output of the LVDS receiver is connected to the input of the logical element NOT, the second inputs of the second and third logical elements 2I; the output of the logic element is NOT connected to the second inputs of the first and fourth logical elements 2I.

The technical result is achieved by the fact that in the method of increasing the fault tolerance of a multi-channel self-diagnosing computer system with redundancy replacement, which consists in diagnosing the health of the active channel by the processor of the channel itself in the process of periodically solving a diagnostic problem similar to the standard one with pre-selected initial data, comparing the result of solving the diagnostic problem with a pre a known result and, in case of coincidence, the formation by the processor of pulses using ting active channel analysis serviceability Incoming pulses and their repetition period based on the results of analysis and serviceability of the pulse repetition period of a sequence of logic signals is formed. They are converted into logical signals of opposite polarity, which are then converted to a sinusoidal voltage and to a constant voltage to control the disconnect switch of the voltage of the secondary power source of the backup channel.

The technical result is achieved in that in order to increase fire safety in a method of increasing the fault tolerance of a multi-channel self-diagnosing computer system with redundancy substitution, which consists in diagnosing the active channel operability by the processor of the channel itself in the process of periodically solving a diagnostic problem similar to the standard one with previously selected initial data, comparing the solution result diagnostic task with a known result and, in case of coincidence, the form As the processor continues to monitor the health of the active channel, the analysis of the arrival of health pulses and their repetition period, the sequence of logical signals is formed according to the results of the analysis of health pulses and their repetition period. They are converted into current signals of the opposite direction, then into logical signals of the opposite polarity, which are then converted into a sinusoidal voltage and into a constant voltage to control the disconnect switch of the voltage of the secondary power supply of the backup channel.

In FIG. 1 is a structural diagram of a multi-channel self-test system with redundancy substitution.

In FIG. 2 shows a structural diagram of a backup device.

In FIG. Figure 3 shows a variant of the device for switching off the power of the backup channel

In FIG. Figure 4 shows a possible implementation of the system using the 1892 BM12T processor.

In FIG. Figure 5 shows a variant of a backup device in which a sequence of health pulses is converted into current signals of the opposite direction for transmission via the LVDS interface.

The multi-channel, self-testable, redundant substitution computing system shown in FIG. 1 contains three identical channels. Each channel contains a system generator 1, a power off device 2, a secondary power source 3, a processor 4, an initial setup 5, a backup device 6, a memory access device 7, a memory 8. System generator 1 is connected to the processor 4 and the backup device 6. The processor 4 is connected to the initial setup circuit 5, the backup device 6 and the memory access device 7, which is connected to the memory 8. The secondary power source 3 is connected to the power-off device 2. In addition, the reserve device channel 6 of the first channel is connected to the power-off device 2 of the second and third channel, the backup device 6 of the second channel is connected to the power-off device 2 of the first and third channel; a backup device 6 of the third channel is connected to a power-off device 2 of the first and second channel; the processor 4 of the first channel is connected to memory access devices 7 of the second and third channel; processor 4 of the second channel is connected to memory access devices 7 of the first and third channel; processor 4 of the third channel is connected to memory access devices 7 of the first and second channel.

The backup device, the circuit of which is shown in FIG. 2, contains a frequency divider 9, the first input of which is connected to the system generator 1, and the second to the initial installation circuit 5, the first input of the first pulse counter 10, the first inputs of the first 14, second 15, third 16, and fourth 17 logic elements 2I; the first output of the frequency divider 9 is connected to the first input of the second pulse counter 11, and the second to the first input of the logic element 3I 12; the output of the second pulse counter 11 is connected to the second input of the logic element 3I 12; the second input of the first pulse counter 10 is connected to the processor 4 and the second input of the second pulse counter 11; the output of the first pulse counter 10 is connected to the third input of the logic element 3I 12, the output of which is connected to the input of the logical element NOT 13, the second inputs of the second 15 and third 16 of the logical elements 2I; the output of the logic element NOT 13 is connected to the second inputs of the first 14 and fourth 17 logic elements 2I.

In the embodiment of FIG. 3 variant of the power supply backup device of the backup channel, the transformer T1 is connected to the diodes Dl, D2, resistor R1, capacitor C1; resistor R1 is connected to resistor R2, transistor VT1; transistor VT1 is connected to resistor R2, resistor R3, which is connected to transistor VT2, resistor R4; transistor VT2 is connected to resistor R4, diode D3.

The backup device, the circuit of which is shown in FIG. 5, contains a frequency divider 9, the first input of which is connected to the system generator 1, and the second to the initial setup circuit 5, the first input of the first pulse counter 10, the first inputs of the first 14, second 15, third 16 and fourth 17 logic elements 2I; the first output of the frequency divider 9 is connected to the first input of the second pulse counter 11, and the second to the first input of the logic element 3I 12; the output of the second pulse counter 11 is connected to the second input of the logic element 3I 12; the second input of the first pulse counter 10 is connected to the processor 4 and the second input of the second pulse counter 11; the output of the first pulse counter 10 is connected to the third input of the logic element 3I 12, the output of which is connected to the input of the LVDS transmitter; the output of the LVDS transmitter 18 is connected to the input of the LVDS receiver 19; the output of the LVDS receiver is connected to the input of the logical element NOT 13, the second inputs of the second 15 and third 16 logic elements 2I; the output of the logic element NOT 13 is connected to the second inputs of the first 14 and fourth 17 logic elements 2I.

In the proposed multi-channel self-test computer system with redundancy substitution is carried out:

- diagnosing the health of the active channel by the processor of the channel itself in the process of periodically solving the diagnostic problem, similar to the standard one, with pre-selected initial data;

- comparing the result of solving the diagnostic problem with a previously known result and, in case of coincidence, the processor generates health impulses of the active channel;

- analysis of the arrival of health impulses and their repetition period;

- according to the results of the analysis of health pulses and the period of their succession, a sequence of logical signals of opposite polarity is formed;

- conversion of logical signals of opposite polarity to a sinusoidal voltage;

- conversion of the sinusoidal voltage to constant to control the switch off the voltage of the secondary power source of the backup channel.

In each channel of the system, the block diagram of which is shown in FIG. 1, the voltage from the secondary power source 3 is supplied continuously to the power-off device 2. To the memory access device 7 and memory 8, the voltage is supplied continuously from the secondary power sources 3 of all channels according to the “OR” scheme through decoupling diodes (not shown in FIG. 1 )

At the time of supplying voltage to the system, the secondary power supply 3 of each channel generates the initial Res signal (changes from logical “0” to logical “1”). When the signal reaches a certain level, the system is allowed to work. In this case, the processor 4, which first enters the mode, will periodically at a fixed time solve the diagnostic problem with pre-selected initial data and a known result.

If the result of the solution of the diagnostic problem coincides with the known result, the processor 4 generates a health signal of the current channel. When periodically solving the diagnostic problem, the processor 4 generates a sequence of pulses that are received on the backup device.

The backup device analyzes the presence of impulses of serviceability of the channel and the period of their succession. With a working channel, the backup device generates a pulse train, which is converted into logical signals of opposite polarity, then into a sinusoidal voltage, a constant voltage to control the disconnect switch of the voltage of the secondary power supply of the backup channel.

In the event that the current transformer impulses disappear or the period of their repetition (channel failure) changes, the backup device stops generating a pulse sequence to turn off the secondary power sources of the 2 backup channels. In this case, the voltage from the secondary power sources 2 will be supplied to the backup channels and one of the backup channels will be connected, which earlier will generate current impulses of the current transformer. Thus, one backup channel will be in operating mode, while the others will be in the “cold” reserve. In the process, the necessary calculation results are periodically stored in the memory of 8 of all channels. The connected channel will continue the calculation taking into account the information stored in memory 8, which allows you to speed up the solution of required tasks.

When the channel is operational, the redundancy device provides power off from the backup channels.

To the backup device 6 from the initial setup circuit 5, the signal Res is applied (changes from “0” to “1”). From the system generator 1 to the frequency divider 9 receives frequency signals Fgen. From the processor 4, the health signals of the current channel are generated, formed according to the results of self-diagnosis.

At the time of supplying power to the backup device 6, when the Res signal reaches a certain value, the lock is removed from the frequency divider 9, logic elements 2I 14-17. The pulse counter 10 is set to its original state (at the output of the counter 10 is a logical "0"). The output of the counter 11 may be in an arbitrary state. By the time the processor enters the mode, the pulse counter 11 will receive a certain number of pulses from the frequency divider 9, a logical “1” will appear at its output and it will close at the input. Until the appearance of current pulses, there will be logic levels at the inputs and outputs of logic element 3I 12. At the moment of occurrence of the health signals of the current transformer (first pulse), the pulse counter AND will be set to its original state (logical “0” at the output). When a certain number of current pulses arrives at the pulse counter 10, it closes at the input and a logical “0” appears at its output. In this case, the frequency signals from the frequency divider 9 will appear at the output of the logical element 3I 12 and inverted at the output of the logical element NOT 13. The signals from the output of the element 3I 12 and the output of the element NOT 13 will go to the inputs of the logical elements 2I 14-17, and from the outputs of the elements 2I 14-17 to the transformer T1 of the power-off device of the corresponding backup channels.

The power-off device, the structural diagram of which is shown in FIG. 3, converts the alternating voltage into direct voltage, which is supplied to the transistor VT1. In this case, it opens and closes the transistor VT2. In this case, the supply voltage will disconnect from the backup channel.

In the proposed multichannel self-diagnostic computer system, there is no OR gate and a device for generating channel sample signals, which are a serial link between the main and backup channels, and the number of communication lines used to connect the backup channels is reduced.

A possible embodiment of the system using the domestic high-performance processor 1892 BM12T is presented in FIG. 4. The memory of the active channel is accessed via the serial high-speed SpaceWire port, and the memory of the backup channels via the serial high-speed SpaceFiber port, which provides galvanic isolation.

The backup device, the circuit of which is shown in FIG. 2, is implemented on logic elements and contains a frequency divider, pulse counters, 2I logic elements, 3I logic element, NOT logic element, resistors, capacitors, transformers, diodes, transistors. The listed elements exist in the form of independent small-sized products.

A memory access device may be implemented using an 1892 BM12T microprocessor.

The power-off device can be implemented using transistors of the type 2T690AC9, 2T689AC9, diodes 2D803AC9.

It is advisable to implement a secondary power supply using a radiation-resistant PWM controller 1359EU034.

It is advisable to use a 1620RE4U random-access memory device with high radiation resistance as a memory.

In the proposed system, the connection of the backup channels occurs as in the event of a channel failure, a failure of the backup device, a break in the communication lines of the backup device with the secondary power supply connecting device of the backup channel.

The implementation of the method is carried out by introducing into the backup device a logical element NOT, logical elements 2I, transformers, diodes, resistors, capacitors, transistors.

The embodiment of the backup device shown in FIG. 5, with an LVDS transmitter and an LVDS receiver, in which the sequence of health pulses is converted into current signals of the opposite direction for transmission via the LVDS interface, and then into pulses of the opposite polarity, which are then converted to a sinusoidal voltage and a constant voltage to control the trip key voltage of the secondary power source of the backup channel, will provide galvanic isolation between the channels and greatly simplify the technical implementation of secondary power sources.

In this case, increasing fire safety is achieved by the fact that in a multi-channel self-diagnosing computer system with redundancy substitution after the formation of variable logical signals according to the results of the analysis of health pulses and the period of their following:

- conversion of variables of logical signals into current signals of the opposite direction;

- conversion of current signals of the opposite direction into logic signals;

- conversion of logical signals into logical signals of opposite polarity;

- conversion of logical signals of opposite polarity to a sinusoidal voltage;

- conversion of the sinusoidal voltage to constant to control the switch off the voltage of the secondary power source of the backup channel.

The use of the LVDS interface for communication with the backup channel (transmission of health signals not by the voltage level, but by the direction of the current) ensures the connection of the backup channels that are distant from each other over considerable distances, and, therefore, increases fire safety.

Literature

1. Antimirov V.M. On-board computing systems of the Malachite family for operation in extreme conditions / V.M. Antimirov, A.B. Umansky, L.N. Shalimov // Bulletin of the Samara State Aerospace University. - No. 4 (42), 2013. - S. 19-27.

2. Onboard spacecraft control systems: Textbook / Brovkin A.G., Burdygov B.G., Gordiyko S.V. and others. Edited by A.S. Syrova - Moscow: Publishing House MAI-PRINT, 2010 .-- 304 p.

3. Patent for the invention RU 2047899 C1, G06F 11/18. A method of providing fault tolerance of computing systems.

4. Patent No. 2527191, Russian Federation, IPC G06F 11/20. Redundant multi-channel computing system.

5. Rusanov V.N. Self-diagnosed three-channel on-board computer system with redundancy substitution / V.N. Rusanov, A.Yu. Kiselev, N.V. Silyanov // Aerospace Instrumentation. - M., ed. “Nauchtekhlitizdat”, - 2015. - No. 2 P. 23-33.

6. Rusanov, V.N. Diagnostic model of redundant onboard computer system / V.N. Rusanov, S.A. Korolev // Devices and systems. Management, control, diagnostics. - M., ed. "Nauchtekhlitizdat", - 2014. - No. 11. - S. 59-64.

Claims (5)

1. A multi-channel self-test computer system with redundancy substitution, containing three identical channels, each of which contains a secondary power source, memory, system generator, the output of which is connected to the first input of the processor; the initial installation circuit, the output of which is connected to the second input of the processor, characterized in that a power cut-off device, a memory access device, the output of which is connected to the memory, and the input is connected to the first output of the processor are introduced into each channel; a backup device, the first input of which is connected to the output of the initial installation circuit, the second input is connected to the second output of the processor, the third input is connected to the output of the system generator; the first output of the backup device of the first channel is connected to the first input of the power-off device of the third channel, the second output is connected to the first input of the power-off device of the second channel; the first output of the backup device of the second channel is connected to the first input of the power-off device of the first channel, the second output is connected to the second input of the power-off device of the third channel; the first output of the backup device of the third channel is connected to the second input of the power-off device of the second channel, the second output is connected to the second input of the power-off device of the first channel; the third output of the processor of the first channel is connected to the second input of the second channel memory access device, the fourth output is connected to the second input of the third channel memory access device; the third processor output of the second channel is connected to the second input of the memory access device of the first channel, the fourth output of the second channel processor is connected to the third input of the memory access device of the third channel; the third output of the processor of the third channel is connected to the third input of the memory access device of the first channel, the fourth output is connected to the third input of the memory access device of the second channel. 2. The system according to claim 1, characterized in that the backup device contains a frequency divider, the first input of which is connected to the system generator, and the second to the initial setup circuit, the first input of the first pulse counter, the first inputs of the first, second, third and fourth logical elements 2I; the first output of the frequency divider is connected to the first input of the second pulse counter, and the second to the first input of the 3I logic element; the output of the second pulse counter is connected to the second input of the logic element 3I; the second input of the first pulse counter is connected to the processor and the second input of the second pulse counter; the output of the first pulse counter is connected to the third input of the logical element 3I, the output of which is connected to the input of the logical element NOT, the second inputs of the second and third logical elements 2I; the output of the logic element is NOT connected to the second inputs of the first and fourth logical elements 2I. 3. The system according to claim 1, characterized in that the backup device contains a frequency divider, the first input of which is connected to the system generator, and the second to the initial installation circuit, the first input of the first pulse counter, the first inputs of the first, second, third and fourth logical elements 2I; the first output of the frequency divider is connected to the first input of the second pulse counter, and the second to the first input of the 3I logic element; the output of the second pulse counter is connected to the second input of the logic element 3I; the second input of the first pulse counter is connected to the processor and the second input of the second pulse counter; the output of the first pulse counter is connected to the third input of the 3I logic element, the output of which is connected to the input of the LVDS transmitter; the output of the LVDS transmitter is connected to the input of the LVDS receiver; the output of the LVDS receiver is connected to the input of the logical element NOT, the second inputs of the second and third logical elements 2I; the output of the logic element is NOT connected to the second inputs of the first and fourth logical elements 2I. 4. A way to increase the fault tolerance of a multi-channel self-diagnosed computing system with redundancy substitution, which consists in diagnosing the active channel operability by the processor of the channel itself in the process of periodically solving a diagnostic problem similar to the standard one with previously selected initial data, comparing the result of solving the diagnostic problem with a previously known result, and, in case of coincidence, formation by the processor of impulses of serviceability of the active channel, analysis of health pulses and their repetition period, characterized in that according to the results of the analysis of health impulses and their repetition period, a sequence of logical signals is generated, they are converted into logical signals of opposite polarity, which are then converted to a sinusoidal voltage and to a constant voltage to control the secondary voltage disconnect switch backup channel power supply. 5. A way to increase the fault tolerance of a multi-channel self-diagnosing computing system with redundancy substitution, which consists in diagnosing the active channel operability by the processor of the channel itself in the process of periodically solving a diagnostic problem similar to the standard one with previously selected initial data, comparing the result of solving the diagnostic problem with a previously known result and, case of coincidence, formation by the processor of impulses of serviceability of the active channel, analysis received health pulses and their repetition period, characterized in that according to the results of the analysis of health impulses and their repetition period, a sequence of logical signals is formed, they are converted into current signals of the opposite direction, then into logical signals of the opposite polarity, which are then converted to a sinusoidal voltage and to a constant voltage for controlling the voltage isolation key of the secondary power supply of the backup channel.

Images