JP2015172906A - network system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To secure control redundancy to external equipment.SOLUTION: In a network system 100 configured by connecting a plurality of node devices 1 each of which operates on the basis of an operating system, the plurality of node devices 1 control external equipment connected to each of them, and an application program to be executed by any one node device 1 among the plurality of node devices 1 is executed even by other one or more node devices 1 in a multiple manner.

Description

  The present invention relates to a network system configured by connecting a plurality of node devices each operating based on an operating system.

  Conventionally, as shown in Patent Document 1, a distributed operating system is constructed using a plurality of computers connected by a network or a computer equipped with a plurality of processors, and the calculation load on each computer or each processor is distributed. There is. In addition, as shown in Patent Document 2, in a system that stores files distributed over a plurality of file servers via a network, a plurality of file servers can be replicated as a means for ensuring file integrity and redundancy. There is something to save.

JP 2013-156765 A JP 2010-218335 A

  On the other hand, the inventor of the present application considers ensuring control redundancy to external equipment connected to a node device such as a computer in a distributed operating system, and the present invention has been made as a result of intensive studies. It is. That is, the main object of the present invention is to ensure control redundancy for external devices.

  In other words, the network system according to the present invention is a network system configured by connecting a plurality of node devices each operating based on an operating system (OS), and is an external system to which the plurality of node devices are connected. An apparatus is used to control an apparatus, and an application program executed on any one of the plurality of node devices is also executed on one or more other node devices.

  In such a case, since the application program executed on one node device is also executed in multiple on one or more other node devices, two or more on which the same application program is executed Even when one of the node devices does not normally operate on the external device due to an abnormality such as a failure, the external device is continuously controlled by the application program executed by the other node device. Can do.

It is desirable that the application program executed on the one node device is also executed on two or more other node devices. That is, it is desirable that there are three or more node devices that execute the same application program.
If the calculation results by three or more node devices are completely coincident, control of the external device is continued by a predetermined one node device. On the other hand, if a timeout or mismatch occurs, an abnormal node device is identified, and the node device is switched to another node device to continue control of the external device. Here, if the calculation results do not match, a majority decision is taken based on the calculation results of three or more node devices, and a small number of node devices are determined as abnormal node devices.

  As a specific embodiment for realizing the network system of the present invention, in a node device (hereinafter, also referred to as a multiple execution node device) in which the same application program is executed, an operating system of each multiple execution node device is used. It is desirable for the system to provide a common execution environment for the same application programs executed on them.

For example, the following can be considered as a specific example in which the operating systems of the multiple execution node devices provide a common execution environment.
(A) The operating system of each multi-execution node device outputs a value obtained by completely matching the node device identification information such as the node name, node number, process ID, and IP address to the application program. Here, the completely matched value may be false information not related to each node device, or may be information on any one of the node devices.
(A) The operating system of each multiple execution node device negotiates a random number (the OS that provides the multiple execution environment negotiates in advance between the nodes) and outputs the same value to the application program.
(C) The read result of the file system in the operating system of each multiple execution node device matches the portion where no data exists.
(D) In each multiple execution node device, the stack and the BSS are in the same state at the start of execution by initialization or the like.
(E) If the value of the clock counter or the like in each multiple execution node device is also possible, reading from the user is prohibited, and the operating system of each multiple execution node device outputs the same value in exception processing.
(F) The input / output interface (I / O) information cannot be directly read from the application program being multiplexed.

  To improve performance, do not synchronize the application program on the operating system of each multi-execution node device, let the preceding node device execute first, and wait for the data of other delayed node devices Compare the calculation results. Further, when the progress of execution is remarkably separated between a plurality of multiple execution node devices, the execution of the node device whose progress has progressed excessively is made to wait, and the deviation in the progress of the execution is alleviated. If this measure is not taken, there will be too much data of the preceding node device that the operating system should hold, and the operating system will fail.

It is desirable that an application program executed on any one of the plurality of node devices is transferred to another node device and can be copied.
In this case, even if an abnormality such as a failure occurs in one node device and the multiplicity is lowered, a copy of the application program of the normal node (at that time) is used instead of the application program of the node device in which the abnormality has occurred. In other words, the reduced multiplicity can be restored, so that the system can be used stably.

  As specific node devices, each of the node devices includes one or more CPUs, one or more memories, a plurality of peripheral circuits having mutually different functions, a memory interface connecting them, and an external device. Preferably, the LSI chip includes a plurality of connection pins that enable input / output, and is configured so that functions of the plurality of peripheral circuits can be selected and assigned to the plurality of connection pins.

It is desirable that the plurality of peripheral circuits include a plurality of Ethernet transmission / reception units.
In this case, since it has a plurality of Ethernet transmission / reception units, even if it is used in a complicated network system, it can relay Ethernet packets by itself, so there is no need to use a network relay device. The configuration of the system can be simplified. In addition, since a plurality of Ethernet transmission / reception units have a CPU on the same LSI, the communication relay function performed by the LSI chip can be expanded, and information processing and communication for improving the living environment can be performed. It becomes easy to use for LSI (LCCP) to be integrated.

  As a specific embodiment of the LSI chip, it is desirable that four or more Ethernet transmission / reception units are provided. If this is the case, LSI chips can be connected to each other in a grid pattern, which enables a scalable system expansion.

It is desirable that the Ethernet transmission / reception units in the plurality of node devices are connected to each other.
This makes it possible to expand the network system in a scalable manner. In addition, even if one Ethernet transmission / reception unit becomes unable to transmit / receive due to a failure or the like, a communication path that bypasses the other Ethernet transmission / reception unit can be established. Thereby, it becomes easy to apply to a complicated network system, especially a network system (LCCA) in which information processing and communication for improving a living environment are integrated.

  According to the present invention configured as described above, control redundancy to an external device can be ensured.

The schematic diagram which shows the network system (LCCA) in this embodiment. The schematic diagram which shows the structure of the LSI chip (LCCP) of the embodiment. The schematic diagram which shows the multiple execution of the application program of the embodiment.

  Hereinafter, an embodiment of a network system according to the present invention will be described with reference to the drawings.

  As shown in FIG. 1, the network system 100 according to the present embodiment is configured by connecting a plurality of node devices 1, and specifically, integrates information processing and communication for improving a living environment. Network system (LCCA).

  Each node device 1 is connected to an external device, and each node device 1 operates based on an operating system (OS) to control each external device.

  The node device 1 of the present embodiment is an LSI chip that combines information processing and communication (Life Computing and Communication) for improving the living environment (hereinafter referred to as Life Computing and Communication Processor (LCCP)).

  The LCCP 1 includes one or more CPUs, one or more memories, a plurality of peripheral circuits having mutually different functions, a memory interface that connects them, and a plurality of connection pins that enable input / output to / from the outside. The LSI chip is configured so that a user can select functions of a plurality of peripheral circuits and assign them to a plurality of connection pins after manufacture. In other words, the LCCP 1 has more functions built into the chip than the number of connection pins provided on the chip, and assigns only necessary functions to the connection pins to transmit / receive data to / from the outside. It is configured to be able to.

  As shown in FIG. 2, the specific configuration of the LCCP 1 includes one or more CPUs 2, one or more memories 3a, 3b, 3c (two SRAMs and one FLASH ROM), and a plurality of Ethernet transmission / reception units 4a. To 4d and a memory interface 5 connecting them. Note that the transmission speed of Ethernet (registered trademark) may be 10 Mbps, 100 Mbps, 1 Gbps, 10 Gbps, or the like.

  In addition, the LCCP 1 of this embodiment includes an FPU accelerator 6, a cryptographic processing device (CryptoEngine) 7, a CAN / LIN communication interface 8, a USB OTG controller 9, a general-purpose input / output pin (GPIO) 10, and an asynchronous serial communication (UART). A peripheral circuit, a memory, and connection pins such as an interface 11, an I2C communication interface 12, an AD converter 13, a DA converter 14, an EEPROM 15, and a timer circuit 16 are provided.

  In this embodiment, an FPU accelerator 6, a general-purpose input / output pin (GPIO) 10, an asynchronous serial communication (UART) interface 11, an I2C communication interface 12, an AD converter 13, a DA converter 14, an EEPROM 15, a timer circuit 16, and a plurality of The Ethernet transmission / reception units 4a to 4d are connected by a local bus.

  The CPU 2, the plurality of memories 3 a, 3 b, 3 c, the plurality of Ethernet transmission / reception units 4 a to 4 d, the cryptographic processing device (CryptoEngine) 7, the CAN / LIN communication interface 8, the USB OTG controller 9, etc. are connected to the memory interface 5. Has been. Further, an FPU accelerator 6 is connected to the CPU 2. Note that the FPU may be integrated with the CPU.

  Each Ethernet transmission / reception part 4a-4d has a physical layer (PHY) and a logical layer (MAC). The plurality of Ethernet transmission / reception units 4a to 4d are drawn by being stacked, but this is a display convenience, and does not mean that the Ethernet transmission / reception units 4a to 4d are stacked on the semiconductor substrate.

  In this embodiment, a switch mechanism SW for bypassing data transfer between the transmission / reception units is provided between the plurality of Ethernet transmission / reception units 4 a to 4 d and the memory interface 5.

  This switch mechanism SW is composed of a single semiconductor switch element, and connects the output from each Ethernet transceiver unit of the plurality of Ethernet transceiver units 4a to 4d to the input of the memory interface 5 or another Ethernet transceiver unit. Is. The switch mechanism SW normally functions to connect the output from the memory interface to the input of the Ethernet transceiver and the output from the Ethernet transceiver to the input of the memory interface. As a result, the Ethernet transmission / reception unit is not prevented from inputting / outputting data packets to / from the memory by the direct memory access function.

  This switch mechanism SW is controlled by the data content of the received packet. Specifically, the content of a packet received by an arbitrary Ethernet transceiver among the plurality of Ethernet transceivers 4a to 4d needs to be transferred by transmission from another Ethernet transceiver, and other transceivers are used for the transfer. Only when there is no data packet to be transferred, the switch mechanism SW is controlled to transfer the packet to the Ethernet transmission / reception unit to be relayed without transferring the packet to the memory. The determination of the Ethernet transmission / reception unit used for transfer is obtained by subtracting the table built in the Ethernet transmission / reception unit that received the packet by the destination Ethernet address. When the switch mechanism exists, the Ethernet transmission / reception unit includes hardware including a table for that purpose. The contents of the table are set in advance by the CPU.

  If the Ethernet transmission / reception unit to be used for transfer via the switch mechanism SW is unfortunately being sending a packet, etc., and cannot be used immediately, it is transferred to the area on the memory by the direct memory access function and sent to the CPU. A reception completion interrupt is generated. In this transfer, in order to shorten the transfer time, separate transfer areas are prepared for packets that need to be transferred and other packets. Further, in order to process a packet for each priority, a transfer area is prepared for each packet priority. The CPU transfers the packets with the highest priority among the packets stored in the transfer area to the transmission memory area of the Ethernet transmission / reception unit to be relayed by the program activated by the reception interrupt. For the sake of convenience, the term “transfer” is used, but depending on the implementation, there are many cases where it is sufficient to reset the pointer.

  When the data is transferred via the switch mechanism SW, the Ethernet transmission / reception unit to be relayed is determined by a table set in advance by the CPU, and when not via the switch mechanism SW, the Ethernet transmission / reception unit to be relayed by the program is determined by the CPU. doing. Therefore, even if an Ethernet transmission / reception unit that cannot be used due to a failure or the like occurs, it can be dealt with by rewriting the table or changing the program behavior. That is, a system made by combining LSIs having this configuration can dynamically change the relay path of Ethernet packets during operation.

  Since the data transmission bandwidth of the memory interface 5 is sufficiently wide, the plurality of Ethernet transmission / reception units 4a to 4d can simultaneously perform a maximum of four transmissions and four receptions. Of course, only one read / write operation to the memory can be performed at a time, but a slight waiting for that is performed by the FIFO memory circuit inserted everywhere.

  As shown in FIG. 1, the network system 100 using the LCCP 1 configured as described above is configured by connecting a plurality of LCCPs 1 to each other. The connection topology may be a connection form that can secure an optional detour communication path even if a path that cannot be used due to a failure of one transmitting / receiving unit or a failure of one LCCP 1 occurs.

  Specifically, a plurality of Ethernet transmission / reception units 4a to 4d of LCCP1 are connected to each other. The LCCP 1 of the present embodiment has four Ethernet transmission / reception units (ports) 4a to 4d, and a plurality of LCCPs 1 are connected in a lattice pattern. By connecting in this way, each node (LCCP1) is an LSI chip having various input / output interfaces, so various peripheral devices, sensors, and control devices can be connected except for the Ethernet transmission / reception unit (port) of each node. A system connected to a port can be constructed. Each node (LCCP1) has a function of controlling peripheral devices, sensors, and control devices connected to the node. Thus, only the LCCP 1 can have a control function of the external peripheral device connected to each node, and the external peripheral device does not have to be provided with a control unit.

  FIG. 1 shows a case where LCA is applied to a home network, and one LCCP 1 is provided corresponding to a device provided in a bedroom, for example, and an air conditioner and a remote controller are connected to the air conditioner and the remote controller. To control. Moreover, one LCCP1 is provided corresponding to the apparatus provided in the kitchen, for example, and a refrigerator, a microwave oven, etc. are connected and it controls the said refrigerator, a microwave oven, etc. One LCCP 1 is provided, for example, corresponding to a device provided in the study, and is connected to a personal computer device such as a display and a keyboard and a wireless run parent device, and controls the personal computer device and the wireless run parent device. One LCCP 1 is provided corresponding to, for example, a device provided in a living room, and is connected to a television and a DVD recorder, and controls the television and the DVD recorder.

  Thus, the network system 100 of the present embodiment is configured such that an application program executed on any one of a plurality of node devices is also executed on two or more other node devices. . In the following, with reference to FIG. 3, an embodiment of multiple execution will be described. FIG. 3 shows multiple executions in four node devices (node A, node B, node C, and node D). In addition, these four node devices are provided corresponding to, for example, one room, and one common external device (for example, an air conditioner) is LIN connected to control the air conditioner via LIN communication. Is assumed. At this time, if each node device has a hardware failure, the circuit design is such that there is a high possibility that the node device will die without outputting a LIN communication signal (a signal will not be output if the component is broken). Yes.

  In the four node devices, the application program (program a) that is executed on the operating system of the node A is multiplexed and executed on the operating systems of the other two node devices (node B and node C). Here, the program a is a program for controlling an external device connected to the node A (here, the air conditioner is controlled by LIN communication). In FIG. 3, an application program (program b) executed on the operating system of the node B is a program for controlling an external device connected to the node B, and is executed on the operating system of the node C. The application program (program c) is a program for controlling an external device connected to the node C, and the application program (program d) executed on the operating system of the node D is connected to the node D. A program for controlling an external device. Note that the programs b to d may be configured to be executed in a multiple manner on the operating systems of the other two nodes.

  In the multiple execution node devices (node A, node B, and node C) in which the same application program (program a) is executed, the operating systems of the nodes A to C are the same executed on them. A common execution environment is provided for the application program (program a).

Specifically, a common execution environment is provided as follows.
(A) The operating system of each of the nodes A to C outputs to the program a a value obtained by completely matching the node device identification information such as the node name, node number, process ID, and IP address. Here, the completely matched value may be false information irrelevant to each of the nodes A to C, or may be information of any one node device (for example, the node A).
(A) The operating system of each of the nodes A to C negotiates random numbers (the OS that provides the multiple execution environment negotiates in advance between the nodes) and outputs the same value to the application program.
(C) The read results of the file system in the operating system of each of the nodes A to C also match the portions where no data exists.
(D) In each of the nodes A to C, the stack and the BSS are in the same state at the start of execution by initialization or the like.
(E) If the value of the clock counter or the like in each of the nodes A to C is possible, the reading from the user is prohibited, and the operating system of each of the nodes A to C outputs the same value in exception processing.
(F) Information on the input / output interface (I / O) cannot be directly read from the program a that is being executed in a multiplexed manner.

Then, the air conditioner is controlled with one of the nodes (nodes A to C) performing redundant multiple execution (for example, node A) as the master of LIN communication. Other nodes (nodes B and C) are physically connected to an external device (air conditioner), but the LIN communication line is in a standby state.
In this environment, when a failure is detected, if the failure is not the node (node A) that functions as the LIN master, the master remains the same node (node A). On the other hand, in the case of a node (node A) in which the failure functions as a LIN master, if the operating system on the failed node is still alive, it explicitly cancels itself as the LIN communication master, Even when there is no response due to a hardware failure, the circuit design is made so as not to disturb the LIN communication (the active state is not continuously maintained). At this time, if a new master for LIN communication is selected from normal nodes (nodes B and C) and this new master continues to send control signals to the air conditioner, the air conditioning can be continued without interruption. it can.

Here, an example of abnormality determination of an abnormal node device from a plurality of node devices will be described.
The calculation results of the three nodes A to C are compared by a management system provided in any one of the plurality of node devices (nodes A to D). This management system may be configured by an operating system, or may be configured by executing a management program on the operating system. When the management system determines that the three calculation results are completely identical, the calculation result of a predetermined one node device (node A) is output to the external device to control the external device. On the other hand, the management system identifies an abnormal node device if any calculation times out or the calculation results do not match. Here, when the calculation results do not match, a majority decision is taken based on the calculation results of the three nodes A to C, and a small number of node devices are set as abnormal node devices. If the abnormal node device is the node device (node A) that has been controlling the external device most recently, the node device is switched to the other node device (node B or node C) and the control of the external device is continued. .

  Further, after identifying the abnormal node device, the management system replaces the program a of the abnormal node device (node A) with the normal node device (node C) in order to restore the decrease in the multiplicity of the program a. ) Program a (including snapshots of all data at that time) is transferred to another node device (node D) that is not executing multiple copies. Then, the program a is multiple-executed on the operating system of the node D.

<Effect of this embodiment>
According to the network system 100 according to the present embodiment configured as described above, the application program executed on one node device 1 is also executed on one or more other node devices 1, so that the same Even if one of the three or more node devices 1 on which the application program is executed does not operate normally with respect to the external device due to an abnormality such as a failure, it is executed by the other node devices 1 The external program can be continuously controlled by the application program.

  In addition, since an application program executed on any one of the plurality of node devices 1 is transferred to another node device 1 and can be copied, an abnormality such as a failure occurs in one node device 1 Even if the multiplicity is lowered, the multiplicity can be prevented from being lowered by transferring and copying the application program from the normal node device to another node device 1 instead of the application program of the node device 1 in which the abnormality has occurred. You can continue to use the system stably.

The present invention is not limited to the above embodiment.
For example, in the application program of each node device, it is conceivable that a program that is executed by multiple other node devices is a highly important program in each node device.

  In the above-described embodiment, the same application program is multiplexed and executed by three node devices. However, the configuration may be such that two or four or more node devices are multiplexed.

  In the above-described embodiment, the plurality of Ethernet transmission / reception units 4a to 4d are illustrated in a multilayer structure, but this is a convenience in drawing notation, and physically, at least one Ethernet transmission / reception unit is the other Ethernet. Even if arrange | positioned planarly with respect to the transmission / reception part, you may arrange | position distantly planarly.

  Moreover, in the said embodiment, although it had four Ethernet transmission / reception parts, you may have five or more Ethernet transmission / reception parts. For example, when a plurality of LCCPs are connected in a grid pattern, a fifth Ethernet transmission / reception unit is required to connect the LCCP and an external device via Ethernet. Further, for example, when a plurality of LCCPs are connected in a lattice pattern, if two ports are prepared using the LCCP as an information outlet, a total of six Ethernet transmission / reception units are required. Furthermore, it may be possible to construct a huge network by providing more Ethernet transmission / reception units.

  In the above-described embodiment, the LSI chip 1 has the switch mechanism SW, but the CPU 2 does not have the switch mechanism SW, and the CPU 2 is configured to substitute the function as the switch mechanism by a program. May be. In this case, since it is not necessary to provide a switch mechanism as a physical configuration, the design of the LSI chip 1 can be simplified.

  As a network system using a plurality of LSI chips, in addition to a home network, it can be applied to a wide area network such as an infrastructure such as a public facility, a local government or a city, and a network system for factory automation (factory automation) It can also be applied to network systems such as automobiles and robots.

  In addition, the present invention is not limited to the above embodiment, and various modifications can be made without departing from the spirit of the present invention.

1 ... LSI chip 2 ... CPU
3a to 3c ... Memory 4a to 4d ... Ethernet transceiver 5 ... Memory interface SW ... Switch mechanism 100 ... Network system

Claims (8)

A network system configured by connecting a plurality of node devices each operating based on an operating system,
The plurality of node devices control external devices connected to the respective node devices;
A network system characterized in that an application program executed on any one of the plurality of node devices is also executed on one or more other node devices.   The network system according to claim 1, wherein an application program that is executed by any one of the plurality of node devices is multiplexed and executed by two or more other node devices.   2. The node device in which the same application program is executed, and the operating system of each node device provides a common execution environment for the same application program executed on the node device. Or the network system of 2.   The network system according to any one of claims 1 to 3, wherein an application program executed on any one of the plurality of node devices is configured to be transferred to another node device so as to be replicated.   Each of the node devices has one or more CPUs, one or more memories, a plurality of peripheral circuits having different functions, a memory interface connecting them, and a plurality of inputs / outputs to / from the outside. 5. The network system according to claim 1, further comprising a connection pin, wherein the LSI system is configured to select a function of the plurality of peripheral circuits and assign the function to the plurality of connection pins.   The network system according to claim 5, wherein the plurality of peripheral circuits include a plurality of Ethernet transmission / reception units.   The network system according to claim 6, wherein four or more Ethernet transmission / reception units are provided.   The network system according to claim 6 or 7, wherein Ethernet transmission / reception units in the plurality of node devices are connected to each other.