JP2017016319A - Multiplexed data processing device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a multiplexed data processing device with which it is possible to restore a semi-fault state to a normal state without stopping operation.SOLUTION: A multiplexed data processing device 1 comprises three processors 11. The three processors 11 repeat a series of data processes like a first process, a second process, etc., and an m'th process. Each of the three processors 11 collates the result of data processing of the own processor with the results of data processing of the other processors. A collation circuit 14 and a determination circuit 15 detect the abnormality of a processor 11 on the basis of the result of collation by the processors 11. The determination circuit 15 restarts the processor 11 that was detected to be abnormal. The processor 11 having stopped data processing due to the restart receives processing identification data for identifying a data process executed in the present frame from the other processors 11 continuing with data processing, and specifies which data process to execute when restarting data processes on the basis of the received processing identification data.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a technique for improving the reliability of a result of data processing by a processor.

  There are data processing devices that require high reliability in operation, such as a control device that performs vehicle speed control of a train. With regard to such a data processing device that requires high reliability, the operation reliability is improved by providing a plurality of processors that perform the same processing in parallel. In the present application, a data processing device that includes two processors that perform similar processing in parallel is called a “duplex data processing device”, and a data processing device that includes three or more processors that perform similar processing in parallel is “multiplexed” It is called “data processing device”.

  A duplex data processing apparatus having only two processors cannot identify which processing result of the two processors is normal when any of the processors performs abnormal data processing. Therefore, the duplex data processing device cannot provide a highly reliable processing result while any of the processors performs abnormal data processing.

  On the other hand, in a multiplexed data processing apparatus having three or more processors, even if one of the processors performs abnormal data processing, if the processing results of other processors match, the processing result is normal. It can be confirmed. Therefore, the multiplexed data processing apparatus can continue to provide highly reliable processing results as long as two or more processors perform normal data processing even if any one of the processors performs abnormal data processing. .

  As a document proposing a technique related to the multiplexed data processing apparatus, there is, for example, Patent Document 1. Patent Document 1 describes a triple multiplexing control device in which three control devices that perform similar operations in parallel are connected by a signal line. The multiplexing control device described in Patent Document 1 includes an inter-system diagnosis system that identifies an abnormal control device based on the majority theory based on the results of operations performed in parallel by three control devices. By changing the generation theory of the intersystem synchronization signal, the abnormal control device is disconnected from the intersystem diagnosis system. According to the invention described in Patent Document 1, the detected faulty system is surely disconnected, and a multiplexed control device having high safety is provided by restarting the disconnected system without stopping the control. It is supposed to be.

JP-A-6-348524

  For example, a triple data processing apparatus having three processors is highly reliable as long as one of the three processors performs abnormal data processing while the other two processors perform normal data processing. Providing processing results can be continued. However, if one of the two processors that were performing normal data processing performs abnormal data processing, the triple data processing device can no longer provide a highly reliable processing result. Therefore, it is desirable to normalize a processor that performs abnormal data processing as quickly as possible.

  As a process for normalizing a processor that performs abnormal data processing, the processor is widely restarted. In this case, a processor that has performed abnormal data processing cannot perform data processing at the same time it is instructed to restart, and can be processed again after a predetermined preparation process such as initialization is completed after the restart. It becomes. The processor that has become able to process data again receives a start-up signal from another processor, synchronizes with the other processor, and resumes data processing.

  Data processing performed by the multiplexed data processing apparatus is not always the same data processing. For example, the multiplexed data processing apparatus repeats a series of data processing including a plurality of different types of data processing such as first processing, second processing,..., M-th processing (where m is a natural number of 2 or more). There is. In this case, even if a processor that has stopped data processing due to abnormal data processing is in a state where data processing can be performed after restarting, the processor is in the first to m-th processing. Data processing cannot be resumed because there is no way of knowing which processing should be performed.

  Therefore, in a multiplexed data processing apparatus that performs a plurality of different types of data processing, when any one of the processors stops data processing, the processor leaves the data processing (hereinafter referred to as “semi-failure state”). Will continue.

  In order to return a multiplexed data processing device that has entered a semi-failure state to a normal state, for example, the multiplexed data processing device may be restarted, but if the multiplexed data processing device is restarted, the multiplexed data processing device is multiplexed. The multiplexed data processing apparatus cannot operate until a predetermined preparation process such as initialization of the data processing apparatus is completed.

  In view of the above-described circumstances, an object of the present invention is to provide a multiplexed data processing apparatus capable of recovering from a semi-failure state to a normal state without stopping operation.

  In order to solve the above-described problems, the present invention is a multiplexed data processing apparatus including a plurality of three or more processors that perform the same series of data processing, and is determined to be abnormal among the plurality of processors. Before stopping and restarting the series of data processing, the processor acquires identification information of data processing performed by the processor that continues the series of data processing among the plurality of processors, and stores the identification information in the identification information. In accordance with the first aspect of the present invention, there is provided a multiplexed data processing apparatus for specifying data processing to be performed when the series of data processing is resumed.

  According to the multiplexed data processing device according to the first aspect, the recovery from the semi-failed state to the normal state is performed without stopping the operation.

  In the multiplexed data processing device according to the first aspect, the processor that continues the series of data processing among the plurality of processors synchronizes data processing with other processors of the plurality of processors. A configuration in which the signal and the identification information of the data processing performed by the processor are output simultaneously or alternately may be adopted as the second mode.

  According to the multiplexed data processing device according to the second aspect, the processor that resumes data processing can know which data processing should be started at which timing.

  In the multiplexed data processing device according to the first or second aspect, each of the plurality of processors includes a result of data processing performed by the processor and a result of data processing performed by another processor of the plurality of processors. An abnormality detection circuit that outputs a result of collation and instructs a processor determined to be abnormal based on the collation result output from each of the plurality of processors to stop the series of data processing. The configuration of including the above may be adopted as the third aspect.

  According to the multiplexed data processing device according to the third aspect, even when a processor performing abnormal data processing cannot identify the abnormality by itself, the data processing of the processor is stopped.

  In the multiplexed data processing device according to the third aspect, the abnormality detection circuit relates to each combination of two processors among the plurality of processors, and is output from each of the two processors of the combination. For each of the plurality of processors, a collation circuit that collates a collation result, and determines that the processor is abnormal based on the collation result of the collation circuit that targets the collation result output from the processor A determination circuit including a determination circuit may be adopted as the fourth aspect.

  According to the multiplexed data processing device of the fourth aspect, whether or not a certain processor is normal is determined with high reliability based on the collation results of two or more processors different from the certain processor. Done.

  In the multiplexed data processing device according to any one of the first to fourth aspects, the processor determined to be abnormal among the plurality of processors determines whether the processor is normal after stopping the series of data processing. A configuration in which the series of data processing is resumed when it is diagnosed that it is normal may be adopted as the fifth aspect.

  According to the multiplexed data processing device of the fifth aspect, it is possible to avoid the inconvenience that a processor that constantly shows an abnormality restarts data processing.

The figure which showed the structure of the multiplexed data processing apparatus concerning one Embodiment. The timing chart which shows the timing which a start-up signal and intersystem information are transmitted between several processors concerning one Embodiment. The figure which showed the structure of the determination circuit concerning one Embodiment. The figure which showed the processing flow of the processor concerning one Embodiment. The figure which showed the processing flow of the processor concerning one Embodiment. The timing chart which shows the timing which a start-up signal and intersystem information are transmitted between several processors concerning one Embodiment. The figure which showed the structure of the multiplexed data processing apparatus concerning one modification.

[Embodiment]
A multiplexed data processing apparatus 1 according to an embodiment of the present invention will be described below. FIG. 1 is a diagram showing the configuration of the multiplexed data processing apparatus 1. In FIG. 1, a processing result utilization device 9 is also shown as a device that utilizes the result of data processing performed by the multiplexed data processing device 1. The multiplexed data processing device 1 outputs processing result data indicating the result of data processing to the processing result utilization device 9.

  The multiplexed data processing device 1 is a triple data processing device including three systems of A system, B system, and C system. The multiplexed data processing apparatus 1 includes an A-system processor 11A, a B-system processor 11B, and a C-system processor 11C. Hereinafter, these three processors are collectively referred to as “processor 11”.

  In this application, a processor refers to a device that performs data processing widely. That is, the processor in the present application is a general-purpose processor such as a CPU (Central Processing Unit), an MPU (Micro-Processing Unit), a DSP (Digital Signal Processor), or a GPU (Graphics Processing Unit), an ASIC (Application Specific Integrated Circuit), or the like. A dedicated processor to be constructed, a reconfigurable processor such as an FPGA (Field-Programmable Gate Array), and the like are included.

The A system processor 11A and the B system processor 11B are connected by the following four transmission paths.
Transmission path 12AB: A transmission path used for transmitting a startup signal from the A-system processor 11A to the B-system processor 11B.
Transmission path 12BA: A transmission path used for transmitting a startup signal from the B-system processor 11B to the A-system processor 11A.
Transmission path 13AB: A transmission path used for transmitting intersystem information from the A system processor 11A to the B system processor 11B.
Transmission path 13BA: A transmission path used for transmitting intersystem information from the B system processor 11B to the A system processor 11A.

  The start-up signal is a signal transmitted / received for synchronization of execution timing of data processing performed in each of the three processors 11. The intersystem information is information transmitted and received in order to match the contents of data processing performed in each of the three processors 11. In the present embodiment, the intersystem information includes process identification data for identifying the type of data process to be executed, and process result data indicating the result of the data process.

The B-system processor 11B and the C-system processor 11C are connected by the following four transmission paths.
Transmission path 12BC: A transmission path used for transmitting a startup signal from the B processor 11B to the C processor 11C.
Transmission path 12CB: A transmission path used for transmitting a startup signal from the C processor 11C to the B processor 11B.
Transmission path 13BC: A transmission path used for transmitting intersystem information from the B system processor 11B to the C system processor 11C.
Transmission path 13CB: A transmission path used for transmitting intersystem information from the C-system processor 11C to the B-system processor 11B.

The C processor 11C and the A processor 11A are connected by the following four transmission paths.
Transmission path 12CA: A transmission path used for transmitting a startup signal from the C-system processor 11C to the A-system processor 11A.
Transmission path 12AC: A transmission path used for transmitting a startup signal from the A-system processor 11A to the C-system processor 11C.
Transmission path 13CA: A transmission path used for transmitting intersystem information from the C processor 11C to the A processor 11A.
Transmission path 13AC: A transmission path used for transmitting intersystem information from the A system processor 11A to the C system processor 11C.

  FIG. 2 is a timing chart showing the timing at which the startup signal and the intersystem information are transmitted between the three processors 11. The multiplexed data processing apparatus 1 has a system clock (not shown in FIG. 1), and the three processors 11 synchronize processing according to a clock signal output from the system clock. In the present embodiment, after the multiplexed data processing device 1 is activated, the three processors 11 perform the first process, the second process,..., The m-th process, the first process, the second process,. A series of data processing including a plurality of types of data processing is repeated, such as m-th processing (where m is a natural number of 2 or more). Each of these processes is executed in a frame defined by a time length corresponding to a predetermined number of clocks. In each frame, the three processors 11 each have a startup signal for synchronization in the frame, process identification data for identifying data processing to be executed in the frame, and process result data indicating the result of the process executed in the frame Are sequentially transmitted to and received from other processors.

  According to the timing chart shown in FIG. 2, as long as they are operating normally, the three processors 11 perform the same data processing within the same frame and generate processing result data indicating the same processing result.

  Returning to FIG. 1, the description of the configuration of the multiplexed data processing apparatus 1 will be continued. The multiplexed data processing apparatus 1 includes three verification circuits, that is, a verification circuit 14AB, a verification circuit 14BC, and a verification circuit 14CA. Hereinafter, these three verification circuits are collectively referred to as “verification circuit 14”. The collation circuit 14 is a circuit for collating the collation result of the processing result data performed in each of the three processors 11.

  When each of the three processors 11 receives processing result data from each of the two other processors in each frame, each of the received processing result data is collated with the processing result data generated by the own processor. And a collation result flag indicating the collation result is output. Hereinafter, when the value of the collation result flag output by the processor 11 is “1”, the collation is successful, and when the value is “0”, the collation is not successful.

  The A-system processor 11A outputs a collation result flag indicating the collation result between the processing result data generated by the A-system processor 11A and the processing result data received from the B-system processor 11B to the collation circuit 14AB. Further, the A-system processor 11A outputs a collation result flag indicating a collation result between the processing result data generated by the A-system processor 11A and the processing result data received from the C-system processor 11C to the collation circuit 14CA.

  The B-system processor 11B outputs a collation result flag indicating a collation result between the processing result data generated by the B-system processor 11B and the processing result data received from the C-system processor 11C to the collation circuit 14BC. In addition, the B-system processor 11B outputs a collation result flag indicating a collation result between the processing result data generated by the B-system processor 11B and the processing result data received from the A-system processor 11A to the collation circuit 14AB.

  The C-system processor 11C outputs a collation result flag indicating a collation result between the processing result data generated by the C-system processor 11C and the processing result data received from the A-system processor 11A to the collation circuit 14CA. Further, the C-system processor 11C outputs a collation result flag indicating a collation result between the processing result data generated by the C-system processor 11C and the processing result data received from the B-system processor 11B to the collation circuit 14BC.

  The collation circuit 14AB is an AND circuit, and in each frame, the collation result flag output from each of the A-system processor 11A and the B-system processor 11B is used as an input value, and the logical product of these input values is output as a collation result flag. . When the same processing result data is generated by the A system processor 11A and the B system processor 11B, and the processing result data is correctly verified in both the A system processor 11A and the B system processor 11B, the verification circuit 14AB outputs The collation result flag to be performed is “1”, and in other cases, the collation result flag output from the collation circuit 14AB is “0”. Accordingly, when the collation result flag output from the collation circuit 14AB is “1”, both the A-system processor 11A and the B-system processor 11B are performing normal data processing.

  The collation circuit 14BC is an AND circuit, and in each frame, a collation result flag output from each of the B-system processor 11B and the C-system processor 11C is used as an input value, and a logical product of these input values is output as a collation result flag. . When the same processing result data is generated by the B-system processor 11B and the C-system processor 11C, and the processing result data is collated correctly in both the B-system processor 11B and the C-system processor 11C, the collation circuit 14BC outputs The collation result flag to be performed is “1”, and in other cases, the collation result flag output from the collation circuit 14BC is “0”. Therefore, when the collation result flag output from the collation circuit 14BC is “1”, both the B processor 11B and the C processor 11C are performing normal data processing.

  The collation circuit 14CA is an AND circuit, and receives a collation result flag output from each of the C-system processor 11C and the A-system processor 11A as an input value and outputs a logical product of these input values as a collation result flag in each frame. To do. When the same processing result data is generated by the C-system processor 11C and the A-system processor 11A and the verification processing of the processing result data is correctly performed in both the C-system processor 11C and the A-system processor 11A, the verification circuit 14CA outputs The collation result flag to be performed is “1”, and in other cases, the collation result flag output from the collation circuit 14CA is “0”. Therefore, when the collation result flag output from the collation circuit 14CA is “1”, both the C-system processor 11C and the A-system processor 11A are performing normal data processing.

  Even if the collation result flag output from the collation circuit 14 is “0”, it is not specified which processor 11 is performing abnormal data processing only with this one collation result flag. For example, when the collation result flag output from the collation circuit 14AB is “0”, it is not specified which of the A-system processor 11A and the B-system processor 11B is performing abnormal data processing.

  The multiplexed data processing apparatus 1 includes three determination circuits, that is, a determination circuit 15A, a determination circuit 15B, and a determination circuit 15C. Hereinafter, these three determination circuits are collectively referred to as “determination circuit 15”. The determination circuit 15 determines whether or not the data processing of each of the three processors 11 has been normally performed based on the verification result flag output from each of the three verification circuits 14 in each frame, and the abnormal data This is a circuit that instructs the processor 11 to restart and perform self-diagnosis processing according to the number of times processing has been performed.

  The verification circuit 14 and the determination circuit 15 constitute an abnormality detection circuit that instructs the processor 11 determined to be abnormal based on the verification result flag output from each of the three processors 11 to stop data processing.

  The determination circuit 15A determines whether or not the data processing of the A-system processor 11A has been normally performed, and instructs the A-system processor 11A to perform restart or self-diagnosis processing according to the determination result. The determination circuit 15B determines whether or not the data processing of the B-system processor 11B has been normally performed, and instructs the B-system processor 11B to perform restart or self-diagnosis processing according to the determination result. The determination circuit 15C determines whether or not the data processing of the C-system processor 11C has been normally performed, and instructs the C-system processor 11C to perform restart or self-diagnosis processing according to the determination result.

  The three determination circuits 15 have a common configuration. FIG. 3 is a diagram showing a configuration common to the three determination circuits 15. First, the determination circuit 15 includes an OR circuit 151 that receives a collation result flag output from each of the two collation circuits 14 as an input value and outputs a logical sum of the input values as a determination result flag.

  For example, the OR circuit 151 of the determination circuit 15A receives the collation result flag output from the collation circuit 14AB and the collation result flag output from the collation circuit 14CA as input values, and calculates the logical sum of these input values as the determination result flag. Output as. Therefore, if at least one of the verification result flag output from the verification circuit 14AB and the verification result flag output from the verification circuit 14CA is “1”, the determination result flag output from the OR circuit 151 of the determination circuit 15A is “ 1 ".

  If the collation result flag output from the collation circuit 14AB is “1”, as described above, both the A-system processor 11A and the B-system processor 11B are performing normal data processing. If the collation result flag output from the collation circuit 14CA is “1”, as described above, both the A-system processor 11A and the C-system processor 11C are performing normal data processing. Therefore, if the collation result flag output from the collation circuit 14CA is “1”, the A-system processor 11A is performing normal data processing.

On the other hand, if the collation result flag output from the collation circuit 14AB and the collation result flag output from the collation circuit 14CA are both “0”, the determination result flag output from the OR circuit 151 of the determination circuit 15A is “0”. " The case where both the verification result flag output from the verification circuit 14AB and the verification result flag output from the verification circuit 14CA are “0” is any of the following cases.
When the B-system processor 11B performs abnormal data processing.
The B system processor 11B performs normal data processing, but both the A system processor 11A and the C system processor 11C perform abnormal data processing.

  The possibility that two processors 11 simultaneously perform abnormal data processing is significantly lower than the possibility that one processor 11 performs abnormal data processing. Therefore, when all the collation result flags output from the collation circuit 14CA are “0”, that is, when the determination result flag output from the OR circuit 151 of the determination circuit 15A is “0”, the B-system processor 11B It may be considered that abnormal data processing has been performed.

  For the reasons described above, in this embodiment, when the determination result flag output from the OR circuit 151 is “0”, the processor 11 corresponding to the determination circuit 15 including the OR circuit 151 performs abnormal data processing. It is determined that it has been done.

Judging circuit 15, in addition to the OR circuit 151, an abnormality frequency counter 152 for counting the number of times the OR circuit 151 has output a flag "0" determination, the count result of the abnormality counter 152 reaches a predetermined threshold T _R Sometimes, the restart instruction circuit 153 that instructs the processor 11 to restart, the restart counter 154 that counts the number of times the restart instruction circuit 153 has been instructed to restart, and the count result of the restart counter 154 are predetermined. the processor 11 when it reaches the threshold value T _D comprises a diagnostic indication circuit 155 for instructing a self diagnosis process.

Restart instruction circuit 153, in each frame, no counter result of the restart counter 154 reaches a threshold value T _D, and if the counter results of the abnormality counter 152 has reached the threshold T _R, the processor 11 re At the same time, the counter result of the abnormal number counter 152 is reset to “0”.

Diagnostic indication circuit 155, in each frame, if the counter results of restart counter 154 reaches a threshold value T _D, together to perform self-diagnosis processing in the processor 11, the counter result of the abnormality counter 152 and restarts the counter 154 Reset to “0”.

  In the self-diagnosis process, the processor 11 performs test data processing according to a predetermined program (hereinafter referred to as “self-diagnostic program”), and collates the processing result of the test data processing with the correct processing result. This is a process of diagnosing whether or not the processor is normal. The processor 11 performs self-diagnosis processing according to an instruction from the corresponding determination circuit 15 and, when diagnosing that the own processor is normal, restarts the own processor according to the self-diagnosis program. The restarted processor 11 resumes the same processing as the data processing performed by the other processors according to the procedure described later. On the other hand, when the processor 11 diagnoses that the own processor is abnormal, the processor 11 stops the operation of the own processor until the multiplexed data processing apparatus 1 is restarted according to the self-diagnosis program.

  Returning to FIG. 1, the description of the configuration of the multiplexed data processing apparatus 1 will be continued. The multiplexed data processing device 1 selects one of the processing result data generated by each of the three processors 11 in each frame and outputs a selection circuit 16 that outputs the selected processing result data to the processing result utilization device 9. Prepare.

  The selection circuit 16 receives processing result data from each of the three processors 11. In FIG. 1, the transmission paths used for transmitting the processing result data from each of the three processors 11 to the selection circuit 16 are not shown so that the drawing is not complicated.

  Further, the selection circuit 16 receives the collation result flag output from each of the three collation circuits 14, and specifies the processor 11 that has performed normal data processing based on the received collation result flag. The selection circuit 16 preferentially selects a predetermined rule (for example, the A-system processor 11A, the B-system processor 11B, and the C-system processor 11C) from the processing result data received from the processor 11 that has performed normal data processing. , Etc.) is selected, and the selected processing result data is output to the processing result utilization apparatus 9. The above is the description of the configuration of the multiplexed data processing device 1.

  Subsequently, processing of the processor 11 will be described. FIG. 4 is a diagram showing a processing flow of the processor 11. When the user turns on the multiplexed data processing device 1 or performs a predetermined operation for restarting the multiplexed data processing device 1, each of the three processors 11 has a predetermined startup state. The raising process is performed (step S101). In step S101, each of the processors 11 initializes various data, establishes synchronization with other processors, and the like.

  Subsequently, each of the processors 11 performs a process associated with the first process (step S102-1), a process associated with the second process (step S102-2), a process associated with the third process (step S102-3),. The process associated with the m-th process (step S102-m) is repeatedly executed. Hereinafter, steps S102-1 to S102-m are collectively referred to as “step S102”. Note that step S102 is sequentially executed for each frame, for example, step S102-1 is performed on the first frame and step S102-2 is performed on the second frame.

  FIG. 5 is a diagram showing a flow of processing performed by the processor 11 in step S102-i (where i is an arbitrary natural number satisfying 1 ≦ i ≦ m), that is, processing performed by the processor 11 in accordance with the i-th processing. . The processor 11 first transmits / receives a startup signal to / from another processor (step S201). Subsequently, the processor 11 performs transmission / reception of process identification data for identifying the i-th process with another processor (step S202). Subsequently, the processor 11 performs the i-th process (step S203).

  Subsequently, the processor 11 transmits / receives the processing result data of the i-th process to / from another processor and transmits the processing result data to the selection circuit 16 (step S204). Subsequently, the processor 11 collates the processing result data generated by the processor with the processing result data received from another processor (step S205). Subsequently, the processor 11 outputs a collation result flag indicating the collation result in step S205 to the collation circuit 14 (step S206).

  The collation circuit 14 outputs a collation result flag indicating the logical product of the collation result flags output from the processor 11 to the determination circuit 15 and the selection circuit 16 in step S206. The determination circuit 15 determines whether or not the data processing performed by the processor 11 is normal based on the verification result flag input from the verification circuit 14, and restarts the processor 11 based on the number of times abnormal data processing is performed. The necessity of self-diagnosis processing is determined, and the processor 11 is restarted or self-diagnosis processing is performed as necessary. The selection circuit 16 identifies the processor 11 that has performed normal data processing based on the collation result flag input from the collation circuit 14, and the processing result selected according to a predetermined rule from the processing result data received from the identified processor 11 Data is output to the processing result utilization device 9. As a result, normal processing result data is provided from the multiplexed data processing device 1 to the processing result utilization device 9.

  Returning to FIG. 4, the description of the flow of processing performed by the processor 11 will be continued. When abnormal data processing is repeated, the processor 11 receives a restart or self-diagnosis processing instruction from the determination circuit 15. The processor 11 restarts when it receives a restart instruction or performs a self-diagnosis process upon receiving a self-diagnosis instruction and diagnoses that its own processor is normal. The restarted processor 11 performs a predetermined startup process (step S301). In step S301, the processor 11 performs initialization of various data.

  Subsequently, the processor 11 receives a startup signal from each of the two other processors (step S302). Subsequently, the processor 11 receives processing identification data from each of the two other processors (step S303). Subsequently, the processor 11 collates the two process identification data received in step S303 (step S304). When the collation in step S304 fails (step S304; No), the processor 11 stands by until the next frame, and repeats the processes in steps 302 to S304 in the next frame.

  When the collation in step S304 is successful (step S304; Yes), the processor 11 specifies which data processing should be performed when the data processing of the own processor is resumed based on the processing identification data received in step S303 (step S304). S305). Thereafter, the processor 11 starts the data processing specified in step S305 at the start timing of the next frame specified based on the startup signal received in step S302 (step S102).

  For example, when the process identification data received in step S303 indicates the j-th process (where j is an arbitrary natural number satisfying 1 ≦ j ≦ m−1), the processor 11 resumes the (j + 1) -th process in step S305. It is specified as a process to be executed at times. If the process identification data received in step S303 indicates the m-th process, the processor 11 specifies the first process as a process to be executed at the time of restart in step S305.

  Subsequently, the processor 11 transmits / receives the startup signal (step S201) at a timing one frame after the startup signal reception timing in step S302, and then performs steps S202 to S206 related to the data processing specified in step S305. Thereafter, the processor 11 repeats step S201 according to the frame. As a result, the multiplexed data processing apparatus 1 is restored from the semi-failed state to the normal state.

  In FIG. 6, when the C-system processor 11C stops data processing upon restart and the start-up processing is completed in the k-th frame, a startup signal and inter-system information are transmitted between the three processors 11. It is a timing chart which shows a timing. In this case, the C processor 11C receives the start-up signal from the A processor 11A and the B processor 11B in the (k + 1) th frame, and then receives the processing identification data from the A processor 11A and the B processor 11B. Thereafter, the C-system processor 11C specifies the data processing next to the data processing indicated by the received processing identification data as the data processing to be executed at the time of restart. Then, the C-system processor 11C resumes normal processing in the (k + 2) th frame.

  As described above, according to the multiplexed data processing device 1, even if any one of the three processors 11 performs abnormal data processing, as long as the other two processors 11 perform normal data processing, Providing highly reliable processing result data to the result use device 9 is continued. Then, the processor 11 that has performed abnormal data processing restarts or performs self-diagnosis processing as necessary. Along with the restart or self-diagnosis processing, the processor 11 that has performed abnormal data processing temporarily stops the data processing, but then restarts the data processing. When the processor 11 that has stopped the data processing resumes the data processing, the other processors 11 do not need to stop the data processing. Therefore, the multiplexed data processing device 1 can recover from the semi-failed state to the normal state without stopping the provision of the processing result data to the processing result utilization device 9.

[Modification]
The embodiment described above can be variously modified. Examples of these modifications are shown below. Note that the above-described embodiment and the modifications shown below may be combined as appropriate.

(1) In the above-described embodiment, the multiplexed data processing device 1 is a triple data processing device including three processors 11. The number of processors 11 included in the multiplexed data processing device 1 is not limited to three, and may be four or more.

  For example, the multiplexed data processing device 1 may be configured as a quadruple data processing device including a D-system processor 11D in addition to the A-system processor 11A, the B-system processor 11B, and the C-system processor 11C. In this case, the multiplexed data processing apparatus 1 includes six collation circuits 14 (collation circuit 14AB, collation circuit 14BC, collation circuit 14CD, collation circuit 14DA, collation circuit 14CA, and collation circuit 14BC). 4 determination circuits 15 (determination circuit 15A, determination circuit 15B, determination circuit 15C and determination circuit 15D).

  For example, regarding the A-system processor 11A, if any of the three verification circuits 14 (the verification circuit 14AB, the verification circuit 14CA, and the verification circuit 14DA) outputs the verification result flag “1”, normal data processing is performed. That is confirmed. The same applies to the other processors 11.

(2) In the above-described embodiment, the roles of the plurality of processors 11 included in the multiplexed data processing device 1 are equivalent, and the relationship between the plurality of processors 11 is also equivalent. Instead, a configuration in which the multiplexed data processing apparatus includes the processor 11 having a master-slave relationship or the grouped processors 11 may be employed.

  FIG. 7 is a diagram showing a configuration of the multiplexed data processing device 2 according to an example of this modification. The multiplexed data processing device 2 includes four processors: an A-system master processor 11Am, an A-system slave processor 11As, a B-system master processor 11Bm, and a B-system slave processor 11Bs. The A-system master processor 11Am and the A-system slave processor 11As constitute one duplex data processing device (hereinafter referred to as “A-system duplex data processing device”), and the B-system master processor 11Bm and the B-system slave processor 11Bs are the other. A duplex data processing apparatus (hereinafter referred to as “B-system duplex data processing apparatus”) is configured.

  The multiplexed data processing device 2 includes a collation circuit 14A and a determination circuit 15A for the A-system duplex data processing device, and a collation circuit 14B and a determination circuit 15B for the B-system duplex data processing device.

  In the A-system duplex data processing apparatus, the A-system master processor 11Am and the A-system slave processor 11As are connected by a transmission path for transmitting / receiving a startup signal and a transmission path for transmitting / receiving information between systems. In each frame, the A-system master processor 11Am outputs a collation result flag indicating the result of collating the processing result data generated by the processor and the processing result data received from the A-system slave processor 11As to the collation circuit 14A. Similarly, in each frame, the A-system slave processor 11As outputs a collation result flag indicating the result of collating the processing result data generated by the processor with the processing result data received from the A-system master processor 11Am to the collation circuit 14A. . The verification circuit 14A outputs the logical product of the verification result flags input from the two processors to the determination circuit 15A as a verification result flag.

  If the collation result flag output from the collation circuit 14A is “1”, the determination circuit 15A determines that the A-system master processor 11Am and the A-system slave processor 11As have performed normal data processing. On the other hand, if the verification result flag output from the verification circuit 14A is “0”, the determination circuit 15A determines that either the A-system master processor 11Am or the A-system slave processor 11As has performed abnormal data processing, and the number of abnormal times Count. The determination circuit 15A instructs a restart or self-diagnosis process for the A-system master processor 11Am and the A-system slave processor 11As based on the counted number of abnormalities.

  The operations of the verification circuit 14B and the determination circuit 15B according to the B-system duplex data processing device are the same as the operations of the verification circuit 14A and the determination circuit 15B according to the A-system duplex data processing device.

  The A-system master processor 11Am and the B-system master processor 11Bm include a transmission path for transmitting and receiving a start-up signal for synchronizing the data processing between the A-system duplex data processing device and the B-system duplex data processing device, and the A-system duplex data. The processing device and the B-system duplex data processing device are connected by a transmission path for transmitting / receiving intersystem information. The flow of processing performed by each of the A-system duplex data processing device and the B-system duplex data processing device is the same as the processing flow performed by each of the processors 11 shown in FIG.

  In each frame, the matching circuit 14A and the matching circuit 14B each output a matching result flag to the selection circuit 16. The selection circuit 16 identifies a duplex data processing device that has performed normal data processing based on the collation result flag input from the collation circuit 14A and the collation circuit 14B, and includes the processing result data generated by the identified duplex data processing device. The processing result data selected according to a predetermined rule is output to the processing result utilization device 9.

  Similarly to the multiplexed data processing device 1, the multiplexed data processing device 2 described above can recover from a semi-failed state to a normal state without interrupting the provision of processing result data to the processing result utilization device 9.

(3) In the above embodiment, the processor 11 it is determined that the abnormality, restart the count it is determined that the abnormality reaches the threshold T _R, the number of restarts reaches the threshold T _D self-diagnostic process Do. The content of the processing performed by the processor 11 when it is determined as abnormal is not limited to the content exemplified in the embodiment. For example, the processor 11 determined to be abnormal may perform only restart or only self-diagnosis processing. Further, a configuration may be employed in which the processor 11 determined to be abnormal performs processing that is neither restart nor self-diagnosis processing, such as initialization of various data without restart. Further, the conditions that serve as a trigger for the processor 11 determined to be abnormal to perform operations such as restart and self-diagnosis processing are not limited to the conditions exemplified in the above-described embodiment. For example, when the number of abnormal data processing has been performed reaches a threshold T _D performs self-diagnosis processing by the processor 11 without rebooting, when diagnosed as abnormal self-diagnosis processing is configured to perform a restart May be.

(4) In the above-described embodiment, when the processor 11 receives a restart instruction from the determination circuit 15, the processor 11 restarts the processor according to the instruction. Instead of this, a configuration in which the determination circuit 15 forcibly restarts the processor 11 by temporarily stopping the power supply to the processor 11 and then restarting the processor 11 may be employed. In this case, even if the processor 11 cannot restart its own processor, the processor 11 is surely restarted.

(5) In the embodiment described above, the processor 11 that has performed abnormal data processing performs processing such as restart in accordance with an instruction from the determination circuit 15. Instead, a configuration may be employed in which the processor 11 determines whether or not the data processing by the own processor has been normally performed, and restarts the own processor based on the result of the determination.

(6) In the above-described embodiment, each of the first process, the second process,..., The m-th process is performed in a frame having the same time length defined by a predetermined number of clocks. The time length of the frame is not limited to a fixed length, and may be a variable length.

(7) In the above-described embodiment, the processor 11 repeats a series of data processing such as first processing, second processing,..., M-th processing. Data processing performed by the processor 11 need not repeat a series of similar data processing. For example, a configuration in which the processor 11 determines subsequent data processing according to processing result data generated in the preceding data processing according to a certain program may be employed. In this case, after stopping the data processing, the processor 11 that resumes the data processing receives the next frame from the processor 11 that continues the data processing in addition to the processing identification data that identifies the data processing performed in the current frame. The processing result data of the preceding data processing required for the determination of the data processing performed in is received as intersystem information. The processor 11 that resumes data processing determines data processing to be executed at the time of resumption based on these data received from the other processors 11.

(8) In the embodiment described above, the output timing of the process identification data in each frame is later than the output timing of the startup signal. Accordingly, the start-up signal and the process identification data are output alternately. The relationship between the process identification data and the start-up signal output timing in each frame is not limited to this. For example, the start-up signal and the process identification data may be output at the same timing.

(9) In the above-described embodiment, the process identification data is transmitted / received through a transmission path used for transmission / reception of process result data as part of intersystem information. Alternatively, the process identification data may be transmitted / received via a transmission path used for transmission / reception of the startup signal. Furthermore, process identification data may be transmitted and received as a startup signal.

(10) In the above-described embodiment, different transmission paths are used for transmission / reception of startup signals and transmission / reception of intersystem information. Instead, the same transmission path may be used for transmission / reception of startup signals and transmission / reception of intersystem information.

(11) The processor 11 that continues data processing may continue to transmit a startup signal and intersystem information to the processor 11 that has stopped data processing, or it stops transmission of the startup signal and intersystem information. May be. When the processor 11 that continues data processing stops transmission of a startup signal and intersystem information to the processor 11 that stops data processing, the processor 11 that has stopped data processing can resume data processing. At this point, a configuration may be adopted in which the other processor 11 is requested to resume transmission of a startup signal and intersystem information.

DESCRIPTION OF SYMBOLS 1 ... Multiplexed data processing apparatus, 2 ... Multiplexed data processing apparatus, 9 ... Processing result utilization apparatus, 11 ... Processor, 14 ... Collation circuit, 15 ... Determination circuit, 16 ... Selection circuit, 151 ... OR circuit, 152 ... Abnormality Number counter, 153... Restart instruction circuit, 154... Restart counter, 155.

Claims (5)

A multiplexed data processing apparatus comprising a plurality of three or more processors that perform the same series of data processing,
Data processing performed by a processor that continues the series of data processing among the plurality of processors before the processor judged to be abnormal among the plurality of processors stops and restarts the series of data processing. A multiplexed data processing device that acquires the identification information and identifies data processing to be performed when the series of data processing is resumed based on the identification information. The processor that continues the series of data processing among the plurality of processors, and a signal for synchronizing the data processing with the other processors of the plurality of processors and the data processing performed by the own processor. The multiplexed data processing apparatus according to claim 1, wherein the identification information is output simultaneously or alternately. Each of the plurality of processors outputs a result of collation between a result of data processing performed by its own processor and a result of data processing performed by another processor of the plurality of processors,
The abnormality detection circuit which instruct | indicates the stop of a series of said data processing to the processor determined to be abnormal based on the result of the said collation output from each of these processors among these processors. 2. A multiplexed data processing device according to 1. The abnormality detection circuit is
A collation circuit for collating the result of the collation output from each of the two processors of the combination for each of the combinations of two processors of the plurality of processors;
A determination circuit that determines, for each of the plurality of processors, the processor as abnormal based on the result of the collation of the collation circuit that uses the collation result output from the processor as a target of collation. The multiplexed data processing apparatus as described. The processor determined to be abnormal among the plurality of processors diagnoses whether or not the processor itself is normal after stopping the series of data processing, and performs the series of data processing when the processor is diagnosed as normal. The multiplexed data processing device according to claim 1, wherein the multiplexed data processing device is restarted.

Images