JP2626545B2 - Fault-tolerant computer system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to first, second,.
It is composed of an n-th (n ≧ 2) processor, and the i-th (i =
When the (1 to n-1) processor fails, the (i + 1) processor continues the function of the i-th processor, and when the n-th processor fails, the first processor continues the function of the n-th processor. It relates to a fault-tolerant computer system.

[0002]

2. Description of the Related Art Conventionally, this kind of fault-tolerant computer system has been known as "Fault Tolerant System" published by McGraw-Hill Book Co., Ltd. in October 1986.
(J. Gray et al., Translated by Eiichi Watanabe). This fault-tolerant computer system according to the prior art is constituted by a plurality of processors, each of which has a different function, and when a software program or hardware failure occurs on one processor, the other processor can replace the failed processor. It is used to keep the function and not stop the system. As a method of upgrading the execution program of each processor, a method of downloading the execution program to each processor from a download terminal is generally used.

FIG. 3 is a block diagram showing an example of a conventional fault-tolerant computer system including three processors. The processor 2A protects the processor 1A, the processor 3A protects the processor 2A, and the processor 1A protects the processor 3A. The memory 11A in the processor 1A stores a download program, a preliminary program, and an execution program. The processor failure detection circuit 12 receives a signal from the processor 3A to be protected, and outputs a signal to the CPU 13A when detecting a failure in the processor 3A.
The download interface unit 14 receives the download program from the download terminal 4, and stores the download program in the download area of the memory 11A. Further, the download interface unit 14 outputs a signal indicating the completion of the download to the CPU 13A.
The CPU 13A copies the program in the download area of the memory 11A to the execution program area, and thereafter executes the contents as an execution program. The CPU 13
A is for executing the execution program in the CPU bus interface unit 1
5, copying via the processor bus 5 and the CPU interface unit 25 to the spare program area of the memory 21A of the processor 2A. Further, the CPU 13A periodically outputs a signal to the processor failure detection circuit 22 of the processor 2A. Similarly, the processor 2A includes a processor 21A, a processor failure detection circuit 22, a CPU 23A, a download interface unit 24, and a CPU bus interface unit 25.
1A, a processor failure detection circuit 32, a CPU 33A, a download interface unit 34, and a CPU bus interface unit 35.

FIG. 4 shows a program C for the processor 3A.
5 is a sequence chart showing an operation of downloading the processor 3A and an operation of the processor 1A protecting the processor 3A when a failure occurs in the processor 3A.

First, an operation of downloading the program C for the processor 3A will be described. Download terminal 4
Downloads the program C for the processor 3A to the processor 3A (step 13). The download interface unit 34 of the processor 3A stores the received program C in the download area of the memory 31A and outputs it to the signal CPU 33A indicating that the download has been completed (step 14). The CPU 33A has a memory 31
The program C in the download area of A is stored in the memory 31
A to the execution program area (Step 1)
5). Next, the CPU 33A copies the program C in the execution program area of the memory 31A to the spare program area of the memory 11A of the processor 1A via the CPU bus interface unit 35, the processor bus 5, and the CPU bus interface unit 15 (step 16,1
7). Thereafter, the CPU 33A executes the program C in the execution program area of the memory 31A (step 1).
8). The programs A and B for the processor 1A and the processor 2A are also downloaded by the same procedure as described above.

Next, the operation of the processor 1A for protecting the processor 3A when the processor 3A fails will be described. Here, the processor 1A downloads the program A for the processor 1A according to the same procedure as described above,
It is assumed that the CPU 13A is executing the program A in the execution program area of the memory 11A. When there is no failure in the processor 3A, the CPU 33A
A signal is periodically transmitted to the processor failure detection circuit 12 of FIG. When a failure occurs in the processor 3A (step 19), the CPU 13A sends a signal to the processor 1A.
Is stopped (step 20). The processor failure detection circuit 12 detects a failure of the processor 3A due to the interruption of the signal, and outputs a signal to the CPU 13A.
The processor failure detection circuit 12 can employ various configurations using general electronic circuit elements. For example, in March 1991, published by Maki Shoten, “Design and Construction of a Fault-Tolerant System” (written by Yoshihiro Toma et al.), No. 15.
This is a “watchdog timer” described on page 9. In this case, the processor failure detection circuit 12 sets the timer periodically, and before the timer expires, the CPU 3
If a signal from 3A to the processor fault detection circuit 12 does not reset the timer, it is determined that a fault has occurred in the processor 3A. When the CPU 13A recognizes the occurrence of the failure in the processor 3A from the signal, the CPU 13A executes the program C stored in the spare program area in the memory 11A in parallel with the contents of the program A, and continues the function of the processor 3A (step 21). By the same procedure as described above, the processor 2A protects the processor 1A and the processor 3A
A protects processor 2A.

[0007]

The conventional fault-tolerant computer system described above stores a spare program for continuing the function of the failed processor in a spare program area of a memory when a failure occurs in the processor to be protected, Since the download program received from the download terminal was stored in the download area of the memory to upgrade the version of the program, three areas of the execution program area, the download area, and the spare program area were required as the program storage areas of the memory. There is a disadvantage that the size is large and the cost is high.

An object of the present invention is to provide a small memory size,
Accordingly, it is an object of the present invention to provide a fault-tolerant computer system which is inexpensive.

[0009]

The fault-tolerant computer system of the present invention comprises: an i-th (i = 1 to n) processor;
From the download terminal, the (i-1) th (where i = 1
In the case of (i), the download interface means for receiving the program for the (n) th processor, the memory including the download area and the execution program area, and the (i-1) th (if i = 1, the nth) A processor failure detecting unit for detecting a processor failure, a processor bus interface unit connected to a processor bus connecting all the processors to transmit and receive data between the processors, and a program received by the download interface unit from the download terminal Is stored in the download area, and when the storage of the program is completed,
The (i-1) th processor (if i = 1, the nth processor) is notified of this fact, and the notification is sent to the (i + 1) th processor (if i = n, the first processor). From the (i + 1) th (where i = n, the first)
A program stored in the download area of the processor is copied to an execution program area of the memory, and thereafter, the program is executed, and the (i-1) -th (where i = 1, n-th) processor is executed. When the above-mentioned fault is detected by the processor fault detecting means, the program of the (i-1) -th (if i = 1, n-th) processor stored in the download area of the memory is also executed. Including a CPU.

[0010]

According to the present invention, the memory of each processor includes a download area and an execution program area.

After the execution program of each processor is stored in the download area of the processor that protects the processor, the execution program is copied to the execution program area of the processor and executed by the processor. When a failure occurs in a certain processor, since the execution program of the processor is already stored in the download area of the processor that protects the processor, the execution program is also executed, and the function of the failed processor is continued.

[0012]

Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram of a fault-tolerant computer system according to an embodiment of the present invention.

This embodiment is a fault-tolerant computer system composed of three processors. The conventional fault-tolerant computer system shown in FIG. 3 differs from the conventional fault-tolerant computer system in memories 11A, 21A, and 31A.
Configuration of CPU 13A, CPU 23A, CPU 33
The control of A is different. That is, the memories 11A and 2A
Each of 1A and 31A comprises a download area and an execution program area in which a download program and an execution program are stored, respectively.

FIG. 2 shows an operation in which the processor 1 stores and executes an execution program in the memory 11A, an operation in which a program for the processor 3 is downloaded,
5 is a sequence chart showing an operation in which the processor 1 protects the processor 3 when a failure occurs.

First, the operation of the processor 1 for storing and executing the execution program A in the memory 11 will be described. When the execution program A for the processor 1 is downloaded to the processor 2 by the same procedure as the download of the execution program C for the processor 3 described later, the processor 2 notifies the processor 1 of the completion of the download. When the processor 1 knows that the download has been completed (step 1), it executes the program A according to the same procedure as the processor 3 which copies the program from the processor 1 described later.
Is copied from the download area of the memory 21 of the processor 2 to the execution program area of the memory 11, and thereafter the program A is executed (steps 2 and 3). According to the same procedure as above, the processors 2 and 3 also store the execution programs B and C in the memories 21 and 31 and execute them.

Next, the operation of downloading the program C for the processor 3 will be described. The download terminal 4 downloads the program C for the processor 3 to the processor 1 (Step 4). The download interface unit 14 in the processor 1 stores the received program C in the download area of the memory 11, and outputs a signal indicating that the download has been completed to the CPU 13 (step 5). The CPU 13 is a CPU interface unit 1
5. The completion of the download is notified to the CPU 33 in the processor 3 via the processor bus 5 and the CPU interface unit 35 (step 6). When the CPU 33 knows the completion of the download (step 7), the CPU 33 copies the program e in the download area of the memory 11 to the execution program area of the memory 31 via the CPU bus interface unit 35, the processor bus 5, and the CPU bus interface unit 15. Thereafter, the contents of the program C are executed (steps 8 and 9). The programs A and B for the processor 1 and the processor 2 are also downloaded by the same procedure as described above.

Next, an operation in which the processor 1 protects the processor 3 when the processor 3 fails will be described. If there is no failure in the processor 3, the CPU 33
A signal is periodically transmitted to the processor failure detection circuit 12 of FIG. When a failure occurs in the processor 3 (step 10), the signal transmission from the CPU 33 to the processor 1 is stopped (step 11). The processor failure detection circuit 12 detects a failure of the processor 3 due to the interruption of the signal, and outputs a signal to the CPU 13. The processor failure detection circuit 12 can employ various configurations using general electronic circuit elements. For example, 199
This is a "watchdog timer" described on page 159 of "Design and Construction of Fault-Tolerant System" published by Maki Shoten in March 2001 (Yoshihiro Toma et al.). In this case, the processor failure detection circuit 12 sets the timer periodically, and if the signal from the CPU 33 to the processor failure detection circuit 12 does not reset the timer before the timer expires, the processor 3 fails. Judge that it has occurred. CP
When U13 recognizes the occurrence of the failure of the processor 3 from the signal, the U13 executes the program C stored in the download area in the memory 11 in parallel with the contents of the program A, and continues the function of the processor 3 (step 12). By the same procedure as described above, the processor 2 protects the processor 1 and the processor 3 protects the processor 2.

Although the present embodiment is an example in which the present invention is applied to a fault-tolerant computer system using three processors, the present invention can be similarly applied to a fault-tolerant computer system using two or more processors. It is.

[0020]

As described above, according to the present invention, the execution program of each processor is stored in the download area of the processor that protects the processor, and then copied to the execution program area of the processor. Since the same function as before can be realized with only two areas, the area and the download program area,
The memory size required for the processor can be reduced, and the cost of the processor can be reduced.

[Brief description of the drawings]

FIG. 1 is a block diagram of a fault-tolerant computer system according to an embodiment of the present invention.

FIG. 2 illustrates the fault-tolerant computer system of FIG.
5 is a sequence chart showing an operation in which the processor 1 stores and executes an execution program A in the memory 11, an operation to download an execution program C for the processor 3, and an operation in which the processor 1 protects the processor 3 when the processor 3 fails. .

FIG. 3 is a block diagram of a conventional example of a fault-tolerant computer system.

FIG. 4 illustrates the fault-tolerant computer system of FIG.
5 is a sequence chart showing an operation of downloading a program C for the processor 3 and an operation of the processor 1 protecting the processor 3 when the processor 3 fails.

[Explanation of symbols]

 1, 2, 3 processor 4 download terminal 5 processor bus 11, 21, 31 memory 12, 22, 32 processor failure detection circuit 13, 23, 33 CPU 14, 24, 34 download interface unit 15, 25, 35 CPU bus interface unit

Claims (2)

(57) [Claims] A first (i = 1)-(n-1) -th processor when a failure occurs in an i-th (i = 1 to n-1) processor. A fault-tolerant computer system in which the processor continues the function of the i-th processor and the first processor continues the function of the n-th processor when the n-th processor fails, the i-th (i = 1 to n) A download interface means for receiving a program for the (i-1) -th (where i = 1, n-th) processor from the download terminal; a memory including a download area and an execution program area; (I-1) th (where i = 1
In this case, the processor fault detecting means for detecting the fault of the n-th processor, a processor bus interface means connected to a processor bus connecting all the processors to transmit and receive data between the processors, and the download interface means The program received from the download terminal is stored in the download area, and when the storage of the program is completed, the (i-1) -th (if i = 1, n-th) processor is notified to that effect. , When the notification is received from the (i + 1) -th (where i = n, first) processor,
The program stored in the download area of the processor (1) (if i = n, the first) is copied to the execution program area of the memory. (Where i = 1, if i = 1, a failure of the n-th processor) is detected by the processor failure detection means, and the (i-1) -th (where, i-th) is stored in the download area of the memory. If i = 1, the CP that also executes the program of the n-th processor
Fault tolerant computer system including U. 2. The CP of an i-th (i = 1 to n) processor
U sends out a signal to the processor fault detecting means of the (i + 1) -th processor (if i = n, first) when there is no fault in the processor, and the processor fault detecting means 2. The fault-tolerant computer system according to claim 1, wherein a fault of the i-th (where i = n, first) processor is detected by the interruption of the signal.