JP2985188B2 - Redundant computer system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION <Industrial Application Field> The present invention relates to a system in which a computer is duplicated, in which switching control is given to which side of the duplicated computer the control right is given (whether to be the main system). More specifically, the present invention relates to a redundant computer system in which a control function is provided in each computer, and more particularly, to a redundant computer system in which a program can be loaded by communication without affecting a switching operation of a control right for the redundant computer. It relates to a computer system.

<Prior Art> FIG. 4 is a conceptual diagram illustrating an example of a conventional redundant computer system. In the figure, FC1 and FC2 are duplicated computers, and DXC monitors signals and data from these duplicated computers FC1 and FC2, and makes one of FC1 and FC2 the main system and puts the other in operation. It is configured to be in a standby state as a slave system. CPL is a coupler that connects the computers FC1 and FC2 to the bus BS, respectively.

In each of the computers FC1 and FC2, FC11 is a communication unit and CP1
Reference numeral 1 denotes a CPU unit including a CPU that performs a control operation.

The redundant control unit DXC switches the redundant control mainly with reference to the signal CPUREDY indicating the result of the self-diagnosis from both the computers FC1 and FC2. The computer having the control right executes communication with the host computer via the communication unit FC11, and outputs control operation results to various I / Os. The computer on the standby side does not perform any control operation or communication operation, but performs operations such as self-diagnosis and equalization of the database, and performs a standby operation for smoothly switching the control right. ing.

<Problems to be Solved by the Invention> In a redundant computer system configured as described above, when a program is loaded from an upper-level computer to a CPU unit via a communication unit, for example, it is necessary to temporarily stop the operation of the CPU. This is because there is a risk of runaway if the program is rewritten while the CPU is running.

Therefore, in this case, the CPU is stopped by communication, but since the stopped state of the CPU becomes a not-ready state, a signal CPUR indicating a self-diagnosis result from the computer is issued.
EDY becomes a signal indicating a CPU error. In response to this, a problem occurs that the redundant control unit DXC switches the control right even though it is not necessary.

In the conventional device, in order to prevent such a problem from occurring, when the CPU is stopped prior to the loading of the program, the control right is not switched even when the redundant control unit receives the not-ready signal. It was configured to perform complicated control.

SUMMARY OF THE INVENTION An object of the present invention is to provide a redundant computer system capable of preventing a control right from being switched even when a CPU is stopped by communication in a system without a dedicated redundant control unit, and enabling a simple configuration to load a program from communication. It is to realize.

<Means for Solving the Problems> To achieve the above object, the present invention provides a dual computer system in which computers having a self-diagnosis function are duplicated. A CPU that outputs a signal (CPURDY0) indicating that the operation can be performed normally, a signal (CPURDY0) that indicates that the operation from the CPU can be performed normally, and that the operation from the partner CPU can be performed normally Input signal (CPURDY1), a signal (DCS0) indicating that the own device has the control right, and a signal (DCS1) indicating that the other device has the control right. Redundant control unit that determines the control right, communicates with the host, and when receiving a “stop” command from the host, outputs a signal (STOP0) to the other CPU to stop its operation, and then outputs the signal to the local CPU. To Outputs a signal (CSTOP) to stop the operation, and when the entire system is stopped and a “Restart” command is received from the host, the own CPU unit that has control authority is higher than the other CPU unit. And a communication unit that outputs a signal (CRESTART) for restarting first.

<Example> Hereinafter, an example of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a configuration block diagram showing one embodiment of the present invention. In the figure, FC1 and FC2 are duplicated first and second computers, and both have almost the same internal configuration.

In the first and second control calculation units FC1 and FC2, C and C perform calculations and control, and output a signal (CPURDY0) indicating that the operation is normally performed by self-diagnosis.
PU units 12, 22 are communication units for communicating with the host via the data bus BS. This communication unit is "stop" from the top
When a command is received, a signal (STOP0) to stop the operation is output to the other CPU unit. To restart (CREST
ART) is output.

Reference numerals 13 and 23 denote redundant control units having a redundant control function for outputting signals (DCS0 and DCS1) for giving control to one of the computers. The redundant control unit receives a signal (CPURDY0) indicating that the operation from the CPU unit can be normally performed and a signal (CPURDY) indicating that the operation from the partner CPU unit can be normally performed.
RDY1) and a signal (DCS
0) and a signal indicating that the other party has control (DCS1)
And determines the control right by taking the logic of each of these signals.

FIG. 2 is a block diagram showing the configuration of the communication units 12, 22 and the duplex control units 13, 23 in each computer.

The communication units 12 and 22 receive a "stop" command from the host, and cause the other CPU unit to stop the operation (STOP0).
Is output, and after the other CPU unit stops,
A stop signal output means C1 for outputting a stop signal (CSTOP) to the PU, and a signal (CRESTART) for receiving a "restart" command from the host system and restarting its own CPU unit first when the entire system is stopped. ) To output the restart signal output means C2.

A signal (COMRDY) indicating that the operation is normally performed is applied to one input terminal from the communication unit 12 (22) from the communication unit 12 (22). T1) is applied to the gate G11 (G21), and a signal from the gate G11 (G21) and a signal (DCS0) indicating that the own side has the control right (DCS0) are applied via the inverter IN11 (IN21) to the gate G12. (G22), a signal from the gate G12 (G22), and a signal (CPURDY1) indicating that the operation can be performed normally from the CPU unit of the partner computer are output from the inverter IN2.
2 (IN12) and the gate G13 (G23) applied via the inverter IN13 (IN23) and the signal from the gate G13 (G23).
A gate G14 to which a signal (CPURDY0) indicating that the operation is normally performed is applied from the CPU unit 11 (21).
(G24), a gate for inputting a signal from the gate G14 (G24) and a signal (DCS1) indicating that the other party has control right
G10 (G20).

Here, the gates G10 and G20 in the two computers FC1 and FC2 use their outputs (DCS1) as inputs to the other gates, respectively.
These two gates constitute a flip-flop circuit.

For this reason, when both computers are ready, which side gives control right when the computer starts up has priority on a first-come, first-served basis. Thus, the configuration is such that the control right is not simultaneously given to both of the two computers.

The duplex control unit 13 (23) having such a configuration relinquishes the condition for acquiring the control right and the control right depending on the signals applied thereto depending on whether or not the control right is obtained. The condition is configured so as to be expressed by the expressions (1) and (2).

Switching from no control right to control right (condition for setting DCS0) CPURDY0 * ▲ ▼ + ▲ ▼ * COMRD
Y * T1 * ▲ ▼ …… (1) Condition for switching from control right to no control right (condition to stop DCS0) DCS1 + ▲ ▼ * CPURDY1 …… (2) The operation of the device configured in this way is controlled by the control right. The operation of raising the signal DCS0 indicating that there is a signal and the operation of releasing the signal DCS0 will be described below.

<Operation for Setting DCS0 DCS0 = 0 → 1> The logic for setting DCS is expressed by the above equation (1).

In the equation (1), the first term is a normal condition. In the case where the partner computer has not acquired the control right (DCS1 = 0) and its own computer is ready (CPURDY0 = 1),
Set 0.

The second term is that even if the CPU units 11 and 21 of the two computers are both not-ready, one of them acquires the control right and the communication unit 12
Alternatively, 22 is for enabling communication operation.

At the time of energization, for example, when the contents of the memory are volatilized, the ready state is not established unless the program is loaded into the memory by communication from the host computer. Therefore, after energization, a certain period of time
Both the CPU units 11 and 21 are not ready, and neither computer can acquire the control right only under the condition of the first term of the equation (1), and the communication unit cannot perform the communication operation, so that the program cannot be loaded.

After a certain period of time has elapsed after energization, the timer 13 (23) times out and the T1 signal becomes "1". as a result,
For example, if the communication unit 12 or 22 is ready, the other party has no control right and the other party's CPU
Control can be obtained on condition that the department is not ready.

The communication unit of the computer that has obtained the control right can perform a communication operation from that point on, and the program can be loaded by communication from the host computer.

The CPU section loaded with the program enters a ready state (CPURDY0 = 1) and enters a normal operation state.

<Operation for dropping DCS0 DCS0 = 1 → 0> The logic for dropping the signal DCS0 indicating that there is control right is as follows:
It is shown by equation (2).

This formula indicates that the computer that has control has
Only when the unit is not ready and the CPU unit of the partner computer becomes ready, the control right is released.

Normally, it is not possible, but if the other computer acquires control for some reason while owning control, it relinquishes control according to the first term of the equation. I do. With such a logic, control rights are not simultaneously given to two computers.

The reason why the logic of dropping DCS0 does not include the condition of the communication units 12 and 23 here is as follows.

That is, depending on the operation state such as the initialization processing at the time of the startup of the CPU unit, an initialization command may be issued to the communication unit to temporarily set the communication unit to the not-ready state when the CPURDY0 is not set. This is because the control right is not transferred even in this state.

After the normal operation of the CPU unit is started, the communication unit can be diagnosed by the CPU unit (including monitoring of the status of the COMRDY) to detect an abnormality of the communication unit. If an abnormality is detected, the CPURDY0 signal is set to “0”. (Not ready).

If the computer in the main system fails during the system operation by the above operation, two gates G1
0, G20 flip-flop circuit is inverted,
The operation is switched to the computer that was in the standby state until then. In this state, even if the failed computer is removed from the system for repair, for example, the state of the CPURDY1 from the failed partner remains unchanged, so the flip-flop circuit does not reverse, and the system Has no effect on operation.

Next, an operation at the time of loading a program by communication will be described.

Now, it is assumed that the first computer FC1 has the control right and performs the control operation. In this state, a “stop” command is sent from the host computer before the program is loaded.

The stop signal output means C1 in the communication unit 12 of the computer FC1 is
When this "stop" command is received, the other computer
A stop signal (STOP0) is output to the CPU unit 21 of FC2. CPU unit 21 in the standby computer receiving this stop signal
Stops operation immediately.

After the CPU unit 21 stops operating, the stop signal output unit C1
Is followed by a stop signal (CSTO
P) is output. Upon receiving the stop signal, the CPU unit 11 immediately stops.

In this state, since each of the CPU units in the two computers is in the stopped state, the signal CP output therefrom is output.
Both URDY0 and CPURDY1 have fallen, and therefore do not satisfy the control right switching condition of the above equations (1) and (2), and the control right is not switched.

When the computer is stopped, the program can be loaded by communication, and the program from the host computer is loaded into the computer by communication.

When the loading of the program by communication is completed, a “restart” command is sent from the host computer via the bus. When the communication unit 12 receives the “restart” command, the restart signal output unit C2 restarts the own CPU unit 11 having control right (CRE).
START) to the CPU section 11.

CPU unit 11 receiving this restart signal (CRESTART)
Outputs the signal CPURDY0 and starts the operation of control calculation. After entering the control operation, the other CPU
Signal for restarting section 21 (RESTART0)
Is output, and the CPU section 21 is restarted. When the CPU section 21 restarts, this side immediately enters a standby operation because the signal CPURDY0 has already been set.

FIG. 3 is a flowchart showing the operation at the time of loading from the above communication, and also shows the state of each computer at each step.

According to such a procedure, a program can be loaded by communication without switching control right when each computer is stopped or restarted.

In the above embodiment, the configuration of the duplex control unit in each computer is not limited to that shown in FIG. 2, and for example, a timer may not be provided.

<Effects of the Invention> As described in detail above, according to the present invention, in a system having no dedicated control circuit for redundancy control, an operation of loading a program from communication affects an operation of switching control authority. A system that can be provided without giving a simple configuration can be provided.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an embodiment of the present invention, and FIG.
FIG. 3 is a block diagram showing a configuration of a communication unit and a duplex control unit in each computer. FIG. 3 is a flowchart showing an operation when a program is loaded from communication, and FIG. FC1 first computer FC2 second computer 11,21 CPU unit 12,22 communication unit 13,23 duplex control unit

──────────────────────────────────────────────────続 き Continued on the front page (58) Field surveyed (Int.Cl. ⁶ , DB name) G06F 11/16-11/20 G06F 15/16-15/177

Claims (1)

(57) [Claims] In a duplicated computer system in which computers having a self-diagnosis function are duplicated, each computer system performs a calculation and a control and outputs a signal (CPURDY0) indicating that the self-diagnosis function can normally operate itself. A signal indicating that the operation from the CPU unit can be performed normally (C
PURDY0), a signal (CPURDY1) indicating that the operation from the partner CPU unit can be performed normally, a signal (DCS0) indicating that the partner has control right, and indicating that the partner has control right. When a signal (DCS1) is input and the logic of each of these signals is taken and the control right is determined, the redundant control unit communicates with the host and receives a "stop" command from the host. After outputting a signal (STOP0) to stop the operation, it outputs a signal (CSTOP) to stop the operation to its own CPU unit. If the entire system is stopped and a "restart" command is received from the host, the control right A communication unit for outputting a signal (CRESTART) for restarting the own CPU unit before the partner CPU unit, the communication unit comprising: