JP3255934B2 - Basic processing unit and highly reliable computer system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a highly-reliable computer system, and more particularly to a highly-reliable computer system having a structure which allows not only continued operation in the event of a failure but also restoration afterward.

[0002]

2. Description of the Related Art Traffic control systems, financial systems, and securities systems, for example, have become the basis of social life with the spread of the information-oriented society. It is necessary that the processing be continued while maintaining the data consistency even if a failure occurs.

In order to meet these demands, various types of fault-tolerant computers or fault-tolerant and fault-tolerant computer systems have been proposed, and a plurality of computers having the same function so that data processing can be continued even if a fault occurs. The system is constituted by a system or components, and a system or a component in which a failure has occurred is detected by providing redundancy in each section, and the data processing can be continued with the remaining components by separating the fault.

[0004] As a specific conventional example, US Pat.
No. 7 employs a so-called pair-and-spare method, and operates as a set of two processor boards including a memory having a self-diagnosis function, a processor, and an input / output control device. Every processor board has two microprocessors inside, collates the outputs of the microprocessors, and if they do not match, it is regarded as a board failure,
A failure has been detected. In addition, the output from the processor board to the bus is checked and synchronized with the other processor board for each bus clock, and a lockstep method is adopted. Even if a failure occurs on one processor board, the lock step method is used. , A disconnection process is performed, and only the output of the normal processor board is used.

In Japanese Patent Application Laid-Open No. 59-160899, similarly to US Pat. No. 4,654,857, there are provided two processor boards which are respectively connected to dual system buses and have two processors therein. Focusing on the cache memory for synchronization, the flash operation from the cache memory to the main storage device is performed under OS control, thereby avoiding the performance limitation due to the lock step operation. Then, if a failure is detected by comparing the two microprocessors in the processor board, the process is executed again on the alternative processor board from the previous flash point.

[0006] In the above system, 2 on the processor board
A total of four microprocessors, two on one processor board and another, are used. In Japanese Patent Laid-Open No. 1-258057, a triple redundant TMR (Triple Modular Redundancy) technique is employed, and the output results of three processors are used. Is output to the duplicated system bus via the majority circuit.

[0007]

In the above-mentioned conventional example, three or four processors are used in any case, apart from the number of processors to be arranged on one processor board. If one of the processors fails, disconnect this processor and reduce the system to two-unit operation, and then install another new one or two processors to restore the original system configuration. It is composed.

In these systems, the set of processors before the occurrence of the failure is completely different from the set of processors after restoration. That is, in the former two examples, if the processor is initially operated by four processors A, B, C, and D, the processor configuration after the restoration is operated by E, F, C, and D. In the last conventional example, those of A, B and C were initially
D, B, and C. For this reason, the prior art requires special connection, disconnection hardware, and a synchronization mechanism with other processors constituting the system. In addition, the processor or the processor board is usually upgraded or revised gradually, but in the above-mentioned conventional example in which the processor or the processor board which is a part of the system is replaced, the mismatch between the old and new processors after restoration is considered. Adequate precautionary measures to prevent them are essential. Further, in the case of replacing the processor board, it is necessary to always prepare an expensive replacement board. Furthermore, synchronization between processors is difficult.

In view of the above, it is an object of the present invention to provide a highly reliable computer system having a configuration in which not only operation can be continued when a failure occurs but also recovery after that is taken into consideration.

Another object of the present invention is to provide a highly reliable computer system capable of speeding up synchronization.

Another object of the present invention is to provide a highly reliable computer system capable of replacing a hardware board without stopping the system.

Another object of the present invention is to provide a highly reliable computer system capable of replacing a hardware board without deteriorating the performance of the system. Other objects of the present invention will be clarified from the following description of the specification.

[0013]

According to the present invention, in order to achieve the above object, a processor system comprising a plurality of processors is mounted on one hardware board, and the hardware board itself has a fault tolerance function. It was made.

Further, the present invention synchronizes clocks of a plurality of processors on one hardware board.

Further, according to the present invention, when a failure occurs in the inside, the hardware board itself is replaced with another hardware board.

Further, according to the present invention, when a fault occurs in the inside, the processor is disconnected and the operation is continued by the remaining processors.

[0017]

According to the present invention, a processor system composed of a plurality of processors is mounted on one hardware board, and the hardware board itself has a fault tolerance function and the processor board itself is replaced. In addition, hardware and software necessary for processor replacement are not required, and a system configuration that allows for recovery can be provided.

In the present invention, the clocks of a plurality of processors on one hardware board are synchronized with each other, so that the wiring is short and the speed of synchronization can be increased.

According to the present invention, when a failure occurs inside the system, the hardware board itself is replaced immediately with another hardware board, so that the system is not stopped.

According to the present invention, when a failure occurs in the inside, the processor is stopped and the operation is continued by the remaining processors, so that the hardware board can be replaced without lowering the performance of the system.

[0021]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described in detail below, but the description in this specification is divided into the following items in order to facilitate understanding.

I. Schematic overall configuration of the system II. Configuration of BPU2 III. Anomaly detection method IV. Configuration change control in case of abnormality V. Signal processing when internal bus is connected VI. Recovery measures after an abnormal occurrence VII. Alternative Variations of Each Circuit I. FIG. 1 shows a schematic overall configuration of a fault tolerant system of the present invention. This system has two sets of system bus 1-
1 and 1-2, and one or a plurality of basic processing units (hereinafter simply referred to as BPs)
2-1, 2-2 ... 2-n is the system bus 1
-1 and 1-2. A main storage device 3-1 is connected to the system bus 1-1, and a main storage device 3-2 is individually connected to the system bus 1-1.
4-1) and 4-2 are connected to any of the system buses. The main storage device 3 and the IOU 4 are 2
The table is used as one set, and the example of FIG. 1 shows an example in which each set is used one by one. However, this can be used by appropriately increasing the number of sets according to the expansion of the system. The n sets of BPUs shown in the figure usually execute different processes, but all have the same configuration. Therefore, the configuration and operation of the BPU 2-1 will be described as an example unless otherwise required, unless otherwise required. Will be described.

The BPU 2 includes a plurality of microprocessing units 20 (hereinafter, simply referred to as MPUs.
), A plurality of MPU output check circuits 23 (3
The main constituent elements are a plurality of cache memories 220 and 221, a plurality of bus interface circuits 27 (hereinafter simply referred to as BIU), such as a three-state buffer circuit 29, and the like. Here, the schematic operation of the circuit shown in FIG. 1 will be described. An operation is executed by three MPUs 20 , the outputs of the MPUs are checked by a check circuit 23, and the outputs of the two MPUs determined to be normal are output. Are output to two sets of the system bus 1 or two sets of cache memories 220 and 221 via the bus interface circuit 27, respectively. If an abnormality is found in one of the MPUs, this MPU is excluded and the other two normal MPUs are removed.
Thus, the output is output to two sets of the system bus 1 or two sets of cache memories 220 and 221 via the bus interface circuit 27, respectively. Three M
After an abnormality is found in a part of the PU 20, three MPUs 20 are replaced by three MPUs 20 that are completely different from each other at an appropriate timing.
The operation is switched to 20 to execute the calculation.

II. Configuration of BPU2 A more detailed configuration of BPU2 is shown in FIG. As will be described later, the BPU is preferably provided with the functions shown on a single printed board. To be more specific, BPU
(Basic processing unit) is the same operation
At least three processor units for performing
The output of a processor unit is output from another processor unit.
Check circuit to check soundness by comparing with force
External output of each recognized output and input of external input
Multiple interface units and processor units
Cache memos that store information required for calculations in
And the internal bus provided between them
The processor unit is mounted on the processor board.
Is used to check the health of other processor units
For output to be used for
Sessa unit and its output to another processor unit
Used only for checking the health of the
Two types of processor units for reference
Each interface unit has a specific
The soundness of the output of the output processor unit is confirmed
Output, output the output to a specific output
Of the output of the processor unit is not confirmed
At other times, the processor unit for other health-checked outputs
Output the output of the unit. Unchecked output
Other health checks instead of processor unit outputs.
Select the output of the processor unit for the recognized output
It has a selection circuit. In addition, BPU confirms soundness
Disconnecting means for disconnecting the unprocessed output processor unit
And a cache memo giving the output of the processor unit
The output of other processor units whose health has been confirmed
Switching means for switching to give Soshi
Then, the BPU stops outputting the abnormal cache memory.
Stopping means and receiving information from the abnormal cache memory
Is another normal cache memory in the processor unit
Switching means for switching the information to be received.
Further, the BPU switches off the interface unit side of the abnormality.
Release unit and the abnormal interface unit side
The processor unit connected to the
Connect to the internal bus on the interface unit side.
Switching means for switching.

In FIG. 2, three MPUs 20-1, 20-2
For 0-2 and 20-3, a synchronous operation is performed by a clock (not shown), and the result is output to an address line A and a data line D, respectively. MPU 20-1, 20-2, 20
-3 address on address line A and data line D
The above data is provided with an appropriate parity signal from the parity generation / inspection / collation circuits 10 to 15 and supplied to the MPU output check circuit 23. The MPU output check circuit 23 outputs the output from the MPUA (20-1) (address and data to which the parity signal is added) and the MPU (20-
2) First check circuit CHK that compares the output from CHK
AB (23-1), a second check circuit CHKCA (23-2) for comparing the output from MPUA (20-1) with the output from MPUC (20-3), and MPUB (2
A third check circuit CHKBC (23-3) that compares the output from 0-2) with the output from MPUC (20-3).
And error check circuits 234 and 235 for specifying which of the MPUs has failed according to the comparison results from the three check circuits CHK. The MPU output check circuit 23 is a so-called majority circuit, and the three-state buffer circuits 200, 20
The open / close states of 1, 203, 204 and 29 are controlled. The relationship between this determination result and the state of the three-state buffer circuit will be described later. In short, the MPU determined to be abnormal is not used thereafter, and the output of the MPU determined to be normal is given to the two cache memories 220 and 221 so that It is operated as a heavy system. In the following description, the enable state of the three-state buffer circuit is simply called an open state,
The disabled state is referred to as a closed state.

The three-state buffer circuits 200, 201,
The address and data obtained through 203 and 204 are 2
Provided to the two cache memories 220 and 221, respectively.
At this time, the parity check circuit 250 checks the parity assigned by the parity generation / check / collation circuits 10 to 15. The MPU output is output from the synchronization circuit 29.
At 0,291, the two MPU outputs are synchronized,
The data is transmitted to the system bus via the bus interface unit BIU. At that time, the parity check circuit 30,
At 31, parity generation / check / collation circuits 10 to 15
Is checked. The above configuration mainly describes the write access from the MPU. In this way, at the time of the write access from the MPU, the check is performed in the MPU output check circuit 23 and the parity check circuits 30 and 31.

On the other hand, at the time of cache read access, signal transmission is performed along the route of each of the cache memories 220, 221, 3-state buffer circuits 202, 205 and the MPU.
At 0 to 15, the address and data from the cache memory are checked. 26-1 and 26-2 are also 3
This is a state buffer circuit, and the open / close state is controlled in accordance with the result of checking the address and data in the parity generation / check / collation circuits 10 to 15 during cache read access.

As is apparent from the configuration of FIG. 2, in the BPU system of the present invention, at least three MPUs, an abnormal MPU detecting circuit by a majority circuit, a duplicated cache memory, and a duplicated output circuit portion are used. Have.

III. Anomaly Detection Method The MPU output check circuit 23 and many parity check circuits are employed as an abnormality detection unit in the BPU of FIG. In this section, these abnormality detection methods will be described.

<< Abnormality Detection by MPU Output Circuit >> FIG. 3 shows an MPU output check portion. FIG.
The output of the first check circuit CHKAB is AB,
The output of the second check circuit CHKCA is CA, the output of the third check circuit CHKBC is BC, the output of the error check circuit 231 is Ag, Cg, and 29g, respectively. The relationship with the open / closed state of the circuit will be described. In this figure, C is a control line not described in FIG.

First, the first to third check circuits CHK
Obtains the two sets of inputs (address, data, control signal), and the first check circuit CHKAB outputs the MPUA
The comparison result AB between the output of MPUA and the output of MPUB, the second check circuit CHKCA indicates the comparison result CA between the output of MPUA and the output of MPUC, and the third check circuit CHKBC indicates M
A comparison result BC between the output of PUB and the output of MPUC is output. The result of this comparison is a status signal that either matches or does not match.

The error check circuit 231 obtains (1), (2) from the outputs AB, BC and CA of the three check circuits CHK.
MPUA, MPUB, MPUC according to equations (2) and (3)
Are obtained, the outputs Ag, Bg and Cg representing the normality of. 2 and 3, the error check circuit is duplicated.

Ag = “AB ·“ CA + ”AB · BC · CA + AB · BC ·“ CA... (1) Bg = “AB ·“ BC + ”AB · BC · CA + AB ·“ BC · CA... (2) Cg ” = "BC /" CA + AB / "BC / CA + AB / BC /" CA ... (3) where AB: event of output mismatch between MPUA and MPUB (confirmed in 23-1) BC: event of output mismatch between MPUB and MPUC CA: event of output mismatch between MPUA and MPUC (confirmed in 23-2) •: logical product (AND) +: logical sum (OR) “: negation (NOT) (1), (2) ), (3) 3-state buffer circuits 200, 201, 20 3 , 20 4 , 29 according to the result of the operation.
The opening / closing state of is controlled, and this will be described in the next section.

Table 1 shows three check circuits CHKAB,
6 is a table summarizing the outputs (coincidence, non-coincidence) of CHKBC and CHKCA, the determination results Ag, Bg, and Cg of the abnormal MPU at this time, and the open / close state of the three-state buffer circuit as a result. In addition, in the section of the determination result in Table 1,
1 means MPU normal, 0 means abnormal or unknown.

Table 2 shows a part of cases assumed as the cause of the coincidence and non-coincidence check circuit output of Table 1. (In the present invention, the circuit configuration in the BPU in the event of an abnormality is changed. The main point is how to change and continue the operation, and it is not the main purpose to specify the cause of the abnormality. Therefore, detailed description is omitted here.

[0036]

[Table 1]

[0037]

[Table 2]

As described with reference to FIG. 3, FIG. 2, Table 1 and Table 2, in the present invention, the MPU output check circuit 23 determines whether the MPU is normal or abnormal based on the above logic.

Next, a description will be given of an abnormality detection method using a parity check circuit employed as another abnormality detection method in each section in the BPU. However, since the parity check circuit itself is well known and any one can be adopted, a detailed description of the circuit is omitted, and here, a method of specifying an abnormal part when a parity error is detected will be described.

As shown in FIG. 2, at the time of write access, an appropriate parity signal is added from the parity generation / check / verification circuits 10 to 15 and information is transmitted to the address line A and the data line D. , 30, 31. At the time of read access, the parity generation / inspection / collation circuits 10 to 15 and the parity check circuits 250, 30, and 31 detect an abnormality in information. These parity checks are basically performed individually for each of address and data. Regarding the address, when a parity error is detected in the address information, the abnormal part is the bus master transmitting this address signal, and the bus from the bus arbiter (not shown) which grants the right to use the internal bus shown in FIG. By monitoring the grant signal, the device (MP
U, cache memory, BIU) can be specified. Next, regarding the data, when a parity error of the data information is detected at the time of the write access, the abnormal part is the bus master transmitting the data signal. The bus master is specified by monitoring a bus grant signal of a bus arbiter. Lastly, when a parity error of data information is detected at the time of read access, the abnormal point is the output source of this data signal, and this can be specified by decoding the device indicated by the address attached to this data. .

The concept of identifying the abnormal part is represented by a logical expression as follows.

<< Abnormality Detection by Parity Check >> PTYGEN / NG = APE · MPU / MST + DPE (WT · MPU / MST + RD · MPU / SND) (4) Cach / NG = APE · Cach / MST + DPE (WT · Cach / MST + RD · Cach / SND) (5) BIU / NG = APE / BIU / MST + DPE (WT / BIU / MST + RD · BIU / SND) (6) SYSBUS / NG = BIU / NG (7) However, in equations (4) to (7), PTYGEN: parity generation / check / collation circuit 10 to 1
5 / NG: Parity error APE: Address parity error-: Logical product / MST: Bus master +: Logical sum DPE: Data parity error WT: Bus master outputs data Cach: Cache memory RD: Bus master inputs data / SND: Data output source IV. Configuration Change Control at the Time of Abnormality An abnormality in the BPU includes one detected by the MPU output check circuit at the time of write access from the MPU and one detected by the parity check circuit at the time of write access or cache read access.

[Configuration Change When MPU Output Check Circuit Detects Abnormality] The three-state buffer circuit 20 according to the output Ag of the error check circuit 231 of the MPU output check circuit 23
0,201 is Cg and 203,204 is 29g
29 are controlled as shown in Table 1 in accordance with. In Table 1, the MPU determination result Ag = 1 is 2
00,201 open, Ag = 0 basically corresponds to 200,201 closed, Cg = 1 is 203,204 open, Cg = 0 is 2
Basically, it corresponds to 03,204 closing, but Bg and 29g do not have a correspondence. Thus the 29 g, 29 opening and closing states of Ag = 1 and Cg = 1 closed when, 3-state buffer circuit of the direction in which any of Ag and Cg is directed to the 3-state buffer circuit becomes 0 when 1 29 Only open. Hereinafter, each case in Table 1 will be described in more detail with reference to the system configuration in FIG.

Case 1: All MPU outputs match and all MPUs are normal. Three-state buffer circuits 200, 2
01, 203 and 204 are open, 29 is closed,
The MPUA and the cache memory 220 as shown in FIG.
And the system based on the MPUC and the cache memory 221 are independently and redundantly operated.

Case 2: Only the check circuit CHKCA gives a mismatch output, and only the MPUB is determined to be normal. As shown in FIG. 2, the MPU is used as a reference for other MPUs and is not configured to provide an output to the cache memory. Therefore, the operation cannot be continued by changing the configuration, and in this case, the system is down.

Case 3: Only the check circuit CHKBC gives a mismatch output, and only the MPUA is determined to be normal. In this case, the three-state buffer circuits 200 and 2
01 is open, 203 and 204 are closed, 29 is only the three-state buffer circuit in the direction of the cache memory 221 is open. The MPUB and the MPUC are stopped, and the operation is performed by the single system using only the MPUA as shown in FIG. The reason why only the three-state buffer circuit 29 in the direction of the cache memory 221 is opened is to maintain the identity of the contents stored in the cache memory.

Case 4: Only the check circuit CHKAB provides a coincidence output, and it is determined that MPUA and MPUB are normal. In this case, the three-state buffer circuit 20
0 and 201 are open, 203 and 204 are closed, 29 is only the three-state buffer circuit in the direction of the cache memory 221 is open. In this case, the MPUC is stopped, a dual system is configured by the MPUA and the MPUB as shown in FIG. 4C, and the duplex operation is performed in which the output of the MPUA is monitored by the MPUB. 3 toward cache memory 221
Only the state buffer circuit 29 is opened.
This is for maintaining the identity of the contents stored in the cache memory.

Case 5: Only the check circuit CHKAB gives a mismatch output, and the MPUA and the MPUB are abnormal.
Only MPU C is determined to be normal. In this case, the three-state buffer circuits 200 and 201 are closed,
04 is open, 29 is only the three-state buffer circuit in the direction of the cache memory 220 is open. In this case, the MPUA and the MPUB are stopped, and as shown in FIG. The reason that only the three-state buffer circuit 29 in the direction of the cache memory 220 is opened is to maintain the identity of the contents stored in the cache memory.

Case 6: Only the check circuit CHKBC gives a coincidence output, and it is determined that MPUC and MPUB are normal. In this case, the three-state buffer circuit 20
0 and 201 are closed, 203 and 204 are open, and 29 is only the three-state buffer circuit toward the cache memory 220 in the open state. In this case, the operation is basically performed in the same manner as Case 4.

Case 7: Only the check circuit CHKCA provides a coincidence output, and it is determined that MPUC and MPUA are normal. In this case, since the MPU for reference is abnormal, only the MPU is disconnected as shown in Case 7 in FIG.
The state buffer circuit continues the duplex operation by MPUC and MPUA without any change.

Case 8: Any of the check circuits CHK has detected a mismatch, and since all the MPUs are abnormal, the operation cannot be continued thereafter.

As described above, the normality of the three MPUs and their peripheral circuits (for example, parity generation / inspection / collation circuits) is confirmed, and the configuration change control is appropriately performed. Table 1 shows the collation results to the last. Only the possible combinations have been described, and in practice, the seven abnormal events in cases 2 to 8 do not occur with the same probability. In other words, among these, there are three cases of single failure, 4, 6, and 7, three cases of double failure, 2, 3, and 5, and eight cases of triple failure. As is well known, operation continues. Cases 2 and 8 that are disabled
Is extremely low as compared with a single fault. In addition, in most cases, a single failure actually progresses and leads to multiple failures. Therefore, by taking some recovery measures at the time of the single failure, a system configuration that does not substantially hinder operation continuity is obtained. be able to. In the present invention, even if a double failure occurs, the operation can be continued without any problem in many cases, and in this sense, it can be said that the system is extremely reliable.

Although not shown in FIG. 2 at the time of occurrence of the above abnormal event, a signal for stopping the abnormal MPU is generated from the MPU output check circuit 23 to stop the signal, or output to the outside to output the signal to the operator. It is a matter of course that the occurrence of an abnormality is notified to notify the necessity of the following measures.

[Configuration Change at the Time of Detecting Abnormality by Parity Check] As described in the above section III, at the time of write access or cache read access, the location of abnormality in the cache memories 220, 221, BIU 27-1, 27-2. Can be identified. Next, the configuration change control inside the BPU at the time of each abnormality will be described. Table 3 shows the cash
The cache memory 22
0, 221, BIU 27-1, 27-2, and three-state buffer circuits 29, 26-1 , 26-2 .

[0055]

[Table 3]

FIG. 5 shows a circuit configuration in each case, which will be described below with reference to Table 3 and FIG. FIG.
(A) shows a signal flow in a normal state. in this case,
3-state buffer circuit 29,26 -2 closed, 2 6-1
Is open, so that information from the BIU 27-1 or the cache memory 220 stores the MPUA 20-1 and M
It is supplied to PUB20- 2, BIU27-2 or information from the cache memory 221 is supplied to the MPUC20-3. Thus, the BIU 27-1, the cache memory 220, the MPUA 20-1, and the MPUB 20-
2 constitute one set, and the BIU 27-2, the cache memory 221, and the MPUC 20-3 operate so as to constitute another set.

Case 1: The cache memory 220 is abnormal. As shown in FIG. 5B, the cache memory 220
Is stopped, and the three-state buffer circuit 29
Only the signal to the UA 20-1 side is controlled to pass, the three-state buffer circuit 26-1 is closed, and 26-2 is
Opened . Thereby, all the MPUs are configured to receive the common information from the cache memory 221, and the operation is continued even after the abnormality is found. The reason for switching from the normal state, such as closing the three-state buffer circuit 26-1 and opening the three-state buffer circuit 26-1 , is that even if the cache memory 220 is logically identified as abnormal, the cache memory 220 is connected. The possibility of an abnormality in the internal bus cannot be denied, and it is switched to the cache memory 221 side just in case. If the internal bus to which the cache memory 220 is connected is abnormal, the effect does not appear on the MPUC side because the three-state buffer circuit 29 is in one-way communication.

Case 2: The cache memory 221 is abnormal. As shown in FIG. 5C, the cache memory 221
Is stopped, and the three-state buffer circuit 29
Control is performed so that only the signal to the UC 20-3 side is passed, whereby all MPUs
The system is configured to receive the common information from, and the operation is continued even after the abnormality is found.

Cases 3 and 4 : BIU 27-1, 27-2
Alternatively, the error is on the connected system bus 1-1 side. As shown in FIGS. 5D and 5E, BIU 27-1 or
Is 27-2 or the system bus 1-1 connected thereto.
Side, and operate as in Case 1.

As described above, when an error due to a parity error is detected, an external notification of the error is made along with the configuration change.

As described in detail above, according to the present invention, even if an abnormality occurs inside the BPU, the circuit configuration can be cut off or the information flow can be changed in the same manner as in the normal state. Operation can be continued. For this reason, if an abnormality occurs during data processing, (1) the operation in the BPU is continued until a good cut or repair maintenance time, and (2) a good cut or a repair maintenance time. The processing executed by the BPU is changed to another normal B
What is necessary is just to hand over to PU.

As a result, the backup operation for the checkpoint restart in the event of an abnormality becomes unnecessary, and
Processing performance can be improved.

V. Signal Processing When Connecting Internal Bus As described above, the internal bus is switched using the three-state buffer 29 in the event of an abnormality in each unit. In comparison, it takes time to switch, and it takes time to detour between buses. As a remedy, extending the bus cycle by retry only when an abnormality occurs as shown in FIG. 6 is effective without causing a delay of the bus cycle.

That is, an abnormality is found (step S
1, S2), the signal for retrying is asserted in step S4, the abnormal output is stopped in step S5 (operation for disconnecting the abnormal MPU, etc.), and the bypass processing for the normal output is performed. Is asserted to end a series of processing. Note that when it is normal, it is only necessary to assert a signal for ending this bus cycle in step S3. The signal line for terminating the bus cycle or retrying the MPU has a different name depending on the type of the MPU.
MPU automatically executes by inputting to PU. Table 4
Shows signal names of typical MPUs.

[0065]

[Table 4]

FIGS. 7 and 8 show the signal flow when the retry method of FIG. 6 is employed at the time of write access. FIG. 7 shows a normal state and FIG. 8 shows an abnormal state. In the figure, the vertical axis shows the passage of time, and the horizontal axis shows the circuits of each unit until the MPU output reaches the cache memory. Usually, an address signal is output from the MPU prior to the data signal. In FIG. 7, since both the address signal and the data signal are normal, the MPU output check circuit 23,
The parity check circuit 250 determines that the state is normal,
An end signal is returned to U, the data is stored in the cache memory 220, and the bus cycle ends.

In FIG. 8, the MPU is abnormal and both the address signal and the data signal are determined to be abnormal by the MPU output check circuit 23. A retry signal is returned to each MPU together with an end signal, and a retry operation is started. At the time of the retry operation, the three-state buffers 200 and 201 are closed to prevent signal transmission from the MPUA to the internal bus, and the three-state buffer 29 is opened only in one direction to supply the MPUC output signal to the cache memory 250 as well. Thereafter, an end signal is returned to each MPU, and the operation ends.

FIGS. 9, 10 and 11 show the flow of signals when the retry method of FIG. 6 is employed at the time of cache read access. FIG. 9 shows a normal state, FIG. FIG. 11 shows the case where the data signal is abnormal. In FIG. 9, since the address signal and the data signal are both normal and no abnormality is found, an end signal is returned to the MPU, and the MPU stores the data from the cache memory 250 and ends the bus cycle. In FIG. 10, MP
The address signal from the UA is determined to be abnormal because the address signal does not match with the others, and a retry signal is returned to each MPU together with an end signal, and a retry operation is started. At the time of the retry operation, the 3-state buffer 201 is closed to prevent signal transmission from the MPUA to the internal bus, the 3-state buffer 29 is opened in only one direction, and the address output signal of the MPUC is supplied to the cache memory 220. The data stored at the given address is transferred to MPUA and MPUB
To supply. Thereafter, an end signal is returned to each MPU, and the retry operation ends.

In FIG. 11, there is an abnormality in the data from the cache memory 220, and the parity generation collation check circuit 1
At 0, 12, the parity check by the parity check circuit 250 is judged to be normal , a retry signal is returned to each MPU together with an end signal, and a retry operation is started. During the retry operation, the output of the cache memory 220 is blocked, the three-state buffer 29 is opened in only one direction, and the output of the cache memory 221 is supplied to the MPUA and the MPUB. In this case, the three-state buffer circuit 26 -1
The closed, switch 2 6-2 from the open normal state as the cache memory 22 through the 3-state buffer circuit 27
By supplying the output of 1 to the MPUB, it is possible to prevent erroneous data from being supplied to the MPUB due to an abnormality in the path of the data signal from the cache memory 220 to the MPUB.

VI. Recovery measures after occurrence of abnormality As described above, the device of the present invention can continue to operate even after occurrence of abnormality.However, it is difficult to operate the system permanently with this configuration, considering the possibility of secondary failure, to quickly return to the initial state. Next, a recovery measure for normally recovering the function of the BPU generated above will be described. The method is achieved by forming the BPU of FIG. 1 on one printed board and replacing the abnormal BPU printed board with a normal BPU printed board.

FIG. 12 shows the structure of a computer board. When the door is opened, a slot portion for accommodating a printed board is formed inside the computer board. Further, in each slot, the main storage device 3, BPU2, Each printed board constituting the output control unit BIU4 is inserted, and in the inserted state, is connected to a system bus not shown in FIG. In the illustrated example, there are 12 slots SL, of which SL
1, a printed board is inserted into SL3 to SL6, and another SL is inserted.
2, SL7 to SL12 are empty slots. The printed board PL to be inserted into the slot SL may be a known one, but in the present invention, a lever 282 for fixing the printed board to the slot SL, and an indicator lamp indicating whether the printed board is stopped or not. 280, and a printed board removal request button 281 as needed. Hereinafter, the procedure for replacing the BPU printed board will be described.

<< Replacement with One BPU Printed Board >>
FIG. 13 shows a system bus (shown as a single system for convenience of explanation).
Among the n slots SL to which the printed circuit board PL can be connected, 1 is a BPU or SL2 in which an abnormality has occurred inside SL1.
Shows an example in which a print of the IOU 4 is inserted into the main storage device 3 and SLn, respectively, and SL3 is an empty slot. Here, the new BP that should function instead of the abnormal BPU
U has not yet been inserted into the slot. The display lamp 280 on the printed board is turned off because it is in operation.

In this state, to take over the function of the old BPU 2A to the normal new BPU 2B, first, an empty slot is prepared. In the example of FIG. 13, since the slot SL3 is an empty slot, the new BPU 2B is inserted into the empty slot SL3 next.

The BPU 2A detects the insertion of the BPU 2B,
By the processing of the operating system (hereinafter abbreviated as OS), the task running on the old BPUA can be changed to the new BPU2B.
To display lamp 2 on the printed board of the old BPU2A
Light 80. After that, the online business will be the new BPU2
Executed by B. Business transfer from the old BPU 2A to the new BPU 2B is instantaneous. Thereafter, the display lamp 280 on the old BPU printed board is turned on, and after confirming that the BPU is stopped, the old BPU 2A is removed. According to the above procedure, since the online business has been transferred to the new BPU 2B before the old BPU 2A is pulled out, the BPU can be replaced without stopping the system and without lowering the system performance.

FIG. 14 shows the BP for the example shown in FIG.
It is a BPU exchange procedure processing flow showing the contents of the processing by dividing the U exchange procedure into human operation and processing inside the computer.

When replacing the BPU, first, an empty slot is prepared (St1). If there is an empty slot that is already unused, use that empty slot.If there is no empty slot, if there is a hardware board that can be temporarily removed, remove the board and temporarily remove the empty slot. It is also possible to prepare an empty slot by returning the board after the target BPU is replaced. Next, a new BPU is inserted into an empty slot (St
2 ) Do it. The old BPU 2A recognizes the BPU insertion by means such as an interrupt (St 3 ). Then, the old BPU 2A saves the currently executing task on the main storage device (St 4 ),
This enables the new BPU 2B to continue processing the task. The new BPU 2B receives this and executes the task (S
t5), and start an online business. The old BPU2A turns on the board stop lamp on the BPU by itself (St6),
The processing is stopped (St7). Then, a human confirms that the board stop lamp on the old BPU is lit (St8).
Thereafter, the old BPU is removed (St9). This completes the BPU exchange.

FIG. 15 shows the old BPU in the above embodiment.
FIG. 7 is a diagram for explaining in detail a means for taking over a task being executed on 2A to a new BPU 2B. Old BPU2 in the system bus
A, a new BPU 2B, and a printed board of the main storage device 3 are mounted. A task 920-1 is being executed on the old BPU 2A. At that time, if the notification that the new BPU 2B has been inserted enters the old BPU 2A, the old BPU 2A suspends the processing and executes the task 920-
1 is saved on the main storage device 3. On the other hand, the new BPU 2B recovers the task 920-2 following the task 920-1 saved on the main storage device 3, and continues the processing of the task from the point at which it was interrupted. Using the above method, the exchanged B
Take over business between PUs.

The above is an example of BPU replacement when there is one BPU. In the above embodiment, even when there is one BPU, the BPU can be replaced without stopping the system.

<< Replacement when there are a plurality of BPU printed boards >>
Next, a description will be given of a case where there are a plurality of BPUs or a case where the inserted BPU does not operate correctly. FIG.
In the sixth embodiment, a plurality of BPUs are mounted. Each BPU has a board removal request button 281 and a printed board number 282 as means for designating a BPU to be replaced.

Slots SL1 to SL3 for connecting a printed board to the system bus 1 have BPUs 2A, 2
B and 2C are respectively mounted. A main storage device is connected to the slot SL4. Slot SL5 is an empty slot. Also, each BPU has a display lamp 280 that lights up when the BPU stops, and a BP to be removed.
It has a printed board removal request button 281 used to designate U and a printed board number 282. Here, the printed board numbers are 1 for BPU2A, 2 for BPU2B, and BP
U2C is promised three. When replacing the new BPU 2D with the old BPU 2B installed in the slot SL2, the new BPU 2D is first inserted into the empty slot SL5. Then, the slots SL1 to SL
The user presses the button 281 for requesting the removal of the BPU 2B in the slot SL2 to be replaced among the BPUs mounted in L3. Then, the old BPU 2B saves the running task and its own printed board number on the main storage device 3, and stores the new BPU
The 2D fetches the printed board number saved on the main storage device 3 and executes the task under saving. The old BPU 2B turns on the display 280 and stops itself. After that, the old BPU2B
After confirming that the board stop lamp 280 is lit,
Remove the BPU 2B.

FIG. 17 is a block diagram of B in the example shown in FIG.
It is a BPU exchange procedure processing flow showing the contents of the processing by dividing the PU exchange procedure into human operation and processing inside the computer.

When replacing the BPU, first, an empty slot is prepared (St1). If there is an empty slot that is already unused, use that empty slot.If there is no empty slot, if there is a hardware board that can be temporarily removed, remove the board and temporarily remove the empty slot. It is also possible to prepare an empty slot by returning the board after the target BPU is replaced.

Next, a new BPU2D is inserted into an empty slot (St2). Thereafter, the user presses the printed board removal request button of the old BPU 2B to be removed (St3). Then, the old BPU 2B saves the currently executing task and the own printed board number on the main storage device 3 (St4), and the new BPU 2B
Allow D to continue processing the task. New BPU
In response, the 2D executes the task (St5) and starts an online job. The old BPU 2B turns on the display lamp on the BPU by itself (St6), and stops the processing (St).
7) Yes. Then, after confirming that the display lamp on the old BPU 2B is lit (St8), the old BPU 2B is removed (St9). This completes the BPU exchange.

FIG. 18 shows the old BPU in the above embodiment.
FIG. 11 is a diagram for explaining in detail a means for transferring a task being executed and a printed board number to a new BPU. Old B on system bus
Three PUs (2A, 2B, 2C), a new BPU 2D, and a main storage device are mounted. Old BPU2A, 2B,
On 2C, tasks 1, 2, and 3 are being executed, respectively. Also, the printed board numbers 282 of the old BPUs 2A, 2B, 2C
Are 1, 2, and 3, respectively. At that time, in order to specify the removal BPU, when a printed board removal request button of the old BPU2B is pressed, old BPU2B interrupts the process, a main memory and task 2 running its own printed circuit board No. 2 82 3. Evacuate on top. On the other hand, the new BPU2D is a printed circuit board No. 2 82 is retracted in the main storage device 3 Task 2
And continue processing the task from the point of interruption.
By using the above method, the business between the exchanged BPUs is taken over.

According to this embodiment, the BPU to be replaced
Has the advantage that even if a plurality of BPUs are installed, the BPU can be replaced without stopping the system and without lowering the system performance even if a plurality of BPUs are installed. .

Further, by taking over the printed circuit board number assigned to the exchanged BPU between the exchanged BPUs, even if the operation printed circuit board number is designated by the user program, the BPU can be changed without changing the user program.
There is an advantage that can be replaced.

<< When the inserted BPU does not operate correctly >> On the other hand, if the replaced new BPU does not operate normally, there is a disadvantage that the system is seriously affected. According to FIG. 19 and FIG. 20, there is provided a means for checking the operation of the inserted BPU, and there is no effect on the system even if the newly inserted new BPU does not operate normally.

FIG. 19 is a diagram showing a state where the new BPU 2B is inserted. At this time, a task is being executed in the old BPU 2A. When the new BPU 2B is inserted, the BPU self-diagnosis program 925 is executed to perform an operation check on the BPU. Until the diagnosis program ends normally, the old BPUA is not notified of the board insertion. If a failure point is found in the new BPU by the diagnostic program 925, the old BPU is not contacted, the display lamp 280 of the own BPU 2B is turned on, and the processing is stopped. In the old BPU, the new B
The task processing is continued as if nothing had happened without interrupting task 1 at the PU insertion timing.

FIG. 20 is a BPU exchange procedure processing flow showing the contents of the BPU exchange procedure in the above embodiment, which is divided into human operation and computer internal processing. St
The processes of 1, St2, St4 to St8, and St11 to St13 are completely the same as those in FIG. 21 and thus will not be described here. Only the processes unique to this embodiment will be described.

When a new BPU is inserted, a diagnostic program is first executed to check the operation of the new BPU (S
t3). If the result of the diagnosis program indicates that the condition is normal, the process proceeds to step St4 as in the previous embodiment. However, when it is determined that a failure has occurred, the display lamp on the inserted new BPU is turned on (St9), and the processing of the new BPU is stopped.
(St10). Thereafter, the lighting of the display lamp on the new BPU is confirmed (St14), and the new BPU is removed again (S14).
t15). As a result, although the exchange of the BPU has failed, the online system is not affected because the old BPU continues the processing. Whether or not the replacement has succeeded is determined by which of the display lamps of the new and old BPUs is turned on after the BPU is inserted.

As described above, according to the method of the present embodiment, even when the inserted BPU does not operate normally, it is possible to eliminate the influence on the online system.

<< Configuration and Processing Before and After Abnormality Occurrence >> FIG. 21 shows the processing and configuration of the MPUs in the old BPU 2A and the new BPU 2B in chronological order, and shows three MPUs of the BPU 2A during normal operation. Are operating, and the majority result is output. Then, during the execution of the process B, the MP
If a failure occurs in the UC, it is disconnected and the MPUA and MPU
The operation is normally continued by the multiplexing circuit configuration of B. On the other hand, when the printed board of the new BPU 2B is inserted into the empty slot due to the notification of the abnormality of the MPUA, each MPU in the new BPU 2B performs a self-diagnosis, and at an appropriate time, the processing is performed by the old BP
Moved from U2A to new BPU2B, 3 M of BPU2B
The processing D based on the majority decision result of the PU (MPUD, MPUE, MBUF) is executed. In this process handover, the operation in the BPU is continued until a time when the cutting is good or the time for repair and maintenance is performed.
It is sufficient that the processing executed by the PU is taken over by another normal BPU, and in practice, it can be performed at the most desirable point in performance due to software. Obviously, the timing of task switching is generally appropriate as such timing. This is because the BPU can be switched in exactly the same procedure as the processor switching in the multiprocessor system, and the extra performance overhead associated with the handover can be reduced to zero. Therefore, according to the present invention, the backup operation for the checkpoint restart at the time of occurrence of a fault becomes unnecessary, and the processing performance can be improved.

When a fault occurs, the hardware records the fault occurrence status in a register, and the operating system refers to the register at the time of a context switch or at the time of an interrupt process for repair and maintenance. If necessary, take over B
The PU is notified by an interrupt or the like, and the processing in the own BPU is terminated. When a failure occurs in a part of the elements (MPU, cache memory, etc.) constituting the BPU 2, even if the other elements are normal, after the processing is taken over in this method, the entire BPU 2 including the other normal elements is processed. Stop using.

FIG. 22 schematically shows the difference between the configuration of the present invention and the known example at the time of takeover when the MPUA, MPUB, and MPUC redundant for fault tolerance suffers a failure or the like. Show. In the conventional method, only the failed MPUA is replaced with a normal MPUD. In contrast, in the method according to the present invention, not only the failed MPUA but also the normal MPUB, MPUC
Has also been newly replaced with MPUD, MPUE, and MPUF. As described above, a combination of redundant MPUs for fault tolerance, that is, an MPU
The combination of A, MPUB, and MPUC can be fixed. Therefore, if the combination of MPUs is used as an exchange unit,
The MPUs constituting each combination can be connected by a high-speed clock, and a high-speed fault-tolerant computer can be realized. Further, unlike the related art, various hardware and software associated with the MPU rearrangement are unnecessary.

Since the BPU can continue its operation in the case of a single failure, it is not necessary to carry out the processing immediately after the occurrence of the failure. Just do it.

According to the present embodiment, the wiring board of the failed BPU 20-1 can be pulled out and a normal wiring board can be replaced while the processing is continued.

VII. Alternative Modifications of Each Unit Circuit Although the present invention has been described above, each unit circuit and the like of the present invention can be implemented by appropriately changing. Hereinafter, these alternatives and modifications will be described.

<< Majority Logic Unit >> FIG. 23 shows how the majority logic circuit unit of FIG. 2 is assembled and switched in a simplified and easy-to-understand form by omitting other components. And MPUC are fixed for output, and MPUB is used only as a reference for checking the soundness of MPUA and MPUC, and when MPUA or MPUC is abnormal, one output whose soundness is checked is commonly used. The data is supplied to two sets of cache memories. In the case of this method, the output of the MPU is directly input to the cache memory without passing through the majority circuit, so that the cache memory access time can be reduced by the delay time in the majority circuit.

In the present invention, the operation is continued by switching from the triple system to the double system by using the majority logic as described above. It can be. For example, in FIG. 25, the outputs of three MPUs are given to majority decision selection circuits 210 and 211, respectively, and one of the three MPUs whose soundness is confirmed is selected. In this case, the data in the cache memory connected to the failed majority decision circuit is destroyed, but the operation can be continued using the data in the cache memory connected to the normal majority selection circuit.

Further, as shown in FIG. 24, the output of the MPU is directly input to the cache memory without passing through a gate circuit, a switching circuit, etc., and the operation of the cache memory which receives a signal from the abnormal MPU is stopped. If data is not used, the cache memory access time can be further reduced by the delay time of the gate circuit, switching circuit, and the like. In addition, since there is no need to switch between address buses and data buses including many signal lines, the amount of hardware can be reduced.

FIG. 26 shows four MPUs, in which MPUA and MPUC are fixed for output , MPUB and MPUD are used for their reference, and the output MPU is output by matching two sets of outputs.
Respectively. When the MPU is abnormal, a method of switching to a healthy MPU and using the data or a method of stopping the operation of the cache memory receiving a signal from the abnormal MPU and not using the data thereafter can be used. .

[0102] "read access portion of the cache data" Also, when we attached to the cache memory, the cache output of the memory 220, 221 (data) parity check by the normal / abnormal can be determined, the parity check 250 as shown in Figure 27 MPUA through switching means 2 06 the output of the cache memory that is judged to be normal by,
Input to MPUB and MPUC. If both cache memories are normal, the master and slave of the cache memory may be determined in advance, and the output of the master may be selected.

Also, as shown in FIG. 28, MPUA and MPUB use the cache memories 22
Alternatively, the output of the selected cache memory may be input only to the MPU and fixed to 0,221. In this case, even if one of the cache memories fails, two of the three MPUs can operate normally and the amount of hardware can be reduced.

[0104]

According to the present invention, a processor system including a plurality of processors is mounted on a single hardware board, and the hardware board itself has a fault tolerance function and the processor board itself is replaced. Therefore, hardware and software necessary for processor replacement are not required, and a system configuration that allows for recovery can be provided.

In the present invention, a plurality of processors on one hardware board are clock-synchronized, so that the wiring is short and the speed of synchronization can be increased.

According to the present invention, when a failure occurs inside the system, the hardware board itself is replaced immediately with another hardware board, so that the system is not stopped.

In the present invention, when a failure occurs in the inside, the processor is stopped and the operation is continued by the remaining processors, so that the hardware board can be replaced without lowering the performance of the system.

[Brief description of the drawings]

FIG. 1 is a diagram showing the overall system configuration of the present invention.

FIG. 2 is a diagram showing a configuration of a BPU of the present invention.

FIG. 3 is a diagram showing an embodiment of an MPU output check circuit.

FIG. 4 is a diagram showing a configuration of a BPU when an abnormality occurs in a write access.

FIG. 5 is a diagram showing a configuration of a BPU at the time of abnormality in read access.

FIG. 6 is a flowchart of a bus cycle control.

FIG. 7 is a diagram showing a signal flow in a BPU when the MPU is normal.

FIG. 8 is a diagram showing a signal flow in a BPU when an MPU is abnormal.

FIG. 9 is a diagram showing a signal flow in a BPU when the MPU is normal.

FIG. 10 is a diagram showing a signal flow in a BPU when an address signal is abnormal.

FIG. 11 is a diagram showing a signal flow in a BPU when a data signal is abnormal.

FIG. 12 is a diagram showing a computer board configuration.

FIG. 13 is an explanatory diagram of a BPU exchange principle.

FIG. 14 is a diagram showing a BPU replacement procedure.

FIG. 15 is a diagram showing processing takeover of new and old BPUs.

FIG. 16 is an explanatory diagram of a BPU exchange principle at the time of a multiprocessor.

FIG. 17 is a diagram showing a BPU exchange procedure at the time of a multiprocessor.

FIG. 18 is a diagram showing takeover of old and new BPU processes at the time of a multiprocessor.

FIG. 19 is a diagram showing a BPU replacement process when an inserted BPU fails.

FIG. 20 is a flowchart of a BPU replacement process when an inserted BPU fails.

FIG. 21 is a diagram showing handover of processing when a BPU fails.

FIG. 22 is a diagram showing handover of processing when a BPU fails.

FIG. 23 is a view showing an embodiment of comparison and collation by 3MPU.

FIG. 24 is a view showing another embodiment of comparison and collation by 3MPU.

FIG. 25 is a view showing another embodiment of a majority decision system.

FIG. 26 is a diagram showing an embodiment of comparison and collation by 4MPU.

FIG. 27 is a diagram showing read access of cache data.

FIG. 28 is a view showing another embodiment of read access of cache data.

[Explanation of symbols]

1: System bus, 2: BPU, 10, 11, 12, 1
3, 14, 15 ... parity generation / collation circuit, 20 ... MP
U, 23 ... MPU output check circuit, 27 ... BIU (bus interface unit), 30, 31 ... Parity check circuit, 200 to 205, 26-1 , 26-2 ,
29 ... three-state buffer, 220, 221 ... cache memory, 234, 235 ... error check circuit.

──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Yoshiki Kobayashi 4026 Kuji-cho, Hitachi City, Ibaraki Prefecture Within Hitachi Research Laboratory, Hitachi, Ltd. (72) Inventor Takeshi Miyao 5-2-1 Omika-cho, Hitachi City, Ibaraki Prefecture Co., Ltd. Inside Hitachi, Ltd. Omika Plant (72) Inventor Manabu Araoka 5-2-1, Omika-cho, Hitachi City, Ibaraki Prefecture Inside Hitachi Ltd. Omika Plant (72) Inventor Tomoaki Nakamura 5-2-1, Omika-cho, Hitachi City, Ibaraki Prefecture Hitachi, Ltd. Omika Plant (72) Inventor Masayuki Tanji 5-2-1, Omika-cho, Hitachi City, Ibaraki Prefecture Hitachi, Ltd. Omika Plant (72) Inventor Shigenori Kaneko 5-2-1, Omika-cho, Hitachi City, Ibaraki Prefecture No. 1 Inside the Hitachi, Ltd. Omika Plant (72) Inventor Koji Masui Omikacho, Hitachi City, Ibaraki Prefecture No.2-1, Hitachi, Ltd. Omika Factory, Hitachi, Ltd. (72) Inventor Saburo Iijima 5-2-1, Omika-cho, Hitachi City, Ibaraki Prefecture Within Hitachi Process Computer Engineering Co., Ltd. (56) References JP-A-2-2 202636 (JP, A) Yasuhiko Kawamoto and 4 others, "V60 / V70 Microprocessor and High Reliability System", Transactions of Information Processing Society of Japan, Information Processing Society of Japan, January 1989, Vol. 30, No. 1, p. 58-71 Takashi Kojo and 1 other, “General-purpose Microprocessor Chip”, Journal of the Institute of Electronics, Information and Communication Engineers, Institute of Electronics, Information and Communication Engineers, November 1990, Vol. 73, No. 11, p. 1222-1227 Yasuhiko Kawamoto and 4 others, “V60 / V70 Microprocessor System and High Reliability System”, Transactions of Information Processing Society of Japan, (58) Fields investigated (Int. Cl. ⁷ , DB name) G06F 11 / 16-11/20 G06F 15/16-15/177

Claims (10)

(57) [Claims] At least three processor units for executing the same operation, and an output of the processor unit is connected to another processor unit.
Check the soundness by comparing with the output of the
Checking circuit and sound output are output as external output
Multiple interface units, each taking in external inputs.
And information required for calculations in the processor unit
Multiple cache memories, and
Internal bus on a single processor board
A processing unit , the output of which is output to another processor.
Used to check the health of the unit and
The output processor unit to be output and the output
Used only to check the health of other processor units.
Reference processor unit that is used and is not output to the outside
There are two types of interface units.
Processor unit output health for specific output different
When the property is confirmed, the output is output to the outside,
The soundness of the output of the processor unit for that particular output
If not checked, another health-checked output
A basic processing unit that outputs the output of a processor unit to the outside . 2. The basic processing according to claim 1.
The output of the processor unit for output that is not
Processor for other sanitized outputs instead of power
It has a selection circuit for selecting the output of the unit.
Basic processing unit. 3. A basic processor according to claim 1 or 2.
In Tsu single unit, switching the processor unit for the output not confirm the soundness
Separating means for separating and providing an output of the processor unit
Other health-checked output
Switching means for switching to give the output of the processor unit
And a basic processing unit. 4. A basic processing unit according to claim 1, wherein: a stop means for stopping output of an abnormal cache memory;
A processor that receives information from the cache memory of the abnormality
Unit receives information from other normal cache memory
A basic processing unit, comprising: switching means for performing switching in such a manner . 5. The basic processing unit according to claim 1 , wherein said disconnecting means disconnects an abnormal interface unit.
Connected to the internal bus on the interface unit side of the error
Processor unit to another normal interface
Switching means for switching to connect to the internal bus on the unit side
And a basic processing unit. 6. At least three processors performing the same operation.
The output of the processor unit and the processor unit to another
Checks to check the health by comparing with the output of the processor
Output for each of the
Multiple interface units and processes
Multiple keys to store information necessary for computation in the
Cache memory and the internal bus between them.
Basic processor mounted on one processor board
And a plurality of interface units
A plurality of system buses respectively connected to the plurality of system buses;
High reliability configured with main storage connected to the system bus
In a computer system, a processor unit of the basic processing unit is provided.
The output of the unit is the health of other processor units.
Used for checking the status and output to the outside
Processor unit and its output
Used only to check the integrity of the knit,
Two types available, with unreferenced processor unit for reference
Each interface unit has a specific
The soundness of the output of the output processor unit is confirmed
Output the external output and output the specific output
Of the output of the processor unit is not confirmed
When other processor outputs are checked for soundness,
The high reliability core characterized in that the output of the
Computer system. 7. A highly reliable computer system according to claim 6.
In the system , the basic processing unit
Other sound instead of processor output for unrecognized output
To select the processor output for the
Computer having a selection circuit
System . 8. A highly reliable computer according to claim 6 or 7.
In a data system, the basic processing unit
Release handle for disconnecting processor unit for unauthorized output
Stage and a cache providing an output of the processor unit
A processor processor for other sanitized outputs in memory
Switching means for switching to give a knit output
A highly reliable computer system characterized by the above-mentioned . 9. The high signal according to any one of claims 6 to 8.
In the computer system, the basic processing unit is used to
Stopping means for stopping the output of the flash memory;
Processor unit that receives information from cache memory
To receive information from another normal cache memory
A highly reliable computer system comprising: a switching unit for switching . 10. The height according to claim 6, wherein :
In a trusted computer system, the basic processing unit is used to detect an error
Disconnecting the interface unit and an abnormal interface.
Processor connected to the internal bus on the face unit side
The unit within other normal interface units
Switching means for switching to connect to the external bus
A highly reliable computer system characterized by the following.