JP3256181B2 - How to restore a highly reliable computer system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a highly reliable computer system, and more particularly, to a method for restoring a highly reliable computer system in which the operation can be continued in the event of a failure, and the subsequent recovery measures are devised.

[0002]

2. Description of the Related Art Traffic control systems, financial systems, and securities systems, for example, have become the basis of social life with the spread of the information-oriented society, and the computer systems used in these systems do not suffer from obstacles. It is necessary that the processing be continued while maintaining the data consistency even if a failure occurs.

In order to meet these demands, various types of fault-tolerant computers or fault-tolerant and fault-tolerant computer systems have been proposed, and a plurality of computers having the same function so that data processing can be continued even if a fault occurs. A system or a component is configured, and a redundant system or component is provided to detect a failed system or component, and to continue data processing.

[0004] As a specific conventional example, US Pat.
No. 7 employs a so-called pair-and-spare method, and operates as a set of two processor boards including a memory having a self-diagnosis function, a processor, and an input / output control device. Every processor board has two microprocessors inside, collates the outputs of the microprocessors, and if they do not match, it is regarded as a board failure,
A failure has been detected. In addition, the output from the processor board to the bus is checked and synchronized with the other processor board for each bus clock, and a lock step method is adopted. Even if a failure occurs in one processor board, the lock step method is used. , A disconnection process is performed, and only the output of the normal processor board is used.

In Japanese Patent Application Laid-Open No. 59-160899, similarly to US Pat. No. 4,654,857, there are provided two processor boards which are respectively connected to dual system buses and have two processors therein. Focusing on the cache memory for synchronization, the flash operation from the cache memory to the main storage device is performed under OS control, thereby avoiding the performance limitation due to the lock step operation. And
If a failure is detected by comparing two microprocessors in the processor board, the process is executed again on the alternative processor board from the previous flash point.

[0006] In the above system, 2 on the processor board
A total of four microprocessors, two on a separate processor board, are used.
Adopting the MR (Triple Modular Redundancy) technique, the output results of three processors are output to a duplicated system bus via a majority circuit.

[0007]

In the above conventional example, apart from the number of processors to be arranged on one processor board, three to four processors are used in each case. The system to be used. When a failure occurs in any of the processors, this processor is separated, the system is reduced to a two-processor operation, and then another one or two new processors are incorporated into the original system configuration. Is reconstructed.

In these systems, the set of processors before the occurrence of the failure is completely different from the set of processors after restoration. That is, in the former two examples, if the processor is initially operated by four processors A, B, C, and D, the processor configuration after the restoration is operated by E, FC, and D. In the last conventional example, those of A, B and C were initially
D, B, and C. As described above, in the conventional system, it is necessary to change the processor at the time of recovery after the occurrence of a failure. Therefore, in the conventional system, special connection, disconnection hardware, synchronization with other processors constituting the system are required. A mechanism is needed. In addition, the processor or the processor board is usually upgraded or revised gradually, but in the above-mentioned conventional example in which the processor or the processor board which is a part of the system is replaced, it is sufficient to prevent a mismatch after recovery. Proactive response is essential. Further, in the case of replacing the processor board, it is necessary to always prepare an expensive replacement board. Furthermore, synchronization between processors is difficult.

In view of the above, it is an object of the present invention to provide a method of restoring a highly reliable computer system that can easily replace a processor board without stopping the system when replacing the processor board. .

[0010]

A highly reliable computer system according to the present invention has a plurality of slots for inserting a board on a system bus, and executes the same operation as the board of the main storage device in the slot. After the operation of the old basic processor board, which consists of multiple processors and is inserted with multiple basic processor boards and operates, and the fault occurs and continues to operate in some circuits, the processing of the old basic processor board is saved to the main storage device and the new basic processor board is saved. Then, the old basic processor board is stopped and removed from the slot to recover from the degraded operation state due to the failure of a part of the processor.

According to the present invention, even when a plurality of processor boards are mounted, replacement of the processor boards can be realized without stopping the system and without reducing the system performance.

[0012]

BEST MODE FOR CARRYING OUT THE INVENTION The present invention will be described in detail below, but the description in this specification will be divided into the following items to facilitate understanding.

I. Schematic overall configuration of the system II. Configuration of BPU2 III. Abnormality detection method IV. Configuration change control in case of abnormality Signal processing when connecting to internal bus VI. Restoration after abnormal occurrence VII. Alternative modification of each circuit I. FIG. 1 shows a schematic overall configuration of a fault tolerant system of the present invention. This system has two sets of system bus 1-
1 and 1-2, and one or more basic processing units (hereinafter simply referred to as BPs)
2-1, 2-2 ... 2-n is the system bus 1
-1 and 1-2. A main storage device 3-1 is connected to the system bus 1-1, and a main storage device 3-2 is individually connected to the system bus 1-1.
4-1) and 4-2 are connected to any of the system buses. The main storage device 3 and the IOU 4 are 2
The table is used as one set, and the example of FIG. 1 shows an example in which each set is used one by one. However, this can be used by appropriately increasing the number of sets according to the expansion of the system. The n sets of BPUs shown in the figure usually execute different processes, but all have the same configuration. Therefore, the configuration and operation of the BPU 2-1 will be described as an example unless otherwise required, unless otherwise required. Will be described.

The BPU 2 includes a plurality of microprocessing units 20 (hereinafter, simply referred to as MPUs.
Main units), a plurality of MPU output check circuits 23 (three in the example in the figure), a plurality of cache memories 220 and 221, a plurality of bus interface circuits 27 (hereinafter simply referred to as BIU), etc. Requirements. Here, the schematic operation of the circuit of FIG. 1 will be described. An operation is executed by three MPUs 20, and this MP
The output of U is checked by the check circuit 23, and the outputs of the two MPUs determined to be normal are output to two sets of system bus 1 or two sets of cache memories 220 and 221 via the bus interface circuit 27, respectively. You. If an abnormality is found in one of the MPUs, this MP
U is excluded and its output is output to the two sets of system buses 1 via the bus interface circuit 27 or the two sets of cache memories 22 by the remaining two normal MPUs.
0,221 respectively. After an abnormality is found in a part of the three MPUs 20, the three MPUs 20
The PU 20 is switched to three completely different new MPUs 20 to execute the operation.

II. Configuration of BPU2 A more detailed configuration of BPU2 is shown in FIG. As will be described later, the BPU is preferably provided with the functions shown on a single printed board.

In FIG. 2, three MPUs 20-1 and 20-2 are provided.
For 0-2 and 20-3, a synchronous operation is performed by a clock (not shown), and the result is output to an address line A and a data line D, respectively. MPU 20-1, 20-2, 20
-3 address on address line A and data line D
The above data is provided with an appropriate parity signal from the parity generation / inspection / collation circuits 10 to 15 and supplied to the MPU output check circuit 23. The MPU output check circuit 23 outputs the output from the MPUA (20-1) (address and data to which the parity signal is added) and the MPU (20-
2) First check circuit CHK that compares the output from CHK
AB (23-1), a second check circuit CHKCA (23-2) for comparing the output from MPUA (20-1) with the output from MPUC (20-3), and MPUB (2
A third check circuit CHKBC (23-3) that compares the output from 0-2) with the output from MPUC (20-3).
And error check circuits 234 and 235 for specifying which of the MPUs is faulty according to the comparison results from the three check circuits CHK. The MPU output check circuit 23 is a so-called majority circuit, and the three-state buffers 200, 201, 20
The open / close state of 3,204,29 is controlled. The relationship between this determination result and the state of the three-state buffer circuit will be described later. In short, the MPU determined to be abnormal is not used anymore, and the output of the MPU determined to be normal is given to the two cache memories 220 and 221 so that It is operated as a heavy system. In the following description, the enabled state of the three-state buffer circuit is simply called an open state, and the disabled state is called a closed state.

Three-state buffers 200, 201, 20
The addresses and data obtained through the third and fourth cache memories 220 and 221 are supplied to the two cache memories 220 and 221 respectively.
The parity added by the check / check circuits 10 to 15 is checked. Further, the MPU output is supplied to the synchronization circuits 290 and 2
At 91, the two MPU outputs are synchronized and sent out to the system bus via the bus interface unit BIU. At this time, the parity check circuits 30 and 31 check the parity given by the parity generation / check / check circuits 10 to 15. The above configuration is MP
It mainly describes write access from U,
As described above, in the case of write access from the MPU, the MPU
Output check circuit 23 and parity check circuits 30 and 3
At 1 a check is made. On the other hand, at the time of cache read access, each of the cache memories 220, 2
Signal transmission is performed at the roots of the 21, 3-state buffers 202, 205 and the MPU.
The check and collation circuits 10 to 15 check addresses and data from the cache memory. 26-
Reference numerals 1 and 26-2 also denote three-state buffers, and the open / close state is controlled in accordance with the result of the address and data check by the parity generation / check / check circuits 10 to 15 at the time of cache read access.

As is apparent from the configuration of FIG. 2, in the BPU system of the present invention, at least three MPUs, an abnormal MPU detection circuit by a majority circuit, a duplicated cache memory, and a duplicated output circuit portion are used. Have.

III. Anomaly Detection Method The MPU output check circuit 23 and many parity check circuits are employed as an abnormality detection unit in the BPU of FIG. In this section, these abnormality detection methods will be described.

<< Abnormality Detection by MPU Output Circuit >> FIG. 3 shows an MPU output check portion. FIG.
, The output of the first check circuit CHKAB is set to AB,
The output of the second check circuit CHKCA is CA, the output of the third check circuit CHKBC is BC, the output of the error check circuit 231 is Ag, Cg, and 29g, respectively. The relationship with the open / closed state of the circuit will be described. In this figure, C is a control line not described in FIG.

First, first to third check circuits CHK
Obtains the two sets of inputs (address, data, control signal), and the first check circuit CHKAB outputs the MPUA
The comparison result AB between the output of MPUA and the output of MPUB, the second check circuit CHKCA indicates the comparison result CA between the output of MPUA and the output of MPUC, and the third check circuit CHKBC indicates M
A comparison result BC between the output of PUB and the output of MPUC is output. The result of this comparison is a status signal that either matches or does not match.

The error check circuit 231 obtains (1), (2) from the outputs AB, BC, and CA of the three check circuits CHK.
MPUA, MPUB, MPUC according to equations (2) and (3)
Are obtained, the outputs Ag, Bg and Cg representing the normality of. 2 and 3, the error check circuit is duplicated.

Ag = “AB ·“ CA + ”AB · BC · CA + AB · BC ·“ CA... (1) Bg = “AB ·“ BC + ”AB · BC · CA + AB ·“ BC · CA... (2) Cg ” = "BC /" CA + AB / "BC / CA + AB / BC /" CA ... (3) where AB: event of output mismatch between MPUA and MPUB (confirmed in 23-1) BC: event of output mismatch between MPUB and MPUC CA: event of output mismatch between MPUA and MPUC (confirmed in 23-2) •: logical product (AND) +: logical sum (OR) “: negation (NOT) (1), (2) ), (3) The open / close state of the three-state buffers 200, 201, 20 3 , 20 4 , 29 is controlled in accordance with the result of the operation of the expression (3), which will be described in the following section.
Three check circuits CHKAB, CHKBC, CHKC
9 is a table summarizing the output of A (coincidence, non-coincidence), the abnormal MPU determination results Ag, Bg, Cg at this time, and the open / closed state of the three-state buffer circuit as a result. In addition,
In the judgment result section in Table 1, 1 means MPU is normal, and 0 means abnormal or unknown.

Table 2 shows a part of the cases assumed as the cause of the output of the check circuit for the match / mismatch of Table 1. (The present invention shows how to change the circuit configuration in the BPU when an abnormality occurs. The main purpose is whether to change to and continue the operation, and it is not the purpose of specifying the cause of the abnormality), and the detailed description is omitted here.

[0025]

[Table 1]

[0026]

[Table 2]

As described with reference to FIG. 3, FIG. 2, Table 1 and Table 2, in the present invention, the MPU output check circuit 2
At 3, the MPU is judged to be normal or abnormal by the above logic.

Next, an abnormality detection method using a parity check circuit adopted as another abnormality detection method in each section in the BPU will be described. However, since the parity check circuit itself is well known and any one can be adopted, detailed description of the circuit is omitted, and here, a method of identifying an abnormal part when a parity error is detected will be described.

As shown in FIG. 2, at the time of write access, an appropriate parity signal is added from the parity generation / check / verification circuits 10 to 15 and information is sent to the address line A and the data line D. , 30, 31. At the time of read access, the parity generation / inspection / collation circuits 10 to 15 and the parity check circuits 250, 30, and 31 detect an abnormality in information. These parity checks are basically performed individually for each of address and data. Regarding the address, when a parity error is detected in the address information, the abnormal location is the bus master transmitting this address signal, and a bus arbiter (not shown) that grants the right to use the internal bus shown in FIG. The device that becomes the bus master by monitoring the bus grant signal (MP
U, cache memory, BIU) can be specified. Next, regarding data, when a parity error of data information is detected at the time of write access, an abnormal portion is a bus master that transmits this data signal. The bus master is specified by monitoring a bus grant signal of a bus arbiter. Lastly, when a parity error of data information is detected during read access, the abnormal point is the output source of this data signal. This is determined by decoding the device indicated by the address attached to this data by decoding the address. it can.

The concept of specifying the abnormal portion is expressed by a logical expression as follows.

<< Abnormality Detection by Parity Check >> PTYGEN / NG = APE · MPU / MST + DPE (WT · MPU / MST + RD · MPU / SND) (4) Cach / NG = APE · Cach / MST + DPE (WT · Cach / MST + RD · Cach / SND) (5) BIU / NG = APE / BIU / MST + DPE (WT / BIU / MST + RD · BIU / SND) (6) SYSBUS / NG = BIU / NG (7) However, in equations (4) to (7), PTYGEN: parity generation / check / collation circuit 10 to 15 / NG: parity error APE: address parity error-: logical product / MST: bus master +: logical sum DPE: data parity error WT: Bus master outputs data Cach: Cache memory RD: Bus master Over data input / SND: data output based on IV. Configuration Change Control at the Time of Abnormality An abnormality in the BPU includes one detected by the MPU output check circuit at the time of write access from the MPU and one detected by the parity check circuit at the time of write access or cache read access.

[Configuration Change When MPU Output Check Circuit Detects Abnormality] The 3-state buffers 200 and 201 respond to the output Ag of the error check circuit 231 of the MPU output check circuit 23, and 203 and 204 respond to Cg.
However, the open / close state of 29 is controlled as shown in Table 1 according to 29g. In Table 1, the MPU determination result A
g = 1 basically corresponds to 200,201 open, Ag = 0 basically corresponds to 200,201 closed, Cg = 1 203,204 open, Cg
= 0 basically corresponds to the closing of 203 and 204, but Bg and 29g do not correspond. According to 29 g, the open / close state of 29 is closed when Ag = 1 and Cg = 1, and Ag and C
When any of g is 1, only the 3-state buffer 29 in the direction toward the 3-state buffer circuit which has become 0 is released. Hereinafter, each case in Table 1 will be described in more detail with reference to the system configuration in FIG.

Case 1: All MPU outputs match and all MPUs are normal. 3-state buffers 200, 20
1, 203 and 204 are open and 29 is closed, and as shown in FIG. 4A, a system composed of the MPUA and the cache memory 220 and a system composed of the MPUC and the cache memory 221 are independently operated in duplicate.

Case 2: Only the check circuit CHKCA gives a non-coincidence output, and only the MPUB is determined to be normal. As shown in FIG. 2, the MPU is used as a reference for other MPUs and is not configured to provide an output to the cache memory. Therefore, the operation cannot be continued by changing the configuration, and in this case, the system is down.

Case 3: Only the check circuit CHKBC gives a mismatch output, and only the MPUA is determined to be normal. In this case, the three-state buffers 200 and 201
Is open, 203 and 204 are closed, 29 is only the three-state buffer circuit in the direction of the cache memory 221 is open. MPUB and MPUC are stopped, and FIG.
As shown in (b), the operation is performed by a single system using only the MPUA. The reason why only the three-state buffer circuit 29 in the direction of the cache memory 221 is opened is to maintain the identity of the contents stored in the cache memory.

Case 4: Only the check circuit CHKAB provides a coincidence output, and it is determined that MPUA and MPUB are normal. In this case, the three-state buffers 200 and 2
01 is open, 203 and 204 are closed, 29 is only the three-state buffer circuit in the direction of the cache memory 221 is open. In this case, the MPUC is stopped, a dual system is configured by the MPUA and the MPUB as shown in FIG. 4C, and the duplex operation is performed in which the output of the MPUA is monitored by the MPUB. The reason why only the three-state buffer circuit 29 in the direction of the cache memory 221 is opened is to maintain the identity of the contents stored in the cache memory.

Case 5: Only the check circuit CHKAB gives a mismatch output, and MPUA and MPUB are abnormal,
Only MPU C is determined to be normal. In this case, the three-state buffers 200 and 201 are closed,
Is an open state, and 29 is an open state of only the three-state buffer circuit toward the cache memory 220. In this case, the MPUA and the MPUB are stopped, and as shown in FIG.
The islanding operation is performed only by the PUC. The reason that only the three-state buffer circuit 29 in the direction of the cache memory 220 is opened is to maintain the identity of the contents stored in the cache memory.

Case 6: Only the check circuit CHKBC provides a coincidence output, and it is determined that MPUC and MPUB are normal. In this case, the three-state buffers 200 and 2
01 is closed, 203 and 204 are open, 29 is only the three-state buffer circuit in the direction of the cache memory 220 is open. In this case, the operation is basically performed in the same manner as Case 4.

Case 7: Only the check circuit CHKCA provides a coincidence output, and it is determined that MPUC and MPUA are normal. In this case, since the reference MPU is abnormal, only the MPU is disconnected as shown in case 7 of FIG.
The 3-state buffer circuit is MPUC without any change.
And the redundant operation by MPUA is continued.

Case 8: Any of the check circuits CHK has detected a mismatch, and since all MPUs are abnormal, it is impossible to continue the operation thereafter.

As described above, the normality of the three MPUs and their peripheral circuits (for example, parity generation / inspection / comparison circuits) is confirmed, and the configuration change control is performed as appropriate. Only the possible combinations are described, and in practice, the seven abnormal events in cases 2 to 8 do not occur with the same probability. That is, among them, the single failure case is 3, 4, 6, 7 cases, the double failure is 2, 3, 5 cases, and the triple failure is 8,
Case 2 in which operation cannot be continued as is well known
The probability of simultaneous occurrence of multiple faults including 8 is much lower than that of a single fault. In addition, in most cases, a single failure actually progresses and leads to multiple failures. Therefore, by taking some recovery measures at the time of the single failure, a system configuration that does not substantially hinder operation continuity is obtained. be able to. In the present invention, even if a double failure occurs, the operation can be continued without any problem in many cases, and in this sense, it can be said that the system is very reliable.

Although not shown in FIG. 2 at the time of occurrence of the above abnormal event, a signal for stopping the abnormal MPU is generated from the MPU output check circuit 23 to stop it, or is output to the outside to output the signal to the operator. It is a matter of course that the occurrence of an abnormality is notified to notify the necessity of the following measures.

[Configuration Change at the Time of Error Detection by Parity Check] As described in the above section III, at the time of a write access or a cache read access, an abnormal portion of the cache memories 220, 221, BIU 27-1, 27-2 Can be identified. Next, the configuration change control inside the BPU at the time of each abnormality will be described. Note that Table 3 shows that the cache memory 22
0, 221, BIU 27-1, 27-2, 3-state buffers 29, 26-1 , 26-2 are controlled in a list.

[0044]

[Table 3]

FIG. 5 shows a circuit configuration in each case, which will be described below with reference to Table 3 and FIG. FIG.
(A) shows a signal flow in a normal state. in this case,
The 3-state buffers 29 and 26-2 are closed, and 26-1 is open. Therefore, the information from the BIU 27-1 or the cache memory 220 is transmitted to the MPU 20-1 and the MPU 20-1.
It is supplied to B20- 2, BIU27-2 or information from the cache memory 221 is supplied to the MPUC20-3. Thus, typically BIU27-1, cache memory 220, MPUA20-1, MPUB20- 2 constitute one set, BIU27-2, cache memory 221, so MPUC20-3 constitute another set It is operated.

Case 1: The cache memory 220 is abnormal. As shown in FIG. 5B, the cache memory 220
Is stopped, and the 3-state buffer 29
It is controlled so that only the signal to the 20-1 side passes, and 3
State buffer 26 -1 closed, 26-2 are opened. As a result, all MPUs are stored in the cache memory 22.
1 to receive the common information, and the operation is continued even after the abnormality is found. The three-state buffer 26 −
The reason for switching from the normal state, such as closing 1 and opening 26-2, is that even if it is logically specified that the cache memory 220 is abnormal, there is also a possibility that the internal bus to which the cache memory 220 is connected is abnormal. It cannot be denied, and is switched to the cache memory 221 side just in case. If the internal bus to which the cache memory 220 is connected is abnormal,
Since the three-state buffer 29 is in one-way communication, the effect does not appear on the MPUC side.

Case 2: The cache memory 221 is abnormal. As shown in FIG. 5C, the cache memory 221
Is stopped, and the 3-state buffer 29
Control is performed so that only the signal to the 20-3 side passes, whereby all the MPUs are configured to receive the common information from the cache memory 220, and the operation is continued even after the abnormality is found.

Cases 3 and 4 : BIU 27-1 or 27-
2 or an abnormality in the connected system bus 1-1. As shown in FIGS. 5D and 5E, the BIU 27-1
Or 27-2 or its connected system bus 1-
Stop the first side and operate as in Case 1.

As described above, when an error due to a parity error is detected, an external notification of the error is made along with the configuration change.

As described in detail above, according to the present invention, even if an abnormality occurs in the BPU, a part of the circuit configuration is cut off or the flow of information is changed to obtain the same information as in the normal state. Operation can be continued. Therefore, if an error occurs during data processing, (1)
If the operation in the BPU is continued until a good cut or repair / maintenance time, and (2) the process executed in the BPU at the good cut or repair / maintenance time can be taken over by another normal BPU. good.

As a result, it is not necessary to perform a backup operation in preparation for a checkpoint restart when an error occurs.
Processing performance can be improved.

V. Signal processing at the time of connection of internal bus As described above, switching of the internal bus is performed using the three-state buffer 29 in the event of an abnormality in each unit. In comparison, it takes time to switch, and it takes time to detour between buses. As an improvement measure, FIG.
It is effective to extend the bus cycle by retry only when an abnormality occurs, as described above, without causing a delay in the bus cycle.

That is, an abnormality is found (step S
1, S2), a signal for retrying is asserted in step S4, the abnormal output is stopped in step S5 (disconnection operation of abnormal MPU, etc.), and the bypass processing of the normal output is performed. Is asserted to end a series of processing. Note that when it is normal, it is only necessary to assert a signal for ending this bus cycle in step S3. Terminate bus cycle to MPU,
The name of the signal line for retrying differs depending on the type of MPU, but in many MPUs, the MPU automatically executes the retry signal by inputting the signal to the MPU. Table 4 shows typical MPU signal names.

[0054]

[Table 4]

FIGS. 7 and 8 show the flow of signals when the retry method of FIG. 6 is employed at the time of write access. FIG. 7 shows a normal state and FIG. 8 shows an abnormal state. In the figure, the vertical axis shows the passage of time, and the horizontal axis shows the circuits of each unit until the MPU output reaches the cache memory. Usually, an address signal is output from the MPU prior to the data signal. In FIG. 7, since both the address signal and the data signal are normal, the MPU output check circuit 23,
The parity check circuit 250 determines that the state is normal,
An end signal is returned to U, the data is stored in the cache memory 220, and the bus cycle ends.

In FIG. 8, the MPU is abnormal, and both the address signal and the data signal are determined to be abnormal by the MPU output check circuit 23. A retry signal is returned to each MPU together with an end signal, and a retry operation is started. At the time of the retry operation, the three-state buffers 200 and 201 are closed to prevent signal transmission from the MPUA to the internal bus, and the three-state buffer 29 is opened only in one direction to supply the MPUC output signal to the cache memory 250 as well. Thereafter, an end signal is returned to each MPU, and the operation ends.

FIGS. 9, 10 and 11 show the flow of signals when the retry method of FIG. 6 is employed at the time of cache read access. FIG. 9 shows a normal state, FIG. FIG. 11 shows the case where the data signal is abnormal. In FIG. 9, since the address signal and the data signal are both normal and no abnormality is found, an end signal is returned to the MPU, and the MPU stores the data from the cache memory 250 and ends the bus cycle. In FIG. 10, MP
The address signal from the UA is determined to be abnormal because the address signal does not match with the others, and a retry signal is returned to each MPU together with an end signal, and a retry operation is started. At the time of the retry operation, the 3-state buffer 201 is closed to prevent signal transmission from the MPUA to the internal bus, the 3-state buffer 29 is opened in only one direction, and the address output signal of the MPUC is supplied to the cache memory 220. The data stored at the given address is transferred to MPUA and MPUB
To supply. Thereafter, an end signal is returned to each MPU, and the retry operation ends.

In FIG. 11, there is an error in the data from the cache memory 220, and the parity generation / collation check circuit 1
0, 12, the parity check by the parity check circuit 250 determines that the operation is normal, and returns a retry signal together with an end signal to each MPU to start a retry operation. During the retry operation, the output of the cache memory 220 is blocked, the three-state buffer 29 is opened in only one direction, and the output of the cache memory 221 is supplied to the MPUA and the MPUB. It should be noted that in this case, switching the three-state buffer 26 -1 closed, from a normal state as open 26-2, the cache memory 221 via the 3-state buffer 26-1
Is supplied to the MPUB, it is possible to prevent erroneous data from being supplied to the MPUB due to an abnormality in the path of the data signal from the cache memory 220 to the MPUB.

VI. Recovery measures after occurrence of abnormality As described above, the device of the present invention can continue to operate even after occurrence of abnormality.However, it is difficult to operate the system permanently with this configuration, considering the possibility of secondary failure, to quickly return to the initial state. Next, a recovery measure for normally recovering the function of the BPU generated above will be described. The method is achieved by forming the BPU of FIG. 1 on one printed board and replacing the abnormal BPU printed board with a normal BPU printed board.

FIG. 12 shows the structure of a computer board. When the door is opened, a slot for accommodating a printed board is formed inside the computer board. Each printed board constituting the output control unit BIU4 is inserted, and in the inserted state, is connected to a system bus not shown in FIG. In the illustrated example, there are 12 slots SL, of which SL
1, a printed board is inserted into SL3 to SL6, and another SL is inserted.
2, SL7 to SL12 are empty slots. The printed board PL inserted into the slot SL may be a known one. However, in the present invention, a lever 282 for fixing the printed board to the slot SL, an indicator lamp indicating whether the printed board is stopped or not. 280, and a print board removal request button 281 as needed. Hereinafter, the procedure for replacing the BPU printed board will be described.

<< Replacement when one BPU printed board is used >>
FIG. 13 shows a system bus (shown as a single system for convenience of explanation).
Among the n slots SL to which the printed circuit board PL can be connected, 1 is a BPU or SL2 in which an abnormality has occurred inside SL1.
Shows an example in which a print of IOU4 is inserted into the main storage device 3 and SLn, respectively, and SL3 is an empty slot. Here, the new BP that should function instead of the abnormal BPU
U has not yet been inserted into the slot. The display lamp 280 on the printed board is turned off because it is in operation.

In this state, in order to take over the function of the old BPU 2A to the normal new BPU 2B, first, an empty slot is prepared. In the example of FIG. 13, since the slot SL3 is an empty slot, the new BPU 2B is inserted into the empty slot SL3 next.

BPU2A detects the insertion of BPU2B,
By the processing of the operating system (hereinafter abbreviated as OS), the task running on the old BPUA can be changed to the new BPU2B.
To display lamp 2 on the printed board of the old BPU2A
Light 80. After that, the online business will be the new BPU2
Executed by B. Business transfer from the old BPU 2A to the new BPU 2B is instantaneous. Thereafter, the display lamp 280 on the old BPU printed board is turned on, and after confirming that the BPU is in the stop state, the old BPU 2A is removed.
According to the above procedure, since the online business has been transferred to the new BPU 2B before the old BPU 2A is pulled out, the BPU can be replaced without stopping the system and without reducing the system performance.

FIG. 14 shows the BP for the example shown in FIG.
It is a BPU exchange procedure processing flow showing the contents of the processing by dividing the U exchange procedure into human operation and processing inside the computer.
When replacing a BPU , first prepare an empty slot (St
1) Yes. If there is an empty slot that is already unused, use that empty slot.If there is no empty slot, if there is a hardware board that can be temporarily removed, remove the board and temporarily remove the empty slot. It is also possible to prepare a free slot by returning the board again after replacing the target BPU. Next, a new BPU is inserted into an empty slot (St 2 ). The old BPU 2A recognizes the BPU insertion by means such as an interrupt (St 3 ). Then, the old BPU 2A saves the currently running task on the main storage device (St 4 ), and the new BPU 2A
Allow B to continue processing the task. New BPU
2B receives this, executes the task (St5), and starts an online job. The old BPU 2A turns on the board stop lamp on the BPU by itself (St6), and stops the processing (St7). Then, after the human confirms that the board stop lamp on the old BPU is lit (St8), the old BP
U is removed (St9). This completes the BPU exchange.

FIG. 15 shows the old BPU in the above embodiment.
FIG. 14 is a diagram for explaining in detail means for taking over a task being executed on 2A to a new BPU 2B. Old BP for system bus
The U2A, the new BPU 2B, and the printed board of the main storage device 3 are mounted. A task 920-1 is being executed on the old BPU 2A. At that time, if the notification that the new BPU 2B has been inserted enters the old BPU 2A, the old BPU 2A suspends the processing and executes the running task 9
20-1 is saved on the main storage device 3. Meanwhile, the new BPU
2B recovers the task 920-2 following the task 920-1 saved on the main storage device 3, and continues the processing of the task from the point at which it was interrupted. By using the above method, the business between the exchanged BPUs is taken over.

The above is an example of BPU exchange when there is one BPU. In the above embodiment, even when there is one BPU, the BPU can be replaced without stopping the system.

<< Replacement when there are a plurality of BPU printed boards >>
Next, a description will be given of a case where there are a plurality of BPUs or a case where the inserted BPU does not operate correctly. FIG.
In the sixth embodiment, a plurality of BPUs are mounted. Each BPU has a board removal request button 281 and a printed board number 282 as means for designating a BPU to be replaced.

Slots SL1 to SL3 for connecting a printed board to system bus 1 have BPUs 2A, 2
B and 2C are respectively mounted. A main storage device is connected to the slot SL4. Slot SL5 is an empty slot. Further, each BPU has a display lamp 280 which lights up when the BPU stops, and a BPU to be removed.
And a print board removal request button 281 used to designate a print board number, and a print board number 282. Here, the printed circuit board numbers are 1 for BPU2A, 2 for BPU2B, and BP
U2C is promised three. When replacing the new BPU 2D with the old BPU 2B installed in the slot SL2, the new BPU 2D is first inserted into the empty slot SL5. Then, the slots SL1 to SL
The user presses the BPU 2B removal request button 281 of the slot SL2 to be exchanged among the BPUs attached to L3. Then, the old BPU 2B saves the running task and its own printed board number on the main storage device 3, and stores the new BPU
The 2D fetches the printed board number saved on the main storage device 3 and executes the task under saving. The old BPU 2B turns on the display 280 and stops itself. After that, the old BPU2B
After confirming that the board stop lamp 280 is lit,
Remove the BPU 2B.

FIG. 17 shows B in the example shown in FIG.
It is a BPU exchange procedure processing flow showing the contents of the processing by dividing the PU exchange procedure into human operation and processing inside the computer.

When replacing the BPU, first, an empty slot is prepared (St1). If there is an empty slot that is already unused, use that empty slot.If there is no empty slot, if there is a hardware board that can be temporarily removed, remove the board and temporarily remove the empty slot. It is also possible to prepare a free slot by returning the board again after replacing the target BPU.

Next, a new BPU 2D is inserted into an empty slot (St2). Thereafter, the user presses the printed board removal request button of the old BPU 2B to be removed (St3). Then, the old BPU 2B saves the currently executing task and the own printed board number on the main storage device 3 (St4), and the new BPU 2B
Allow D to continue processing the task. New BPU
In response, the 2D executes the task (St5) and starts an online job. The old BPU 2B turns on the display lamp on the BPU by itself (St6), and stops the processing (St).
7) Yes. Then, after confirming that the display lamp on the old BPU 2B is lit (St8), the old BPU 2B is removed (St9). This completes the BPU exchange.

FIG. 18 shows the old BPU in the above embodiment.
FIG. 11 is a diagram illustrating in detail a task that is being executed above and a means for handing over a printed board number to a new BPU. Old to system bus
BPU is three (2A, 2B, 2C), New BPU2D, further main storage device is attached. Old BPU2A, 2
Tasks 1, 2, and 3 are being executed on B and 2C, respectively. The printed board numbers 282 of the old BPUs 2A, 2B, and 2C are 1, 2, and 3, respectively. At that time, remove B
If the print board removal request button of the old BPU2B is pressed to specify the PU, the old BPU2B
Processing is interrupted, task 2 being executed and own printed circuit board number 2
82 is saved on the main storage device 3. On the other hand, new BPU2D
Recovers the printed board number 282 and the task 2 saved on the main storage device 3 and continues the task processing from the interruption point. By using the above method, the business between the exchanged BPUs is taken over.

According to this embodiment, the BPU to be replaced
Has the advantage that even if a plurality of BPUs are installed, the BPU can be replaced without stopping the system and without deteriorating the system performance. .

Further, by taking over the printed circuit board number assigned to the exchanged BPU between the exchanged BPUs, the BP can be changed without changing the user program even when the operation printed circuit board number is designated by the user program.
There is an advantage that U can be exchanged.

<< When the inserted BPU does not operate properly >> On the other hand, if the replaced new BPU does not operate normally, there is a disadvantage that the system is seriously affected. According to FIG. 19 and FIG. 20, there is provided a means for checking the operation of the inserted BPU, and there is no effect on the system even if the newly inserted new BPU does not operate normally.

FIG. 19 is a diagram showing a state where the new BPU 2B is inserted. At this time, a task is being executed in the old BPU 2A. When the new BPU 2B is inserted, the BPU self-diagnosis program 925 is executed to perform an operation check on the BPU. Until the diagnosis program ends normally, the old BPUA is not notified of the board insertion. If a failure point is found in the new BPU by the diagnostic program 925, the old BPU is not contacted, the display lamp 280 of the own BPU 2B is turned on, and the processing is stopped. In the old BPU, the new B
The task processing is continued as if nothing had happened without interrupting task 1 at the PU insertion timing.

FIG. 20 is a BPU exchange procedure processing flow showing the contents of the BPU exchange procedure in the above embodiment, which is divided into human operation and internal computer processing. St
The processes of 1, St2, St4 to St8, and St11 to St13 are completely the same as those in FIG. 21 and thus will not be described here. Only the processes unique to this embodiment will be described.

When a new BPU is inserted, a diagnostic program is first executed to check the operation of the new BPU (S
t3). If the result of the diagnosis program indicates that the condition is normal, the process proceeds to step St4 as in the previous embodiment. However, if it is determined that a failure has occurred, the display lamp on the inserted new BPU is turned on (St9), and the processing of the new BPU is stopped (St10). Thereafter, the lighting of the display lamp on the new BPU is confirmed (St14), and the new BPU is removed again (S14).
t15). As a result, although the exchange of the BPU has failed, the online system is not affected because the old BPU continues the processing. Whether or not the replacement has succeeded is determined based on which display lamp of the new and old BPU is turned on after the BPU is inserted.

As described above, according to the method of the present embodiment, even when the inserted BPU does not operate normally, it is possible to eliminate the influence on the online system.

<< Configuration and Processing Before and After Abnormality Occurrence >> FIG. 21 shows the processing and configuration of the MPUs in the old BPU 2A and the new BPU 2B in chronological order, and shows three MPUs of the BPU 2A during normal operation. Are operating, and the majority result is output. Then, during the execution of the process B, the MP
If a failure occurs in the UC, it is disconnected and the MPUA and MP
The operation is normally continued by the multiplexing circuit configuration based on the UB. On the other hand, when the printed board of the new BPU 2B is inserted into the empty slot by the notification of the abnormality of the MPU, each MPU in the new BPU 2B performs a self-diagnosis, and at an appropriate time, the processing is performed by the old BPU 2B.
The process D is transferred from the PU 2A to the new BPU 2B, and the process D based on the majority decision result of the three MPUs (MPUD, MPUE, MBUF) of the BPU 2B is executed. In this process takeover, the operation in the BPU is continued until a good cut or a repair / maintenance time, and the process executed in the BPU at the good cut or the repair / maintenance time is taken over to another normal BPU. It can be done at the point where the performance is the most desirable due to the software. It is clear that such a timing is generally suitable for the task switching timing. This is because the switching of the BPU can be performed in exactly the same procedure as the switching of the processor in the multiprocessor system, and the extra performance overhead associated with the takeover can be reduced to zero. Therefore, according to the present invention, the backup operation for the checkpoint restart at the time of occurrence of a fault becomes unnecessary, and the processing performance can be improved.

When a fault occurs, the hardware records the fault occurrence status in a register, and the operating system refers to the register at the time of a context switch or at the time of an interrupt process for repair and maintenance. If necessary, it notifies the BPU of the processing takeover destination by an interrupt or the like, and ends the processing in the own BPU. When a failure occurs in a part of the elements (MPU, cache memory, etc.) constituting the BPU 2, even if the other elements are normal, after the processing is taken over in this method, the entire BPU 2 including the other normal elements is processed. Stop using.

FIG. 22 schematically shows the difference between the configuration of the present invention and that of the known example at the time of takeover when the MPUA, MPUB, and MPUC, which have been made redundant for fault tolerance, suffers a failure or the like. Show. In the conventional method, only the failed MPUA is replaced with a normal MPUD. On the other hand, in the method according to the present invention, not only the failed MPUA but also the normal MPUB, MPU
C has also been newly exchanged for MPUD, MPUE, and MPUF. As described above, a combination of redundant MPUs for fault tolerance, that is, an MPU
The combination of A, MPUB, and MPUC can be fixed. Therefore, if the combination of MPUs is used as an exchange unit,
The MPUs constituting each combination can be connected by a high-speed clock, and a high-speed fault-tolerant computer can be realized. Further, unlike the related art, various hardware and software associated with the MPU rearrangement are unnecessary.

Since the BPU can continue its operation in the case of a single failure, it is not necessary to immediately carry out this processing immediately after the occurrence of the failure. Just do it.

According to the present embodiment, the wiring board of the failed BPU 20-1 can be pulled out and replaced with a normal wiring board while the processing is continued.

VII. The present invention has been described above with reference to alternative modifications of the respective circuits. However, the respective circuits and the like of the present invention can be realized by appropriately changing them. Hereinafter, these alternatives and modifications will be described.

<< Majority Logic Unit >> FIG. 23 shows how the majority logic circuit unit of FIG. 2 is assembled and switched in a simplified and easily understandable form by omitting other components.
MPUA and MPUC are fixed for output only and used.
The UB is used only as a reference for checking the soundness of the MPUA and MPUC, and when an error occurs in the MPUA or MPUC, one of the outputs whose soundness is checked is used in common and supplied to two sets of cache memories. Things. In the case of this method, the output of the MPU is directly input to the cache memory without passing through the majority circuit, so that the cache memory access time can be reduced by the delay time in the majority circuit.

In the present invention, the operation is continued by switching the triple system to the double system by using the majority logic as described above. can do. For example, in FIG.
The output of one MPU is given to each of the majority decision circuits 210 and 211, and one output whose soundness is confirmed is selected from the three MPUs. In this case, the data in the cache memory connected to the failed majority decision circuit is destroyed, but the operation can be continued using the data in the cache memory connected to the normal majority selection circuit.

Further, as shown in FIG. 24, the output of the MPU is directly input to the cache memory without passing through a gate circuit, a switching circuit, etc., and the operation of the cache memory which receives a signal from the abnormal MPU is stopped. If data is not used, the cache memory access time can be further reduced by the delay time of the gate circuit, switching circuit, and the like. In addition, since the means for switching between the address bus and the data bus including many signal lines becomes unnecessary, the amount of hardware can be reduced.

FIG. 26 shows four MPUs. The MPU and the MPUC are fixed for output only, the MPUB and the MPUD are used for their reference, and the output-only MPU is used by matching two sets of outputs.
Respectively. When the MPU is abnormal, it can be dealt with by a method of switching to a healthy one and using it, or a method of stopping the operation of the cache memory receiving a signal from the abnormal MPU and not using the data thereafter. .

<< Read Access Unit for Cache Data >> Further, regarding the cache memory, the output (data) of the cache memories 220 and 221 can be determined to be normal / abnormal by the parity check. MPUA output of the cache memory that is judged to be normal through the switching means 206,
Input to MPUB and MPUC. If both cache memories are normal, the master and slave of the cache memory may be determined in advance, and the output of the master may be selected.

Also, as shown in FIG. 28, MPUA and MPUB each have a cache memory of 22
Alternatively, the output of the selected cache memory may be input only to the MPU and fixed to 0,221. In this case, even if one of the cache memories fails, two of the three MPUs can operate normally and the amount of hardware can be reduced.

[0092]

According to the present invention, even when a plurality of processor boards are mounted, the system can be stopped without stopping.
Further, replacement of the processor board can be realized while suppressing a decrease in system performance.

[Brief description of the drawings]

FIG. 1 is a diagram showing the overall system configuration of the present invention.

FIG. 2 is a diagram showing a configuration of a BPU of the present invention.

FIG. 3 is a diagram showing an embodiment of an MPU output check circuit.

FIG. 4 is a diagram showing a configuration of a BPU when an abnormality occurs in a write access.

FIG. 5 is a diagram showing a configuration of a BPU at the time of abnormality in read access.

FIG. 6 is a flowchart of a bus cycle control.

FIG. 7 is a diagram showing a signal flow in a BPU when the MPU is normal.

FIG. 8 is a diagram showing a signal flow in a BPU when an MPU is abnormal.

FIG. 9 is a diagram showing a signal flow in a BPU when the MPU is normal.

FIG. 10 is a diagram showing a signal flow in a BPU when an address signal is abnormal.

FIG. 11 is a diagram showing a signal flow in a BPU when a data signal is abnormal.

FIG. 12 is a diagram showing a computer board configuration.

FIG. 13 is an explanatory diagram of a BPU exchange principle.

FIG. 14 is a diagram showing a BPU replacement procedure.

FIG. 15 is a diagram showing processing takeover of new and old BPUs.

FIG. 16 is an explanatory diagram of a BPU exchange principle at the time of a multiprocessor.

FIG. 17 is a diagram showing a BPU exchange procedure at the time of a multiprocessor.

FIG. 18 is a diagram showing takeover of old and new BPU processes at the time of a multiprocessor.

FIG. 19 is a diagram showing a BPU replacement process when an inserted BPU fails.

FIG. 20 is a flowchart of a BPU replacement process when an inserted BPU fails.

FIG. 21 is a diagram showing handover of processing when a BPU fails.

FIG. 22 is a diagram showing handover of processing when a BPU fails.

FIG. 23 is a view showing an embodiment of comparison and collation by 3MPU.

FIG. 24 is a view showing another embodiment of comparison and collation by 3MPU.

FIG. 25 is a view showing another embodiment of a majority decision system.

FIG. 26 is a diagram showing an embodiment of comparison and collation by 4MPU.

FIG. 27 is a diagram showing read access of cache data.

FIG. 28 is a view showing another embodiment of read access of cache data.

[Explanation of symbols]

1: System bus, 2: BPU, 10, 11, 12, 1
3, 14, 15 ... parity generation / check and collation circuit, 20 ...
MPU, 23: MPU output check circuit, 27: BIU
(Bus interface unit), 30, 31 ... parity check circuit, 26-1 , 26-2 , 29, 200 to 205 ... 3-state buffer, 220, 221 ... cache memory, 234, 235 ... error check circuit.

──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Tomoaki Nakamura 5-2-1 Omikacho, Hitachi City, Ibaraki Prefecture Inside the Omika Plant, Hitachi, Ltd. (72) Inventor Masayuki Tanji 5-2-2 Omikacho, Hitachi City, Ibaraki Prefecture No. 1 Inside the Hitachi, Ltd. Omika Plant (72) Inventor Shigenori Kaneko 5-1-2, Omika-cho, Hitachi City, Ibaraki Prefecture Inside the Hitachi Ltd. Omika Plant (72) Inventor Koji Masui 5-chome, Omikamachi, Hitachi City, Ibaraki Prefecture No. 1 Hitachi, Ltd. Omika Plant (72) Inventor Saburo Iijima 5-2-1 Omikacho, Hitachi City, Ibaraki Prefecture Within Hitachi Process Computer Engineering Co., Ltd. (72) Inventor Shinichiro Yamaguchi Hitachi, Ibaraki Prefecture 7-1-1, Omikacho Hitachi, Ltd. Hitachi Research Laboratory (72) Nobuyasu Kanakawa 7-1-1, Omika-cho, Hitachi City, Ibaraki Prefecture Within Hitachi Research Laboratory, Hitachi, Ltd. (72) Inventor Yoshiki Kobayashi 7-1-1, Omika-cho, Hitachi City, Hitachi City, Ibaraki Hitachi, Ltd. Hitachi Research Laboratory (56 References JP-A-63-298613 (JP, A) JP-A-2-246597 (JP, A) (58) Fields investigated (Int. Cl. ⁷ , DB name) G06F 3/00 G06F 11/16- 11/20

Claims (3)

(57) [Claims] 1. A system bus comprising a plurality of slots for inserting a board, the slot comprising a board of a main storage device and a plurality of processors for executing the same operation.
In high reliability computer system in which a plurality of basic processing blocks single unit board is operated is inserted, the board part of the basic processing unit
A method for restoring a highly-reliable computer system, comprising a board removal requesting means, and restoring from a degraded operation state due to a partial processor failure as follows. a. Old basic processor with failed processor
Sing unit is a board unit provided on its own board.
The task being executed is
The identification number indicating the own board is saved in the main storage device. b. Inserted new basic processing blocks Thing unit
An input and an evacuation task identification number to the main memory
And the old basic processing unit should be run
The process is subsequently executed. c. To stop the old basic processing blocks single unit. 2. A system for inserting a board onto a system bus.
It has multiple slots, and the main storage
And multiple processors that perform the same operationEstablishedMultiple
Basic processorThing unitBoard and insert
Operating in a reliable computer system
Basic processorThing unitThe board is part of it
Board removal request means, and some processors
The recovery from the degraded operation state due to the failure of the
To restore a highly reliable computer system
Law. a.Having a failed processorOld basic processor
Sing unitIs selfBoardBoard
The task being executed is
Save the identification number indicating its own board to the main memory
You. b.InsertedNew basic processorSing unit
IsPerform self-diagnosis and only if it is normalMain storage device
Enter the saved task and identification number in the old basic
CuprosséSing unitThe process to be executed
Execute. c. Old basic processorSing unitTo stop. 3. A system bus comprising a plurality of slots for inserting boards on the system bus, the slots comprising a board of a main storage device and a plurality of processors executing the same operation .
When a fault occurs in a part of the circuit,
Multiple of basic professional set Shin to continue operation Reno configuration
In a high-reliability computer system that operates by inserting the board of the storage unit, in the event of a processor failure, temporarily remove the removable board and replace it with new basic processing.
Insert the board of the unit,
Processing of old basic processing unit
Transfer to the basic processing unit and start operation
Stop the old basic processing unit
Removed from the lot and removed to the slot after removal
Recovery how of highly reliable computer system, characterized in that it allowed to operate by inserting the board.