JP3511033B2 - Fault tolerant computer equipment - Google Patents

Description

Description: BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system requiring high reliability, such as an attitude control system, for an aircraft (satellite) navigating in outer space. A suitable fault tolerant computer device. 2. Description of the Related Art Generally, a computer is used as a control device of various systems. In a system requiring high reliability, two central processing units operate in exactly the same manner. . Normally, a system is adopted in which system control is performed by the main central processing unit, and when an abnormality occurs in the main central processing unit, the system is switched to the sub central processing unit for operation. In this case, the power of the main central processing unit is turned off and the system is shut down, and the system is switched so that the sub central processing unit performs system control instead. Conventionally, a diagnostic device using a watchdog counter has been used as a method for realizing this.
As shown in FIG. 3, the diagnostic apparatus monitors a pulse output from a central processing unit that operates by alternately repeating an operation period and a stop period at a constant cycle. The central processing unit outputs this pulse in synchronization with the suspension period, and this pulse is used as a clear pulse of the counter. When the counter does not supply a clear pulse of a predetermined period from the central processing unit, the counter determines that the count value is equal to or more than a predetermined value and the central processing unit is in a runaway state, and turns off the power of the central processing unit. It is configured. [0004] The present invention is, however, in the above abnormality judgment means, a runaway state as a central processing unit continuously outputs clear pulse (as indicated by the broken line in FIG. 3
In addition, a clear pulse is output irrespective of the fixed period.
When it becomes a by which) it is impossible to detect this. This is because the counter is always cleared and the count does not increase. Therefore, an object of the present invention is to provide a fault-tolerant computer device capable of more accurately diagnosing a runaway state of a central processing unit. According to the present invention , calculation processing is set to be performed in a fixed cycle including an arithmetic processing period (during operation) and a vacant period (during stop) alternately. the arithmetic processing period and (in operation) and a central processing unit for outputting an identification signal identifying the idle period (stopped), the unique stop which is synchronized with the idle period of a constant cycle of the central processing unit A check pulse is generated and the
The generation of a stop check pulse is repeated in the fixed cycle.
Return stop check pulse generating means, the stop check pulse and the identification signal are supplied, and the central processing unit runs away and the central processing unit runs out of control when the identification signal indicates the arithmetic processing period at the time of occurrence of the stop check pulse. JP by comprising a detecting means for turning off the power of the processing unit
As a result, a fault-tolerant computer device is obtained . According to the above means, when the central processing unit runs away, the logical product of the stop check pulse and the identification signal indicating the stopped state cannot be obtained, so that the runaway state of the central processing unit can be accurately detected. You can do it. An embodiment of the present invention will be described below with reference to the drawings. FIG. 1 shows an embodiment of the present invention, which is used, for example, in a satellite attitude control device. Central processing unit 10
1 and 102 are connected to a common random access memory (RAM) 104 and a read-only memory (ROM) 105 via a common bus 103. Further, the central processing units 101 and 102 include an external device (an actuator wheel to be controlled, a gas jet thruster, etc.) 10
6. Connected to input device 107 for collecting various data. The central processing units 101 and 102 execute calculation processing in a fixed cycle including an arithmetic processing period (during operation) and an idle period (during stop), respectively.
An identification signal A that identifies an arithmetic processing period (during operation) and an idle period (during stop) is output. This identification signal is supplied to abnormality monitoring circuits 11 and 12 provided corresponding to the central processing units 101 and 102, respectively. The monitoring operation of the central processing unit 101 will be described as a representative. The abnormality monitoring circuit 11 includes the central processing unit 1
01 the idle period during the constant cycle (during suspension)
To generate a unique stop check pulse that made me synchronized with the
At the same time, the generation of the stop check pulse is
A stop check pulse generating means that repeats the stop check pulse (the stop check pulse
Refer to the stop check pulse in FIG.
It is clear if you do). Further, the stop check pulse from the stop check pulse generating means is supplied to the check means. The check means calculates the logical product of the identification signal and the stop check pulse, and obtains the power control signal B of the central processing unit according to the result of the logical operation. If the stop state is confirmed by the check means, the check means continues the operation of the central processing unit 101. Conversely, if the operation state is confirmed, it is determined that the central processing unit 101 is running out of control. The power of the processing apparatus 101 is turned off. When the power of the central processing unit 101 is turned off, the central processing unit 102 that performs the same operation instead of this operates the system. FIG. 2 is a time chart showing an operation example of the apparatus of the present invention. If the central processing unit is operating normally, a stop check pulse is generated when the identification signal A is at a level (for example, 0) indicating that the operation of the central processing unit is stopped. At this time, for example, a counter clear pulse is obtained. Further, when the central processing unit is in the runaway state and the identification signal is at the level indicating the operating state (for example, 1) and the stop check pulse is generated, the counter clear pulse is not obtained and the count value of the counter increases. When the count value of this counter increases, a power control signal B for turning off the power of the central processing unit is obtained. FIG. 2 shows that the power is turned off in the second cycle after the central processing unit goes out of control, but this is set so that the power is turned off with a delay of several cycles. Is also good. In particular, in a special atmosphere such as outer space, for example, it is assumed that one of the processing devices is irradiated with radiation, and a part of data changes from 0 to 1 or from 1 to 0. Since such a single or accidental error may return to a normal state when the processing device itself is reset, a period for resetting the power without immediately turning off the power may be given. Further, in the above description, the abnormality monitoring circuit 11 has been described, but the abnormality monitoring circuit 12 also performs similar monitoring on the central processing unit 102. As described above, the present invention can provide a fault-tolerant computer device capable of more accurately diagnosing a runaway state of a central processing unit.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a configuration explanatory view showing one embodiment of the present invention. FIG. 2 is a time chart shown for explaining the operation of the apparatus of FIG. 1; FIG. 3 is a time chart for explaining the operation of the conventional device. [Description of Signs] 101, 102: Central processing unit. 103 ... data bus. 104 RAM. 105 ROM. 106 ... Output device. 107 ... Input device. 11, 12 ... abnormality monitoring device.

Continuation of the front page (72) Inventor Atsushi Itsukaichi 1 Kosuka Toshiba-cho, Saiwai-ku, Kawasaki-shi, Kanagawa Prefecture Inside the Komukai Plant of Toshiba Corporation (56) References JP-A-63-232857 (JP, A) JP-A-63 JP-A-313245 (JP, A) JP-A-59-139462 (JP, A) JP-A-2-210555 (JP, A) JP-A-2-181240 (JP, A) JP-A-63-313246 (JP, A) (Japanese) Shokai 57-175240 (JP, U) (58) Fields investigated (Int. Cl. ⁷ , DB name) G06F 11/00 G06F 11/28-11/34 JSTPLUS file (JOIS)

Claims (1)

(57) [Claims 1] The calculation processing is set to be executed in a fixed cycle including an arithmetic processing period (during operation) and a vacant period (during stop) alternately. a central processing unit for outputting an identification signal identifying the idle period (stopped) and (during operation), prior to the in certain cycles of the central processing unit
Serial as well as generating its own stop check pulse which is synchronized to the free period, the occurrence of the stop check pulse
Stop check pulse generation that is repeated in a fixed cycle
Means , the stop check pulse and the identification signal are supplied, and the central processing unit is turned off when the identification signal indicates the arithmetic processing period at the time when the stop check pulse is generated due to runaway of the central processing unit. A fault tolerant computer device comprising: