JP3879436B2 - Distributed processing system, distributed processing method, and distributed processing control program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a distributed processing system, a distributed processing method, and a distributed processing control program, and more particularly to a distributed processing system, distributed processing method, and distributed processing control program having fault-tolerant (fault-tolerant) capability.
[0002]
[Prior art]
FIG. 14 is a configuration diagram of an example of a conventional distributed processing system. In FIG. 14, a processor element A; 401a is connected to an apparatus A; 403a by an input / output unit A; 402a, and input data A; 405a from the apparatus A; 403a is a task in the processor element A; 401a. Output data A; 404a is calculated by A; 408a and output to the device A; 403a.
[0003]
Further, the processing operation in the processor element B; 401b and the processing in the processor element C; 401c are similarly executed in the task B; 408b and the task C; 408c, and are output to the device B; 403b and the device C; 403c. The Furthermore, data exchange necessary for executing tasks A; 408a, task B; 408b, and task C; 408c is performed via the network 406.
[0004]
Such a system originally has no fault-tolerant capability, but by providing the self-fault diagnosis units A; 409a to C; 409c in each processor element, the failed processor element element can be separated from the system. However, self-diagnosis cannot detect all faults 100% and perform fault isolation. Furthermore, when a failed processor element is separated by failure, the devices connected to the failed processor element are also separated, so that the functions possessed before the failure occurs are impaired. In order to prevent this, it is necessary to install a spare processor element for standby redundancy, but the amount of hardware increases accordingly.
[0005]
As described above, the conventional distributed processing system has a drawback that the fault-tolerant capability against the occurrence of a failure is not sufficient.
[0006]
In order to solve the above-mentioned drawbacks, the processor element A; 401a, the processor element B; 401b, and the processor element C; 401c in FIG. It can be easily considered as an extension of the conventional technology. However, in that case, the amount of hardware is increased at least three times for triple redundancy, so that the amount of hardware is greatly increased.
[0007]
In other words, because the conventional technology basically handled the distributed processing technology and fault tolerant technology as independent technologies, even if the weakness of one technology was compensated for using the other technology, it would be inefficient. It was.
[0008]
It should be noted that the technology for achieving a good balance between improving the processing performance and reliability of the entire system by efficiently combining distributed processing technology and fault-tolerant technology (redundant processing technology) is extremely rare, but existing inventions are also rare. Therefore, an example of the embodiment of the invention is shown below.
[0009]
Japanese Patent Application Laid-Open No. 7-114520 (name: redundant resource management method and distributed fault tolerant computer system using the same) as an invention for effectively improving the processing capability and improving the reliability by utilizing the above redundant resources (Hereinafter referred to as Prior Art Document 1). Here, the technology described in Prior Art Document 1 collects fault occurrence information for each task in each computer module constituting the redundant system, sets an evaluation function based on the fault occurrence information, and sets each task's The reliability is estimated, the task redundant configuration is determined by the own computer module, and the task to be participated is executed.
[0010]
As an explanation here, in order to clarify the difference from the present invention, the operation when the system described in the prior art document 1 is applied to the same functional operation as the configuration of FIG. 1 which is an embodiment of the present invention. An example is shown below. In other words, there are three devices for the computer module to input / output data as control targets, and there are individual tasks for controlling each device corresponding to each device, and each has a triple redundancy. An embodiment in the case of executing fault tolerance by triple majority will be described.
[0011]
FIG. 15 is a configuration diagram of a system described in Prior Art Document 1. This figure shows an operation example when a failure occurs in the computer modules 1; 501 to 9; Here, for the purpose of making a comparison with the case of FIG. 1 which is an embodiment of the present invention, the difference is simplified so as to be clear.
[0012]
In FIG. 15A, computer modules 1; 501 to 9; 509 correspond to the processor elements of the present invention, respectively, and perform data input / output in order to control the devices A; 510 to C; Do. It is assumed that the computer modules 1 to 9 can transfer data to each other via the data bus 513. Task A; 514 for controlling the device A operates as a triple redundant task with three modules of the computer modules 1; 501 to 3; 503, and performs fault detection / separation / reconfiguration by triple majority. As a result, the output data A; 517 to the device A is transferred via the data bus 513. Similarly, the task B; 515 for controlling the device B operates as a triple redundant task with three modules of the computer modules 4; 504 to 6; 506, and performs fault detection / isolation / reconfiguration by triple majority. As a result, the output data B; 518 to the device B is transferred. Similarly, the task C; 516 for controlling the device C operates as a triple redundant task with three modules of the computer module 7; 507-9; 509, and performs fault detection / isolation / reconfiguration by triple majority. As a result, the output data 519 to the device C is transferred.
[0013]
Here, when the importance & reliability requirement of task A; 514 is high and triple redundancy is always required, but the importance & reliability requirement of task B; 515 is lower than that of task A; 514 When the computer module 2; 502 fails, the operation changes to that shown in FIG. That is, the information that the computer module 2; 502 has failed is reflected in the evaluation function, so that the computer module 4; 504 stops executing the task B; 515 in order to maintain the triple redundancy of the task A. Task A; 514 starts executing. In other words, when computer module resources that can be used are reduced due to a failure, task A; 514 is suitable for the most execution at each computer module so that the reliability of tasks with high importance and reliability requirements is not lowered. This has the effect of selecting and executing a task.
[0014]
As described above, in the case of the system described in the prior art document 1, the means for controlling the optimal task execution for the purpose is described, but the general means for the fault detection / isolation means is described. I will use it. Other examples of this type of system are disclosed in JP-A-8-329025 (hereinafter referred to as Prior Art Document 2), JP-A-9-16535 (hereinafter referred to as Prior Art Document 3), and JP-A-8-212285. Publication (hereinafter referred to as Prior Art Document 4) and JP-A-8-95935 (hereinafter referred to as Prior Art Document 5).
[0015]
[Problems to be solved by the invention]
However, in the system described in the above-mentioned prior art document 1, three computer modules are required for each task in order to perform triple majority and perform 100% failure detection / separation. Therefore, when there are three types of devices to be controlled, nine computer modules are required as shown in FIG. On the other hand, means for solving this problem is not described in the prior art documents 2 to 5.
[0016]
SUMMARY OF THE INVENTION An object of the present invention is to provide a distributed processing system, a distributed processing method, and a distributed processing control program capable of reducing the amount of hardware such as a computer module as compared with the prior art.
[0017]
[Means for Solving the Problems]
In order to solve the above problems, a first invention according to the present invention includes a plurality of processors, a plurality of devices provided corresponding to the processors, and an input / output for controlling data input / output between the processors and the devices. A distributed processing system in which the plurality of processors distribute the data input from the plurality of devices and the data output to the plurality of devices, the system being intended for the distributed processing Including fault tolerance processing means for causing the plurality of processors and the plurality of input / output means to perform fault tolerance processing together; The fault tolerance processing means is provided in each of the processors, and data sharing means for inputting data from all the devices and outputting data to all the devices, output data addressed to a predetermined device calculated by the own processor, Redundancy management means for comparing output data destined for the predetermined device calculated by the other processor and notifying the comparison result to the other processor, and provided in the input / output means, based on the comparison result notified from the other processor. Failure determination means for determining whether or not the processor is faulty, and when the failure determination means determines that the own processor is faulty, further includes fault separation means for fault-separating the own processor. When a processor is fault-isolated, the data output to the device corresponding to its own processor is output from another processor. Includes data transfer means, the redundancy management means, the output data calculated in both processor sends a failure notification to the other processor to calculate the output data in the case of disagreement, and sends a normal notification when a match It is characterized by that.
[0018]
A second invention according to the present invention includes a plurality of processors, a plurality of devices provided corresponding to the processors, and input / output means for controlling data input / output between the processors and the devices. A distributed processing method in which the plurality of processors perform data input from the plurality of devices and data output to the plurality of devices in a distributed manner, the method including the plurality of processors for the purpose of the distributed processing; A fault tolerance processing step for causing the plurality of input / output means to perform fault tolerance processing together; The fault tolerance processing step is provided in each of the processors, and a data sharing step for inputting data from all the devices and outputting data to all the devices, output data addressed to a predetermined device calculated by the own processor, A redundancy management step for comparing the output data addressed to the predetermined device calculated by the other processor and notifying the other processor of the comparison result, and provided in the input / output means and based on the comparison result notified from the other processor. A failure determination step for determining whether or not the processor is faulty. When the failure determination step determines that the own processor is faulty, the failure determination step further includes a fault isolation step for fault isolation of the own processor. If a processor is fault-isolated, data output to the device corresponding to the processor is A data transfer step for outputting the data from another processor, and when the output data calculated by the two processors does not match, the redundancy management step sends a failure notification to the other processor that calculated the output data. Distributed processing method characterized by sending a normal notification to a client It is characterized by that.
[0019]
A third invention according to the present invention includes a plurality of processors, a plurality of devices provided corresponding to the processors, and input / output means for controlling data input / output between the processors and the devices. A distributed processing control program in which the plurality of processors distribute and input data from the plurality of devices and data output to the plurality of devices, the program being the plurality of processors for the distributed processing And a fault tolerance processing step for causing the plurality of input / output means to perform fault tolerance processing together, The fault tolerance processing step is provided in each of the processors, and a data sharing step for inputting data from all the devices and outputting data to all the devices, output data addressed to a predetermined device calculated by the own processor, A redundancy management step for comparing the output data addressed to the predetermined device calculated by the other processor and notifying the other processor of the comparison result, and provided in the input / output means and based on the comparison result notified from the other processor. A failure determination step for determining whether or not the processor is faulty. When the failure determination step determines that the own processor is faulty, the failure determination step further includes a fault isolation step for fault isolation of the own processor. If a processor is fault-isolated, data output to the device corresponding to the processor is A data transfer step for outputting the data from another processor, and when the output data calculated by the two processors does not match, the redundancy management step sends a failure notification to the other processor that calculated the output data. Send a normal notification to It is characterized by that.
[0020]
According to the first to third aspects of the present invention, when a failure occurs in a multi-processor system that performs distributed processing, a plurality of processor resources are effectively used for fault-tolerant processing for the purpose of distributed processing. Therefore, it is possible to reduce the amount of hardware such as a computer module as compared with the prior art.
[0021]
DETAILED DESCRIPTION OF THE INVENTION
First, an outline of the present invention will be described. FIG. 9 is a system configuration diagram showing an outline of the present invention. In FIG. 5A, there are three devices to be controlled, that is, devices A; 604 to C; 606, and a processor element (corresponding to the computer module in FIG. 15) that performs these control tasks is a processor element. There are three: A; 601-C; In each of these processor elements A; 601 to C; 603, task A; 608, task B; 609, task C; 610 are executed, and the redundant processing by the triple majority is executed as a whole.
[0022]
If the processor element B 602 fails, as shown in FIG. 5B, the output data B 612 transferred from the task B 609 on the processor element B 602 to the device B 605 when the processor element B 602 is normal is the task on the processor element A 601. By performing the transfer from B609, failure detection / separation is performed, and at the same time, normal processing is continued with the remaining normal processor elements.
[0023]
In other words, if 100% failure detection / separation can be performed for a failure of the processor element (computer module in FIG. 15) under the same conditions, nine systems are possible in the case of the system (FIG. 15) described in the prior art document 1. Whereas a computer module is required, the present invention (FIG. 9) can be realized with three processor elements.
[0024]
At this time, even in the present invention, it is possible to maintain a triple majority at the time of fault isolation. In that case, it is necessary to add one spare processor element. The number of processor elements (redundant resources) is less than half (4/9).
[0025]
Note that FIG. 20 in Prior Art Document 1 shows a table showing the relationship between the number of computer modules and the number of executable tasks. In the table, when the number of computer modules is 3, double redundant It shows that only one task and one task without redundancy can be executed. In other words, when there are only three redundant resources, it is shown that the execution of the three types of triple redundant tasks that can be realized by the present invention is impossible, and the difference from the present invention is clear. It is.
[0026]
In the case of the present invention, as shown in the embodiment of FIG. 1, the redundancy management units 3a to 3c, the failure determination units 10a to 10c, the network control units 12a to 12c, the failure isolation units 9a to 9c in FIG. This is because the data transfer control units 11a to 11c enable failure detection / separation by redundant processing by triple majority using only three processor elements for distributed processing purposes.
[0027]
The above differences of the present invention from the system described in Prior Art Document 1 are summarized as follows. First, the system described in Prior Art Document 1 will be described.
[0028]
(1) When there are three control targets, the number of processor elements necessary for implementing redundancy management by triple majority is nine.
[0029]
(2) The problem to be solved by the invention (the most serious one) is handled by combining distributed processing and redundant processing by using redundant computer module (corresponding to processor elements) resources. When improving performance and improving reliability at the same time, the failure of a computer module could reduce the reliability of the most important task, that is, from the less important task when a failure occurs. It is desirable to stop the system first and maintain the reliability of the task with high importance. However, for that purpose, the redundancy can only be increased and there is no means for efficient degeneration.
[0030]
(3) The greatest effect of the invention is that in the event of a failure, it is possible to maintain the reliability and function / performance related to the important task by stopping the less important task first and reducing the function / performance. This means that the resources allocated can be allocated to the most important purpose. In other words, it is highly effective when redundant resources are used to improve processing performance and reliability at the same time, and when tasks have high and low importance. However, at that time, there is no effect unless there are a large number of redundant resources such as computer modules. The distributed processing here is limited to distributed processing for improving processing performance.
[0031]
Next, the present invention will be described.
[0032]
(1) When there are three control objects, three processor elements are sufficient to implement redundancy management by triple majority.
[0033]
(2) The problem (most important) to be solved by the invention is that processor element resources that exist for the purpose of distributed processing cannot be detected / isolated by using those resources for redundant processing. That's what it means. For this reason, when the reliability is increased by the redundancy processing, it is necessary to make individual distributed resources individually redundant, so that the amount of hardware that is increased for improving the reliability is enormous.
[0034]
(3) The greatest effect of the invention is that the processor element resources existing for the purpose of distributed processing can be simultaneously used for redundant processing so that failure detection / separation can be realized, and separation processing can be performed with a minimum number of redundant resources. This means that it is possible to achieve simultaneous improvements in reliability. It is better to apply to separation processing systems that need to be physically distributed for mission purposes, such as indirect cooperative control in robot arms, than to separation processing for improving processing performance. Demonstrate high power.
[0035]
That is, the present invention is superior to the system described in the prior art document 1 in that the hardware amount of redundant resources can be realized by about 1/3.
[0036]
Note that the present invention and the system described in Prior Art Document 1 are similar in a broad category of efficiently realizing distributed processing and fault tolerance processing. However, as described above, the invention is to be solved. The invention is greatly different in terms of the problem and the effect of the invention. The system described in the prior art document 1 is efficient depending on the failure occurrence state when performing distributed processing for improving processing performance and redundant processing for improving reliability by using a large number of redundant resources. The present invention provides a means for performing degeneration (stops a low-importance task first to reduce the influence on a high-importance task). In other words, since it is intended to actively reduce unimportant functions, it can only be applied to a system that allows function reduction.
[0037]
On the other hand, the present invention effectively utilizes redundant resources originally existing for the purpose of distributed processing for fault tolerance, and simultaneously achieves distributed processing and improved reliability with the minimum number of redundant resources. Since the present invention provides means, the contents of the invention are greatly different, and the invention does not overlap with the system described in Prior Art Document 1.
[0038]
As described above, according to the present invention, in a multiprocessor system that performs distributed processing, a plurality of processor resources existing for the purpose of distributed processing are effectively used for fault-tolerant processing, and the minimum necessary redundant resources (conventional technology) are used. Failure detection / separation when a failure occurs in about 1/3), and the same functions as before the failure can be continuously executed without interrupting the operation of the distributed processing target device It is.
[0039]
Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In a multiprocessor system that performs distributed processing, the present invention manages input data from each device to be distributed as shared information between the processors, and uses that data for redundancy such as majority processing between different processors. By managing it, the system as a whole has fault-tolerant capability and is characterized by increasing the reliability when a failure occurs.
[0040]
FIG. 1 is a block diagram of the best mode of a distributed processing system according to the present invention. Referring to the figure, the distributed processing system includes a processor element A; 1a, an input / output unit A; 8a connected to the processor element A; 1a via the processor element interface 7a, and the input / output unit A; An apparatus A; 15a connected to the transmission line A through the transmission line A; a processor element B; 1b; an input / output unit B; 8b connected to the processor element B; 1b through the processor element interface 7b; The device B; 15b connected to the input / output unit B; 8b via the transmission line B; 15b; the processor element C; 1c; and the processor element C; 1c connected to the processor element interface 7c. An input / output unit C; 8c, and an apparatus C; 15c connected to the input / output unit C; 8c via a transmission line C. Ri, output unit A; 8a, B; 8b and C; 8c are respectively connected to the network 16.
[0041]
Further, the processor element A; 1a includes a data sharing unit 2a, a redundancy management unit 3a, and tasks A; 4a to C; 6a. Similarly, the processor element B; 1b includes a data sharing unit 2b and redundancy management. The unit 3b includes tasks A; 4b to C; 6b, and the processor element C; 1c includes a data sharing unit 2c, a redundancy management unit 3c, and tasks A; 4c to C; 6c.
[0042]
The input / output unit A; 8a includes a fault isolation unit 9a, a fault determination unit 10a, a data transfer control unit 11a, and a network control unit 12a. Similarly, the input / output unit B; 8b is a fault isolation unit. 9b, a failure determination unit 10b, a data transfer control unit 11b, and a network control unit 12b. An input / output unit C; 8c is a failure isolation unit 9c, a failure determination unit 10c, and a data transfer control unit 11c. And a network control unit 12c.
[0043]
In the figure, input data A; 14a to C; 14c from devices A; 15a to C; 15c to be distributed are transferred using a network 16, and processor elements A; 1a to C; Managed as shared data by each processor 1c. Using the shared data, task A that outputs data to apparatus A; 4a to 4c; task B that outputs data to apparatus B; 5a to 5c; task C that outputs data to apparatus C; 6a ~ 6c are executed in each processor element.
[0044]
For the above tasks, failure determination based on the majority rule is performed between the processor elements A; 1a to C; 1c using the redundancy management units 3a to 3c and the failure determination units 10a to 10c. The processor elements that have failed are separated by the separation units 9a to 9c. At that time, the devices connected to the processor elements separated by failure are in a state where data can be transferred to other normal processor elements by the data transfer control units 11a to 11c according to the results of the failure separation units 9a to 9c. Thereby, the same function as before the occurrence of the failure is continuously executed without interrupting the processing as the apparatus.
[0045]
In this way, according to the present invention, when a failure occurs in a multiprocessor system that performs distributed processing, a plurality of processor resources for the purpose of distributed processing are effectively used for fault-tolerant processing. In addition, the same function as before the occurrence of the failure can be continuously executed without interrupting the operation of the device to be distributed.
[0046]
【Example】
Examples of the present invention will be described below. First, the first embodiment will be described. FIG. 1 is also used to explain the first embodiment. FIG. 1 shows an embodiment of a system that performs distributed processing on three independent devices A to C. In the figure, the processor element A; 1a is connected to the device A; 15a, and basically the input data A; 14a from the device A; 15a is transmitted via the transmission line A and the input / output unit A; 8a. In the processor element A; 1a, it is processed by the task A; 4a, and is output to the device A; 15a as the output data A; 13a via the input / output unit A; 8a and the transmission line A. The input / output unit A; 8a connected between the device A; 15a and the processor element A; 1a performs the above data transfer.
[0047]
Here, the processor elements A; 1a to C; 1c have functions of a general computer, and as a computer having a data input / output function, an arithmetic function, a data storage function, etc., like an embedded computer. Only the most basic functions can be used.
[0048]
The configuration of the apparatus B; 15b and the processor element B; 1b and the input / output unit B; 15b and the apparatus C; 15c, the processor element C; 1c and the input / output unit C; The same as the case of the apparatus A;
[0049]
Further, these are connected to the network 16 by an input / output unit A; 8a, an input / output unit B; 8b, and an input / output unit C; 8c, and mutual data transfer is possible. Data transfer by the network 16 is performed by the network control units 12a to 12c, and this may have a general network function.
[0050]
In the basic distributed processing system configuration described above, a plurality of processors are used for the purpose of distributed processing. In the present invention, in order to effectively use a plurality of processor resources, triple processing is performed simultaneously with distributed processing. Redundancy processing based on majority vote can be performed.
[0051]
In FIG. 1, devices A; 15a to C; input data A; 14a to C; 14c from a distributed processing target are transferred using a network 16, and processor elements A; 1a to C; Managed as shared data by each processor 1c. Using the shared data, task A that outputs data to apparatus A; 4a to 4c; task B that outputs data to apparatus B; 5a to 5c; task C that outputs data to apparatus C; 6a ~ 6c are executed by each processor. The above data is managed in each processor element by the data sharing units 2a to 2c.
[0052]
FIG. 2 shows an example of a shared data management table used by each data sharing unit 2a to 2c for data management. This shared data management table is provided in a storage unit (not shown) in each of the data sharing units 2a to 2c, for example. Referring to the figure, in the shared data management table, the output value of task A that is the processing result of processor element A for the input data from apparatus A, the output value of task A that is the processing result of processor element B, and processor element C Output value of task A, the output value of task B which is the processing result of processor element A for the input data from apparatus B, the output value of task B which is the processing result of processor element B, and processor element C Output value of task C, the output value of task C, which is the processing result of processor element B for the input data from apparatus C, the output value of task C, which is the processing result of processor element B, and processor element C The output value of task C, which is the result of the above processing, is stored.
[0053]
The redundancy managers 3a to 3c perform redundancy management based on a general majority rule using the shared data management table of FIG. For example, in the case of processor element A; 1a, a majority decision is made on the output value of task A, and if it is normal, the value determined to be normal by the majority decision is output to apparatus A as output data A; 13a.
[0054]
In the case of processor element B; 1b, a majority decision is made on the output value of task B, and if it is normal, the value determined to be normal by the majority decision is output to device B as output data B; 13b. In the case of the processor element C; 1c, a majority decision is made on the output value of the task C, and if it is normal, the value determined to be normal by the majority decision is output to the device C as output data C; 13c.
[0055]
If there is a discrepancy in the majority result, the redundancy managers 3a to 3c use the network 16 to notify the failure to the processor elements that have a different result from their own results based on the general majority principle. To do. For example, in FIG. 1, when the processor element B; 1b fails, the task A; 4b, task B; 5b, task C; 6b executed by the processor element B; Executed.
[0056]
FIG. 3 is an explanatory diagram showing an example of failure notification when the processor element B; 1b fails. Referring to the figure, for failure determination unit 10b connected to processor element B; 1b, failure notification AB17 (failure notification from processor element A to processor element B) and failure notification CB20 (processor element C to processor) The failure determination unit 10b can determine that it is a failure based on the majority rule. On the other hand, since only one failure notification (from the processor element B) is notified to the failure determination units 10a and 10c connected to the other processor elements A and C, it can be determined that the device is normal.
[0057]
FIG. 4 is a diagram illustrating a failure determination logic in the failure determination units 10a to 10c. Here, the identification mark ID of its own processor element is N, the ID of the processor element right next to N in FIG. 1 is N + 1, and the ID of the processor element right next to N + 1 is N + 2. However, the processor element A; 1a is the processor element C;
[0058]
Referring to FIG. 4, when the processor element N is notified that at least one of the processor elements N + 1 and N + 2 is normal, the processor element N indicates that its own processor element is determined to be normal. In other words, the processor element N determines that its own processor element is faulty only when both of the processor elements N + 1 and N + 2 are notified of the fault.
[0059]
The failure determination units 10a to 10c notify their failure determination results to the failure isolation units 9a to 9c and the data transfer control units 11a to 11c according to the logic shown in FIG. The determination results of the failure determination units 10a to 10c and the operations of the failure isolation units 9a to 9c and the data transfer control units 11a to 11c according to the determination results are summarized as follows.
[0060]
First, a case where the failure determination unit determines that it is normal will be described.
[0061]
(1) The fault isolation unit does nothing.
[0062]
(2a) In the data transfer control unit, the input data buffer from the device, the output data buffer to the device, and the port to which the failure notification data of the failure determination unit is input can all be recognized as independent addresses on the network. To.
[0063]
(2b) All processor elements can read input data from all devices via a network.
[0064]
(2c) All processor elements are allowed to write failure notification data to a port to which failure notification data of the failure determination unit is input.
[0065]
(2d) Data transfer to the output data buffer to the device is possible only from its own processor element.
[0066]
Next, a case where the failure determination unit determines that it is a failure will be described.
[0067]
(1) Blocks data sent from its own processor element and functionally separates its own processor element from the input / output unit. Then, it resets its own processor element.
[0068]
(2b) to (2c) are the same as when the above-described failure determination unit determines that it is normal.
[0069]
(2d) The transfer of data to the output data buffer to the apparatus is enabled to be transferred from another processor element via the data bus. At this time, it cannot be transferred from its own processor element.
[0070]
That is, when any processor element has a failure, the failed processor elements are separated by the failure separation units 9a to 9c. At that time, the devices connected to the processor elements separated by failure are in a state where data can be transferred with other normal processor elements by the data transfer control units 11a to 11c according to the results of the failure separation units 9a to 9c. .
[0071]
In the state as described above, the redundancy managers 3a to 3c in FIG. 1 change the processor elements that are determined to be normal by the method described so far to the devices connected to the processor elements that are fault-isolated. The output data for the device is transferred so that the normal operation of the device can be continued.
[0072]
Specifically, as shown in FIG. 3, when it is determined that the processor element B; 1b is faulty, the processor element B; 1b in FIG. 1 is separated from the input / output unit B; Output data B for 15b; 13b is the result of processor element A; task B of 1a; 5a, or the result of processor element C; task B of 1c;
[0073]
Here, whether to use the data of the processor element A; 1a or the data of the processor element C; 1c is not an important problem, and may be either. For example, logic such as using the data of the processor element on the right side of the processor element separated by failure may be determined, and can be easily realized by a generally well-known method.
[0074]
As described above, even if a failure occurs in any of the processor elements A; 1a to C; 1c, the same function as before the failure occurs is continuously executed without interrupting the processing as the device. can do.
[0075]
The failure determination units 10a to 10c, the failure / separation units 9a to 9c, and the data transfer control units 11a to 11c in the input / output units A; 8a to 8C; It can be realized by software or hardware as long as it satisfies the operation when it determines that it is normal / failure. Both can be easily realized by a generally well-known method.
[0076]
Next, the operation of the present embodiment shown in FIG. 1 will be described using a flowchart. In FIG. 1, the processor element A; 1a to C; 1c inputs the input data A; 14a to C; 14c from the devices A; 15a to C; 15c, and the failure management units 10a to 10c are input by the redundancy management units 3a to 3c. FIG. 5 shows a flowchart of the operation up to the notification of the failure notification.
[0077]
In FIG. 5, in order to provide versatility for explanation, it is shown as a software operation of the processor element at the position N. Here, N + 1 indicates the position on the right side of N, and N + 2 indicates the position on the right side of N + 1. In FIG. 1, it is assumed that the processor element C; For example, when N is A, N + 1 is B and N + 2 is C.
[0078]
In FIG. 5, the processor element at position N inputs the input data of the devices N, N + 1, N + 2, and uses these data to calculate the output data to the devices N, N + 1, N + 2 (step S101). , S102, S103).
[0079]
The above is shown by way of example in comparison with the configuration of FIG. 1. When N is A in FIG. 1, this is a software operation of the processor element A; 1a, and the input data of the device of N is input data. A; 14a, the input data of the N + 1 device is input data B; 14b, and the input data of the N + 2 device is input data C; 14c. Using these, the output data to device A; 15a is calculated by task A; 4a, the output data to device B; 15b is calculated by task B; 5a, and the device C; 15c is calculated by task C; 6a. Corresponds to the calculation of the output data.
[0080]
Next, in FIG. 5, the result calculated by the processor element at the position N is sent to the processor elements at the positions N + 1 and N + 2, and at the same time, the calculation result is received from the processor elements at the positions N + 1 and N + 2 (step S104). These operations are realized by the data sharing units 2a to 2c in FIG.
[0081]
Next, redundancy management based on the majority rule is performed by the redundancy management units 3a to 3c in FIG. In FIG. 5, a majority decision is performed based on the calculation results of N, N + 1, and N + 2, and a failure is determined for each calculation result (steps S105, S106, and S109). As a result, when it is determined that the calculation result of N is normal, normal processing is continued (step S107). If N + 1 is determined to be a failure, a failure notification is notified to N + 1 (step S110), and if N + 2 is determined to be a failure, a failure notification is notified to N + 2 (step S108). If N determines that it has failed, the operation is stopped (step S111).
[0082]
In an actual system, data exchange for distributed processing, synchronization processing, and the like are necessary in the above-described operation. However, since they are not related to the scope of the present invention, descriptions thereof are omitted. In addition, since the handling when a plurality of failures occur is complicated in explanation, in this embodiment, it is assumed that one failure has occurred in order to simplify the explanation.
[0083]
Next, the operation of the input / output units A; 8a to C; 8c in FIG. 1 will be described using a flowchart. FIG. 6 is a flowchart showing the operations of the fault isolation units 9a to 9c and the data transfer control units 11a to 11c after the fault determination units 10a to 10c receive the fault notification shown above. Note that the definitions of N, N + 1, and N + 2 here are the same as the contents defined in FIG.
[0084]
In FIG. 6, N performs failure determination based on the majority rule for failure notifications from N + 1 and N + 2 (steps S201 and S202). This is performed by the failure determination units 10a to 10c in FIG. That is, if a failure notification is received from N + 1 (Yes in step S201) and a failure notification is also received from N + 2 (Yes in step S202), N is determined to be a failure (step S203), and N processor elements Are separated (step S204), and N + 1 and N + 2 are notified of the result of failure separation (step S205). Further, in order to continue the operation of the device connected to N in a state where the N processor elements are fault-isolated, the output to the device connected to N is output from N + 1 or N + 2 in data transfer. Enable (step S206). These operations are performed by the fault isolation units 9a to 9c and the data transfer control units 11a to 11c in FIG. In FIG. 6, if N is determined to be normal (No in either step S201 or S202), the processing is continued as it is (step S207).
[0085]
Next, as described above, the operations of the redundancy management units 3a to 3c after the fault isolation and the like are performed by the input / output units A; 1a to C; 1c in FIG. Will be described.
[0086]
FIG. 7 shows the operation of the redundancy management units 3a to 3c realized as the software operation of the processor elements A; 1a to C; 3c in FIG. 1 in response to the operation result shown in FIG. The definitions of N, N + 1, and N + 2 here are the same as the contents defined in FIG.
[0087]
In FIG. 7, when the fault isolation result is received from N + 1 (Yes in step S301), N + 1 recognizes that the processor element is fault-isolated (step S302), and the device connected to N + 1 On the other hand, output data for the device connected to N + 1 is transmitted (step S303), and other processing is continued (step S304).
[0088]
Also, when a failure isolation result is received from N + 2 (No in step S301, Yes in step S305), the same operation is performed on N + 2 (steps S306, S307, and S308).
[0089]
Further, if no fault isolation result has been received from N + 1 or N + 2 (No in step S301, No in step S305), the process is continued without changing any state (step S309). ).
[0090]
As an example of the above operation, FIG. 8 shows an example of the data output operation to the apparatus when the processor element B; 1b is fault-isolated. In FIG. 8, the processor element B; 1 b is fault-isolated and is in an operation stop state. Instead, from the output value of the task B; 5 a operating on the processor element A; 1 a to the device B; 15 b Output data B; 22 is transferred. At this time, the output data A; 21 is transferred from the output value of the task A; 4a operating on the processor element A; 1a to the device A; Also for the device C; 15c, the output data C; 23 is transferred from the output value of the task C; 6c operating on the processor element C;
[0091]
As described above, according to this embodiment, even when one processor element in the distributed processing system fails, the failure is detected / isolated, and the processing as a device connected to the processor element is interrupted. Without failing, the same function as before the failure occurred can be continued.
[0092]
In the present embodiment, a fault tolerant capability is provided when a failure occurs in the processor elements A; 1a to C; 1c in FIG. 1, but the input / output units A; 8a to C; 8c In some cases, it is necessary to deal with a case where a failure occurs. However, in general, when comparing the basic computer function part such as the processor element and the interface part, the processor element is much larger in circuit scale and operation complexity. Is more important, and the impact of redundancy is significantly greater. Further, as a countermeasure against the failure of the interface portion, since it can be easily realized by means conventionally used such as redundancy and high reliability of used parts, in the present invention, in order to simplify the explanation, the processor element The embodiment has been described by narrowing down the conditions when a failure occurs in a part.
[0093]
The present invention is not limited to the above embodiment. For example, in the embodiment of FIG. 1, if there is a means for diagnosing the failure of its own processor element, tasks can be made redundant in one processor element. There is no need to run and implement a majority vote. In that case, when a failure occurs in one processor element and the failure is separated from the failed processor element by the self-fault diagnosis, the subsequent operation is the same as that of the embodiment of FIG. The normal processing can be continued without interrupting the operation of 15c. Even if a failure occurs in the processor element, the effect of maintaining the function of the entire system is the same. This will be described later as a third embodiment.
[0094]
1 is an example of a fault tolerant method assuming that a failure occurs once in any of the processor elements. However, when used in a special environment such as outer space, the environment Due to the peculiarities of the conditions, there are many cases where temporary (transient) failures occur many times and return to normal each time they are restarted. When applied to a system used in such an environment, the processor element separated in the embodiment shown in FIG. 1 is reset and restarted. If the initial self-check result is normal, the system is reset. It is effective to add a method of returning. In that case, it is possible to realize a fault-tolerant system that can continue normal processing non-stop even if temporary (transient) failures occur many times.
[0095]
For the self-failure diagnosis method described above and the method for restarting and returning to the system corresponding to a temporary (transient) failure, a well-known method is applied. Therefore, the description is omitted here.
[0096]
Next, a second embodiment will be described. FIG. 10 is a schematic diagram showing a configuration of the second embodiment, and FIG. 11 is a schematic diagram showing a relationship between a CPU (for example, processor element A) and a device (for example, device A). In the second embodiment, the distributed processing system in the first embodiment is applied to a robot arm.
[0097]
FIG. 10 shows an example of the configuration of the robot arm. Referring to FIG. 10, the robot arm includes a handle portion 31, arms 32 to 35, and actuators 41 to 45. The actuator 41 controls the operation of the handle portion 31, and the actuator 42. ˜44 controls the operation of the arms 32˜35. The actuator 45 is an actuator that is the origin of the arms 32 to 35. That is, these actuators 41 to 45 correspond to the joints of the robot arm.
[0098]
The joints of the robot arm (in this paragraph, the actuators 41 to 45 are referred to as joints 41 to 45 for convenience) perform an emphasis operation with the adjacent joints. For example, in order to move the handle portion 31 to a predetermined position, not only the arm 32 but also each of the arms 33 to 35 must be moved. For that purpose, each joint 41-45 needs to operate | move in cooperation. Therefore, the distributed processing according to the present invention can be applied to the control of the joints 41 to 45.
[0099]
Referring to FIG. 11, each of the actuators 41 to 45 is a motor based on the sensor 61, the motor 62, the output from the sensor 61, and the processing results of other CPUs required for cooperative operation (received via the network). A CPU (central processing unit) 52 that controls the CPU 62 and an interface 53 connected to the network are included. The movement of the motor 62 controls the operations of the handle 31 and the arms 32 to 35. The sensor 61 and the motor 62 are included in the device 51.
[0100]
The CPU 52 corresponds to the processor elements A to C and the input / output units A to C in FIG. 1, the interface 53 corresponds to the network control units 12a to 12c in FIG. 1, and the device 51 corresponds to the devices A to C in FIG. To do.
[0101]
Now, the distributed processing system according to the present invention is applied to the actuators 42 to 44 among the actuators 41 to 45. That is, the actuator 42 is constituted by the processor element A, the input / output unit A and the device A shown in FIG. 1, and the actuator 43 is constituted by the processor element B, the input / output unit B and the device B shown in FIG. 1 is configured by the processor element C, the input / output unit C, and the device C of FIG.
[0102]
That is, the input data 71 input from the sensor 61 to the CPU 52 (more precisely, the input / output units A to C in FIG. 1) is the input data A to C in FIG. Output data 72 output from A to C) to the motor 62 is the output data A to C in FIG. Then, the CPU 52 calculates the input data 71 and outputs the output data 72 that is the calculation result.
[0103]
Therefore, each of the actuators 42 to 44 performs redundant processing by majority decision as well as distributed processing. If it is determined that the actuator 43 (corresponding to processor element B in FIG. 1) is faulty, the actuator 43 is fault-isolated, and the output data 72 for the motor 62 of the device 51B of the actuator 43 is the actuator data. The data is output from the CPU 52 of the actuator 41 (equivalent to the processor element A in FIG. 1) or the actuator 43 (equivalent to the processor element C in FIG. 1).
[0104]
Next, a third embodiment will be described. FIG. 12 is a schematic diagram showing the configuration of the third embodiment, and FIG. 13 is a schematic diagram showing data transfer control when a processor element fails. Similarly to the second embodiment, the third embodiment is an example in which the distributed processing system is applied to the robot arm. However, the difference from the second embodiment is that each actuator does not perform redundant processing.
[0105]
That is, the actuator 42 inputs only the input data 71 from its own device 51A, and outputs the output data 72 of the calculation result only to its own device 51A. Similarly, the actuator 43 inputs only the input data 71 from its own device 51B, outputs the output data 72 of the operation result only to its own device 51B, and the actuator 44 inputs from its own device 51C. Only the data 71 is input, and the output data 72 of the calculation result is output only to its own device 51C.
[0106]
Further, each of the actuators 42 to 44 does not judge that the own actuator has failed from the failure notification from the other actuators, but indicates that the own actuator has failed in the own actuator. A failure detection unit for detection is included.
[0107]
Referring to FIG. 12, a camera 46 is connected to the actuator 41, and the actuator 41 is configured to control an internal motor 62 based on image information from the camera 46.
[0108]
On the other hand, the actuator 41 also has a function of performing a substitute process when any of the actuators 42 to 44 fails. For example, when the actuator 43 fails, the CPU 52 in the actuator 43 is isolated from the failure. Instead, the CPU 52 in the actuator 41 performs a process to be performed by the actuator 43, and the actuator 43. Output data is output to the motor 62. At this time, the actuator 41 calculates data to be output based on the input data 71 obtained from the device 51B via the network 16. The origin actuator 45 may perform this substitution process.
[0109]
FIG. 13 shows the operation of the third embodiment. In the first and second embodiments, when the processor element B fails, the output data B is output from the processor element A to the apparatus B. In the embodiment, output data B is output from the actuator 41 (processor element D) to the apparatus B.
[0110]
If it demonstrates with the flowchart of FIG. 6, the operation | movement after it is judged that the processor element B is a failure will become the same as that of step S203-S205 of the same figure.
[0111]
【The invention's effect】
According to a first aspect of the present invention, a plurality of processors, a plurality of devices provided corresponding to each of the processors, and input / output means for controlling data input / output between the processors and the devices are included. A distributed processing system in which the plurality of processors perform data input from the plurality of devices and data output to the plurality of devices in a distributed manner, the system including the plurality of processors for the distributed processing and Since the fault tolerance processing means for causing the plurality of input / output means to perform fault tolerance processing together is included, the amount of hardware such as a computer module can be reduced.
[0112]
The second and third inventions according to the present invention also have the same effects as the first invention.
[0113]
More specifically, according to the present invention, in a multiprocessor system that performs distributed processing, a failure when a failure occurs by effectively utilizing a plurality of processor resources for the purpose of distributed processing for the purpose of distributed processing. Detection / separation can be performed, and the same function as before the occurrence of the failure can be continuously executed without interrupting the operation of the device to be distributed.
[0114]
This is because the system configuration feature of the distributed processing system is added to the original purpose and another dimension, even though individual components such as processors do not have fault-tolerant capability. As a whole, it has fault-tolerant ability. In other words, the fault-tolerant capability is realized without taking the means of making the hardware redundant for the purpose of fault-tolerant, so the hardware amount of the conventional fault-tolerant system is large (usually triple majority) This solves the weak point of increasing the amount of hardware to more than three times.
[0115]
When actually realizing the present invention, it is also necessary to consider application so that the means for realizing the present invention do not become a disadvantage. In other words, in order to realize the present invention, it is desirable that the processor processing speed and the network transfer speed are high in order to actively perform software redundant operation and exchange of shared data between processors. However, looking at recent technological trends in computer-related technologies, the processor processing speed and network transfer speed have improved dramatically, so in many cases, the means for realizing the present invention will not be a disadvantage. Conceivable.
[0116]
Further, the present invention exhibits the greatest effect when applied to a system that is a distributed processing system for the reason of system configuration. For example, in the case of an embedded distributed processing system in which joint control of a robot arm is performed by an independent processor, there are originally as many processors as the number of joints, so if there are three or more, the present invention is applied. Thus, a highly reliable system can be constructed by adding a small amount of hardware in the interface part. In particular, in the case of such an embedded system, it is considered that the effect of applying the present invention is extremely large because it is required to simultaneously reduce the amount of hardware and ensure high reliability.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of a best mode of a distributed processing system according to the present invention.
FIG. 2 is a diagram showing a shared data management table.
FIG. 3 is a diagram showing an example of a failure notification when a processor element B; 1b fails.
FIG. 4 is a diagram illustrating a failure determination logic in a failure determination unit.
FIG. 5 is a flowchart showing an operation until a failure is notified.
FIG. 6 is a flowchart showing an operation after receiving a failure notification.
7 is a flowchart showing an operation executed in response to the operation result shown in FIG.
FIG. 8 is a flowchart showing an operation of outputting data to the apparatus when the processor element B; 1b is fault-isolated.
FIG. 9 is a system configuration diagram showing an outline of the present invention.
FIG. 10 is a schematic diagram showing a configuration of a second embodiment.
FIG. 11 is a schematic diagram showing a relationship between a CPU and a device.
FIG. 12 is a schematic diagram showing a configuration of a third embodiment.
FIG. 13 is a schematic diagram showing data transfer control when a processor element fails.
FIG. 14 is a configuration diagram of an example of a conventional distributed processing system.
15 is a configuration diagram of a system described in Prior Art Document 1. FIG.
[Explanation of symbols]
1a to 1c processor element
2a-2c Data sharing part
3a-3c Redundancy management unit
4a, 5a, 6a tasks
7a Processor element interface
8a-8c Input / output section
9a-9c Fault isolation part
10a to 10c failure determination unit
11a to 11c Data transfer control unit
12a to 12c Network control unit
15a-15c device
31 Toride Department
32-35 arm
41-45 Actuator
51 devices
52 CPU
53 Interface
61 sensors
62 Motor

Claims (12)

A plurality of processors, a plurality of devices provided corresponding to each of the processors, and input / output means for controlling data input / output between the processors and the devices, the data input from the plurality of devices and the A distributed processing system in which the plurality of processors distribute data output to a plurality of devices,
Including fault tolerance processing means for causing the plurality of processors for the distributed processing and the plurality of input / output means to perform fault tolerance processing together;
The fault tolerance processing means is provided in each of the processors, and data sharing means for inputting data from all the devices and outputting data to all the devices, output data addressed to a predetermined device calculated by the own processor, Redundancy management means for comparing output data destined for the predetermined device calculated by another processor and notifying the other processor of the comparison result;
A failure determination unit that is provided in the input / output unit and determines whether or not the own processor is faulty based on a comparison result notified from another processor;
If the failure determination means determines that the own processor is faulty, it further includes failure isolation means for isolating the own processor as faults,
A data transfer means for outputting a data output to a device corresponding to the own processor from another processor when the own processor is fault-isolated by the fault isolation means;
The redundancy management means sends out a failure notification to other processors that have calculated the output data when the output data calculated by the two processors does not match, and sends a normal notification when they match. Processing system. Distributed processing system according to claim 1, characterized by using the distributed processing to the joint control of the robot arm.   The fault tolerance processing means is provided corresponding to each of the processors, and a fault determination means for uniquely determining whether or not the own processor is faulty; The distributed processing system according to claim 1, further comprising: 4. The distributed processing system according to claim 3, wherein the distributed processing is used for joint control of a robot arm. In a distributed processing system including a plurality of processors, a plurality of devices provided corresponding to each of the processors, and input / output means for controlling data input / output between the processors and the devices, A distributed processing method in which the plurality of processors distribute data input and data output to the plurality of devices,
Including a fault tolerance processing step for causing the plurality of processors for the distributed processing and the plurality of input / output means to perform fault tolerance processing together;
The fault tolerance processing step is provided in each of the processors, and a data sharing step for inputting data from all the devices and outputting data to all the devices, output data addressed to a predetermined device calculated by the own processor, A redundancy management step of comparing output data addressed to the predetermined device calculated by another processor and notifying the other processor of the comparison result;
A failure determination step that is provided in the input / output means and determines whether or not the own processor is in failure based on a comparison result notified from another processor;
If the failure determination step determines that the own processor has failed, the failure determination step further includes a failure isolation step for isolating the own processor.
A data transfer step for causing a data output to a device corresponding to the own processor to be output from another processor when the own processor is fault-isolated by the fault isolation step;
The redundancy management step is characterized in that if the output data calculated by the two processors does not match, a failure notification is sent to the other processor that calculated the output data, and if it matches, a normality notification is sent. Processing method. 6. The distributed processing method according to claim 5, wherein the distributed processing is used for joint control of a robot arm. The fault tolerance processing step is provided corresponding to each of the processors, and a fault determination step for uniquely determining whether or not the own processor is faulty;
The distributed processing method according to claim 5 , further comprising: a proxy processing step of performing a proxy processing of the processor determined to be the failure. 8. The distributed processing method according to claim 7, wherein the distributed processing is used for joint control of a robot arm. In a distributed processing system including a plurality of processors, a plurality of devices provided corresponding to each of the processors, and input / output means for controlling data input / output between the processors and the devices, A distributed processing control program in which the plurality of processors distribute data input and data output to the plurality of devices,
Including a fault tolerance processing step for causing the plurality of processors for the distributed processing and the plurality of input / output means to perform fault tolerance processing together;
The fault tolerance processing step is provided in each of the processors, and a data sharing step for inputting data from all the devices and outputting data to all the devices, output data addressed to a predetermined device calculated by the own processor, A redundancy management step of comparing output data addressed to the predetermined device calculated by another processor and notifying the other processor of the comparison result;
A failure determination step that is provided in the input / output means and determines whether or not the own processor is in failure based on a comparison result notified from another processor;
If the failure determination step determines that the own processor has failed, the failure determination step further includes a failure isolation step for isolating the own processor.
A data transfer step for causing a data output to a device corresponding to the own processor to be output from another processor when the own processor is fault-isolated by the fault isolation step;
The redundancy management step is characterized in that if the output data calculated by the two processors does not match, a failure notification is sent to the other processor that calculated the output data, and if it matches, a normality notification is sent. Processing control program. The distributed processing control program according to claim 9, wherein the distributed processing is used for joint control of a robot arm. The fault tolerance processing step is provided corresponding to each of the processors, and a fault determination step for uniquely determining whether or not the own processor is faulty;
The distributed processing control program according to claim 9 , further comprising: a proxy processing step that performs a proxy processing of the processor determined to be the failure. 12. The distributed processing control program according to claim 11, wherein the distributed processing is used for joint control of a robot arm.

Images