JP4117685B2 - Fault-tolerant computer and its bus selection control method - Google Patents

Description

  The present invention relates to a lockstep fault tolerant computer system in which a plurality of CPU subsystems process the same instruction sequence in clock synchronization.

  Conventionally, there is a system in which a synchronization device is connected to two information processing devices, data from each information processing device is held in a buffer, collated by a synchronization circuit, and synchronized (for example, see Patent Document 1).

  Here, in a fault-tolerant computer system of a lock step system in which a plurality of CPU subsystems (consisting of a CPU and a main memory and a memory controller corresponding thereto) process the same instruction sequence in clock synchronization, When accessing internal information, device information connected to the local system, internal information of other subsystems, device information connected to other systems, etc., simply issue a command and the synchronization control unit When monitoring is performed, synchronization is lost.

As a countermeasure for this, when executing an instruction to refer to internal information, etc., execute the instruction in consideration of the synchronization state, such as accessing after stopping the synchronization state, and resynchronizing after the instruction execution is completed. Then, not only the hardware configuration but also the software configuration becomes complicated.
JP 2002-14943 A

  However, in the case of a conventional lockstep fault-tolerant computer system, when each CPU subsystem accesses the address space allocated locally to its own system through the synchronous control unit, the synchronous control unit receives from the other system. There is a problem of out of sync due to lack of access.

  In the case of access to the local address space of this system, in order for the system to maintain synchronization, the synchronization control unit monitors the instruction in consideration of the access address and the instruction type, and depends on the instruction. Exception processing must be provided, which complicates the processing in the synchronization control unit.

  Also, if the synchronization control unit does not have exception handling by instructions, addresses, etc., to prevent loss of synchronization, it is necessary to provide access restrictions such as prohibiting specific access during synchronization operation, and managing the synchronization status There is a problem that restrictions such as complicated control and real-time access become impossible.

  Therefore, the present invention provides a fault-tolerant computer and its bus selection control method that can easily access the local system and other subsystems without being aware of the synchronization state and that does not cause loss of synchronization. For the purpose.

In order to solve the above-described problems, the present invention is a fault-tolerant controller of a lockstep type computer system in which a plurality of CPU subsystems process the same instruction sequence in clock synchronization, and each CPU subsystem is compatible with each CPU subsystem. The CPU bus control unit that controls the CPU bus, the bus path control unit that selects which bus the command from the CPU bus control unit is issued through, and the synchronization state for each clock of each CPU subsystem A synchronization control unit to be monitored, an IO address control unit that performs address control of memory access or IO access, and a first bus that transfers a command from the CPU bus control unit to the IO address control unit via the synchronization control unit an instruction from the CPU bus controller, and a second bus for transferring to the IO address control unit without using the synchronization controller, each CP A shared address space allocated for each subsystem, and a local address space for the CPU subsystem to access locally in its own system, and the bus path control unit is configured such that the target address accessed by the instruction is a shared address for spatial, select the first bus, when the target address instruction is accessed in the local address space, by selecting the second bus, to transfer the instruction to the IO address controller Features.

  With the above configuration, it becomes possible to easily access the subsystems of the own system and other systems without being aware of the synchronization state, and the synchronization is not lost. By selecting the bus to be accessed according to the address space allocated to the memory or IO in the bus path control unit, only the synchronized instruction is transferred to the synchronization control unit, and there is a need for exception processing. Thus, the function for synchronization monitoring can be simplified.

  According to the first effect of the present invention, by switching the bus for transferring an instruction for each address space allocated to the subsystem, the synchronization control unit does not cause loss of synchronization for any access. Instructions can be executed without being aware of the synchronization status of the subsystem.

  In addition, by switching the bus for transferring instructions according to the address space allocated to the subsystem, the synchronization control unit only transfers synchronous instructions, so it checks for out-of-synchronization without being conscious of instruction contents or access destinations. As a result, the synchronization control circuit can be simplified.

  This is because the instructions transferred to the synchronization control unit are guaranteed only to the instructions that can always be synchronized. As a result, the synchronization control unit can easily determine that the synchronization has been lost if there is a difference in the commands issued from the CPUs.

  The second effect is that the local address space of the own subsystem and the shared address space uniquely assigned to each subsystem are prepared, thereby allowing access to the inside of the own system and devices connected to the own system. Access to internal information of other subsystems and internal information of devices connected to other subsystems can be executed only in the address space, and it is necessary to be aware of the synchronization status It becomes easy to access.

  The reason is that it is not necessary to be aware of the synchronization state because the hardware automatically selects the bus to be accessed for each address space. In addition, as a result of implementing a unique shared memory space for each subsystem, it is easy to refer to error information of other system devices, it is possible to easily refer to device error information such as the cause of out-of-synchronization, fault information, etc. It will be possible to easily identify.

  The third effect is that a part of the address space allocated to the subsystem is implemented as an access to the address space of the unique device, so that it can be used as a memory access of another subsystem. In addition, by allocating a memory space for issuing instructions to other subsystems, it is possible to easily issue instructions to other systems. This function can be used to identify factors such as errors.

  The reason for this is that when an error is detected in the subsystem, such as when synchronization is detected by the synchronization controller, all CPU subsystems issue access to each uniquely assigned shared address space. This is because it can be checked whether the subsystem first detected an error.

  Next, the best mode of the present invention will be described with reference to the drawings.

  FIG. 1 shows a schematic configuration of a lockstep type fault tolerant computer system to which the present invention is applied. Each fault-tolerant (FT) controller of subsystems 11 and 12 is a CPU, main memory, IO (Input / Output) bridge control unit, a synchronous control unit that checks instructions issued by the CPU, and a CPU issue The data transfer unit is configured to transfer the received instruction to the synchronous control unit of the other system. A command issued from the CPU passes through an internal path or data transfer unit, and is sent to a synchronization control unit of any controller to check a data difference. When a difference in data is detected in the synchronization control unit, an error occurs in synchronization, and the system side that caused the error is disconnected and operated.

  FIG. 2 shows a schematic configuration of a main part of a fault tolerant controller according to the present invention. The CPU bus control units 111 and 121 are connected to a CPU (not shown) and control the CPU bus. The bus route control units 112 and 122 select via which bus the instruction from the CPU bus control units 111 and 121 is issued. The buses 115, 116 and 125, 126 are buses that allow the synchronization control units 113, 123 to pass through. The buses 117 and 127 are buses for directly accessing the IO address control units 114 and 124 without passing through the synchronization control unit.

  In the bus path control units 112 and 122, in the case of an instruction issued from each CPU and an instruction to a device that is normally performed from an instruction target address, the buses 115, 116, 125, and 126 are instructions that require a synchronous operation. To the synchronization control units 113 and 123 via The synchronization control units 113 and 123 check the instruction issued from each CPU and transfer the instruction to the IO address control units 114 and 124. The IO address control units 114 and 124 perform memory access or IO access address control, and access the IO (or memory) controllers 118 and 128.

  When accessing the local address space in the local system that causes loss of synchronization, issue an instruction to the IO address control units 114 and 124 via the buses 117 and 127 that are backdoor paths that do not pass through the synchronization control units 113 and 123. By doing so, it is possible to prevent loss of synchronization in the synchronization control unit. In addition, since only the synchronization command is transferred to the synchronization control units 113 and 123, it is possible to monitor the synchronization state without being conscious of the content of the command.

  FIG. 3 shows an example of the operation of the lockstep fault tolerant computer system according to the present invention. A command issued from the CPUs 110 and 120 to the IO controller 128 passes through the CPU bus control units 111 and 121, and the bus path control units 112 and 122 determine a transfer destination of the command. The command issued from the CPU 110 is recognized as a command to another device in the bus path control unit 112 and transferred to the synchronization control unit 123 via a data transfer unit (not shown).

  The instruction issued from the CPU 120 is decoded as an instruction to the self-system device by the bus path control unit 122 and sent to the synchronization control unit 123 through the interface inside the controller. The synchronization control unit 123 compares the commands issued from the CPUs 110 and 120 and transfers the command to the IO address control unit 124 when there is no difference between the commands. When a difference is detected by this synchronization control unit, the system causing the error is disconnected as an error, and the system operates in the remaining system.

  FIG. 4 illustrates address space allocation according to the present invention. In order to access the system internal information, a shared space 211 allocated for the subsystem 11, a shared space 212 allocated for the subsystem 12, and a space 210 allocated locally in each subsystem are prepared. As means for accessing each of these spaces, the buses that access the IO address control unit are the buses 115, 116 and 125, 126 that pass through the synchronization control unit, and the direct IO address control without going through the synchronization control unit. The buses 117 and 127 that can access the sections are mounted. The bus path control unit determines which bus is to be accessed from the accessed address space, and transfers an instruction.

  FIG. 5 illustrates access to local space within the subsystem. When an instruction is issued to the space 210 allocated to the local subsystem, the bus route control units 112 and 122 select the buses 117 and 127 that do not pass through the synchronization control units 113 and 123, and are included in the respective subsystems. A certain IO address control unit 114 or 124 is accessed. By passing through the buses 117 and 127, no instruction is transferred to the synchronization control unit of the other system, so that loss of synchronization at the time of an instruction to the local space of the subsystem can be prevented.

  If the bus path control units 112 and 122 transfer instructions to the synchronization control units 113 and 123 via the buses 115 and 125, they are issued from each CPU because of the space allocated to the local address in the subsystem. The command is sent to the own synchronization control unit, and the instruction from the CPU of the other system is not transferred to the synchronization control unit, which causes loss of synchronization.

  FIG. 6 shows access to the shared space of each subsystem. When accessing the address space 211 assigned to the subsystem 11 corresponding to the IO address control unit 114 or the address space 212 assigned to the subsystem 12 corresponding to the IO address control unit 124, the subsystem on one side is accessed. Since this space is only mounted, access from CPUs of other systems also passes through the synchronization control unit, and no synchronization is lost.

  In this case, a command issued from the CPU 110 is sent from the bus path control unit 112 to the synchronization control unit 113 via the bus 115. The instruction issued from the CPU 120 is transferred from the bus path control unit 122 to the synchronization control unit 113 via the bus 126, and the synchronization control unit 113 performs instruction synchronization check.

  The instruction sent to the IO address control unit 114 accesses the allocated address space 211 and can access internal information. It is also possible to access a specific external device by using a memory space unique to the system. In this case, it is possible to access by installing a function of transferring the memory space uniquely assigned to a specific address.

  In this way, the bus route control unit selects a route for each instruction issued from the CPU, and uses a different bus (back door path) for instructions to the address causing the loss of synchronization. This makes it easy to access the subsystems of the own system and other systems without causing loss of synchronization. It is also possible to read not only the device information but also the contents of the main memory of another system by using the memory space uniquely assigned to the system, and issue instructions of the other system as a process at the time of error Is possible.

  In the above description, the local space allocated in the subsystem and the shared space of each subsystem are described as the IO address space. However, it is also possible to assign each space to the memory space and select the bus by the memory address. is there. The same function can be realized by treating the IO address control unit of each figure as a shared memory space of the system and an address control unit of a local memory space allocated locally.

  In the first embodiment, the bus is selected according to the target address of the instruction. However, in the fault-tolerant controller of the present embodiment, the bus is issued via which bus by the memory access or IO access instruction command issued by the CPU. It has a function to select. For this reason, instead of the IO address control unit of the first embodiment, an IO command control unit that performs memory access or IO access command control is provided.

  In the bus route control unit, in response to an instruction issued from each CPU, in the case of an instruction to the device that is normally performed from the command of the instruction, it is synchronized via a bus that passes through the synchronization control unit as an instruction that requires synchronous operation Send to control unit. The synchronization control unit checks the instruction issued from each CPU and transfers the instruction to the IO command control unit. The IO command control unit performs memory access or IO access command control, and accesses the IO (or memory) controller.

  For commands that may cause loss of synchronization, it is possible to prevent loss of synchronization at the synchronization control unit by issuing an instruction to the IO command control unit via a bus that is a backdoor path that does not pass through the synchronization control unit. It becomes possible. In addition, since only the synchronization command is transferred to the synchronization control unit, it is possible to monitor the synchronization state without being aware of the content of the command.

  In the bus route control unit of the present embodiment, a route to the IO command control unit is selected for each command of a memory access or IO access command issued from the CPU, and a command causing a loss of synchronization is transmitted to another bus (backdoor path). ) Can be used to facilitate access to the subsystems of the own system and other systems without causing the synchronization control unit to lose synchronization.

It is a schematic block diagram of a fault tolerant computer system to which the present invention is applied. It is a principal part schematic block diagram of the fault tolerant controller by this invention. It is a figure which shows the operation example of the fault tolerant computer system by this invention. FIG. 6 is a diagram illustrating address space allocation according to the present invention. FIG. 4 illustrates access to a local subsystem according to the invention. FIG. 4 is a diagram illustrating access to a shared space of each subsystem according to the invention.

Explanation of symbols

11, 12 Subsystem 111, 121 CPU bus control unit 112, 122 Bus route control unit 113, 123 Synchronization control unit 114, 124 IO address control unit 115, 116, 125, 126 Bus 117, 127 passing through the synchronization control unit Bus that does not pass through the control section

Claims (2)

A fault-tolerant controller for a lockstep computer system in which a plurality of CPU subsystems process the same instruction sequence in clock synchronization,
For each CPU subsystem,
A CPU bus control unit for controlling the CPU bus;
A bus path control unit that selects which bus the command from the CPU bus control unit is issued through; and
A synchronization control unit that monitors the synchronization state for each clock of each CPU subsystem;
An IO address control unit for performing address control of memory access or IO access;
A first bus for transferring a command from the CPU bus control unit to the IO address control unit via the synchronization control unit;
A second bus for transferring a command from the CPU bus control unit to the IO address control unit without going through the synchronization control unit ;
A shared address space allocated for each CPU subsystem, and a local address space for the CPU subsystem to access locally within its own system,
The bus path control unit selects the first bus when the target address accessed by the instruction is a shared address space, and selects the second bus when the target address accessed by the instruction is a local address space. to the fault tolerant controller and transferring the instructions to the IO address controller. A CPU bus control unit for controlling the CPU bus, a bus path control unit for selecting a bus from which a command from the CPU bus control unit is issued, and a synchronization state for each clock of each CPU subsystem are monitored. A synchronization control unit, an IO address control unit that performs address control of memory access or IO access, a first bus that transfers instructions from the CPU bus control unit to the IO address control unit via the synchronization control unit, and a CPU bus A lock step system in which a CPU subsystem having a second bus for transferring instructions from the control unit to the IO address control unit without passing through the synchronization control unit processes the same instruction sequence in a clock-synchronized manner in a plurality of subsystems A fault tolerant computer bus selection control method,
The bus path control unit selects whether to issue an instruction via the first bus or the second bus according to a target address of a memory access or IO access instruction, and performs IO address control on the instruction. A method for controlling the bus selection of a fault-tolerant computer, characterized by comprising:

Images