JP4819707B2 - Redundant computing system and computing unit - Google Patents

Description

  The present invention relates to a redundant arithmetic system and an arithmetic unit used therefor.

  FIG. 8 shows a redundant arithmetic system (conventional example 1) including three arithmetic units that perform parallel processing (see, for example, Patent Document 1). This redundant computing system is a system that can tolerate one failure of the MPU, memory, etc. constituting the computing unit. When one failure occurs, the majority process is performed by the majority circuit, and normal operation with respect to the external device is performed. It can be carried out.

  FIG. 9 shows a redundant arithmetic system (conventional example 2) in which a CLK output circuit is provided in one-to-one correspondence with the arithmetic unit (for example, see Patent Document 2). In this redundant arithmetic system, the arithmetic unit A operates at the frequency of the operation clock A output from the CLK output circuit A. Therefore, the processing time depends on the frequency of the operation clock A. Similarly, the calculation units B and C depend on the frequency of the operation clocks B and C. It is well known that the crystal oscillator constituting the CLK output circuit has a frequency unique to each component, and even if it is the same component, there is a slight deviation in the frequency. Therefore, there is a slight deviation in the processing time of the calculation unit. This deviation time is adjusted by waiting for a fixed time in a majority circuit, and a majority process is performed to enable parallel processing of the system.

  FIG. 10 shows a redundant arithmetic system (conventional example 3) in which the CLK output circuit is made redundant (see, for example, Patent Document 3). This redundant arithmetic system is a system in which the crystal oscillator of the CLK output circuit unit is multiplexed outside the redundant arithmetic unit and the operation clock for the arithmetic unit is switched. For example, as shown in FIG. 10, there is a method of monitoring the phase between one active clock and a spare clock and outputting an operation clock to the arithmetic unit by switching contacts. Even when an abnormality occurs in the working clock, the operation clock phase is prevented from being shifted before and after the occurrence of the abnormality. This is because many of the MPUs constituting the arithmetic unit have a PLL mounted therein, and if the phase shifts, the MPU cannot operate normally.

  Next, the operation will be described. The current clock and the spare clock are each selected by the switching circuit through the delay circuit and output. Further, the current clock and the spare clock are input to the rising detection unit in the phase synchronization monitoring unit, and a constant pulse is formed at the rising of each clock. The pulse formed by the rise detection unit is output by the comparison circuit when the pulses of both systems are aligned, and the pulse output from the comparison circuit is monitored by the pulse detection circuit. The determination circuit determines whether or not to switch the clock based on the disconnection detection circuit for both clocks and the output from the pulse detection circuit. The judgment circuit switches only by detecting the interruption of the standby clock regardless of the output of the pulse comparison circuit when the working clock is interrupted, and prioritizes the judgment so that the judgment can be made by the output of the pulse detection circuit when both system clocks are normal. I have it.

Japanese Patent Application Laid-Open No. 10-133900 (page-page, figure) Japanese Patent Laid-Open No. 2001-306348 (pages-pages, figures) Japanese Patent Laid-Open No. 5-136768 (page-page, figure)

  However, in the redundant arithmetic system of Conventional Example 1 described above, the arithmetic unit is made redundant, but the CLK output circuit is not made redundant. An error occurs and the function of the entire system is lost. Therefore, it is a redundant operation system with low reliability.

  Further, in the redundant calculation system of Conventional Example 2, the processing time shift of the calculation unit due to the frequency shift unique to the crystal oscillator and the component is solved by waiting in the majority circuit. However, during this waiting time, the system function is stopped. Further, when the system is operated for a long time, the processing time deviation is accumulated, and when the system is long, the performance of the system as redundant parallel simultaneous processing is deteriorated.

  Further, in the redundant arithmetic system of Conventional Example 3, the arithmetic unit and the crystal oscillator are made redundant, but the switching circuit is not made redundant. Frequency abnormality occurs and the entire system functions are lost. Therefore, it is a redundant system with low reliability.

  SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to provide a redundant arithmetic system that does not stop redundant parallel processing and cause performance degradation when one fault occurs, and an arithmetic unit used in the redundant arithmetic system.

  The arithmetic unit of the present invention is a crystal oscillator that generates an original clock of frequency F in each of the arithmetic units in the redundant arithmetic system that performs majority processing on the arithmetic results of three or more arithmetic units that perform parallel processing (FIG. 2). 211, etc.), and the original oscillation clock is counted repeatedly, and the counter value from 1 to N is output, and when the first counter value is “1”, when the counter value is N, “0” is counted. A synchronous counter (such as 213 in FIG. 2) that outputs an end flag, and an operation clock having a frequency F / N of “0” when the counter value is N / 2 and “1” when the counter value is N Comparing the clock output circuit output to the arithmetic processor with the count end flag in all arithmetic units, and correcting by skipping the counter value output by the synchronous counter when the arithmetic unit is abnormal A clock generation circuit having a clock correction circuit (such as 212 in FIG. 2) is provided.

  Preferably, the clock correction circuit (such as 212 in FIG. 2) latches the count end flag (referred to as a count end flag string) in all the arithmetic units and holds it as the abnormal state latch 1 at the second counter value. When the third counter value is obtained by advancing the original oscillation clock by a predetermined number from the first counter value, the count end flag string is latched and inverted and held as the abnormal state latch 2, and the first counter value Sometimes, an OR operation is performed corresponding to each bit of the count end flag string to be input, the abnormal state latch 1 being held, and the abnormal state latch 2 being held, and the result of the logical sum operation (referred to as a count end state) Is a majority circuit that outputs a result to a synchronous counter, and the synchronous counter determines the result of the majority process at the first counter value. Ri '1' to count up to the third counter value if a number, characterized in that it counts up one by one until the third counter value otherwise.

  For example, the first counter value is (N-4), the second counter value is N / 2, and the third counter value is (N-2).

  Further, a PLL for multiplying the output frequency of the crystal oscillator or the clock output circuit may be provided (FIG. 7).

  The redundant computation system of the present invention is characterized in that majority processing is performed on the computation result of the computation processor in any of the computation units described above.

  Each arithmetic unit in the redundant arithmetic system of the present invention is provided with a clock generation circuit having a crystal oscillator, a majority circuit, a synchronous counter, and a clock output circuit, and the individual difference and clock of the crystal oscillator mounted in the redundant arithmetic unit Period shifts are monitored each other, a high-speed original oscillation clock is divided to generate an MPU operation clock, and the phase is synchronized according to the majority result.

  At this time, even if a failure or abnormality occurs in one of the plurality of arithmetic units, it is possible to keep the operation clock phases of the remaining normal arithmetic units synchronized. Therefore, even if one failure of the arithmetic unit occurs, the remaining normal arithmetic units can continue the processing without causing the system to stop redundant parallel processing or reduce the performance, so that a highly reliable redundant system is obtained. Can do.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

[Description of configuration]
FIG. 1 shows an example of a redundant arithmetic system in which the arithmetic unit of the present invention is used. The redundant system 1 includes three arithmetic units 2, 3, 4 and an interface unit 5. The arithmetic units 2, 3, 4 are connected to the interface unit 5. The calculation results obtained by the calculation units 2, 3 and 4 are compared by the majority circuit unit 6 of the interface unit 5, and an external I / F signal 8 is output to the external device 7 based on the majority result.

  A detailed configuration of the calculation units 2, 3, and 4 is shown in FIG. In FIG. 2, arithmetic units 2, 3, 4 have the same circuit configuration and circuit function, and are constituted by clock generation circuits 21, 31, 41, MPUs 22, 32, 42, and memories 23, 33, 43. . The clock generation circuits 21, 31, 41 have the same configuration, have a function of generating operation clocks 24, 34, 44 of the MPUs 22, 32, 42, and a crystal oscillator 211 that generates original clocks 215, 315, 415. , 311, 411, synchronous counters 213, 313, and 413 that count N times to maintain the clock synchronization state, majority circuits 212, 312, 412, and clock output circuits 214, 314, 414. is there. Hereinafter, the clock generation circuit 21 will be described.

  The crystal oscillator 211 generates a source clock 215 having a frequency F and supplies it to the synchronous counter 213. The synchronous counter 213 repeatedly counts the original oscillation clock 215 input from the crystal oscillator 211, and outputs a counter value 217 from 1 to N to the clock output circuit 214 and the majority circuit 212.

  The clock output circuit 214 sets the operation clock 24 to ‘0’ when the counter value 217 is N / 2, and sets the operation clock 24 to ‘1’ when the counter value 217 is N. As a result, the operation clock 24 having the frequency F / N can be supplied to the MPU 22.

  The synchronous counter 213 outputs ‘1’ as the count end flag 218 when the counter value 217 is (N−4), and ‘0’ as the count end flag 218 when the counter value 217 is N. The count end flag 218 is supplied to the majority circuit 312 of the clock generation circuit 31 and the majority circuit 412 of the clock generation circuit 41 in addition to the majority circuit 212.

  Further, as will be described later, the synchronization counter 213 determines that the counter value 217 = (N−2) if the number “1” is two or more based on the majority result 216 input from the majority circuit 212 when the counter value 217 is (N−4). Otherwise, the counter value 217 = (N−3).

  As apparent from the above description, the majority circuit 212 is also supplied with the count end flag 318 from the synchronization counter 313 of the clock generation circuit 31 and the count end flag 418 from the synchronization counter 413 of the clock generation circuit 41. The majority decision circuit 212 latches count end flags 218, 318, and 418 (this 3-bit string is called a count end flag string) when the counter value 217 input from the synchronous counter 213 is N / 2. The count end flag string at this time is held as the abnormal state latch 1.

  Further, the majority circuit 212 latches the count end flag string when the counter value 217 input from the synchronous counter 213 is (N−2), bit-inverts this, and holds it as the abnormal state latch 2.

  Further, the majority circuit 212 will be described before and after, but when the counter value 217 input from the synchronization counter 213 is (N-4), the count end flag string to be input, the abnormal state latch 1 being held, An OR operation is performed corresponding to each bit of the abnormal state latch 2 held. In this case, the abnormal state latch 2 is in the previous cycle. The result of the OR operation (referred to as the count end state) is output to the synchronous counter 213 as the majority result 216. The majority result 216 indicates whether or not “1” is two or more in the count end state.

  The relationship among the synchronous counter 213, the majority circuit 212, and the clock output circuit 214 described above will become clear by the following time-series description with reference to FIG.

  After the power is turned on, the synchronous counter 213 in the arithmetic unit 2 is reset to a counter value = 1 (S1 in FIG. 3), and the crystal oscillator 211 always outputs the original clock 215. The synchronous counter 213 counts up with a counter value = 2 (S2 in FIG. 3), 3, 4,. The count end flag 218 has “0” as an initial value.

  When the counter value 217 of the synchronous counter 213 is N / 2 (S3 in FIG. 3), the clock output circuit 214 sets the operation clock 24 to “0” (S3-1 in FIG. 3). The majority circuit 212 holds the count end flag string as the abnormal state latch 1 (S3-2 in FIG. 3).

  At this time, if all the arithmetic units are normal, the count end flag is “000”, and the abnormal state latch 1: “000” is latched. The arithmetic unit outputting “1” to the count end flags 418, 318, and 218 can determine that an abnormal case has occurred, and “1” is latched to the corresponding bit of the abnormal state latch 1. . For example, when an abnormality occurs in the arithmetic unit 2, the abnormal state latch 1: “001” is set. When the counter value 217 of the synchronous counter 213 = (N−4) (S4 in FIG. 4), the count end flag 218 = “1” is output (S4-1 in FIG. 3).

  At the same time, the majority circuit 212 performs a majority process on the count end state bit indicated by 3 bits (S4-2 in FIG. 3), and if one or less of the 3 bits in the count end state is '1', the counter value Count up to 217 = (N−3) (S5 in FIG. 3). On the other hand, if 2 or more of the 3 bits in the count end state are ‘1’, the counter value 217 = (N−2) is incremented by 2 (S6 in FIG. 3).

  Here, the count end state refers to the result of logical sum operation for each bit correspondence of the count end flag string, the abnormal state latch 1 (S3-2 in FIG. 3), and the abnormal state latch 2 (S6-1 in FIG. 3). means. For example, if the count end flag string is “100”, the abnormal state latch 1 is “001”, and the abnormal state latch 2 is “000”, the count end state is “101”.

  Since the count end flag 218 output (S4-1 in FIG. 3) and the majority decision process (S4-2 in FIG. 3) are performed at the same time, the count end flag 218′1 ′ output from the arithmetic unit 2 is the arithmetic unit 2 This is not reflected in the majority process (S4-2 in FIG. 3) of the majority circuit 212.

  Accordingly, “2 or more of the 3 bits in the count end state is“ 1 ”” means that the count end flags 318 and 418 are being output from the other arithmetic units 3 and 4, and the synchronization counter 213 is This is one count behind the other synchronization counters 313 and 413. This is due to the deviation of the frequencies (F2 <F3, F2 <F4) of the original clocks 215, 315, and 415 due to the individual differences of the crystal oscillators 211, 311, and 411. In order to correct this deviation, when “2 or more of the 3 bits in the count end state is“ 1 ””, in S6 of FIG. 3, 2 counts up (counter value: (N-4) → (N-2 ))is doing.

  When the counter value 217 of the synchronous counter 213 is equal to (N-3) (S5 in FIG. 3), the counter value is counted up to (N-2) by the original oscillation clock 215. When the counter value 217 of the synchronous counter 213 = (N−2) (S6 in FIG. 3), the majority circuit 212 inverts the count end flag string and holds it as the abnormal state latch 2 (S6-1 in FIG. 3). .

  At this time, if all the arithmetic units are normal, the count end flag: “111” is inverted and “000” is latched as the abnormal state latch 2. The arithmetic unit outputting “0” as the count end flags 418, 318, and 218 can determine that an abnormal case has occurred, and “1” is latched to the corresponding bit of the abnormal state latch 2. For example, when an abnormality has occurred in the arithmetic unit 2, the abnormal state latch 2 becomes “001”.

  When the counter value 217 of the synchronous counter 213 is equal to (N−1) (S7 in FIG. 3), the counter is counted up to N by the original oscillation clock 215. When the counter value 217 of the synchronous counter 213 = N (S8 in FIG. 3), the clock output circuit 214 sets the operation clock 24 to “1” (S8-1 in FIG. 3). At the same time, the count end flag 218 = “0” is output (S8-2 in FIG. 3).

[Description of operation]
Next, the operation of the clock generation circuit will be described in each case with reference to a timing chart. Note that the counter value N = 16.

(1) Frequency shift due to individual differences in crystal oscillators (Fig. 4)
FIG. 4 shows the original oscillation clock, the counter value, the count end flag, the count end flag string, the abnormal state in each of the arithmetic units 2, 3, and 4 when the phase of the original oscillation clock advances in the order of 215, 315, and 415. The waveforms of latch 1, abnormal state latch 2, count end state, and operation clock are shown.

  Timing A in FIG. 4 is a time point when the counter value 417 of the synchronous counter 413 in the arithmetic unit 4 = (N−4) (S4 in FIG. 4). At this time, since the counter value 417 of the arithmetic unit 4 is behind the other counter values 217 and 317 as shown in the figure, the other count end flags 218 and 318 are already output. Accordingly, the count end state of the arithmetic unit 4 is “011”, and the majority circuit 412 counts up the counter value 417 by 2 (12 in accordance with the majority result (two or more '1's in S4-2 in FIG. 3)). (→ 14) This is because this delay (deviation) is corrected by advancing one count earlier than the other counter values. The same applies to timings C and D.

  Further, at the timing B which is the time point of the counter value 317 = (N−4) (S4 in FIG. 4) of the synchronous counter 313 in the arithmetic unit 3, the counter value 317 of the arithmetic unit 3 is more than the other counter values 217 and 417. Since it is delayed, it is corrected in the same way. The delay from the counter value 417 is due to the correction result at timing A.

  When performing these corrections, the period of the LOW level of the operation clocks 34 and 44 is shortened by one clock of the original clock, and the phase shift between the operation clocks 24, 34, and 44 is 2 clocks of the original clock. It becomes a range. The operation clocks 24, 34, and 44 obtained as a result of the correction can be expressed using the following equations.

Frequency = original oscillation clock frequency x counter value N (error: + 0%, -100 / N%)
Phase shift time = 2 clocks (2 / F) or less of the original oscillation clock From the above two formulas, when a highly accurate operation clock is required, the counter value N is set to a large value, It can easily be seen that the phase shift time can be reduced by increasing the frequency accuracy and increasing the frequency of the original clock.

(2) Stop the source clock due to a crystal oscillator failure (Figure 5)
The following four cases are assumed as abnormal cases.
(A) Count end flag cannot be output due to crystal oscillator failure (original clock stop) (b) Count end flag output timing error due to crystal oscillator failure (original clock frequency error) (c) Count end flag cannot be output due to sync counter failure And output timing abnormality (d) Count end flag cannot be output due to majority circuit failure and output timing abnormality FIG. 5 shows an operation in the abnormal case (a) in which the oscillation clock 415 is stopped due to the failure of the crystal oscillator 411 of the arithmetic unit 4. The waveforms of the oscillation clock, counter value, count end flag, count end flag string, abnormal state latch 1, abnormal state latch 2, count end state, and operation clock in each of the units 2, 3, and 4 are shown.

The source clock 415 stops at the timing E (counter value “15”) in FIG. 5 and is not output thereafter. Accordingly, since the counter value 417 does not become “16”, the count end flag 418 maintains “1” after the timing E. The operation clock 44 does not become “1”. As a result, at the timing F when the counter value 317 of the synchronous counter 313 in the calculation unit 3 becomes N / 2 (S3 in FIG. 3), the majority circuit 312
The count end flag string state “100” is latched as abnormal state latch 1: “100” (S3-2 in FIG. 3). Further, the majority circuit 212 of the arithmetic unit 2 is also latched as abnormal state latch 1: “100” with a slight delay (S3-2 in FIG. 3). Here, the abnormal state latch 1: “100” indicates that an abnormality of the arithmetic unit 4 is detected.

  After the abnormality is detected, the counter value 217 of the arithmetic unit 2 is the counter value of the arithmetic unit 3 at the timing G at which the counter value 217 of the synchronous counter 213 in the arithmetic unit 2 is equal to (N-4) (S4 in FIG. 4). Since it is later than 317, the count end flag 318 of the calculation unit 3 is already output. The count end state of the arithmetic unit 2 at this time is “110”, and the counter value 217 is incremented by 2 (in accordance with the majority result of the majority circuit 212 (two or more “1” in S4-2 in FIG. 3)). 12 → 14) indicating that the delay (deviation) is corrected.

  The abnormal state latch 1, abnormal state latch 2 and count end state of the arithmetic unit 2 at this time, and the count end flags of the arithmetic unit 2, arithmetic unit 3, and arithmetic unit 4 are shown in the following table.

  Similarly, the counter value 317 of the arithmetic unit 3 is the counter value of the arithmetic unit 2 even at the timing H that is the time point of the counter value 317 of the synchronous counter 313 in the arithmetic unit 3 = (N−4) (S4 in FIG. 4). Since it is behind the value 217, it is in a state of correction. Thus, after detecting that the original oscillation clock 415 of the calculation unit 4 has stopped, the phase synchronization of the operation clocks 24 and 34 of the calculation units 2 and 3 is achieved by not making the calculation unit 4 a correction target. Is possible.

(3) Frequency drop of the original clock due to a crystal oscillator failure (Figure 6)
FIG. 6 shows an original clock, counter value, and count end flag in each of the arithmetic units 2, 3, and 4 in the abnormal case (b) in which the frequency of the original clock 415 decreases due to a failure of the crystal oscillator 411 of the arithmetic unit 4. , Count end flag string, abnormal state latch 1, abnormal state latch 2, count end state, and operation clock waveform.

  The frequency of the original clock 415 decreases at the timing I in FIG. The majority circuit 312 at the timing J where the counter value 317 of the synchronous counter 313 in the arithmetic unit 3 becomes 317 = (N−2) (S6 in FIG. 3), the majority circuit 212 of the arithmetic unit 2 with a slight delay, the count end flag string “ The bit of “011” is inverted and the abnormal state latch 2: “100” is held (S6-1 in FIG. 3). Here, the abnormal state latch 2: “100” indicates that an abnormality of the arithmetic unit 4 is detected.

  After the abnormality detection, the counter value 317 of the arithmetic unit 3 is the counter value of the arithmetic unit 2 at the timing K, which is the time point of the counter value 317 of the synchronous counter 313 in the arithmetic unit 3 = (N−4) (S4 in FIG. 4). Since it is later than the value 217, the count end flag 218 of the computing unit 2 has already been output. The count end state of the arithmetic unit 3 at this time is “101” as shown in the table below, and the counter is determined by the majority result of the majority circuit 312 (S4-2 in FIG. 3, “1” is two or more). It shows that the value 317 is incremented by 2 (12 → 14) and the delay (deviation) is corrected.

  After detecting the frequency abnormality of the arithmetic unit 4, the phase of the operation clocks 24 and 34 of the arithmetic units 2 and 3 can be synchronized by not making the arithmetic unit 4 a correction target for deviation. The same operation is performed for the abnormal cases (c) and (d), and the phase synchronization of the operation clocks 24 and 34 is possible.

  As described above, the clock generation circuits 21, 31, 41 of the arithmetic units 2, 3, 4 perform the above operation to synchronize the phases of the operation clocks 24, 34, 44 to the MPU used in each arithmetic unit. It is possible to synchronize the processing steps of the redundant parallel processing of the system implemented by the arithmetic unit. Further, even when one of the arithmetic units 2, 3, and 4 fails, the redundant arithmetic processing of the system can be continuously performed by the remaining arithmetic units.

  The basic principle of the second embodiment of the present invention is the same as that of the first embodiment. However, the original clock generation method and the operation clock output method are further devised, and the number of redundant configurations is increased. It is possible to obtain higher reliability.

  The configuration is shown in FIG. In this figure, the PLL 219 can multiply the clock (frequency: f) output from the crystal oscillator 211 by M to obtain the original oscillation clock 215 (frequency: Mf). The PLL 220 can multiply the frequency-divided clock (frequency: Mf / N) output from the clock output circuit 214 by L to obtain the operation clock 24 (frequency: LMf / N). The two PLLs 219 and 220 make it possible to easily obtain the operation clock 24 from the relatively low frequency clock output from the crystal oscillator 211.

  For example, when the operation clock 24 (10 MHz) is obtained from the synchronous counter 213 (N = 100 counts), a 100 MHz source clock 215 is generated from the crystal oscillator 211 (frequency: 10 MHz) using the PLL 219 of M = 10. To do. The synchronous counter 213 counts 100 MHz × 100, and the clock output circuit 214 generates a 1 MHz divided clock. It is possible to easily obtain the 10 MHz operation clock 24 by multiplying the divided clock 10 times by the PLL 220.

  When the PLL is not used, the oscillation clock 215 (frequency: 1 GHz) × 100 of the crystal oscillator 211 is counted to obtain an operation clock 24 of 10 MHz. On the other hand, as described above, obtaining a similar operation clock from a low-frequency clock is effective as a noise countermeasure and facilitates circuit design.

  In the embodiment of FIG. 7, the redundant configuration of the arithmetic units 2, 3, 4, 5, 6 is set to 5. Thus, by setting the majority method to 3/5, a highly reliable redundant system that can cope with up to two faults in the arithmetic unit is configured. Furthermore, if the redundant configuration is 7, it is obvious that up to 3 failures can be handled by setting the majority method to 4/7.

  As an application example of the present invention, a space-borne device requiring high reliability can be cited.

The block diagram which shows an example of the redundant arithmetic system in which the calculating part of this invention is used The block diagram which shows Example 1 of the calculating part of this invention The figure which shows the time-sequential relationship of the component of the calculating part of FIG. First timing chart for explaining the operation of the present invention Second timing chart for explaining the operation of the present invention Third timing chart for explaining the operation of the present invention The block diagram which shows Example 2 of the calculating part of this invention The block diagram which shows the redundant arithmetic system of the prior art example 1 The block diagram which shows the redundant arithmetic system of the prior art example 2 The block diagram which shows the redundant arithmetic system of the prior art example 3

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Redundant arithmetic system 2-4 Operation part 5 Interface part 6 Majority decision circuit 7 External apparatus 8 External I / F signal 21, 31, 41 Clock generation circuit 22, 32, 42 MPU
23, 33, 43 Memory 211, 311, 411 Crystal oscillator 212, 312, 412 Majority circuit 213, 313, 413 Synchronous counter 214, 314, 414 Clock output circuit 215, 315, 415 Source clock 216, 316, 416 Majority result 217, 317, 417 Counter value 218, 318, 418 Count end flag 219, 220 PLL

Claims (5)

In each of the calculation units in the redundant calculation system that performs majority processing on the calculation results of three or more calculation units that perform parallel processing,
A crystal oscillator that generates a source clock of frequency F;
Counts the original clock repeatedly and outputs a counter value from 1 to N, and outputs a count end flag that is '1' when the counter value is 1 and '0' when the counter value is N A synchronization counter to
A clock output circuit for outputting an operation clock having a frequency F / N of “0” when the counter value is N / 2 and “1” when the counter value is N to the arithmetic processor of the arithmetic unit;
An arithmetic unit comprising a clock correction circuit for correcting the count end flags in all the arithmetic units by comparing each other and skipping a counter value output from the synchronous counter when the arithmetic unit is abnormal. The clock correction circuit includes:
Latching the count end flag (count end flag string) in all the arithmetic units at the second counter value and holding it as an abnormal state latch 1;
The count end flag string is latched / inverted and held as an abnormal state latch 2 at a third counter value obtained by advancing the original clock by a predetermined number from the first counter value;
When the count value is the first counter value, an OR operation is performed for each bit corresponding to the count end flag string to be input, the abnormal state latch 1 held, and the abnormal state latch 2 held. A majority circuit that performs majority processing on the result of the operation (referred to as a count end state) and outputs the result to the synchronous counter;
The synchronous counter counts up to the third counter value if the first counter value has a large number of '1' according to the result of the majority process, and counts one by one up to the third counter value otherwise. The arithmetic unit according to claim 1, further comprising a clock generation circuit to be uploaded.   3. The arithmetic unit according to claim 2, wherein the first counter value is (N-4), the second counter value is N / 2, and the third counter value is (N-2). .   The arithmetic unit according to claim 1, further comprising a PLL that multiplies an output frequency of the crystal oscillator or the clock output circuit.   5. The redundant arithmetic system according to claim 1, wherein majority processing is performed on the arithmetic result of the arithmetic processor in the arithmetic unit.

Images