JP5874492B2 - Fault tolerant control device and control method of fault tolerant system - Google Patents

Description

  The present invention relates to a fault tolerant control device and a control method for a fault tolerant system.

  Conventionally, a fault-tolerant system has been adopted to prevent the system from being unable to continue processing due to a transient malfunction.

  For example, in the lockstep method of the fault tolerant system, a plurality of processors are caused to execute the same instruction sequence in clock synchronization, the operations of all the processors are compared, and when a mismatch is detected, it is determined that an abnormality has occurred. A discrepancy is detected when the output is different from other synchronized processors due to, for example, a fault or other external or internal factor. Then, the fault tolerant system continues the operation of the system by causing the abnormal processor to be disconnected from the system, or causing the abnormal processor to be reset.

  When resetting an abnormal processor, the fault-tolerant system stops the normal processor, issues a reset request to initialize the abnormal processor, and copies status information such as the internal register value of the normal processor to the abnormal processor. Let Thereby, it is possible to continue processing of an application operating on a processor while maintaining synchronization among a plurality of processors (for example, Patent Documents 1 and 2).

  On the other hand, in recent years, a functional safety standard ISO 26262 for automobiles has attracted attention. Functional safety refers to the safety that is achieved by functionally reducing the damage even if a failure occurs in the components of an electronic system such as a microcomputer.

JP-A-5-313930 JP 2004-13396 A

  However, according to the conventional method, each time a mismatch is detected, the abnormal processor is reset, and time is spent for initialization processing, status information copying processing, and the like. From the time when the mismatch is detected until the abnormal processor is restored to the synchronized state, the application running on the processor is stopped. For example, it is not desirable for a stop state to occur for an application that operates on a microcomputer that performs processing related to human life where functional safety is important.

  It is an object of the present invention to propose a fault tolerant control device and a fault tolerant system control method for shortening an application stop time.

  A first aspect is a fault tolerant control device that processes three or more processors connected to a bus in synchronization with each other to process the same instruction sequence, and compares the processing states of the three or more processors to detect an abnormal processing state. An abnormal processor detecting means for detecting an abnormal processor, and when the abnormal processor is detected, a counter corresponding to the abnormal processor is incremented, and the abnormal processor is initialized when the counter reaches a reference value. Resynchronizing means for performing reset processing to be synchronized with a processor in a different processing state, and for performing emergency processing based on a normal processing state if not reached.

  According to the first aspect, the application stop time is shortened.

It is an example figure which shows the structure of a fault tolerant system. It is a figure explaining the detail of each structure of a comparison selection circuit, a comparison copy circuit, and a resynchronization control part. It is a figure explaining the flow of a reset process of an abnormal processor. It is a flowchart figure explaining the flow of a process of the fault tolerant control part in this Example. It is an example figure which shows the case where the mismatch of the value of an internal register occurs and emergency processing is performed. It is an example figure which shows the case where the mismatch of the value of an external access generate | occur | produces and an emergency process is performed. It is an example figure which shows the case where the mismatch of the value of an internal register occurs and reset processing is performed.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the technical scope of the present invention is not limited to these embodiments, but extends to the matters described in the claims and equivalents thereof.

[Configuration of fault-tolerant system]
FIG. 1 is a diagram illustrating an example of a configuration of a fault tolerant system 10 using a lockstep method. A fault tolerant system 10 in the figure is an in-vehicle system such as a brake control system and a speed display system. Since such an in-vehicle system is related to human life, the reliability of the system is particularly important.

  The fault tolerant system 10 of FIG. 1 includes, for example, three processors x1 to x3 that execute the same instruction sequence in clock synchronization, a memory 14, a memory control unit 15, peripheral function circuits e1 to en, and a control unit 20 of the fault tolerant system 10. (Hereinafter, fault tolerant control unit 20).

  The fault tolerant control unit 20 includes, for example, a comparison / selection circuit 11, a comparison / copy circuit 13, and a resynchronization control unit 12. The fault tolerant control unit 20 compares the processing states of the three processors x1 to x3 and performs resynchronization processing of abnormal processors when the processing states do not match. The fault tolerant control unit 20, the memory control unit 15, the peripheral function circuits e 1 to en, and the like are connected via the external bus 16.

  Further, in the bus line between the fault tolerant control unit 20 and the processor in FIG. 1, an external access value (any of x1b to x3b) input / output from one processor, an internal register x1R to The value of x3R (any of x1a to x3a), various signals, etc. are transferred. On the other hand, external access values x1b to x3b input / output from the three processors x1 to x3, internal register values x1a to x3a, various signals, and the like are transferred to the bus lines indicated by bold lines.

  The memory 14 stores a program PR that operates in the fault tolerant system 10. The program PR is, for example, an application program such as brake control or speed display, or a processor initialization program. The memory control unit 15 controls access to the memory 14 as a memory interface.

  In this example, the fault tolerant system 10 includes three processors x1 to x3, but the number of processors is not limited to three. The fault tolerant system 10 in the present embodiment only needs to have three or more processors.

[Fault tolerant control unit 20]
The fault tolerant control unit 20 compares the processing states of the processors one by one, and if a mismatch between the processing states is detected, the fault tolerant control unit 20 identifies a processor in an abnormal processing state (hereinafter referred to as an abnormal processor) based on the majority of the three processing states. Then, the fault tolerant control unit 20 performs resynchronization processing of the abnormal processor with a normal processor. Thereby, even if the processing state of any one of the three or more processors becomes abnormal, it is repaired and the system is continued. Thereby, the application processed by the system operates appropriately.

[Processing status of the processor]
The processing states to be compared by the fault tolerant control unit 20 in the present embodiment are the values x1b to x3b of external access output from each processor and the values x1a to x3a of the internal registers x1R to x3R of each processor. It is.

  Specifically, the external access values x1b to x3b indicate values output from the processor to the data bus, address bus, and control bus, for example. In the fault tolerant system 10, an external access value of a main processor among a plurality of processors is selected and output to a peripheral circuit such as the memory 14 and peripheral function circuits e 1 to en via the external bus 16. For this reason, when the selected external access value is abnormal, the abnormal external access value is propagated to the peripheral circuit, and the memory 14 is destroyed or the peripheral function circuits e1 to en run out of control.

  The internal register values x1a to x3a are, for example, a value of a program counter (hereinafter referred to as PC), a value of a stack pointer (hereinafter referred to as SP), and a register value held by a finite state machine (hereinafter referred to as FSM). is there. The PC value indicates the address value of the instruction to be processed next by the processors x1 to x3, and the SP value indicates the address of the memory where the temporarily saved processor information is stored. The FSM value is a register of a finite state machine that controls the pipeline stages of the processors x1 to x3, and indicates the value of a register that holds the processing state of the pipeline stages. For this reason, if the internal register values x1a to x3a are abnormal, for example, a program runaway or pipeline stage control runaway occurs.

  In the fault tolerant system 10 as shown in FIG. 1, each processor processes the same instruction sequence synchronously. In general, the processors x1 to x3 are processors of the same type. For this reason, normally, the external access values x1b to x3b output from each processor and the internal register values x1a to x3a of each processor are the same.

  Next, the comparison / selection circuit 11, the comparison / copy circuit 13, and the resynchronization control unit 12 constituting the fault-tolerant control unit 20 in this embodiment will be briefly described.

[Comparison selection circuit 11]
The comparison / selection circuit 11 compares the external access values x1b to x3b of the three processors x1 to x3 one by one. If a mismatch occurs between the external access values, the external access value is abnormal based on the majority vote. Identify the processor. The comparison / selection circuit 11 selects an external access value having a normal value as an emergency process when a mismatch occurs in the external access values x1b to x3b, and outputs the selected value to the peripheral circuit via the external bus 16. For example, as shown in FIG. 1, when an abnormal external access value x1b is output from the processor x1 (ER), the comparison / selection circuit 11 selects the external access value of the processor x2 or the processor x3, and Output to the external bus 16.

[Comparative copy circuit 13]
The comparison copy circuit 13 compares the internal register values x1a to x3a of the three processors x1 to x3 one by one, and when a mismatch occurs in the values of the internal registers, the internal register value is abnormal based on the majority vote. Identify the processor. The comparison copy circuit 13 instructs the writing of the normal internal register value to the internal register of the abnormal processor as an emergency process when a mismatch occurs in the internal register values x1a to x3a. This process takes about one cycle by changing the register value of the processor. For example, as shown in FIG. 1, when the value x2a of the internal register of the processor x2 is abnormal (ER2), the comparison copy circuit 13 transfers the internal register value x1a of the processor x1 to the internal register x2R of the processor x2, for example. Instruct to write.

[Resynchronization control unit 12]
The resynchronization control unit 12 resynchronizes the processors when a mismatch occurs in the external access values x1b to x3b or the internal register values x1a to x3a. The resynchronization control unit 12 has a mismatch counter for each processor, increments the mismatch counter corresponding to the processor in which the processing state mismatch has occurred, and performs resynchronization according to the error level determined based on the mismatch counter value. Instructs the synchronization process.

  Next, details of each component of the fault tolerant control unit 20 will be described.

  FIG. 2 is a diagram for explaining details of each configuration of the comparison / selection circuit 11, the comparison / copy circuit 13, and the resynchronization control unit 12. The comparison / selection circuit 11, the comparison / copy circuit 13, and the resynchronization control unit 12 are each connected to three processors x1 to x3, and the comparison / selection circuit 11 is connected to a peripheral circuit via an external bus 16.

[Details of Configuration of Comparison / Selection Circuit 11]
The comparison selection circuit 11 includes, for example, a comparison majority decision unit 111, a normal data selection unit 112, and an external access control unit 113. The comparison majority decision unit 111 compares the external access values x1b to x3b of the processors x1 to x3 one by one, and if a mismatch occurs, identifies a processor having an abnormal external access value based on the majority decision. Then, the comparative majority decision unit 111 notifies the resynchronization control unit 12 of the abnormal processor number s1 as error detection information.

  The normal data selection unit 112 selects a normal external access value from the external access values x1b to x3b of the three processors x1 to x3 as an emergency process when there is a mismatch in the external access values between the processors. Select and output to the external bus 16. Even if a mismatch occurs due to this emergency processing, a normal external access value is selected and output to the external bus 16. This prevents an abnormal external access value from being propagated to the peripheral circuit when a mismatch occurs in the external access value.

  The external access control unit 113 performs access control to the processors x1 to x3 and the external bus 16. The access control to the external bus 16 includes, for example, selection of the main processors x1 to x3, disconnection of abnormal processors, wait control of the processors x1 to x3, control of write suppression to the external bus 16 of the processors x1 to x3, and the like. Show.

[Details of Configuration of Comparison Copy Circuit 13]
The comparison copy circuit 13 includes, for example, a comparison majority decision unit 131 and a register copy control unit 132. The comparison majority decision unit 131 compares the internal register values x1a to x3a of the processors x1 to x3 one by one, and if a mismatch occurs, identifies a processor having an abnormal internal register value based on the majority decision. Further, the comparison majority decision unit 131 notifies the resynchronization control unit 12 of the abnormal processor number s1 as error detection information.

  When the register copy control unit 132 receives a notification of the register copy instruction s5 indicating the emergency process from the resynchronization control unit 12, the register copy control unit 132 instructs to copy the value of the mismatched register from the normal processor to the abnormal processor.

[Details of Configuration of Resynchronization Control Unit 12]
The resynchronization control unit 12 includes, for example, a monitoring timer 121, a mismatch counter 122, an initialization end flag 123, a sequence control unit 124, and a reset number counter 125. The monitoring timer 121 is a timer that monitors the execution time of the initialization program that is executed when the abnormal processor is reset. The initialization end flag 123 is a flag indicating the end of the initialization program. In addition, the sequence control unit 124 performs execution control of a sequence for performing resynchronization between processors. The reset number counter 125 is a counter that is managed for each processor and holds the number of resets of the processor.

  The mismatch counter 122 is managed for each processor, and the mismatch counter 122 corresponding to the abnormal processor is incremented each time a processing state mismatch occurs. When receiving the notification of the abnormal processor number s1, the resynchronization control unit 12 determines whether or not the abnormal processor mismatch counter 122 has reached the reference value. The reference value is set by the user, for example. The resynchronization control unit 12 determines that the error level is “low” when the mismatch counter does not reach the reference value, and does not perform the reset processing of the abnormal processor.

  On the other hand, when the mismatch counter 122 reaches the reference value, the resynchronization control unit 12 determines that the error level is “medium”, instructs the reset processing of the abnormal processor based on the reset requests sr1 to sr3, and writes the write suppression instruction. Based on s4, the output to the external bus 16 of the abnormal processor being reset is limited. At this time, copying of the processing state of the normal processor to the abnormal processor is instructed by the interrupt requests si1 to si3.

  Further, if the initialization program does not end within the reference time in the reset process of the abnormal processor, or if the reset count of the abnormal processor reaches the reference reset count, the resynchronization control unit 12 sets the error level to “high”. judge. In this case, the resynchronization control unit 12 disconnects the abnormal processor from the system and causes the normal processor other than the abnormal processor to continue the processing. In this case, the re-synchronization control unit 12 notifies the comparison / selection circuit 11 of a disconnection instruction s2 that instructs to disconnect the abnormal processor.

  Further, when the processing state mismatch occurs, the resynchronization control unit 12 notifies the peripheral circuit of an error level notification s6 indicating the error level “low / medium / high” of the abnormal processor.

  If the values of the internal registers are inconsistent and the error level is “low”, the resynchronization control unit 12 waits for one cycle for all processors via the external access control unit 113 of the comparison / selection circuit 11. In addition to outputting an instruction s3, the register copying control unit 132 of the comparison copying circuit 13 is notified of a register copying instruction s5 indicating emergency processing. The wait instruction s3 is a signal for stopping instruction fetch processing by the processor.

  Details of the processing flow of each control unit will be described later based on a flowchart and specific examples. Here, first, transition of the state of the abnormal processor and the normal processor when the abnormal processor reset process is performed will be described.

[Flow of abnormal processor reset processing]
FIG. 3 is a diagram for explaining a flow of reset processing of the abnormal processor. (A) of the figure shows the state transition of the abnormal processor to be reset, and (B) shows the state transition of the two normal processors when the abnormal processor is reset. In addition, the horizontal axis of the figure shows the flow of time, and the vertical axis shows the state of the processor. Specifically, the state pt1 indicates a normal state, and the state pt2 indicates an abnormal state.

  In FIGS. 3A and 3B, during the processing of the application program PR, a mismatch in the processing state between the processors is detected at timing t2. Therefore, in order to restore the normal processing state, the processing of the application program PR is stopped, and the preparation processing for resetting the abnormal processor is started.

  In one cycle from the timing t2 to the timing t3 in FIG. 3A, the abnormal processor is specified, the operation stop instruction of the normal processor, and the like are performed as preparation processing for resetting the abnormal processor. In the reset process, in addition to the initialization of the abnormal processor, the copy process CP to the abnormal processor in the normal processor processing state is performed. For this reason, the operation of the normal processor needs to be stopped in advance.

  Subsequently, the reset processing of the abnormal processor is started at timing t3 in FIG. At this time, the two normal processors are in an operation stop state at timing t3 in FIG. Then, until the timing t4, the initialization of the abnormal processor and the copy process CP to the abnormal processor in the processing state of the normal processor are performed. Thereby, the reset process of the abnormal processor is completed, and the state transits to the normal state pt1. Thereby, the process of the application program PR is restarted from the timing t4.

  As described above, during the reset preparation process and the reset process, that is, from the timing t2 to the timing t4 indicated by the dotted arrow tx in FIG. Become. For this reason, during the arrow tx, the processing of the application program PR is also stopped. In the reset process, since the copy process CP to the abnormal processor in the normal processor processing state is performed, the process of the application program PR is stopped for a certain period. However, it is desirable to minimize the stop time of the application program PR. For example, in the case of an application program PR that performs control related to human life that is operated by an in-vehicle microcomputer or the like, even if it is a short stop time, depending on the traveling speed of the automobile, it corresponds to a long traveling distance and has a large influence.

  Therefore, when the fault tolerant control device in the present embodiment compares the processing states of three or more processors and detects an abnormal processor that is in an abnormal processing state, the fault tolerant control device increments a mismatch counter corresponding to the abnormal processor and does not match. When the counter reaches the reference value, the abnormal processor is initialized and a reset process is performed to synchronize with a processor in a normal processing state (error level “medium”). Further, the fault tolerant control device causes emergency processing based on a normal processing state (error level “low”) when the mismatch counter has not reached the reference value.

  In the present embodiment, when the error level is “low” where the mismatch counter does not reach the reference value, it is considered that the mismatch of the processing state of the abnormal processor is caused by a temporary factor such as noise. In this case, the fault tolerant control device eliminates the abnormal processing state not by the reset process but by the emergency process. In the emergency process, the operation stop time of the processor is minimized as compared with the reset process. Thereby, the stop time of the application program can be minimized.

  On the other hand, when the error level is “medium” where the mismatch counter reaches the reference value, it is considered that there is a possibility that the processing state mismatch has occurred due to a permanent factor that is not temporary. Therefore, the fault tolerant control device in the present embodiment instructs reset processing of the abnormal processor and verifies whether or not the abnormal processing state is resolved. Then, the fault tolerant control device in the present embodiment, when the initialization program executed at the time of reset processing of the abnormal processor does not end within the reference time, or when the number of resets of the processor reaches the reference reset number, When the error level is “high”, it is determined that the processor has a permanent failure, and the processor is disconnected from the system.

  As described above, the fault-tolerant control device according to the present embodiment determines the error level based on the number of occurrences of processing state mismatches, the execution time of the initialization program during the reset process, and the like. When the error level is “low”, the fault-tolerant control device assumes that an abnormal processing state has occurred due to a temporary factor and does not perform a processor reset process. Further, when the error level is “high”, the fault tolerant control device disconnects the abnormal processor from the system without performing the processor reset process.

  As a result, the frequency of the reset process is reduced and the operation stop time of the processor is minimized as compared with the case where the reset process of the abnormal processor is performed every time a mismatch of the process state is detected. For this reason, the stop time of the application program can be minimized.

  Here, a flow of a series of control processes of the fault tolerant system will be described later based on a flowchart.

[Flow of fault tolerant control processing]
FIG. 4 is a flowchart for explaining the processing flow of the fault tolerant control unit 20 in the present embodiment. The comparison selection circuit 11 and the comparison copy circuit 13 of the fault tolerant control unit 20 compare the values of the external accesses x1b to x3b indicating the processing states of the three processors x1 to x3 and the values of the internal registers x1a to x3a one by one. Are determined to match (S10). If a mismatch in processing state is detected (YES in S10) and the internal register values x1a to x3a are inconsistent (YES in S11), the comparison copy circuit 13 determines the value x1a in the internal register of each processor x1 to x3. A processor having an abnormal internal register value is identified based on the majority of x3a and notified to the resynchronization control unit 12.

  Specifically, the comparison / selection circuit 11 and the comparison / copy circuit 13 take a majority vote as follows. When the value of the processor x1 and the processor x2 or the value of the processor x1 and the value of the processor x3 match, the comparison selection circuit 11 and the comparison copying circuit 13 set the value of the processor x1 as a majority value, that is, a normal value. Output. On the other hand, if they do not match, the comparison / selection circuit 11 and the comparison copy circuit 13 further compare the values of the processor x2 and the processor x3, and if they match, the value of the processor x2 is determined as a majority value, that is, a normal value. Output.

  Returning to the flowchart, subsequently, the resynchronization control unit 12 determines whether or not the mismatch counter 122 of the abnormal processor has reached the reference value (S12). If it is less than the reference value (YES in S12), it is determined that the error level is “low”, and the emergency process E1-1 in steps S13 to S15 is performed instead of the reset process.

  Specifically, as the emergency process E1-1, the resynchronization control unit 12 first asserts a wait instruction s3 to all the processors x1 to x3 (S13). Further, the resynchronization control unit 12 outputs the register copy instruction s5 to the comparison copy circuit 13, and instructs the copy of the value from the normal processor to the abnormal processor for the register in which the mismatch occurs (S14). Subsequently, the resynchronization control unit 12 cancels the wait instruction s3 to all the processors x1 to x3 (S15), and increments the abnormal processor mismatch counter 122 (S16). Then, the process returns to the process state detection step (S10) again. The mismatch counter 122 is initialized when the fault tolerant system 10 is started or when the corresponding processor is reset.

  As described above, when the values x1a to x3a of the internal register are inconsistent and it is determined that the error level is “low”, the abnormal processing state in the processor is resolved by the emergency processing E1-1 instead of the reset processing. Are resynchronized. In the emergency process E1-1, since the operation stop time of the processor is suppressed to about one cycle, the stop time of the application program is suppressed to the minimum as compared with the case where the reset process is performed.

  On the other hand, when the processing state in which the mismatch occurs is an external access value (NO in S11), the comparison / selection circuit 11 determines that the value of the external access is based on the majority of the external access values of the processors x1 to x3. An abnormal processor is identified and notified to the resynchronization control unit 12. The method of majority decision is as described above.

  Then, the comparison / selection circuit 11 selects a normal external access value and outputs it to the external bus 16 as the emergency process E1-2 (S17). This prevents an abnormal external access value from being output to the external bus and propagated to the peripheral circuit. As described above, when the mismatch of the external access values occurs, the emergency process E1-2 is performed regardless of whether or not the reset process is performed. This prevents an abnormal external access value from propagating to the peripheral circuit. Subsequently, the resynchronization control unit 12 determines whether or not the mismatch counter 122 of the abnormal processor has reached the reference value (S18).

  If it is less than the reference value (YES in S18), the resynchronization control unit 12 increments the mismatch processor 122 of the abnormal processor (S19). At this time, it is determined that the error level is “low”, the reset processes S22 to S26 are avoided, and the process returns to the process state detection step (S10) again. As described above, when the error level is determined to be “low”, the reset process is avoided, so that the stop time of the application program is minimized as compared with the case where the reset process is performed.

  If the abnormal processor mismatch counter 122 exceeds the reference value (NO in S12, NO in S18), the resynchronization control unit 12 determines whether or not the abnormal processor mismatch counter 122 exceeds the reference value for the first time, that is, It is determined whether the reset counter 125 has reached the reference reset count (in this example, 2 times) (S21). When it exceeds for the first time (YES in S21), the resynchronization control unit 12 determines that the error level is “medium” and instructs reset processing E2 (S22 to S26) of the abnormal processor. For example, when it is determined that the error level is “medium” in the in-vehicle system, a warning message is notified to the driver of the automobile.

  As the reset process E2, the resynchronization control unit 12 first asserts a wait instruction s3 to a normal processor and asserts a reset request (any of sr1 to sr3) to an abnormal processor (S22). When the abnormal processor reset request is asserted, the abnormal processor is initialized according to the initialization program. At this time, the resynchronization control unit 12 monitors the execution time of the initialization program by the monitoring timer 121.

  Then, the resynchronization control unit 12 determines whether the time from the start of reset until the initialization program ends and the initialization end flag 123 is set is within the reference time (S23). That is, the resynchronization control unit 12 determines whether or not the target processor is in a runaway state where the initialization program cannot be completed. The reference time is set by the user, for example.

  When the initialization program ends within the reference time (YES in S23), it is determined that the abnormal processor has been normally initialized. Therefore, the resynchronization control unit 12 asserts the wait instruction s3 of the abnormal processor (S24). Subsequently, the resynchronization control unit 12 cancels the wait instruction s3 of all the processors x1 to x3 and asserts the interrupt requests si1 to si3 of all the processors x1 to x3 (S25). As a result, all the processors x1 to x3 start interrupt handlers at the same time, and the processing state is copied from the normal processor to the abnormal processor (S26). At this time, the reset counter 122 of the abnormal processor that has been reset is initialized. Then, the resynchronization control unit 12 increments the reset number counter 125 (S27).

  On the other hand, if the abnormal processor mismatch counter 122 exceeds the reference value for the second time (NO in S21), or if the initialization program does not end within the reference time (NO in S23), resynchronization control. The unit 12 performs the abnormal processor disconnection process E3 (S30, S31 to S32). In this case, it is determined that the error level is “high”. For example, when it is determined that the error level is “high” in the in-vehicle system, the driver of the automobile is notified to go to the repair shop.

  First, the resynchronization control unit 12 notifies the external access control unit 113 of the comparison / selection circuit 11 of the disconnection instruction instruction s2 as the disconnection process E3 (S30, S31). Thereby, for example, the wiring of the abnormal processor is controlled to an invalid state and disconnected from the system. Subsequently, if the initialization program does not end within the reference time (NO in S23), the resynchronization control unit 12 cancels the wait instruction s3 because the wait instruction s3 of the normal processor is asserted (S32). ). As a result, the abnormal processor is disconnected, and in this example, the operation is continued with only two normal processors.

  Specifically, if the abnormal processor mismatch counter 122 exceeds the reference value for the second time (NO in S21), it means that the mismatch counter 122 has reached the reference value again in the reset abnormal processor. . Therefore, it is determined that the processor has a permanent failure that does not clear the abnormal processing state even if reset, and is disconnected from the system. Alternatively, if the initialization program does not end within the reference time (NO in S23), it is determined that the processor cannot complete the execution of the initialization program due to a permanent failure, and is in a runaway state. Detached from.

  In the present embodiment, the permanent cause of the mismatch of the external access values is, for example, a wiring failure in the data bus, address bus, and control bus. In the case of such a wiring failure, the processor cannot perform a process for reading out a command to be executed next from the memory or a process for temporarily storing the processing state of the processors x1 to x3 in the memory.

  Further, a permanent factor causing the mismatch of the internal register values is, for example, a failure of the flip-flops constituting the internal registers x1R to x3R. When having such a failure, the processor calculates the memory address where the instruction to be executed next is stored, calculates the address of the memory that temporarily stores the processing state of the processors x1 to x3, and next time in the sequence control of pipeline processing. The state determination process cannot be performed.

  Thus, when the abnormal processor has a permanent failure, the abnormal processor cannot appropriately proceed with the processing of the initialization program. Thus, even if the initialization program exceeds the reference time, it is not terminated and it is determined that the abnormal processor is in a runaway state. Or, even if the initialization program can be terminated, the abnormal processor again induces an abnormal processing state. Therefore, such an abnormal processor is disconnected from the system.

  In the flowchart of FIG. 4, the fault tolerant control unit 20 disconnects the abnormal processor when the reset number counter 125 reaches two times (NO in S21). However, the number of times (reference reset number) for determining whether or not to disconnect the abnormal processor is not limited to two. The fault tolerant control unit 20 may disconnect the abnormal processor when the number of resets of the abnormal processor reaches, for example, a reference reset number set by the user. In this case, the reset count (reset count counter 125) of the abnormal processor is reset, for example, when the fault tolerant system 10 is activated.

  Next, the processing of the fault tolerant control unit 20 described with reference to the flowchart of FIG. 4 will be specifically described. First, a specific example in the case where mismatch of internal register values occurs and resynchronization is achieved by emergency processing will be described.

[Specific example: Resynchronization by emergency processing (internal register value mismatch)]
FIG. 5 is an example diagram showing a specific example in the case where a mismatch of internal register values occurs and emergency processing is performed. In this example, an abnormal internal register value is detected in the processor x2. Further, the cycle indicated by the arrow c1 on the left side of the figure indicates the same cycle as the cycle in which the processing state mismatch occurs, and the cycle indicated by the arrow c2 indicates one cycle.

  The comparison copying circuit 13 compares the values of the internal registers when executing the application program PR of each of the processors x1 to x3 one by one, and determines whether or not there is a mismatch between the processors. Then, the comparison copy circuit 13 specifies that the abnormal processor is the processor x2 as a result of the majority of the values in the internal register, and notifies the resynchronization control unit 12 of the abnormal processor number s1 “2”.

  Subsequently, the resynchronization control unit 12 receives the notification of the abnormal processor number s1, and determines whether or not the abnormal processor mismatch counter 122 has reached the reference value. In this example, at this time, the mismatch counter 122 does not reach the reference value. Therefore, the register copy control unit 132 notifies the wait instruction s3 via the external access control unit 113 of the comparison / selection circuit 11, and asserts a one-cycle wait instruction s3 to all the processors x1 to x3. When the wait instruction s3 is asserted, the processors x1 to x3 stop the instruction fetch process. As a result, the operations of the processors x1 to x3 are stopped.

  In addition, the resynchronization control unit 12 notifies the register copy instruction s5 to the comparison copy circuit 13. Upon receiving the register copy instruction s5, the register copy control unit 132 of the comparison copy circuit 13 copies the value of the register of the processor x1 to the register in which the mismatch of the processor 2 has occurred. Subsequently, the resynchronization control unit 12 cancels the wait instruction s3 of all the processors x1 to x3 via the external access control unit 113 of the comparison / selection circuit 11. As a result, the operations of the processors x1 to x3 are resumed. Then, the resynchronization control unit 12 increments the mismatch counter 122 of the processor x2.

  As described above, in the specific example of FIG. 5, when the mismatch counter 122 of the processor x2 does not reach the reference value, it is determined that there is a high possibility that the cause of mismatch has occurred due to noise, and not the reset process but the emergency process E1- 1 enables resynchronization of the processor x2. In the internal register emergency process E1-1, the stop time of the processors x1 to x3 is suppressed to about one cycle. Thereby, the stop time of the processors x1 to x3 is minimized as compared with the case where the reset process is performed. As a result, the stop time of the application program PR is minimized, and the processing reliability is improved.

  Next, a specific example in the case where mismatch of external access values occurs and resynchronization is achieved by emergency processing will be described.

[Specific example: Resynchronization by emergency processing (external access value mismatch)]
FIG. 6 is a diagram illustrating a specific example in the case where the mismatch of external access values occurs and emergency processing is performed. In this example, an abnormal external access value x1b is output from the processor x1. In addition, the cycle indicated by the arrow c11 on the left side of the figure indicates the same cycle as the cycle in which the processing state mismatch occurs.

  The comparison / selection circuit 11 compares the external access values when executing the application programs of the processors x1 to x3 one by one, and determines whether or not there is a mismatch between the processors. Then, the comparison / selection circuit 11 specifies that the abnormal processor is the processor x1 as a result of the majority of the values of the external access, and notifies the resynchronization control unit 12 of the abnormal processor number s1 “1”. Further, the external access control unit 113 of the comparison / selection circuit 11 instructs s11 to output the external access value of the normal processor x2, not the processor x1, to the external bus. At this time, the operations of the processors x1 to x3 are continued.

  Subsequently, the resynchronization control unit 12 receives the notification of the abnormal processor number s1, and determines whether or not the mismatch counter 122 of the abnormal processor x1 has reached the reference value. In this example, at this time, the mismatch counter 122 does not reach the reference value. Therefore, the resynchronization control unit 12 increments the mismatch counter 122 of the processor x1.

  As described above, also in the specific example of FIG. 6, when the mismatch counter 122 of the processor x1 does not reach the reference value, it is determined that there is a high possibility that mismatch has occurred due to noise, and the reset process is avoided. In the external access emergency process E1-2, since the operations of the processors x1 to x3 are not stopped, the stop of the processors x1 to x3 itself is avoided when the reset process is performed. As a result, the processing of the application program PR is continued and the processing reliability is improved.

  Next, a specific example in the case where mismatch of internal register values occurs and resynchronization is attempted by reset processing will be described.

[Specific example: Resynchronization by reset processing]
FIG. 7 is an example diagram showing a specific example in a case where a mismatch of internal register values occurs and reset processing is performed. In this example, an abnormal internal register value x2a is detected in the processor x2 in the same manner as in the specific example of FIG. Also, the cycle indicated by the arrow c21 on the left side of the figure indicates the same cycle as the cycle in which the processing state mismatch occurs, and the cycle indicated by the arrow c22 indicates the cycle of the resynchronization process.

  The comparison copy circuit 13 specifies that the abnormal processor is the processor x2 as a result of the majority of the values of the internal register, and notifies the resynchronization control unit 12 of the abnormal processor number s1 “2”. Subsequently, the resynchronization control unit 12 receives the notification of the abnormal processor number s1, and determines whether or not the mismatch counter 122 of the abnormal processor x2 has reached the reference value. In this example, the mismatch counter 122 reaches the reference value. In this example, it is assumed that the mismatch counter 122 reaches the reference value for the first time.

  Therefore, the resynchronization control unit 12 notifies the wait instruction s3 via the external access control unit 113, asserts the wait instruction s3 of the processors x1 and x3, and asserts the reset request sr2 of the processor x2. When the wait instruction s3 is asserted, the instruction fetch processing of the processors x1 and x3 is stopped, and the operation is stopped. In the processor x2, the initialization program is executed based on the reset request sr2. At this time, the processor x2 is notified of the write inhibition instruction s4, and the output to the external bus 16 during execution of the initialization program is inhibited. The monitoring timer 121 of the resynchronization control unit 12 starts monitoring the execution time of the initialization program (s21).

  When the initialization program of the processor x2 is completed, the processor x2 notifies the resynchronization control unit 12 of the initialization completion signal s22. Upon detecting the completion of initialization, the resynchronization control unit 12 controls the initialization end flag 123, notifies the wait instruction s3 via the external access control unit 113, and asserts the wait instruction s3 of the processor x2. As a result, in addition to the processors x1 and x3, the operation of the processor x2 that has been initialized is also stopped.

  Subsequently, the resynchronization control unit 12 asserts the interrupt requests si1 to si3 of the processors x1 to x3 and releases the wait instruction s3 of the processors x1 to x3 via the external access control unit 113 of the comparison / selection circuit 11. To do. Thereby, in the processors x1 to x3, the processing of the interrupt handler is started, and the processing state of the processor x1 is copied to the processor x2. When the copying is completed, the resynchronization process of the processor x2 is completed. Subsequently, the resynchronization control unit 12 cancels the interrupt requests si1 to si3 of the processors x1 to x3 and restarts the operations of all the processors x1 to x3. Then, the resynchronization control unit 12 increments the reset number counter 125.

  As described above, when the mismatch counter 122 of the processor x2 reaches the reference value, resynchronization among the processors is achieved by reset processing of the abnormal processor. By resetting the abnormal processor, faults that can be resolved by initialization of the processor are eliminated. Further, when the abnormal processor is reset, it is verified again whether or not the processing state mismatch occurs after the reset, and it is possible to determine whether or not the abnormal processor has a permanent failure.

  In the example of FIG. 7, an example in which the initialization program during the reset process is completed within the reference time is shown. However, when the initialization program does not end at the reference time, the resynchronization control unit 12 notifies the external access control unit 113 of the processor x2 disconnection instruction s2, and disconnects the processor x2 from the system. When the wait instruction s3 of the processors x1 and x3 is asserted, the resynchronization control unit 12 cancels the wait instruction s3. As a result, the operations of the processors x1 and x3 are resumed, and the processing is continued by the two processors. Similarly, when the reset count counter 125 reaches the reference reset count, the processor x2 is disconnected from the system and the processing is continued by the two processors.

  As described above, when initialization of the processor x2 does not end within the reference time, and when the reset count of the processor x2 reaches the reference reset count (twice in this example), the abnormal processor is not permanently eliminated by the reset processing. Determined to have a fault and disconnected from the system. As a result, the processing state mismatch is prevented from continuously occurring, and the stop time of the application program operating in the system is minimized, thereby improving the processing reliability.

  As described above, the fault-tolerant control device in the present embodiment compares the processing states of three or more processors and detects an abnormal processor that is in an abnormal processing state. When the fault tolerant control device detects an abnormal processor, the fault tolerant control device increments a mismatch counter (counter) corresponding to the abnormal processor, and initializes the abnormal processor when the mismatch counter reaches a reference value. The reset process to be synchronized with is performed, and if not reached, the emergency process based on the normal processing state is performed.

  As a result, the fault tolerant control device can detect the processing state due to a temporary factor such as noise if the processing state mismatch does not reach the reference value even when the processing state mismatch occurs. Therefore, the abnormal processor is not reset. That is, it is avoided that the reset process is performed every time the processing state mismatch occurs. In this case, resynchronization is achieved only by the emergency process, the stop time of the application program is shortened or avoided, and the reliability of the process of the application program is improved. In particular, in the case of an application program that operates on a microcomputer that is related to human life, it is important that the stop time is short.

  Specifically, the fault tolerant control device in the present embodiment detects an abnormal processor by detecting a mismatch of output values to the processor bus. When the fault tolerant control device detects a mismatch in the output values, the output value to the external buses of three or more processors as an emergency process regardless of whether or not the mismatch counter corresponding to the abnormal processor reaches the reference value. A normal output value is selected and output to the bus. This avoids the propagation of abnormal external access values to the peripheral circuits. Further, since the operation of the processor is not stopped in this emergency process, the stop of the application program process is avoided when the reset process is not performed.

  In addition, the fault tolerant control device in the present embodiment detects the abnormal processor by detecting a mismatch in register values of the processor. When the fault tolerant control device detects a mismatch in the value of the internal register, if the mismatch counter corresponding to the abnormal processor has not reached the reference value, instead of reset processing, the fault processor registers the normal register as the emergency processor. Write the value. In this emergency process, since the stop time of the processor is minimized to about one cycle, the stop time of the application program process is minimized as compared with the case where the reset process is performed.

  Furthermore, when the mismatch counter corresponding to the processor having an abnormal processing state reaches the reference value, the fault tolerant control device determines that there is a possibility that the processing state does not match due to a non-temporary factor, Reset the abnormal processor. As a result, failures that are eliminated by the reset process are eliminated, and whether or not the abnormal processor has a permanent failure is determined by verifying whether or not the number of resets has reached the reference reset number. Is done.

  When the number of resets of the abnormal processor reaches the reference number of resets, the fault tolerant control device determines that the abnormal processor has a permanent failure that cannot be resolved by the reset process, and the normal processor other than the abnormal processor has a normal processing state. Continue the system with only the processor. Alternatively, even when initialization processing such as an initialization program does not end within the reference time during reset processing of an abnormal processor, the fault-tolerant control device determines that the abnormal processor has a permanent failure, and other than the abnormal processor The system is continued only by the processor in the normal processing state. As a result, the abnormal processing state is prevented from continuously occurring, the stop time of the application program is minimized, and the processing reliability is improved.

  By the way, the fault tolerant control device according to the present embodiment uses the inconsistency between the value of the external access of the processor and the value of the internal register as the processing state to be compared. Either of them may be the processing state to be compared. Also in this case, when the cause of the mismatch of the processing state is regarded as a temporary factor, the reset processing of the abnormal processor is avoided. Thereby, the stop time of the application program is shortened or avoided.

  The fault tolerant control device according to the present embodiment includes a mismatch counter that is incremented when a mismatch of external access values is detected, and a mismatch counter that is incremented when a mismatch of internal register values is detected. You may have separately. In this case, the fault tolerant control device has a reference value corresponding to each mismatch counter. As a result, a reference value for determining whether or not there is a mismatch due to a temporary factor can be set for each of the internal register and the external access mismatch counter.

  For example, processing state mismatch due to noise is more likely to occur in external access than in internal registers. Therefore, for example, the user sets the reference value corresponding to the mismatch counter of the internal register to a value smaller than the reference value corresponding to the mismatch counter of the external access. Thereby, the fault tolerant control device can realize more appropriate determination of necessity of reset processing.

  Also, the mismatch of external access values may occur due to the mismatch of internal register values. Therefore, for example, the user sets the reference value corresponding to the value mismatch counter of the internal register to a smaller value. As a result, the abnormal processor is reset when the mismatch of the internal register values reaches the reference value, and the mismatch of the external access is also eliminated. As a result, the occurrence of an abnormal processing state is prevented, and the stop time of the application program is minimized.

  The above embodiment is summarized as follows.

(Appendix 1)
A fault-tolerant control device that synchronizes three or more processors connected to a bus and processes the same instruction sequence,
An abnormal processor detecting means for comparing the processing states of the three or more processors and detecting an abnormal processor in an abnormal processing state;
When the abnormal processor is detected, a counter corresponding to the abnormal processor is incremented, and when the counter reaches a reference value, the abnormal processor is initialized and a reset process is performed to synchronize with the processor in the normal processing state. A fault-tolerant control device comprising: resynchronization means for performing emergency processing based on a normal processing state when not reached.

(Appendix 2)
In Appendix 1,
The abnormal processor detection means detects the abnormal processor by detecting a mismatch of output values to the bus of the processor;
The emergency process when the mismatch of the output values is detected includes a process of selecting a normal output value from the output values of the three or more processors and outputting the selected output value to the bus,
The resynchronization means is a fault-tolerant control device that further performs the emergency process in addition to the reset process when the output value mismatch is detected and the counter reaches a reference value.

(Appendix 3)
In Appendix 1 or 2,
The abnormal processor detection means detects the abnormal processor by detecting a mismatch of register values of the processor;
The fault tolerant control device, wherein the emergency process when a mismatch of the register values is detected includes a process of writing a normal register value to the register of the abnormal processor.

(Appendix 4)
In Appendix 3,
The fault tolerant control device, wherein the register includes any one of a register that holds a program counter of the processor, a register that holds a stack pointer, and a register that holds state information of the processor included in a finite state machine.

(Appendix 5)
In Appendix 3 or 4,
The counter has a first counter that is incremented when a mismatch of the output values is detected, and a second counter that is incremented when a mismatch of the values of the registers is detected;
The fault tolerant control device, wherein the reference value includes a first reference value corresponding to the first counter and a second reference value corresponding to the second counter.

(Appendix 6)
In any one of supplementary notes 1 to 5,
The resynchronization means is a fault tolerant in which processing is continued by a processor in the normal processing state other than the abnormal processor when the reset count indicating the number of times the counter exceeds the reference value reaches the reference reset count. Control device.

(Appendix 7)
In any one of supplementary notes 1 to 5,
The resynchronization means is a fault-tolerant control device for continuing processing by a processor in the normal processing state other than the abnormal processor when the initialization of the abnormal processor does not end within a reference time.

(Appendix 8)
In any one of appendices 1 to 7,
The reference value is a fault-tolerant control device that is reset when the fault-tolerant control device is activated.

(Appendix 9)
A method for controlling a fault tolerant system in which three or more processors connected to a bus are synchronized to process the same instruction sequence,
An abnormal processor detection step of comparing the processing states of the three or more processors and detecting an abnormal processor in an abnormal processing state;
When the abnormal processor is detected, a counter corresponding to the abnormal processor is incremented, and when the counter reaches a reference value, the abnormal processor is initialized and a reset process is performed to synchronize with the processor in the normal processing state. And a resynchronization step for performing emergency processing based on a normal processing state when not reached, and a control method for a fault tolerant system.

10: Fault tolerant system, x1 to x3: Processor, 14: Memory, 15: Memory control unit, e1 to en: Peripheral function circuit, 20: Fault tolerant control unit, 11: Comparison selection circuit, 12: Resynchronization control unit , 13: Comparative copying circuit

Claims (8)

A fault-tolerant control device that synchronizes three or more processors connected to a bus and processes the same instruction sequence,
An abnormal processor detection means for comparing the values of the registers of the processors, which are the processing states of the three or more processors, according to a majority decision, and detecting an abnormal processor having a processing state different from the processing state belonging to the majority ;
When the abnormal processor is detected, a counter corresponding to the abnormal processor is incremented, and when the counter reaches a reference value, the abnormal processor is initialized, and a reset process is performed to synchronize with the processors in the processing state belonging to the majority. And a resynchronization means for performing an emergency process for writing the value of the register of the processor in the processing state belonging to the large number to the register of the abnormal processor when not reached. In claim 1,
The abnormal processor detection means further detects the abnormal processor by detecting a mismatch of output values to the bus of the processor,
The emergency process when a mismatch of the output values is detected includes a process of selecting an output value belonging to many of the output values of the three or more processors and outputting the selected output value to the bus,
The resynchronization means is a fault-tolerant control device that further performs the emergency process in addition to the reset process when the output value mismatch is detected and the counter reaches a reference value. In claim 1 ,
The fault tolerant control device, wherein the register includes any one of a register that holds a program counter of the processor, a register that holds a stack pointer, and a register that holds state information of the processor included in a finite state machine. In claim 2 ,
The counter has a first counter that is incremented when a mismatch of the output values is detected, and a second counter that is incremented when a mismatch of the values of the registers is detected;
The fault tolerant control device, wherein the reference value includes a first reference value corresponding to the first counter and a second reference value corresponding to the second counter. In any one of Claims 1 thru | or 4 ,
The resynchronization means is a fault that continues processing by a processor in the processing state belonging to the majority other than the abnormal processor when the reset count indicating the number of times the counter exceeds the reference value reaches the reference reset count. Tolerant control device. In any one of Claims 1 thru | or 4 ,
The resynchronization means is a fault-tolerant control device for continuing processing by a processor in the processing state belonging to the large number other than the abnormal processor when the initialization of the abnormal processor does not end within a reference time. In any one of Claims 1 thru | or 6 .
The reference value is a fault-tolerant control device that is reset when the fault-tolerant control device is activated. A method for controlling a fault tolerant system in which three or more processors connected to a bus are synchronized to process the same instruction sequence,
An abnormal processor detection step of comparing the values of the registers of each processor, which are the processing states of the three or more processors, according to a majority decision, and detecting an abnormal processor having a processing state different from the processing state belonging to the majority ;
When the abnormal processor is detected, a counter corresponding to the abnormal processor is incremented, and when the counter reaches a reference value, the abnormal processor is initialized, and a reset process is performed to synchronize with the processors in the processing state belonging to the majority. And a resynchronization step of performing an emergency process of writing the value of the register of the processor in the processing state belonging to the large number to the register of the abnormal processor if not reached, the control method of the fault tolerant system.

Images