JPH03184128A - Duplex computer system - Google Patents

Abstract

PURPOSE:To prevent a trouble of one of two computers from affecting the other computer by providing a CPU, a memory part, a duplex control part, and a bus interface part to each of duplex computers connected to each other via a back board bus. CONSTITUTION:A duplex computer system contains the duplex computers FC1 and FC2 which are connected to each other via a back board bus BS. The FC1 and FC2 are provided with the CPU and the memory part 12. A duplex control part 14 monitors a ready signal received from a CPU 11 and showing a working state and assigning the computer FC1 or FC2 to an actual job with the other computer kept waiting respectively. A bus interface part 13 inhibits the accesses to the input/output devices IO1-IOn when no control right is given from the part 14. Then the part 13 inhibits the write accesses given via the bus BS while mapping data to an area out of an address range of a memory 12 viewed from the CPU 11 of its own side.

Description

[Detailed Description of the Invention] <Industrial Application Field> The present invention relates to a system in which a total of The present invention relates to a redundant computer system configured so that a failure of one computer does not affect the other computer.

<Conventional technology> Conventionally, one method of increasing reliability has been to have a dual configuration of xis, with one 3EIl in a controlled state and the other 3L machine in a standby state in case one of the computers fails. A redundant computer system with standby redundancy is used.

This type of system is disclosed in, for example, Japanese Patent Publication No. 61-19060 and Japanese Patent Publication No. 61-19061.

In this system, an independent duplication control device is provided between two computers to monitor the operations of both computers and perform duplication control. This redundant control device has a total of J! In addition to monitoring machine operations and performing redundant control, equalization operations are performed to match the memory contents of the two machines in order to maintain continuity in actual work handover.

<Problem to be solved by the invention> According to such a system, a failure of one computer can be prevented from affecting the other computer by an independent duplication control device. There is a problem that a control device is required and the configuration becomes complicated.

The present invention has been made in view of these problems, and is a system that does not have a dedicated redundant control device between two computers, so that a failure in one computer will cause a failure in the other computer. The purpose of the present invention is to provide a redundant X-machine system that improves reliability by not affecting the system.

Means for Solving the Problems> The present invention for solving the problems described above includes a total of 3L machines connected to each other via a backboard bus in a duplex configuration, and a total of 3L machines connected to the backboard bus and controlled by the total 3L machines. A redundant control unit system consisting of input/output devices, each of which has a CPU unit, a memory unit configured to be accessible from the CPU unit and the backboard bus, and an operation from at least the CPU unit. a redundancy control unit that monitors a ready signal indicating the status and controls whether one of the two 3E machines is engaged in actual work and the other is placed in a standby state; and the redundancy control unit is coupled to the backboard bus. A function that prohibits access to the input/output device if control is not granted by the unit, and a function that prohibits access to the input/output device when the control is not granted by the unit, and an address range of the memory unit as seen from the CPU unit on the own side for access from the backboard bus controller. and a backboard bus interface section that has the function of mapping data to a different area and prohibiting write access.

Function> The duplication control unit monitors the ready signal indicating the operating status based on the self-diagnosis result of each CPU unit, and determines whether to engage one of the two machines in actual work and put the other in standby. Outputs an instructing duplex control signal.

The backboard bus interface section has an arbitration function, a bus master function, and a bus slave function for acquiring bus mastership, and due to the bus master function, the I10 area of the memory section can only be accessed from the computer side that has control right. Allow access. Furthermore, the pass slave function disables write operations for access from the backboard bus.

<Example> Embodiments of the present invention will be described in detail below with reference to the drawings.

FIG. 1 is a block diagram showing an embodiment of the present invention.

In the figure, PCI and Fe2 are backboard bus BS
Computers with a redundant configuration connected to each other via IOI
~Ion is an input/output device that is connected to the pack hold bus BS and can be controlled from either of the two total XRs.

For each total of X machines PCI, FC2, 11 is the CPU section, 1
Reference numeral 2 designates a memory section configured to be accessible from the CPU section 1 and backboard bus BS, and 13 a bus interface section coupled to the backboard bus BS.

Reference numeral 14 denotes a duplication control section that monitors a ready signal indicating the operating state outputted from at least the CPU section 1 and the general manager 1, and controls whether one of the two computers is engaged in actual work and the other is placed in a standby state.

The bus interface section 13 receives a signal indicating the control right from the redundancy control section 14, and if the control right is not given to its own computer side, the bus interface section 13 transfers the control right to the computer side of the bus interface section 13.
and the function to prohibit access to Packhoard Bus B5.
1fl has a function of mapping data to an area different from the address range of the memory unit 12 seen from the CPU unit on its own side and prohibiting write access.

Figure 2 shows a total of jj1. fiFc1. In FC2,
3 is a diagram showing an address map for the CPU section 11. FIG.

Each computer PCI, FC2 is $000000 ~ $IFF
I have a total of 3L internal memory of my machine at the FFE address. The area from $200000 to $9FFFFE is allocated to the backboard bus.

Of these, $200,000 to $3FFFFE are allocated to the internal memory of the partner Gekihyo 3L machine, and $800,000
The I10@ area for control input/output is allocated to the area from 000 to $BFFFFF.

The bus interface unit 13 has (a) an arbitration function for acquiring bus mastership, (b) a bus master function, and (c) a bus sleep function.

Here, the bus master function allows only a total of X machines having control authority to access the I10 area in the address map shown in FIG. The reason for this is to prevent erroneous data from being output to the 3L machines that have lost control due to a failure or the like, or to the input/output device that sends direct control output.

Furthermore, the bus slave function disables write operations for access from the backboard bus BS.

The reason for this is to ensure that the hardware does not affect the operation of the CPU section due to external access.

Additionally, this pass slave function responds to addresses $200000 to $3FFFFB on the backboard bus, and accesses to the internal memory are performed by subtracting $200000 from addresses ($0 to $IFFFFE). , realizes the address map shown in FIG.

The operation of the apparatus configured in this way will be explained next.

First, it is assumed here that the computer PCI is in a control state (engaging in actual work) and the computer PCI is in a standby state. In this state, the control flE meter 3111FC1
Control operations are executed by a program stored in the internal memory of 2.

Its operation is to read input data from the input/output devices IO1 to Ion via the backboard bus BS, perform necessary calculations, and then send output data to the three input/output devices fIO1 to Ion via the backboard bus BS.

In order for the standby computer FC2 to determine that its hardware, programs, and data are normal and to perform standby operations, the control computer FC2 first performs a control operation after the control computer PCI starts operating.
lrpJ#'tjL machine PCI program and data are read out via backboard bus BS, standby play review 3Ll
It is stored in the memory 12 of fiFC2. After storing these programs and data, the standby operation starts.

In the standby state, if the control side computer PCI fails for some reason, data is equalized so that control operations can be inherited smoothly. In other words, data and parameters are constantly changing during the control operation of Control Drama Review Parameter standby pointer [I
The FC2 copies the data one after another to the memory section 11 on its own side via the backboard bus BS.

Due to this operation, the standby side computer FC2 always has the same program as the control side computer aiFc1, as well as the data and parameters necessary for control, so that it can perform control operations smoothly even if the control side computer fails. Can be executed continuously.

Next, the operation when the standby side calculation 111Fc2 fails will be explained.

Now, suppose that the standby computer FC2 breaks down and goes out of control, causing arbitrary address write operations to occur continuously.
Such an arbitrary address write operation is blocked by the above-mentioned bus star function and bus slave function of the bus interface section 13, and does not affect the control operation of the system.

In other words, access to the I/OfR area is not possible from a hardware point of view since it does not have control rights. In addition, writing to the memory unit 11 of the control side needle 3L machine PCI is also disabled due to hardware reasons.
There is no effect on the control operations of the 31 aircraft FcI.

Note that in the above embodiment, all areas of the memory in the other party's computer are not writeable, but the programs and data necessary for control operations.

It may be configured such that only the parameter fiI area is not writable and the memory section for the equalize operation is writable.

<Effects of the Invention> As explained in detail above, according to the present invention, in a system with a redundant configuration in which two computers are connected to a backboard bus, a failure in one computer (total of 3L) will cause a failure in the other computer. Since it does not affect the control operations of the total 3 LI1, reliability can be improved.

Additionally, copying of data and parameters is done through a dedicated redundancy control unit in each 3L machine, but by making the addresses from the two computers the same to each duplex control unit, the software can be made the same with two 3L machines. Additionally, special setting elements are not required.

[Brief explanation of drawings]

FIG. 1 is a configuration block diagram showing one embodiment of the present invention, and FIG.
The figure shows an address map for the CPIJ section in each computer. PCI Fe2...Computer 11 with duplex configuration...
CPU section 12...Memory section 13...Bus interface section 14...Duplicity control section

Claims (1)

[Scope of Claims] A redundant computer system comprising redundant computers connected to each other via a backboard bus, and input/output devices connected to the backboard bus and controlled by the computers, each computer having a CPU. a memory section that is configured to be accessible from the CPU section and the backboard bus; and at least a ready signal indicating an operating state from the CPU section, and causes one of the two computers to engage in actual work. a duplexing control unit that controls whether the other device is placed in a standby state; and a function that is coupled to a backboard bus and prohibits access to the input/output device if control authority is not given from the duplexing control unit. , a backboard bus interface unit that has a function of mapping data to an area different from the address range of the memory unit as seen from the CPU unit on its own side and prohibiting write access in response to access from the backboard bus side; A redundant computer system characterized by comprising: