JPH03204039A - Duplexing controller - Google Patents

Abstract

PURPOSE:To improve the reliability of this duplexing controller by transmitting the contents of a duplexing control switching signal to a 1st and 2nd gate means as long as this switch signal is equal to a normal clock signal and then reading out an error signal to switch a processor to the other one when the control switching signal is not equal to a normal clock signal. CONSTITUTION:When a processor PC1 has the breakdown, a ready signal RDY1 is inactivated. A processor ready deciding means 1 detects the inactive ready signal and inactivates a control signal IOCE11 and activates a control signal IOCE21 respectively. Thus, the 1st gate means 12 sets a control switching signal IOCE1 received from its output terminal at a high level in response to the inactive signal IOCE11. Thus, a 1st switch signal monitoring means 13 activates a signal ENA2 which is applied to the 2nd gate means 22 and outputs a clock CK2 through the means 22 to switch the control right so that a processor PC2 and a communication equipment CC2 perform the control operations. In such a constitution, the reliability of the duplexing controller is improved.

Description

DETAILED DESCRIPTION OF THE INVENTION <Field of Industrial Application> The present invention relates to a duplication control device in a system in which processors are configured in a dual configuration using a standby redundancy method, and more specifically, when one of the duplex processors fails, The present invention relates to a redundant control device for performing control so that a bus 17 setter in a standby state can reliably take over control operations.

<Conventional technology> Conventionally, one method of increasing reliability has been to use a dual computer configuration, with one computer in the control state and the other computer in the control state. :
tIB is one total! A redundant redundant standby system has been adopted to keep the L machine on standby in case of failure.

This type of system is disclosed in, for example, Japanese Patent Publication No. 61-19060 and Japanese Patent Publication No. 61-19061.

FIG. 5 is a conceptual diagram of the structure of the apparatus shown in these publications. This device has two processors PCI, PC
An independent duplication control device DXC is provided between the processors 2 and 2 to monitor the operations of both processors and perform duplication control.

The duplex control device DXC monitors Ready No. 18 indicating the operating state of the processor PCIPC2, and outputs a duplex control switching signal l0CE to put one in the control state and the other in the standby state.
I and l0CB2 are output to processors PCI and PC2, respectively.

FIG. 6 shows a conventional device having a configuration that does not have a dedicated duplex control device between two processors PCI and PC2,
A device for duplex control is provided within each processor.

In either device, the duplex control switching signal l0CE
1. The processor whose IOCE2 is active executes the control operation, and the other processor goes into a standby state due to one failure.

Here, duplex control switching signal l0CE1, IOCE
2 has a flip-flop configuration and is a low-accumulation device to avoid both signals being active at the same time.

<Problems to be Solved by the Invention> According to the conventional device having such a configuration, the duplex control switching signal 10CE is active, and the processor that has control right switches the duplex control switching signal 10CE. If the driver or receiver fails and the signal is clamped to a low level, d9 will not be issued immediately, but the failure cannot be discovered and a failure that causes the control processor to crash will occur afterwards. In this case, a problem occurs in which the processor on the standby side cannot switch between control operations. Actually superior system? There are many accidents where the 3'll switching signal is low clamped.

The present invention has been made in view of the above points, and is capable of detecting a failure of a duplex control device that determines which side of two processors is to be the control side. It is an object of the present invention to provide a duplex control device that can perform legitimate duplex control switching.

Means for Solving the Problems> The present invention for solving the above-mentioned problems is a duplication control device in a system in which processors are configured in a redundant standby manner, which receives a ready signal from the processor indicating its operating state. Control signals (IOCEI1, IOCE2) for determining whether one of the two processors should be engaged in actual work and the other should be in a standby state.
1), and a ready determination means that outputs a clock signal that repeats a high level and a low level. A second clock generation means, a clock signal from each of these clock generation means, and a control signal (IOCE11, IOCE21) from the ready determination means are inputted to each processor in the duplex configuration for duplex control switching. The first. which outputs the signal (IOCEI, l0CR2). a second gating means; The overlapping control switching signal (IOCEI, 1OcE2) outputted from the second gate means is monitored, and the monitoring result is provided to the ready determination means, and the second gate means outputs the overlapping control switching signal (IOCEI, 1OcE2).
a first . and second duplex control switching signal monitoring means.

Function> The ready determination means monitors a ready signal indicating the operating state based on the self-diagnosis result of the processor, and generates a control signal that instructs one of the two processors to engage in actual work and the other to be in a standby state. Signal l0CE11, IOCE1
Outputs 2.

1st. The second duplex control switching signal monitoring means includes a second duplex control switching signal monitoring means. If the redundant control switching signal output from the first gate I/means is a regular or lock signal, its contents are changed to the first gate I/means. Inform the second gate means, and if it is not legitimate, error 11
The number is given to the ready determination means.

1st. By reading out the error signal from the second duplex control switching signal monitoring means from the outside, it becomes possible to detect a failure in the duplex control device.

<Example> Embodiments of the present invention will be described in detail below with reference to the drawings.

FIG. 1 is a block diagram showing an embodiment of the present invention. Here, the unified control device D which is the object of the present invention
The XC is shown between two processors PCIP C2.

- In the duplex control device DXC, 1 receives ready signals RDYI and RDY2 indicating the operating status from each processor PCI and PC2 in the duplex configuration, and causes one of the two processors to engage in actual work and places the other in a standby state. Control signals (IOCE11, IOCE21) for determining whether
This is a processor ready determination means that outputs the following.

11.21 is a first and second clock generating means for outputting clock signals CKI, CK2 which repeat high level and low level; 12.22 is a clock signal CKI, CK2 . Processor ready determination means 1
Input control signals l0CEII and 10CE21 from
The first . The second gate means uses a Nant gate here.

13.23 is the 1st. The second switching signal monitoring means
．． Monitoring the duplex control switching signals l0CE1 and IOCE2 output from the second gate means 12.22, respectively,
If the duplication control switching signal indicates a high level or a low level (error), enable signal EN2. ENI
are applied to the second and first gate I/means, respectively, and when the duplex control switching signal is a clock signal, the enable signal E
It is configured to make N2 and ENI inactive, and to provide error signals ERI and ER2 to the processor ready determining means 1 in the case of an error.

3 is the first. This is a reading means for reading out the error signals ER1 and ER2 output from the second switching signal monitoring means 13.23.

CC1 and CC2 are communication devices with a duplex configuration, and control switching signals l0CE1 . In response to l0CE2, one of the processors PCI and PC2 is switched to an active state, and the other is switched to a standby state.

The operation of the device configured in this manner will be explained below for each state.

(1) When the operations of the two processors are ready and the processor PCI has the control right, the ready signals RDYI and RDY2 from the two processors PCI and PC2 indicating that the operations are normal become active.

Processor ready determination means 1 uses these ready signals R
DY1. Upon receiving RDY2, if the ready-borrowed RDYI arrives first, the control signal l0CEII becomes active and the control signal l0CE21 becomes inactive.

In the initial state, the first. Both of the second gate means 12 and 22 are open (their outputs l0CE1 and IOCE2 are both at high level due to an external pull-up, not shown), so that the first and second switching signal monitoring means 1
3.14 is its output ENA2. ENAI is activated together.

Therefore, via the first gate means 12, the clock CK1 from the first clock generation means 11 or the control switching signal l0CEI is output to the processor PCI (device B CC).
I, and these perform control-side operations.

On the other hand, since the control signal 10CE21 from the processor ready determining means 1 is inactive, the second gate means 22 switches the control from the output controller 1 f5';
'7■0CE2 becomes open (high level), and the processor PC2 and communication device CC2 perform standby operations.

FIG. 2 shows the waveforms of the control switching signal l0CE1 and the control switching signal 10C'E2 in this state.

The first switching signal monitoring means 13 is connected to the first gate means 12.
control switching signal 10C formed from clock CKI,
Shin-ri ENA, which was first active after receiving El.
Make 2 inactive.

(2) When the processor PCI goes down from the above state When the processor PCI goes down, the ready signal RDYI
becomes inactive. Processor ready determination means 1
detects this, makes the control signal 10CEII inactive, and makes the control signal 10CE2 active.

As a result, the means 12 to the first gate 1 opens the control switching signal 10CE1 from its output terminal in response to this control No. 19 10CEII becoming inactive.
high level). Upon receiving this, the first switching signal monitoring means 13 applies ENA2 to the second gate means 22.
By making the signal active, the second gate means 22 outputs the clock CK2, and the control right is switched so that the processor PC2, communication device fi CC,2 performs the control operation.

(3) When the processors PC1 and PC2 are ready and the processor PC2 has the control right, the same operation is performed in reverse to the above (1).

Figure 3 shows the 1. Second gate means 12.
The control switching signals l0CEI and 10CE2 from 22 are shown.

(4) If the processor PC2 goes down from the state of (3) above, the same operation as in (2) above is performed.

(5) In the state of (]), if the control switching signal -U0CE1 from the first gate means 12 is clamped to a low level due to a failure in the receiver of the processor PC1i or the communication device CCI, the first switching The signal monitoring means 13 detects this low level clamp and activates the ENA2 signal and also activates the error signal E R1.

This error signal ERI is transmitted to the processor ready determination means 1.
The control signal l0CEII is made inactive and the control signal l0CB2] is made active.

The second gate means 22 receives the clock signal C.
K2 is output as a control switching signal l0CB2, and control authority is transferred to the processor PC2 and the communication device CC2111! ! Switch to I.

The error signal ERI is read out to the outside via the reading means 3, so that the cause of the switching can be known and is also useful for maintenance work.

<6), <1), when the control switching signal 10CE2 is clamped at a low level, the second switching signal monitoring means 23 detects this low level clamping and activates the error signal ER2. E
The NAI signal does not change its active level. Since this is a failure on the standby side, switching of the control right does not occur, but the occurrence of the failure can be known by reading out the error signal ER2 from the outside.

When the control switching signal I0CE2 is clamped to a low level in the states (7) and (3), the same operation as in (5) in 111j is performed in reverse.

In the states (8) and (3), when the control switching signal I0CE1 is clamped to a low level, the same operation as in (6) is performed in reverse.

In this way, even if the control switch signal l0CE on the control side is clamped at a low level due to a failure in the processor or communication device receiver on the control side, it is possible to detect this and switch control rights. Ru.

FIG. 4 is a configuration block diagram showing another embodiment of the present invention.

Here, the case where duplex control is performed between two processors PC1 and PC2 without providing an independent duplex control device, and the same reference numerals are given to the same parts as in Fig. 1. In the embodiment shown, in each of the processors PCI, PC2, the internal ready determination means 1a, lb receives ready signals RDY1. R.D.
Y2 respectively, and determines the operating state of the internal circuit. A control signal l0 is applied to the second gate means 12.22.
Outputs CE11 and IOCE21.

Now, if the ready signal RDYI from the arithmetic control section 15 of the processor PCI precedes the ready signal RDY2 from the arithmetic control section 25 of the processor PC2, the control signal l0CEII from the internal ready determination means 1a becomes active first, Clock signal C from first gating means 12
KI is output as a control switching signal l0CE1, which is transmitted to the arithmetic control section 15, and the processor PCI side executes a control operation.

The control switching signal 10CEI is monitored by the switching signal monitoring means 23 on the processor PC2 side, and the control switching signal 10CEI is monitored by the switching signal monitoring means 23 on the processor PC2 side.
In response to CE1 becoming active, the ENA2 signal becomes inactive.

Therefore, the control signal l0 from the internal ready determination means 1b
Even if CE21 becomes active, the control switching signal l0CE2 from the second cooler 1 to means 22 becomes inactive, and the processor PC2 side is maintained in a standby state.

In this state, when the processor PCI goes down, the control signal I0CE1 from the internal ready determination means 1a becomes inactive, the control switching fs signal l0CEI becomes inactive, the ENA2 signal becomes active, and the control right is transferred to the processor F). Move to C2 side.

Further, when the control switching signal l0CE1 is clamped at a low level, the switching signal monitoring means 13 detects this and activates the error signal E R1.

In response to this, the internal ready determination means 1a outputs a control signal 10.
Set CE1.1 to InacDeep.

At the same time, the switching signal monitoring means 23 makes the ENA2 signal and the error signal ERI active, and the second gate means 2
2 outputs the clock CK2 as the control switching signal l0CE2.

As a result, the control operation is performed by the processor PC21I]lj
can be switched to

Failure of the 17-level clamp can be detected by reading out the error signal ER1 from the outside.

The above operation is the same even when the processor PC2 initially obtains the control right and operates.

Note that in each of the above embodiments, the first. Clock CK1. output from second clock generation means 11.21. C
If K2 is made distinguishable by changing the frequency or duty ratio, for example, it is possible to detect a high-level clamp failure of the control switching signal on the standby side.

<Effects of the Invention> As described in detail above, according to the present invention, in a processor with a duplex configuration, when a failure occurs in which the duplex switching signal on the processor side performing a control operation is low-clamped, It is also possible to detect this and switch to the other processor side, improving reliability.

Also, when the control switching signal on the standby side is low clamped,
Such failures can be detected from the outside and repairs can be made online. Incidentally, according to conventional devices, switching occurs in this case. The switching itself was not a problem, but in order to repair it afterwards, it was necessary to temporarily stop the system in order to eliminate the cause.

[Brief explanation of drawings]

FIG. 1 is a configuration block diagram showing one embodiment of the present invention, and FIG.
Figures 1 and 3 are shown in Figure 1. A waveform diagram showing a control switching signal output from the second gate means, FIG. 4 is a block diagram showing another embodiment of the present invention, and FIGS. 5 and 6 are conceptual diagrams showing the construction of a conventional device. . PCI, PC2... processor CC1 with duplex configuration,
CC2...Communication device 1...Processor ready determination means 11.21...Clock generation means 12.22...First. Second gate means 13.23.
...First. Second switching signal monitoring means 3...reading means

Claims (1)

[Scope of Claims] A duplication control device in a system in which processors are configured in a duplex configuration using a standby redundancy method, which receives a ready signal from the processor indicating its operating state and causes one of the two processors to engage in actual work while the other Control signals (IOCE11, IOCE
21); first and second clock generation means that output a clock signal that repeats high level and low level; first and second gate means that input control signals (IOCE11, IOCE21) and output signals (IOCE1, IOCE2) for duplex control switching to each processor of the duplex configuration; The duplex control switching signals (IOCE1, IOCE2) output from the second gate means are monitored, and the monitoring results are given to the ready determination means.
, first and second duplex control switching signal monitoring means for respectively applying to the first gate means.