JPH03273344A - Fault tolerant system - Google Patents

Abstract

PURPOSE:To improve reliability by executing recovery suitable for the type of error by diagnosing the cause of the error based on the program of the second program memory part when detecting the error according to majority. CONSTITUTION:A processing block 3 is formed by the first program memory part 11, second program memory part 12 to store the same program as a program to be stored in this memory part 11, and processing part 2 to process input data according to the programs stored in these memory parts. When the processed result of the block 3 is decided by the majority and the error is detected in a result processed by the program of the memory part 11, the block 3 executes the processing based on the program in the memory part 12 and the cause of the error is diagnosed from the processed result under the control of a recovery control part 6. Thus, the reliability is improved by executing the recovery suitable for the type of error.

Description

DETAILED DESCRIPTION OF THE INVENTION (Field of Industrial Application) The present invention relates to a fault-tolerant system that performs error detection by N-version programming.

[Conventional technology]

N-version programming is a method in which N functionally equivalent programs are created by different designers based on the same specifications, and bugs are detected or masked by comparing the execution results or by majority vote (J, Gray). (See ``Fault Tolerant Systems'' by Ran Watata and others (1986-10-15), McGraw-Hill Book P, 377).

Conventionally, a fault-tolerant system that performs error detection using N-version programming has N processing blocks in order to process N programs, respectively. Each processing block includes a program storage section that stores each program, and a processing section that processes human data using the program stored in the program storage section. An error detection unit performs error detection on the processing results of each processing block. In other words, when all the processing results match, each processing result is considered correct; when they do not match, it is assumed that an error has been detected and a majority vote of 3 or more votes is taken, and the processing with the highest number of matches is determined. The results are considered correct.

[Invention or problem to be solved]

The above-mentioned conventional fault-tolerant system only detects errors and detects the error location by performing a majority vote of 3 points or more, and does not have a means to diagnose the cause of the error. Therefore, it has the disadvantage that it is not always suitable for the type of error detected and is not necessarily correctable.

An object of the present invention is to provide a fault-tolerant system capable of diagnosing the cause of an error and performing recovery appropriate to the type of error.

[Means for Solving the Problems] A fault-tolerant system of the present invention includes a first program storage section and a second program storage section in which the same program as the program stored in the first program storage section is stored. N processing blocks, each of which has: When a processing result is obtained by the program in the first program storage unit in each processing block, an error is detected in the processing result of one of the processing blocks. and a recovery control unit that causes the processing block to perform processing based on the program in the second program storage unit of the processing block and diagnoses the cause of the error from the result of the processing.

[Operation] When an error is detected in the processing result of the program in the first program storage section, the recovery control section diagnoses the cause of the error based on the program stored in the second program storage section.

〔Example〕

Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing an embodiment of the fault-tolerant system of the present invention, and FIG. 2 is a flowchart showing the processing of the recovery control section 6 in the embodiment of FIG.

This embodiment is a fault-tolerant system using three-version programming. The three processing blocks 3 each include a first program storage section 1, a second program storage section 12 in which the same program as the program stored in the first program storage section 1 is stored. Straw program storage unit 1. ．． It consists of a processing section 2 that processes human data using 12 programs. The error detection unit 5 includes 3
The processing results of each processing block 3 are determined by majority vote, and an error detection signal is sent to the recovery control unit 6 when an error occurs, that is, when an error is detected. When the recovery control unit 6 receives this error detection signal, it performs diagnosis and recovery operations, which will be described later. The input data storage unit 4 holds input data as data for diagnosing errors. The output data memory unit 7 holds the output data as data for diagnosing errors. The external monitoring device interface section 8 is connected to the program storage section 1, . 12
When it is determined that there is a bug, that is, a latent error in the program, a latent error notification signal is output to an external monitoring device (not shown), and the sent correction program is sent to the program storage section of the processing block 3 in which the error was detected. 1. ．．
Write to 12. Modification of the program is performed by the external monitoring device or the like configured with a host computer or the like.

Therefore, since it is possible to rewrite the program from outside the fault-tolerant system, even if a bug that was not discovered during program creation or inspection is discovered during operation, it can be easily corrected.

Next, the operation of the embodiment shown in FIG. 1 will be explained. Here, it is assumed that the first program storage unit 11 is operated in each processing block 3.

The input data is held in the input data storage unit 4 and input to each processing block 3, and is processed into three processing blocks with the same specifications and different designs.
Each is processed by a separate program. The first processing results of each processing block 3 are compared by the error detection unit 5, and if all the processing results match, it is correct (
(no errors), and the matching processing results are output as output data. If the processing results do not match,
It is assumed that one of the processing results has an error, and the error detection section 5 takes a majority vote of each processing result.

Here, the output data obtained by majority vote is defined as correct output data and is held in the output data storage section 7. When the recovery control unit 6 receives the error detection signal from the error detection unit 5, it immediately disconnects the processing block 3 that has outputted (malfunctioned) a processing result different from the correct output data from the operation line, and restores the disconnected processing block 3. Begin the diagnostic and recovery process. At this time, the other processing blocks 3 perform normal operation.

This diagnosis and recovery processing is performed according to each step shown in FIG.

First, initialization such as restarting the current of the first program storage section 11 is performed. After that, the first program storage unit 1 of the separated processing block 3 (hereinafter referred to as malfunction block)
After copying the program in the second program storage unit 12 (hereinafter referred to as spare) of the malfunction block to 1 (hereinafter referred to as the current use), activate the current use and input the same input data as at the time of the error to the malfunction block 3. to obtain the second processing result (step 11). It is determined whether the second processing result is equal to the correct output data, that is, whether it is correct (step 12). If the second processing result is correct, it is determined that the detected error is an accidental error such as a latch-up or a single event error (Step 13), the current use is restored, and the malfunctioning block is returned to the operational line (Step 14). ). If the result of the third processing is incorrect, the backup is activated and the same input data as at the time of the error is manually entered into the malfunction block to obtain the result of the third processing (step 15). It is determined whether the third processing result is equal to the correct output data, that is, whether it is correct (step 16).

If the third processing result is correct, it is determined that there is a failure in the current hardware.Step 17) The malfunctioning block is returned to the production line by operating the spare and making it possible to perform subsequent processing (Step 18) . If the third processing result is incorrect, it is determined that there is a bug in the program, that is, a latent error (step 19), and a latent error notification signal is output to the external monitoring device via the external monitoring device interface unit 8. (Step 20). Thereafter, the modified program is written into the current and backup programs via the external monitoring device interface section 8 (step 21), and the current program is restored and the malfunctioning block is returned to the operational line (step 22).

Table 1 shows a summary of error classifications (error cases) in each of steps 1 to 22 above.

Table 1 [Effects of the Invention] As explained above, when an error is detected by majority vote, the present invention diagnoses the cause of the error based on the program in the second program storage unit, thereby identifying the type of error. Figure 1 is a block diagram showing an embodiment of the fault tolerant system of the present invention, and Figure 2 is a block diagram showing an embodiment of the fault tolerant system of the present invention. It is a flowchart which shows the process of the recovery control part 6 in the example of a figure.

Claims (1)

[Claims] 1. In a fault-tolerant system that performs error detection by N-version programming, a first program storage section and a second program storage section in which the same program as the program stored in the first program storage section are stored. N processing blocks each having a program storage section, and in each processing block, when a processing result is obtained by the program of the first program storage section, an error occurs in the processing result of one of the processing blocks. and a recovery control unit that causes the processing block to perform processing based on the program in the second program storage unit of the processing block and diagnoses the cause of the error from the result of the processing when the processing block is detected. Features a fault-tolerant system.