JPH04241010A - Computer system with nonstop clock - Google Patents

Abstract

PURPOSE:To improve the reliability of the system which operates by using the clock by supplying the clock which does not stop even if a fault occurs. CONSTITUTION:A clock A monitor circuit 2 detects the stop of the clock A, a timing polarity matching circuit 3 sends out a switching signal at the moment a clock B has the same polarity with the clock A, and a selector 4 switches the clock A to the clock B with said signal. Consequently, the clock which does not stop even if a clock oscillation circuit becomes faulty can be supplied and the reliability of the system which operates by using the clock can be improved.

Description

[Detailed description of the invention]

0001

[Industrial Application Field] The present invention relates to a computer system having a nonstop clock, and in particular to a fault tolerant (
The present invention relates to a computer system having a non-stop clock that is suitable for use in non-stop computers and the like.

0002

BACKGROUND OF THE INVENTION As computers come to play the fundamental functions of society, such as traffic control and finance, the reliability of computers has become an increasingly important factor.

In highly reliable fault-tolerant computers, the microprocessing units (Ms.
A so-called redundancy technique in which a plurality of modules such as MPU (micro-processing unit) and memory are prepared is widely used. In order to realize the role of a conventional computer with higher reliability through redundancy, a plurality of redundant modules must operate synchronously as if they were one module. In order to operate a plurality of modules (such as an MPU) in synchronization, there is a method of operating the plurality of modules using a common clock. However, in this method, even if the modules are made redundant, if a clock fails, all modules will stop operating, so it is necessary to make the clocks redundant.

[0004] As a method of making the clock redundant, (1
) Reference 1 Albert L. Hopkins Jr. et al. “Highly Reliable Fault Tolerant Multiprocessor for Aircraft” IEE Volume 66
, No. 10, pp. 1231-1239 (October 1990)
As shown in Figure 4 (p. 1226), a phase control loop (Phas) is used to match the phases between the clock oscillators.
e. Locked Loop) A method using PLL.

(2) There is a method, as disclosed in Japanese Patent Application No. 2-064243, in which the outputs of redundant oscillation circuits are fed back based on a majority vote, and oscillations are made in the same phase.

[0006]

[Problem to be solved by the invention] Among the above-mentioned prior art (
Method 1) does not take into account the simplicity of the circuit, and requires a voltage controlled oscillator (V
Control Oscillator)
Since a VCO, phase discriminator, frequency divider, reference oscillator, etc. are required, the circuit becomes complex, increasing the number of parts, physical size, and power consumption.The increased number of parts also increases the failure rate of the circuit. There was a problem with the price being high.

[0007] Furthermore, method (2) of the above conventional techniques has the problem that the phase pull of the oscillation circuit becomes unstable at high frequencies because the selectivity Q of the crystal oscillator is high and the frequency characteristics are sensitive. There was a point.

From the above, the first object of the present invention is to
It is an object of the present invention to provide a computer system having a simple circuit, a small number of component parts, high reliability, small size, light weight, low power consumption, and a nonstop clock.

A second object of the present invention is to provide a computer system having a non-stop clock that stably and continuously supplies a clock signal even at high frequencies.

0010

[Means for Solving the Problems] In order to achieve the above object, the present invention provides two independent clock oscillation circuits with the same frequency, a main system (regular system) and a slave system (protection system). Keep it (
2) Monitor the clock interval of the main system by counting it using the clock of the slave system, and if the time when the clock signal of the main system is at high or low level is longer than the interval of the clock of the slave system, Assuming that the system clock has stopped, (3
) When the main system clock stops, the clock is switched from the main system to the slave system at the moment the level of the slave system clock matches the level of the main system clock for the first time.

Furthermore, in order to detect a failure in the slave system clock, (4) the slave system clock interval is monitored by counting using the main system clock, and if the slave system clock signal is at a high or low level, If the time is longer than the main system clock interval, it is assumed that the main system clock has stopped, and an alarm is issued.

0012

[Operation] <Conditions Required for Clock Switching> Elements that are timed by a clock such as an MPU and operate according to the timing require certain conditions for the clock to be supplied.

First, the operating speed of the element is limited by the operation delay time of the element. Therefore, there is an upper limit to the clock frequency. This is called the highest clock frequency fa.

[0014] Furthermore, in order to reduce the number of transistors constituting an element and thereby reduce its size, a dynamic circuit is often employed in the storage section to store data using charges stored in a stray capacitance. In this case, the lower limit of the clock frequency is determined by the time until the stored charge is discharged. This is called the minimum clock frequency fb.

Generally, it is recommended that the clock duty cycle be 50%, but considering the above, as shown in FIG. The shorter one should be shorter than 1/2fb, and the shorter one should be longer than 1/2fa. In this case, the duty cycle does not necessarily have to be 50%. The duty cycle is required to be 50% in order to operate at the highest frequency and bring out the best processing performance, and if the clock is switched due to a failure in the clock oscillation circuit like this time, The duty cycle does not necessarily need to be 50%, and the processing performance deterioration associated with it is also at a negligible level. In addition, usually f
a is on the order of several tens of times as large as fb.

[0016] Conventionally, as a result of trying to always maintain the duty cycle of the clock signal at the recommended value of 50% without considering the clock signal requirements as shown in Fig. 3, a majority vote method was adopted instead of a switching method. Because of this, (
Problems similar to methods 1) and 2) persisted.

Therefore, the present invention focuses on the conditions that the clock signal should satisfy as shown in FIG. 3, and solves the problems of the conventional system by switching between two independently operating clocks while satisfying these conditions. This is what we are trying to solve.

[0018] The clock interval of the main system is monitored by counting using the clock of the slave system, and if the time when the clock signal of the main system is at a high or low level is longer than the interval of the clock of the slave system, By regarding this as a stop of the main system clock, it is possible to detect the stop of the main system clock.

[0019] When the clock is switched, the pulse width of the clock is 1.
One of the causes of the difference being shorter than /2fa is the timing shift at the time of clock switching, as shown in FIG. In FIG. 14, assume that clock A stops at a high level. If clock A is switched to clock B when clock B (slave system) 1-2 is at a low level, as shown in the figure, the time that clock B is at a high level immediately after switching is not sufficient and the clock is halved.
It will be shorter than fa. On the other hand, if clock A is switched to clock B when clock B is at a low level, the clock can be switched without the pulse width becoming shorter than 1/2 fa.

[0020] When the clock is switched, the pulse width of the clock is 1.
Another cause of the delay being shorter than /2fa is the delay of the select signal selA of the selector. In the circuit shown in FIG. 15, the delay of the inverter 100 disables clock A (negates SELA) and then enables clock B (asserts SELB).
Therefore, a glitch appears on the output 5 corresponding to the delay time width of the inverter 100. Therefore, if the circuit shown in FIG. 6 disables clock B (asserts SELB) and then enables clock A (negates SELA), the clock can be switched without the pulse width becoming shorter than 1/2fa.

Furthermore, if the clocks are switched within several clocks, the clocks can be switched without the pulse width becoming longer than 1/2fb.

In the present invention, as described above, in order to switch according to the phase of the clock at the time of clock switching, it is not necessary to match the phases of the two clocks, but it is sufficient to prepare two completely independent clocks. There is no problem of complicating the circuit as in method 1), there is no problem of phase pull between multiple clock oscillation circuits as in method (2), and clocks can be supplied without interruption. can.

[0023]

[Examples] Examples of the present invention will be described below with reference to the drawings.

FIG. 1 shows the configuration of a clock switching circuit 4 according to the present invention. Two independent clocks, clock A and clock B, are supplied to the switching circuit.

The clock A monitoring circuit 2 outputs a clock A stop detection signal 6-1 when the clock A stops. This clock A monitoring circuit 2 monitors the clock interval of clock A by counting it using the clock of clock B, and the time when the clock signal of clock A is at a high or low level is longer than the clock interval of clock B. If it is too long, it is assumed that the main system clock A has stopped, and a clock A stop detection signal 6-1 is output.

The clock A stop detection signal 6-1 is input to the timing polarity matching circuit 3, and the timing polarity matching circuit 3 waits until the polarity of the clock B matches the stopped clock A, and outputs the clock A stop detection signal. Selector (Sel) at the moment of first match after 6-1 is output
A switching signal 10 is sent to the selector 4, and the selector 4 switches the output 4 from the clock A to the clock B.

According to this embodiment, after the clock A stops,
It waits until the polarity of clock B matches that of the stopped clock A, and switches the output 5 from clock A to clock B at the moment the polarity matches for the first time after the clock A stop detection signal 6-1 is output, so there is no glitch at the time of switching. It is now possible to switch the clock without this occurring, and the clock can be switched while satisfying the conditions shown in FIG. Therefore, even if clock A stops, M is still operating using the clock.
The PU can continue normal operation.

FIG. 2 shows the embodiment of FIG. 1 in which a clock A monitoring circuit 2-2 having a clock B monitoring function is added. According to this embodiment, by constantly monitoring both clock A and clock B, if either clock stops, it is possible to repair the stopped clock in preparation for the stoppage of the other clock.

FIG. 3 shows the clock switching conditions.

[0030] Elements such as an MPU that are timed by a clock and operate according to the timing require certain conditions for the clock to be supplied.

First, the operating speed of the element is limited by the operation delay time of the element. Therefore, there is an upper limit to the clock frequency. This is called the highest clock frequency fa.

[0032] Furthermore, in order to reduce the number of transistors constituting an element and thereby reduce its size, a dynamic circuit is often employed in the storage section to store data using charges stored in a stray capacitance. In this case, the lower limit of the clock frequency is determined by the time until the stored charge is discharged. This is called the minimum clock frequency fb.

Generally, it is recommended that the clock duty cycle be 50%, but considering the above, as shown in FIG. The shorter one should be shorter than 1/2fb, and the shorter one should be longer than 1/2fa. In this case, the duty cycle does not necessarily have to be 50%. The duty cycle is required to be 50% in order to operate at the highest frequency and bring out the best processing performance, and if the clock is switched due to a failure in the clock oscillation circuit as in the present invention, However, the duty cycle does not necessarily need to be 50%, and the processing performance deterioration associated with it is also at a negligible level. Note that fa is usually on the order of several tens of times as large as fb.

In the present invention, since the clocks are switched while satisfying the conditions shown in FIG. 3, the MPU can continue to operate normally even if the clock A stops.

FIG. 4 shows an embodiment of the clock A monitoring circuit 2-1. As shown in the figure, a clock B is input to the clock terminal CK of the binary counter 101, and an inverted clock A is input to the clear terminal CL. According to this circuit, if the time that clock A is at a high level is longer than one clock of clock B as shown in Figure 5, the coefficient of 2's will be output at the moment the polarity of clock B matches that of clock A. The output of a certain terminal B becomes high. Similarly, if clock A and clock B are input with polarities opposite to those described above (that is, if clock B is inverted and input to the clock terminal CK of the binary counter 102, and clock A is input to the clear terminal CL, ) If the time that clock A is at a low level is longer than one clock of clock B, the output of terminal B, which is the coefficient output of the 2's place, becomes high at the moment the polarity of clock B matches that of clock A. Therefore, the logical sum (OR) of both circuits
)105, if the time that clock A is at high or low level is longer than one clock of clock B, that is, if clock A stops, the moment when the polarity of clock B matches that of clock A. The clock A stop detection signal 6-1 can be outputted to the clock A stop detection signal 6-1. Therefore, according to this embodiment, the timing polarity matching circuit 3 in FIG. 1 is not required, the circuit becomes simpler, and the delay time from clock stop detection to clock switching can be shortened.

FIG. 6 shows an embodiment of the selector 4 for clock switching. As shown in the figure, a clock A, a clock B, and a signal 10B for switching to clock B are input to an AND-OR gate 107 for switching. The output of the AND-OR gate 107 becomes the output 5 of the switching circuit.

In this embodiment, since 10B is inverted by an inverter to become 10B, the clock B is
le (assert SelB) and then turn on clock A.
enable (negate SelA). Therefore, glitches do not occur during switching, and the pulse width is reduced to 1/2.
The clock can be switched without becoming shorter than 2fa.

FIG. 7 shows an embodiment of the present invention. The binary counters 101, 102 and the logical sum 105 constitute a clock A monitoring circuit 2-1 as shown in FIG. 4, and the binary counters 103, 104 and the logical sum 106 constitute a clock B monitoring circuit 2-2. When clock A stops, the output of OR 105 becomes high the moment the polarity of clock B matches that of clock A, so this signal is
The S-flip-flop 108 holds the clock A stop detection signal 6-1, and the selector 4 switches the clock.

Furthermore, when clock B stops, the RS-flip-flop 110 holds that information.

[0040] When clock A is stopped by this method,
It is possible to switch clocks while satisfying the conditions shown in FIG. 3, and it is possible to continuously operate an electronic circuit such as an MPU to which a clock is supplied by the clock switching circuit of the present invention.

FIG. 8 shows an embodiment of the clock switching circuit when the clock frequency is high. If the clock frequency is sufficiently low compared to the operating speed of the circuit, clock A will change at the moment the polarity of clock B matches that of clock A, as shown in Figure 7.
If a system is adopted in which the stop detection signal 6-1 is output, the clock may be switched at the timing when the clock A stop detection signal 6-1 is output. However, when the clock frequency is high, the clock A stop detection signal 6
If the clocks are switched at the time when -1 is output, the polarities of the clocks may no longer match. Especially binary counters 101, 102, 103, 1
04 is constructed by connecting two stages of D-flip-flops, so the delay time is longer than other elements. Therefore, in the embodiment of FIG. 8, when the clock A stops, the moment the polarity of the clock B becomes opposite to that of the clock A, the output terminals B of the binary counters 101 and 102 become high level. Next, inverter 111, and-or gate 1
A timing polarity matching circuit 3 consisting of 12 outputs a switching signal to the selector 4 via the RS-flip-flop 108 at the moment when the polarity of the clock B matches that of the clock A.

FIG. 9 shows a time chart when the clock A of this embodiment stops at a high level, and FIG. 10 shows a time chart when the clock A stops at a low level.

According to this embodiment, even if the clock frequency is high, it is possible to request a clock signal without stopping, and it is possible to operate elements such as an MPU and electronic devices that use this clock without stopping. can. Further, even if the clock oscillation circuit fails, elements such as an MPU and electronic devices can continue to operate, so the reliability of the entire system can be improved.

FIG. 11 shows an embodiment of the present invention in a fault-tolerant computer. Clock switching circuits 1000-1, 1000-2, 1000-3 according to the present invention
Clock A and clock B are input to the input terminal. Outputs 5-1, 5-2, and 5-3 of the clock switching circuits are supplied as clocks to electronic circuits 1001-1, 1001-2, and 1001-3, respectively. Electronic circuit 1001-1,
The outputs of 1001-2 and 1001-3 are sent to the majority circuit 100.
2, a majority vote is taken and the final output 1003 is obtained. Here, electronic circuits 1001-1, 1001-2, 1001-3
has the same function, electronic circuit 1001-1, 1001
Even if any one of -2, 1001-3 cannot output a normal output due to a failure or other failure, the electronic circuit 1001-1, 1001 will be the final output 1003 by majority vote.
-2,1001-3, a normal output appears. That is, even if one of the electronic circuits 1001-1, 1001-2, and 1001-3 has a failure, the entire system operates normally. Furthermore, even if clock A stops due to a failure, clock switching circuits 1000-1, 1000-2, 1000
-3, the electronic circuits 1001-1, 1001-2, 1001 are switched to the normal clock B clock.
-3 can continue normal operation. Also, consider a case where one of the clock switching circuits 1000-1, 1000-2, and 1000-3 fails. For example, if the switching circuit 1000-1 fails, the electronic circuit 1001-1 to which the clock is supplied from the switching circuit 1000-1 will stop operating, making it impossible to output a normal output. However, since the other electronic circuits 1001-2 and 1001-3 are normal, a normal output can be obtained as the final output 1003. According to this embodiment, electronic circuits 1001-1, 1001-2, 1001
-3 failure, but also failure of clock A and clock B, and even clock switching circuits 1000-1 and 1000-2.
, 1000-3, a so-called fault-tolerant system can be constructed that can continue operating even if a failure occurs.

FIG. 12 shows an embodiment in which the present invention is applied to a fault-tolerant computer system. B.P.
A clock is supplied from clock switching circuits 1000-1, 1000-2, and 1000-3 according to the present invention to each of the MPUs constituting U2 (Basic Processing Unit). Although omitted in the figure due to space limitations, the clocks A, Clock A, and Clock A, similar to FIG.
Clock B is a clock switching circuit 1000-1,1000
-2 and 1000-3 respectively. Also,
Although omitted in the figure due to space constraints, the BPU
Similarly to BPU2, the MPUs constituting BPU2 also have duplicated clocks and clock switching circuits for each BPU. According to the present invention, the components in the system including the clock, MPU, and cache memory (Cache)
, Bus Interface Unit (Bus Inter
face unit) BIU, main memory unit (main
Storage) MS, input/output unit (Input/O
The IOUs (output units) are multiplexed and can continue to operate normally even if a failure occurs in one of them.

FIG. 13 shows another embodiment in which the present invention is applied to a fault-tolerant computer system. This is an embodiment in which clocks used for two system buses 1 are supplied by clock switching circuits 1000-1 and 1000-2 according to the present invention. According to the present invention, in addition to FIG. 12, multiplexing can be performed while synchronizing the system bus clocks.

[0047]

According to the present invention, it is possible to supply highly reliable clocks that are in phase and do not stop due to a single failure. Furthermore, by using the clock according to the present invention in a redundant system, it is possible to construct a highly reliable system that does not stop due to clock failure.

[Brief explanation of the drawing]

FIG. 1 is a diagram showing a clock switching circuit configuration of the present invention.

FIG. 2 is a diagram showing a clock switching circuit configuration of the present invention.

FIG. 3 is a diagram showing a clock switching circuit configuration of the present invention.

FIG. 4 is a diagram showing a clock A monitoring circuit.

FIG. 5 is a diagram showing the operation of the binary counter 101.

FIG. 6 is a diagram showing a circuit configuration of a selector.

FIG. 7 is a diagram showing an example of a clock switching circuit.

FIG. 8 is a diagram showing an example of a clock switching circuit.

FIG. 9 is a time chart diagram.

FIG. 10 is a time chart diagram.

FIG. 11 is a diagram showing an example of application to a fault-tolerant system.

FIG. 12 is a diagram showing an example of application to an application system.

FIG. 13 is a diagram showing an application system.

FIG. 14 is a diagram showing conventional clock switching timing.

FIG. 15 is a diagram showing a conventional selector configuration.

[Explanation of symbols]

2-1... Clock A monitoring circuit, 2-2... Clock B monitoring circuit, 3... Timing polarity matching circuit, 4... Selector,
5...Output.

Claims (5)

[Claims] 1. A nonstop clock comprising a computer, two sets of clock sources that supply clocks to the computer, and a clock switching circuit that selects one of the two sets of clock sources and supplies the clock to the computer. In computer systems,
The clock switching circuit includes means for detecting stoppage of the clock of the first clock source, means for generating switching timing for switching the clock source from the first clock source to the second clock source, and generating timing for switching the clock source from the first clock source to the second clock source. and a switching means for switching the clock from a first clock source to a second clock source, and the clock stop detecting means is configured to switch the clock from the first clock source to the second clock source, and the clock stop detecting means is configured to switch the clock from the first clock source to the second clock source for a period of time during which the clock of the first clock source is at a high level or a low level. If the clock interval of the second clock source is longer than the clock interval of the clock source, the clock of the first clock source is stopped, and after determining that the clock is stopped, the switching timing generation means determines that the level of the clock of the second clock source is equal to that of the first clock source. A computer system having a non-stop clock, characterized in that a switching timing is given to the switching means at a time when the clock level matches the clock level. 2. In claim 1, if the time period during which the clock of the second clock source is at high level or low level is longer than the clock interval of the first clock source, it is determined that the clock of the second clock source is stopped. What is claimed is: 1. A computer system having a non-stop clock, characterized in that it is equipped with a monitoring means for issuing an alarm. 3. A nonstop clock comprising a computer, two sets of clock sources that supply clocks to the computer, and a clock switching circuit that selects one of the two sets of clock sources and supplies the clock to the computer. In computer systems,
The clock switching circuit includes means for detecting stoppage of the clock of the first clock source, means for generating switching timing for switching the clock source from the first clock source to the second clock source, and generating timing for switching the clock source from the first clock source to the second clock source. The switching timing generating means has a switching means for switching the clock from a first clock source to a second clock source, and the switching timing generating means has a maximum frequency determined by the elements constituting the computer to which the clock is supplied;
When the lowest frequencies are fa and fb, the timing signal is generated between 1/2fa and 1/2fb, and the clock is switched from the first clock source to the second clock source. A computer system having a nonstop clock characterized by: 4. A plurality of computers, two sets of clock sources provided for each of the computers and supplying a clock to each computer, and a clock selected from one of the two sets of clock sources to supply the clock to the computer. In a computer system having a non-stop clock provided with a switching circuit, the clock switching circuit includes means for detecting a stop of the clock of a first clock source, and switching the clock source from the first clock source to the second clock source. and a switching means for switching the clock from the first clock source to the second clock source according to the generated timing, and the clock stop detection means is configured to switch the clock from the first clock source to the second clock source. The first clock source is stopped when the time period during which the clock is at a high level or a low level is longer than the clock interval of the second clock source, and the switching timing generation means, after determining that the clock is stopped, determines that the first clock source is stopped. A computer system having a non-stop clock, characterized in that switching timing is given to the switching means when the level of the clock of the second clock source matches the clock level of the first clock source. 5. A plurality of computers, a system bus provided between the computers, two sets of clock sources supplying clocks to the system buses, and one of the two sets of clock sources selected to supply the clocks to the system bus. In a computer system having a non-stopping clock, the clock switching circuit includes means for detecting a stoppage of a clock of a first clock source, and a means for detecting a stoppage of a clock of a first clock source, and a switching means for switching the clock from the first clock source to the second clock source according to the generated timing; If the time period during which the clock of the clock source is at high level or low level is longer than the clock interval of the second clock source, the clock of the first clock source is stopped, and the switching timing generation means determines whether the clock is stopped. A computer system having a non-stop clock, characterized in that the switching timing is given to the switching means at the time when the level of the clock of the second clock source matches the clock level of the first clock source.