JPH04241038A - Recovering method for high-reliability computer system - Google Patents

Abstract

PURPOSE:To eliminate various trouble due to the recombination of processors by disconnecting some of the processors in the case of trouble occurrence and switching all the processor into another new processor group at the time of recovery. CONSTITUTION:Three MPUs(microprocessing unit) of a BPU(basic processing unit) 2A are normally in operation. If trouble occurs to the MPUC during the execution of a process B, it is disconnected and the operation is carried on by the MPUA and MPUB. The printed board of a new BPU2B is inserted into a free slot in response to abnormality information by the MPUA, and then the respective MPUs in the new BPU2B diagnose themselves; and the process is transferred from the old BPU2A to the new BPU2B and a process D is carried out according to the result of majority decision making by the three MPUs. Thus, the process is taken over by carrying on the operation of the BPLT up to a good switching point of time or a repair maintenance period, so that the takeover is done at the most suitable point of time of software.

Description

[Detailed description of the invention]

0001

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a highly reliable computer system, and more particularly to a method for restoring a highly reliable computer system that not only allows continued operation in the event of a failure, but also devises subsequent recovery measures.

0002

[Prior Art] For example, traffic control systems, financial systems, and securities systems have become the basis of social life as the information society spreads, and the computer systems used in these systems are designed to prevent failures. It also needs to be configured so that even if a failure occurs, processing can continue while maintaining data consistency.

[0003] In order to meet these demands, various fault-tolerant computers, fault-tolerant, and defect-tolerant computer systems have been proposed. It consists of a system or parts, and by providing redundancy in each part, it is possible to detect a system or part in which a failure has occurred and continue data processing.

As a specific conventional example, US Pat. No. 465
No. 4857 adopts a method commonly called the pair-and-spare method, and uses memory, processor, and
Two processor boards consisting of input/output control devices, etc.
Works in pairs. Every processor board has two
It has several microprocessors, and detects failures by comparing the outputs of the microprocessors and assuming that there is a discrepancy as a board failure. In addition, a lockstep method is adopted in which the output sent from the processor board to the bus is compared and synchronized with the other processor board for each bus clock, so even if a failure occurs on one processor board, the output will remain within that bus clock. The processor board is detected and disconnected, and only the output of the normal processor board is used.

[0005] Also, in Japanese Patent Application Laid-open No. 160899/1989,
Similar to U.S. Pat. No. 4,654,857, this patent has two processor boards connected to each of the dual system buses and has two processors inside, and focuses on cache memory for synchronization. By performing the flash operation to the main memory under OS control, performance limitations due to lockstep operation are avoided. If a failure is detected by comparing the two microprocessors in the processor board, the process is re-executed on the alternative processor board from the previous flash point.

[0006] In the above system, two
A total of four microprocessors are used, one on one processor board and two on another processor board.
The output results of the three processors are output to the redundant system bus via the majority circuit.

[0007]

[Problems to be Solved by the Invention] In the above conventional example, apart from the question of how many processors are arranged on one processor board, in any case, three to four processors are arranged on one processor board. If one of the processors fails, the system is cut down to two processors, and then one or two new processors are installed to restore the original system configuration. It is reconstructed into

In these systems, the set of processors before a failure occurs and the set of processors after recovery are completely different. In other words, in the former two conventional examples, initially there were 4 A, B, C, and D.
If the system was operating with three processors, the processor configuration after recovery would be E, FC, and D. In addition, in the last conventional example, initially A, B, and C were changed to D, B
,C. In this way, with conventional systems, it is necessary to rearrange the processors when recovering after a failure occurs, and for this reason, with conventional systems, special connections, disconnection hardware, and synchronization with other processors that make up the system are required. A mechanism is necessary. In addition, although processors or processor boards are usually upgraded or revised gradually, in the above conventional example of replacing a processor or processor board that is part of a system, sufficient Preliminary measures are essential. Furthermore, when replacing the processor board, it is always necessary to prepare an expensive replacement board. Additionally, synchronization between processors is difficult.

In view of the above, an object of the present invention is to provide a method for restoring a highly reliable computer system that does not require processor replacement when restoring after a failure occurs.

0010

[Means for Solving the Problems] The present invention provides a highly reliable computer system comprising a system bus, a main storage device connected to the system bus, and a basic processing unit connected to the system bus.
The basic processing unit is usually a first,
It is equipped with second and third processors to execute the same operation, and when the first processor fails, it is disconnected and the second
, the configuration is changed so that the third processor executes the same operation, then the fourth, fifth, and sixth processors perform the same operation, and the second and third processors stop the operation. Ru.

[0011]

[Operation] In the present invention, when a failure occurs, a part of it is separated,
Since all of the processors are switched to a new, different processor group at the time of recovery, various failures associated with processor rearrangement are eliminated.

0012

[Example] The present invention will be explained in detail below, but the explanation in this specification will be divided into the following items to facilitate understanding.

I. Schematic overall configuration of the system II.
Configuration of BPU2 III. Anomaly detection method IV. Configuration change control in case of abnormality V. Signal processing during internal bus connection VI. Recovery measures after an abnormality occurs VII. Alternative modification example of each part circuit I. Schematic Overall Structure of the System FIG. 1 shows the schematic overall structure of the fault-tolerant system of the present invention. This system consists of two system buses 1-
1 and 1-2, and on this bus there is one or more basic processing units (hereinafter simply BP).
2-1, 2-2...2-n is system bus 1
-1 and 1-2, respectively. In addition, a main storage device 3-1 is connected to the system bus 1-1, and a main storage device 3-2 is connected to the system bus 1-2.
(referred to as OU) 4-1 and 4-2 are respectively connected to either system bus. The main storage device 3 and IOU4 each have 2
The units are used as a set, and the example in FIG. 1 shows an example in which each set is used, but the number of sets can be increased as appropriate as the system expands. The illustrated n sets of BPUs normally execute different processes, but since they all have the same configuration, the configuration and operation will be explained using BPU 2-1 as an example unless otherwise necessary. I will explain about it.

The BPU 2 includes a plurality of microprocessing units 20 (hereinafter simply referred to as MPUs; in the example shown in the figure, 3
), multiple MPU output check circuits 23 (three in the example shown), three-state buffer circuits 29, multiple cache memories 220, 221, multiple bus interface circuits 27 (hereinafter simply referred to as BIU), etc. It is considered a configuration requirement. To briefly explain the operation of the circuit in FIG. 1, three MPUs 20 execute calculations, the outputs of these MPUs are checked in the check circuit 23, and the outputs of the two MPUs determined to be normal are respectively two sets of system buses 1 via the bus interface circuit 27;
Alternatively, the data is output to two sets of cache memories 220 and 221, respectively. If an abnormality is found in one of the MPUs, this MPU is excluded and the remaining two normal MPUs send their outputs to two sets of system buses 1 via the bus interface circuit 27, or to two sets of caches. The signals are output to memories 220 and 221, respectively. 3 MPU2
After an abnormality is discovered in a part of 0, the three MPUs 20 are switched to three completely different new MPUs 20 at an appropriate timing to execute calculations.

II. Configuration of BPU2 A more detailed configuration of BPU2 is shown in FIG. As will be described later, it is preferable that the BPU has the illustrated functions mounted on a single printed board.

In FIG. 2, three MPUs 20-1 and 2
0-2 and 20-3 are subjected to synchronous calculations by a clock (not shown), and the results are output to address line A and data line D, respectively. MPU20-1, 20-2, 20
-3 address on address line A and data line D
Appropriate parity signals are added to the above data from the parity generation/check verification circuits 10 to 15, and the resulting data is applied to the MPU output check circuit 23. The MPU output check circuit 23 checks the output from MPUA (20-1) (address and data to which a parity signal is attached) and MPUB (20-1).
2) A first check circuit CHK that compares the output from
AB (23-1), a second check circuit CHKCA (23-2) that compares the output from MPUA (20-1) and the output from MPUC (20-3), and MPUB (
A third check circuit CHKBC (20-2) and an output from MPUC (20-3) are compared.
-3), and error check circuits 234 and 235 that identify which MPU is at fault in accordance with the comparison results from the three check circuits CHK. This MP
The U output check circuit 23 is a so-called majority circuit,
According to this determination result, the 3-state buffer circuit 200,
The open/close states of 201, 203, 204, and 29 are controlled. The relationship between this determination result and the state of the 3-state buffer circuit will be described later, but in short, the MP determined to be abnormal
U is no longer used, and the output of the MPU determined to be normal is given to the two cache memories 220 and 221 to operate as a dual system. In the following description, the enabled state of the three-state buffer circuit will be simply referred to as an open state, and the disabled state will be referred to as a closed state.

3-state buffer circuits 200, 201,
The address and data obtained through 203 and 204 are 2
cache memories 220 and 221, respectively,
At that time, the parity check circuit 250 checks the parity given by the parity generation/checking and matching circuits 10 to 15. Also, the MPU output is output from the synchronous circuit 290.
, 291, the two MPU outputs are synchronized and sent to the system bus via the bus interface unit BIU. At that time, the parity check circuit 30, 3
1, the parity assigned by the parity generation/checking and matching circuits 10 to 15 is checked. The above configuration mainly describes write access from the MPU, but in this way, when write access from the MPU is performed, the MPU output check circuit 23 and the parity check circuit 3
A check is made at 0,31.

On the other hand, during cache read access, signals are transmitted through the routes of each cache memory 220, 221, 3-state buffer circuits 202, 205, and MPU, and in this case, the parity generation/check verification circuit 1
Addresses and data from the cache memory are checked from 0 to 15. Note that 26 and 27 are also 3-state buffer circuits, and the addresses in the parity generation/check verification circuits 10 to 15 are
The opening/closing state is controlled according to the data check results.

As is clear from the configuration of FIG. 2, the BPU system of the present invention includes at least three MPUs, an abnormal MPU detection circuit using a majority circuit, a duplicated cache memory, and a duplicated output circuit portion. have

III. Abnormality Detection Method Inside the BPU shown in FIG. 2, an MPU output check circuit 23 and many parity check circuits are employed as an abnormality detection section. This section describes these anomaly detection methods.

<<Abnormality Detection by MPU Output Circuit>> Of these, the MPU output check portion is shown in FIG. Figure 3
AB the output of the first check circuit CHKAB
, the output of the second check circuit CHKCA, and the output of the third check circuit CHKCA
Letting the output of the check circuit CHKBC be BC, and the outputs of the error check circuit 231 as Ag, Cg, and 29g, the relationship between the outputs of the three check circuits and the open/close states of the three-state buffer circuit at that time will be explained. Note that in this figure, C is a control line that is not described in FIG.

First, the first to third check circuits CHK
obtains their respective two sets of inputs (address, data, control signals), and the first check circuit CHKAB is connected to the MPU
The second check circuit CHKCA compares the comparison result AB between the output of A and the output of MPUB with the output of MPUA and MPUC.
The comparison result CA with the output of
BC outputs the comparison result BC between the output of MPUB and the output of MPUC. The result of this comparison is a status signal that either matches or does not match.

The error check circuit 231 detects (1),
MPUA, MPUB, MPUC according to formulas (2) and (3)
Outputs Ag, Bg, and Cg representing normality are obtained. In addition, Figure 2
, the error check circuit in FIG. 3 is duplicated.

Ag="AB・"CA+"AB・BC・CA+AB
・BC・"CA...(1) Bg="AB・"BC+
"AB・BC・CA+AB・"BC・CA...(2)
Cg="BC・"CA+AB・"BC・CA+AB・
BC/“CA…(3) However, AB: MPUA and M
PUB output mismatch event (confirmed with 23-1)
BC: Event of mismatched output between MPUB and MPUC (confirmed in 23-3) CA: Event of mismatched output between MPUA and MPUC (confirmed in 23-2)
・: Logical product (AND)
+: Logical sum (OR) ": Negation (NOT) 3-state buffer circuits 200, 201, 204, 2 according to the results of the calculations of expressions (1), (2), and (3)
The open/close states of 05 and 29 are controlled, and this will be explained in the next section. Table 1 shows the three check circuits CHKAB,C
HKBC, CHKCA output (match, mismatch),
The determination results Ag, Bg, Cg of the abnormal MPU at this time,
This is a table summarizing the open/close states of the 3-state buffer circuit as a result. Note that in the determination result section of Table 1, 1 means MPU normal, and 0 means abnormal or unknown.

[0025] Table 2 describes some of the cases that are assumed to be the causes of the match/mismatch check circuit outputs in Table 1. The main focus is on how to make changes and continue operation, and the main purpose is not to identify the cause of the abnormality, so a detailed explanation will be omitted here.

[0026]

[Table 1]

[0027]

[Table 2]

As explained with reference to FIGS. 3, 2, Tables 1 and 2, in the present invention, the MPU output check circuit 23 determines whether the MPU is normal or abnormal based on the above logic.

Next, a description will be given of an abnormality detection method using a parity check circuit, which is employed as another abnormality detection method in each part of the BPU. However, since the parity check circuit itself is well known and any one can be used, a detailed explanation of the circuit will be omitted, and a method for identifying an abnormal location when a parity error is detected will be described here.

As shown in FIG. 2, at the time of write access, appropriate parity signals are applied from the parity generation/check verification circuits 10 to 15 and information is sent to the address line A and data line D, and this abnormality is detected by the parity check circuit 250. , 30, 31. Furthermore, during read access, parity generation/check verification circuits 10 to 15 and parity check circuits 250, 30, and 31 detect abnormalities in information. These parity checks are basically performed separately for addresses and data. Regarding the address, when a parity error is detected in the address information, the abnormality is the bus master that is sending out this address signal, and the bus arbiter (not shown) that gives the right to use the internal bus in Figure 2. The device (MPU) that is the bus master by monitoring the grant signal
, cache memory, BIU). Next, regarding data, when a parity error in data information is detected during write access, the abnormality is the bus master that is sending out this data signal. The bus master is identified by monitoring the bus grant signal of the bus arbiter. Finally, when a parity error is detected in data information during read access, the abnormal location is the output source of this data signal, and this can be identified by decoding the address to the device pointed to by the address attached to this data. .

[0031] The concept of specifying the abnormal location can be expressed as a logical formula as follows.

<<Abnormality detection by parity check>> PT
YGEN/NG=APE・MPU/MST+DPE(W
T・MPU/MST +RD・
MPU/SND)
...(4) Cach/NG=APE
・Cach/MST+DPE (WT・Cach/MST
+RD・Cach/
SND)...
...(5) BIU/NG=APE・BIU/MST+DP
E(WT・BIU/MST
+RD・BIU/SND)
...(6) SYSBUS/N
G=BIU/NG
...(7) However, in equations (4) to (7), PTYGEN: parity generation/check matching circuits 10 to 1
5/NG: Parity error APE: Address parity error ・: AND/MST: Bus master +: OR DPE: Data parity error WT: Bus master outputs data Cach: Cache memory RD: Bus master inputs data/SND: Data output source IV. Configuration change control during abnormality Abnormalities within the BPU include those detected by the MPU output check circuit during write access from the MPU, and those detected by the parity check circuit during write access or cache read access.

[Configuration change when an abnormality is detected by the MPU output check circuit] The three-state buffer circuit 20 changes depending on the output Ag of the error check circuit 231 of the MPU output check circuit 23.
0,201 is 203,204 depending on Cg, 29g
The opening/closing states of 29 are controlled as shown in Table 1, respectively. In addition, in Table 1, MPU determination result Ag=1 is 2
00,201 open, Ag=0 basically corresponds to 200,201 closed, Cg=1 is 203,204 open, Cg=0 is 2
It basically corresponds to 03 and 204 closures, but Bg and 29g do not have a corresponding relationship. 29g Therefore, the open/closed state of 29 is:
When Ag=1 and Cg=1, it is closed, and when either Ag or Cg is 1, only the 3-state buffer circuit 29 in the direction toward the 3-state buffer circuit, which is 0, is opened. Each case in Table 1 will be described in more detail below with reference to the system configuration in FIG. 4.

Case 1: All MPU outputs match and all MPUs are normal. 3-state buffer circuit 200,2
01, 203, 204 are in the open state, 29 is in the closed state,
As shown in FIG. 4(a), the MPUA and cache memory 220
The system based on the MPUC and the cache memory 221 are independently operated in a redundant manner.

Case 2: Only the check circuit CHKCA gives a non-coincidence output, and only MPUB is judged to be normal. As shown in FIG. 2, MPUB is used as a reference for other MPUs and is not configured to provide output to the cache memory, so it is impossible to continue operation even after changing the configuration, and in this case, the system will go down.

Case 3: Only the check circuit CHKBC is giving a non-coincidence output, and only the MPUA is judged to be normal. In this case, the 3-state buffer circuit 200,
201 is open, 203 and 204 are closed, and only the 3-state buffer circuit 29 toward the cache memory 221 is open. MPUB and MPUC are stopped,
As shown in FIG. 4(b), the system is operated by a single system using only the MPUA. The reason why only the three-state buffer circuit 29 toward the cache memory 221 is kept open is to maintain the sameness of the contents stored in the cache memory.

Case 4: Only the check circuit CHKAB gives a matching output, and MPUA and MPUB are judged to be normal. In this case, the 3-state buffer circuit 20
0 and 201 are open, 203 and 204 are closed, and only the 3-state buffer circuit 29 toward the cache memory 221 is open. In this case, the MPUC is stopped, a duplex system is configured with MPUA and MPUB as shown in FIG. 4(c), and a duplex operation is performed in which the output of MPUA is monitored by MPUB. 3 toward cache memory 221
Only the state buffer circuit 29 is open because
This is to maintain the identity of the contents stored in the cache memory.

Case 5: Only the check circuit CHKAB is giving a non-coincidence output, and it is determined that MPUA and MPUB are abnormal and only MPUA is normal. In this case, the three-state buffer circuits 200, 201 are in the closed state, 203,
204 is in an open state, and only the 3-state buffer circuit 29 toward the cache memory 220 is in an open state. In this case, MPUA and MPUB are stopped, and only MPUC operates independently as shown in FIG. 4(d). The reason why only the three-state buffer circuit 29 toward the cache memory 220 is kept open is to maintain the sameness of the contents stored in the cache memory.

Case 6: Only the check circuit CHKBC gives a matching output, and MPUC and MPUB are judged to be normal. In this case, the 3-state buffer circuit 20
0 and 201 are in the closed state, 203 and 204 are in the open state, and 29, only the three-state buffer circuit toward the cache memory 220 is in the open state. In this case, the operation is basically the same as Case 4.

Case 7: Only the check circuit CHKCA gives a matching output, and MPUC and MPUA are judged to be normal. In this case, the reference MPU is abnormal, so
As in case 7 of Fig. 4(e), only MPUB is separated,
The 3-state buffer circuit can be used as MPUC without any modification.
and continue duplex operation using MPUA.

Case 8: Since both check circuits CHK have detected a mismatch and all MPUs are abnormal, it is impossible to continue operation from now on.

[0042] As described above, the normality of the three MPUs and their peripheral circuits (for example, parity generation/check verification circuits) is confirmed, and configuration change control is implemented as appropriate. However, Table 1 only shows the verification results. This is merely a description of possible combinations, and in reality, the seven abnormal events in cases 2 to 8 do not occur with the same probability. In other words, among these, there are three cases of single failure (4, 6, and 7), three cases of double failure (2, 3, and 5), and three cases of triple failure (8 cases), and as is well known, operation continues. Cases 2 and 8 where it becomes impossible
The probability of multiple failures including multiple failures occurring simultaneously is extremely low compared to a single failure. Moreover, in reality, in most cases, a single failure progresses and leads to multiple failures, so by taking some kind of recovery measures at the time of a single failure, it is necessary to create a system configuration that virtually does not hinder continued operation. be able to. In addition, in the present invention, even if a double failure occurs, operation can be continued without any trouble in most cases, and in this sense, it can be said that the system is extremely reliable.

Although not shown in FIG. 2, when the above-mentioned abnormal event occurs, a signal to stop the abnormal MPU is generated from the MPU output check circuit 23 and is stopped, or is output externally and sent to the operator. It is a matter of course to notify the user of the occurrence of an abnormality and the necessity of future countermeasures.

[Configuration change when abnormality is detected by parity check] As described in Section III above, abnormal locations in the cache memories 220, 221, BIUs 27-1, 27-2 are changed during write access or cache read access. can be identified. Next, the configuration change control inside the BPU at the time of each abnormality will be explained. Table 3 shows that the cache memory 220 is
, 221, BIU 27-1, 27-2, and how to control the 3-state buffer circuits 29, 26, and 27.

[0045]

[Table 3]

FIG. 5 shows the circuit configuration for each case, which will be explained below with reference to Table 3 and FIG. Figure 5
(a) shows the signal flow during normal operation. in this case,
The 3-state buffer circuits 29 and 26 are closed, and the 3-state buffer circuit 27 is open, so that information from the BIU 27-1 or the cache memory 220 is transferred to the MPUA 20-1 and the MPUB 2.
0-1, and information from the BIU 27-2 or the cache memory 221 is supplied to the MPUC 20-3. In this way, normally the BIU 27-1, the cache memory 220, the MPUA 20-1, and the MPUB 20-1 constitute one set, and the BIU 27-2 and the cache memory 22
1. The MPUC 20-3 is operated to form another set.

Case 1: The cache memory 220 is abnormal. As shown in FIG. 5(b), the cache memory 220
The output of MP is stopped, and the 3-state buffer circuit 29
It is controlled so that only the signal to the UA 20-1 side passes through, the 3-state buffer circuit 26 is open, and the 3-state buffer circuit 27 is closed. As a result, all MPUs are connected to the cache memory 221.
The system is configured to receive common information from the system and continues to operate even after an abnormality is detected. Note that the 3-state buffer circuit 26
Although the reason for switching from the normal state such as opening and closing 27 is logically determined to be an abnormality in the cache memory 220, the possibility of an abnormality in the internal bus to which the cache memory 220 is connected cannot be ruled out. First, just to be sure, it is switched to the cache memory 221 side. If there is an abnormality in the internal bus to which the cache memory 220 is connected, the 3-state buffer circuit 22 may
This effect will not be felt on the PUC side.

Case 2: The cache memory 221 is abnormal. As shown in FIG. 5(c), the cache memory 221
The output of MP is stopped, and the 3-state buffer circuit 29
It is controlled so that only the signal to the UC 20-3 side passes through, so that all MPUs are configured to receive common information from the cache memory 220 and continue to operate even after an abnormality is discovered.

Cases 3 and 5: There is an abnormality in the BIU 270 or the system bus 1-1 connected to it. Figure 5 (
As shown in d) and (e), the BIU 270 or the system bus 1-1 side connected to it is stopped, and the operation is performed in the same manner as in case 1.

As described above, when an abnormality due to a parity error is detected, the abnormality is notified externally along with the configuration change.

As described in detail above, according to the present invention, even if an abnormality occurs inside the BPU, by disconnecting a part of the circuit configuration or changing the flow of information, the system can be restored as normal. Continued operation is possible. Therefore, if an abnormality occurs during data processing, (1) the operation of the relevant BPU should be continued until a suitable time is reached or it is time for repair/maintenance; The relevant BP
All that is required is to have another normal BPU take over the processing being executed by U.

[0052] As a result, there is no need for backup operations in preparation for checkpoint restart in the event of an abnormality.
Processing performance can be improved.

[0053]V. Signal processing when connecting the internal bus As explained above, the internal bus is switched using the 3-state buffer 29 in the event of an abnormality in each part, but the 3-state buffer 29
Opening/closing operations take longer to switch than normal write access, and it also takes time to make detours between buses. As a countermeasure for this problem, it is effective to extend the bus cycle by retrying only when an abnormality occurs as shown in FIG. 6 without causing a delay in the bus cycle.

In other words, an abnormality has been discovered (step S1
, S2), a signal for retrying is asserted in step S4, and after stopping the abnormal output (disconnecting the abnormal MPU, etc.) and detouring the normal output in step S5, this bus cycle is terminated in step S6. The series of processing is completed by asserting a termination signal. Incidentally, when the bus cycle is normal, it is only necessary to assert a signal for terminating this bus cycle in step S3. The name of the signal line that causes the MPU to end the bus cycle or make a retry differs depending on the type of MPU, but in many MPUs, the retry signal is
The MPU automatically executes this by inputting it to U. Table 4 shows typical MPU signal names.

[0055]

[Table 4]

FIGS. 7 and 8 show the signal flow when the retry method of FIG. 6 is adopted at the time of write access, with FIG. 7 showing the normal state and FIG. 8 showing the abnormal state. In the figure, the vertical axis shows the passage of time, and the horizontal axis shows each circuit from the MPU output to the cache memory. Usually, an address signal is output from the MPU before a data signal. In FIG. 7, since both the address signal and the data signal are normal, the MPU output check circuit 23 and the parity check circuit 250 determine that they are normal, and the MPU
An end signal is returned to the cache memory 220, and the data is stored in the cache memory 220, and the bus cycle ends.

In FIG. 8, the MPUA is abnormal and both the address signal and the data signal are determined to be abnormal by the MPU output check circuit 23, and a retry signal is returned to each MPU along with a termination signal to enter a retry operation. During retry operation, the 3-state buffers 200 and 201 are closed and M
Signal transmission from the PUA to the internal bus is blocked, the 3-state buffer 29 is opened in only one direction, and the output signal of the MPUC is also supplied to the cache memory 250. Then each M
An end signal is returned to the PU, and the operation ends.

FIGS. 9, 10, and 11 show the signal flow when the retry method of FIG. 6 is adopted at the time of cache read access. FIG. 9 shows the normal state, FIG. 10 shows the address signal abnormal state, FIG. 11 shows each case when the data signal is abnormal. In FIG. 9, since both the address signal and the data signal are normal and no abnormality is observed, an end signal is returned to the MPU, and the MPU stores the data from the cache memory 250 and ends the bus cycle. In Figure 10, MP
The address signal from the UA does not match the others and is determined to be abnormal, and a retry signal is returned together with an end signal to each MPU, and a retry operation begins. During retry operation, the 3-state buffer 201 is closed to prevent signal transmission from MPUA to the internal bus, and the 3-state buffer 29 is opened in only one direction to supply the MPUC address output signal to the cache memory 220. MPUA and MP data stored at the given address
Supply to UB. Thereafter, a termination signal is returned to each MPU, and the retry operation is terminated.

In FIG. 11, there is an abnormality in the data from the cache memory 220, and the parity generation and verification circuit 10
, 12. The parity check in the parity check circuit 250 determines that each is normal, and a retry signal is returned together with an end signal to each MPU, and a retry operation begins. During the retry operation, the output of the cache memory 220 is blocked,
The 3-state buffer 29 is opened in only one direction and the output of the cache memory 221 is supplied to MPUA and MPUB. In this case, the 3-state buffer circuit 26 is closed and the 2-state buffer circuit 26 is closed.
7, the output of the cache memory 221 is changed to M through the 3-state buffer circuit 27.
By supplying PUB, the cache memory 220
It is possible to prevent incorrect data from being supplied to MPUB due to an abnormality in the data signal path from to MPUB.

VI. Restoration measures after an abnormality occurs As described above, the device of the present invention can continue to operate even after an abnormality occurs, but if it is operated permanently with this configuration, considering the possibility of secondary failure, it is impossible to return to the initial state as soon as possible. Next, we will explain the recovery measures to restore the BPU functions that occurred above normally. This method is achieved by forming the BPU of FIG. 1 on one printed board and replacing the abnormal BPU printed board with a normal BPU printed board.

FIG. 12 shows the configuration of a computer board, and when the door is opened, a slot portion for storing a printed board is formed inside, and each slot has the main storage device 3, BPU 2, and input board shown in FIG. Each printed board constituting the output control device BIU4 is inserted, and in the inserted state is connected to a system bus (not shown in FIG. 11). In the illustrated example, there are 12 slots SL, among which SL1
, a printed board is inserted into SL3 to SL6, and the other SL2
, SL7 to SL12 are empty slots. The printed board PL inserted into the slot SL may be of a commonly known type, but the one of the present invention includes a lever 282 for fixing the printed board to the slot SL, and an indicator lamp indicating whether or not the printed board is stopped. 280, and a printed board removal request button 281 as required. The procedure for replacing the BPU printed board will be explained below.

《Replacement when there is only one BPU printed board》
Figure 13 shows the system bus (shown as a single system for convenience of explanation)
Among the n slots SL to which a printed circuit board PL can be connected, the BPU and SL2 in which an abnormality has occurred in SL1
An example is shown in which a print of IOU4 is inserted into the main storage device 3 and SLn, respectively, and SL3 is an empty slot. Here, we introduce a new BP that should function in place of the abnormal BPU.
U has not yet been inserted into the slot. The display lamp 280 on the printed board is off because it is in operation.

In this state, in order to take over the functions of the old BPU 2A to the normal new BPU 2B, an empty slot is first prepared. In the example of FIG. 13, since the slot SL3 is an empty slot, the new BPU 2B is next inserted into the empty slot SL3.

[0064] BPU2A detects the insertion of BPU2B,
Through the processing of the operating system (hereinafter referred to as OS), tasks being executed on the old BPUA are transferred to the new BPU2B.
The display lamp 2 on the printed board of the old BPU2A was transferred to
Turn on 80. From then on, online operations will be handled by the new BPU2.
Executed by B. From old BPU2A to new BPU2B
The transfer of business to will be instantaneous. After that, the indicator lamp 280 on the old BPU printed board lights up, and after confirming that the BPU is in a stopped state, the old BPU 2A is removed. By following the above steps, you will have completed transferring online operations to the new BPU2B before removing the old BPU2A.
BPU replacement can be achieved without stopping the system or reducing system performance.

FIG. 14 shows the BP for the example shown in FIG.
This is a process flow of a BPU exchange procedure that shows the contents of the U exchange procedure divided into human operations and processing inside the computer. When replacing the BPU, first prepare an empty slot (St
1) Do. If there is an empty slot that is already unused, you can use it, or if there is no empty slot, if there is a temporarily removable hardware board, remove that board and use the temporarily empty slot. It is also possible to prepare an empty slot by creating a board and returning the board again after replacing the target BPU. Next, a new BPU is inserted into the empty slot (St5). The old BPU2A recognizes the BPU insertion through means such as interrupts (
St4). Then, the old BPU2A saves the currently executing task onto the main memory (St3), and the new BPU2A
Allow B to continue processing the task. New BP
Upon receiving this, U2B executes the task (St5) and starts online business. Old BPU2A is B itself
The board stop lamp on the PU is lit (St6) and the process is stopped (St7). Thereafter, after a person confirms that the board stop lamp on the old BPU is lit (St8), the old BPU is removed (St9). The BPU exchange is now complete.

FIG. 15 shows the old BPU in the above embodiment.
2A is a diagram illustrating in detail a means for handing over a task being executed on BPU 2A to a new BPU 2B. Printed boards for the old BPU 2A, the new BPU 2B, and the main storage device 3 are attached to the system bus. A certain task 920-1 is being executed on the old BPU2A. At that moment,
The notification that the new BPU2B has been inserted is the old BPU2A.
If this occurs, the old BPU 2A interrupts processing and saves the task 920-1 being executed onto the main storage device 3. On the other hand, the new BPU 2B recovers the task 920-2 following the task 920-1 saved on the main storage device 3, and continues processing the task from the point where it was interrupted. The above method is used to transfer business between the replaced BPUs.

The above is an example of BPU replacement when there is one BPU. In the above embodiment, even when there is only one BPU, the BPU can be replaced without stopping the system.

《Replacement when there are multiple BPU printed boards》
Next, a description will be given of what to do when there is a plurality of BPUs or when the inserted BPU does not operate correctly. Figure 1
In this embodiment No. 6, a plurality of BPUs are installed. Each BPU is provided with a board removal request button 281 and a printed board number 282 as means for specifying the BPU to be replaced.

BPU2A, 2B are installed in slots SL1 to SL3 for connecting printed boards to system bus 1.
, 2C are installed respectively. A main storage device is connected to slot SL4. Slot SL5 is an empty slot. Each BPU also has an indicator lamp 280 that lights up when the BPU stops, and a BPU that should be removed.
Printed board removal request button 2 used to specify
81 and printed board number 282. Here, the printed board numbers are 1 for BPU2A, 2 for BPU2B, and B
PU2C is promised to be 3. Now, new BPU2D
When replacing the old BPU 2B installed in the slot SL2, the new BPU 2D is first inserted into the empty slot SL5. Then slot S
Among the BPUs installed in L1 to SL3, remove request button 28 for BPU2B in slot SL2 that you want to replace.
Press 1. Then, the old BPU2B saves the task being executed and its own printed board number onto the main storage device 3,
The new BPU 2D takes in the printed board number saved on the main storage device 3 and executes the task being saved. Old B.P.U.
2B turns on the display 280 and stops by itself. after that,
After confirming that the board stop lamp 280 of the old BPU2B is lit, remove the BPU2B.

FIG. 17 shows B for the example shown in FIG.
This is a process flow of a BPU replacement procedure that shows the contents of the PU replacement procedure divided into human operations and computer internal processing.

When replacing the BPU, first prepare an empty slot (St1). If there is an empty slot that is already unused, you can use it, or if there is no empty slot, if there is a temporarily removable hardware board, remove that board and use the temporarily empty slot. It is also possible to prepare an empty slot by creating a board and returning the board again after replacing the target BPU.

Next, a new BPU2D is inserted into the empty slot (St2). After that, the old BPU2B that you want to remove
Press the printed board removal request button (St3). Then, the old BPU2B saves the task currently being executed and its own printed board number onto the main storage device 3 (St4), and
Allow U2D to continue processing the task. New B
Upon receiving it, the PU2D executes the task (St5) and starts online business. Old BPU2B is B itself
Turn on the display lamp on the PU (St6) and stop the process (
St7). Thereafter, after confirming that the display lamp on the old BPU 2B is lit (St8), the old BPU 2B is removed (St9). The BPU exchange is now complete.

FIG. 18 shows the old BPU in the above embodiment.
FIG. 4 is a diagram illustrating in detail the means for taking over the task being executed above and the printed board number to a new BPU. old B on the system bus
Three PUs (2A, 2B, 2C), a new BPU 2D, and a main storage device are installed. Old BPU2A, 2B
, 2C, tasks 1, 2, and 3 are being executed, respectively, and task 2 is being executed on the old BPU 2C. Also, old BPU2A, 2
The printed board numbers 282 of B and 2C are 1, 2, and 3, respectively. At that time, in order to specify the removed BPU,
If the printed board removal request button of the PU 2B is pressed, the old BPU 2B interrupts processing and saves the task 2 being executed and its own printed board number 2 onto the main storage device 3. On the other hand, the new BPU 2D recovers the printed board number 2 and task 2 saved on the main memory 3, and continues processing the task from the interruption point. The above method is used to transfer business between the replaced BPUs.

According to this embodiment, the BPU to be replaced
By providing a printed board removal request button, which is a means of specifying this, even if multiple BPUs are installed, the BPU can be replaced without stopping the system or degrading system performance. .

Furthermore, by inheriting the printed board number assigned to the replaced BPU between replaced BPUs, even if the operating printed board number is specified by the user program, the BPU can be changed without changing the user program.
It has the advantage of being able to be replaced.

<<If the inserted BPU does not operate properly>> On the other hand, in the event that the replaced new BPU does not operate properly,
It has the disadvantage of having a serious impact on the system. Figure 19. According to FIG. 20, there is a means for checking the operation of the inserted BPU, and even if the newly inserted new BPU does not operate normally, the system will not be affected.

FIG. 19 is a diagram showing a state in which the new BPU 2B has been inserted, and at this time a certain task is being executed in the old BPU 2A. When a new BPU2B is inserted, the corresponding BP
In order to check the operation on the U, the BPU self-diagnosis program 925 is executed. The old BPUA will not be notified of board insertion until the diagnostic program is completed normally. When a failure point is discovered in the new BPU by the diagnostic program 925, the display lamp 280 of the own BPU 2B is turned on and the processing is stopped without contacting the old BPU. The old BPU continues processing the task as if nothing had happened, without interrupting task 1 at the timing of inserting the new BPU.

FIG. 20 is a flowchart of the BPU replacement procedure in the above embodiment, which shows the contents of the BPU replacement procedure divided into human operations and computer internal processing. St
1, St2, St4 to St8, and St11 to St13 are completely the same as those in FIG. 21, so their explanations will be omitted here, and only the processes specific to this embodiment will be explained.

When a new BPU is inserted, first run a diagnostic program (S
t3). As a result of the diagnostic program, if it is determined to be normal, the process moves to St4 as in the previous embodiment. However, if it is determined that there is a failure, the indicator lamp on the inserted new BPU is turned on (St9) and the processing of the new BPU is stopped (St10). Thereafter, it is confirmed that the display lamp on the new BPU is lit (St14), and the new BPU is removed again (St15). As a result, although the BPU replacement ended in failure, the online system is not affected because the old BPU continues processing. Whether or not the replacement was successful is determined by which indicator lamp of the old or new BPU lights up after the BPU is inserted.

As described above, according to the method of this embodiment, even if the inserted BPU does not operate normally, it is possible to eliminate the influence on the online system.

<<Configuration and processing before and after abnormality occurrence>> Figure 21 shows the processing and configuration of the MPUs in the old BPU2A and new BPU2B described above in chronological order.During normal operation, the three MPUs of BPU2A is driving, and the majority vote result is output. If a failure occurs in MPUC during execution of process B, it is disconnected, and operation continues normally using the multiplexed circuit configuration of MPUA and MPUB. On the other hand, new BPU2B is activated due to MPUA abnormality notification.
When inserting the printed circuit board into the empty slot, the new BPU2B
Each MPU in the MPU performs self-diagnosis, transfers processing from the old BPU2A to the new BPU2B at an appropriate time, and transfers processing from the old BPU2A to the new BPU2B.
Process D is executed based on the majority vote of the three MPUs (MPUD, MPUE, MPUF). This processing handover allows the operation of the relevant BPU to continue until the appropriate time or repair/maintenance period is reached, and the processing executed by the relevant BPU at the appropriate time or the repair/maintenance period is transferred to another normal BPU. In fact, it can be performed at the most desirable point in terms of performance due to software considerations. It is clear that the timing of task switching is generally appropriate as such timing. This is because it is possible to switch BPUs using exactly the same procedure as switching processors in a multiprocessor system, and it is possible to reduce the extra performance overhead associated with handover to zero. Therefore, according to the present invention, there is no need for a backup operation in preparation for a checkpoint restart when a fault occurs, and processing performance can be improved.

[0082] When a fault occurs, the hardware records the fault occurrence status in a register, and the operating system refers to the register when switching contexts or processing interrupts for repair and maintenance.
If it is necessary to take over the processing, select the BPU to which the processing will be taken over.
This is notified by an interrupt or the like, and the processing in the own BPU is terminated. If a failure occurs in some of the elements that make up BPU2 (MPU, cache memory, etc.), even if other elements are normal, in this method, after processing is taken over, the entire BPU2, including other normal elements, will fail. discontinue use.

FIG. 22 schematically shows the difference in configuration between the system of the present invention and the known example at the time of takeover when MPUA, MPUB, and MPUC, which have been made redundant for fault tolerance, are damaged due to a failure or the like. show. In the conventional method, only the failed MPUA is replaced with a normal MPUD. In contrast, in the method according to the present invention, not only the failed MPUA but also the normal MPUB, MP
UC has also been newly replaced with MPUD, MPUE, and MPUF. By doing the above, the combination of MPUs made redundant for fault tolerance, that is, the MPU
The combination of A, MPUB, and MPUC can be fixed. Therefore, if a combination of MPUs is used as a unit of exchange, the MPUs forming each combination can be connected using a high-speed clock, and a high-speed fault-tolerant computer can be realized. Also, as in the past, MP
Various hardware and software associated with recombination of U are not required.

[0084] Furthermore, since the BPU can continue operating in the case of a single failure, it is not necessary to take over the processing immediately after the occurrence of a failure. Just go.

According to this embodiment, the wiring board of the faulty BPU 20-1 can be pulled out and a normal wiring board replaced while the processing is continued.

VII. Alternative Modifications of Each Part Circuit Although the present invention has been described above, each part circuit etc. of the present invention can be appropriately changed and realized. These alternatives and modifications will be explained below.

<<Majority Logic Section>> FIG. 23 shows how the majority logic circuit section shown in FIG. and MPUC are fixed for output only, and MPUB is used only as a reference for checking the health of MPUA and MPUC, and in the event of an abnormality in MPUA or MPUC, the output of one of the ones whose health has been confirmed is commonly used. The data is supplied to two sets of cache memories. In this method, the output of the MPU is input directly to the cache memory without passing through the majority circuit, so that the cache memory access time can be shortened by the delay time in the majority circuit.

In the present invention, as described above, the triple system is switched to the double system and operation is continued using the majority logic, and there are various other variations of the present invention in addition to this system. It can be done. For example, in FIG. 25, the outputs of three MPUs are given to majority selection circuits 210 and 211, respectively, and one output whose soundness has been confirmed is selected from among the three MPUs. In this case, data in the cache memory connected to the failed majority selection circuit is destroyed, but operation can be continued using data in the cache memory connected to the normal majority selection circuit.

In addition, as shown in FIG. 24, the output of the MPU is directly input to the cache memory without passing through the gate circuit, switching circuit, etc., and the operation of the cache memory that receives the signal from the abnormal MPU is stopped and then the By not using data, the cache memory access time can be further shortened by the delay time of gate circuits, switching circuits, etc. Moreover, since switching means for address buses and data buses consisting of many signal lines is not required, the amount of hardware can be reduced.

FIG. 26 has four MPUs, MPUA and MPUC are fixed for output only, MPUB and MPUD are used for reference, and output-only MPU is set by matching the outputs of the two sets.
It gives the output of each PU. In addition, in the event of an abnormality in the MPU, countermeasures can be taken such as switching to a healthy one for use, or stopping the operation of the cache memory that receives signals from the abnormal MPU and preventing the data from being used thereafter. .

<<Cache data read access section>> Also, looking at the cache memory, the cache memory 220,
Since the output (data) of 221 can be determined to be normal or abnormal by a parity check, the output of the cache memory determined to be normal by the parity check 250 is transferred to MPUA, MPUB, M through the switching means 260 as shown in FIG.
Enter in PUC. Further, if both cache memories are normal, it is sufficient to decide in advance the main system and slave system of the cache memory, and select the output of the main system.

Furthermore, as shown in FIG. 28, MPUA and MPUB each have a cache memory of 22
It is also possible to fix it to 0,221 and input the output of the selected cache memory only to MPUB. In this case, even if any of the cache memories fails, two of the three MPUs can operate normally, and the amount of hardware can be reduced.

[0093]

According to the present invention, when a failure occurs, a part of the processors is disconnected, and upon recovery, all of the processors are switched to a new, different processor group, thereby eliminating various failures that occur when processors are rearranged.

[Brief explanation of the drawing]

FIG. 1 is a diagram showing the overall system configuration of the present invention.

FIG. 2 is a diagram showing the configuration of a BPU of the present invention.

FIG. 3 is a diagram of an embodiment of an MPU output check circuit.

FIG. 4 is a diagram showing the configuration of a BPU when an abnormality occurs in write access.

FIG. 5 is a diagram showing the configuration of a BPU when an abnormality occurs in read access.

FIG. 6 is a bus cycle control flow diagram.

FIG. 7 is a diagram showing the flow of signals within the BPU when the MPU is normal.

FIG. 8 is a diagram showing the flow of signals within the BPU when the MPU is abnormal.

FIG. 9 is a diagram showing the flow of signals within the BPU when the MPU is normal.

FIG. 10 is a diagram showing the flow of signals within the BPU when an address signal is abnormal.

FIG. 11 is a diagram showing the flow of signals within the BPU when a data signal is abnormal.

FIG. 12 is a diagram showing a computer board configuration.

FIG. 13 is a diagram explaining the principle of BPU replacement.

FIG. 14 is a diagram showing a BPU replacement procedure.

FIG. 15 is a diagram showing processing takeover between old and new BPUs.

FIG. 16 is an explanatory diagram of the BPU exchange principle in multiprocessor mode.

FIG. 17 is a diagram showing a BPU exchange procedure in the case of multiprocessors.

FIG. 18 is a diagram showing the inheritance of old and new BPU processing in multiprocessor mode.

FIG. 19 is a diagram showing BPU replacement processing when an inserted BPU fails.

FIG. 20 is a flow diagram of BPU replacement processing when an inserted BPU fails.

FIG. 21 is a diagram showing the succession of processing when a BPU fails.

FIG. 22 is a diagram showing the succession of processing when a BPU fails.

FIG. 23 is an example diagram of comparison and verification using 3MPU.

FIG. 24 is a diagram showing another example of comparison and verification using 3MPU.

FIG. 25 is a diagram showing another embodiment of the majority voting system.

FIG. 26 is an example diagram of comparison and verification using 4MPUs.

FIG. 27 is a diagram showing read access to cache data.

FIG. 28 is a diagram showing another embodiment of cache data read access.

[Explanation of symbols]

1...System bus, 2...BPU, 10, 11, 12, 1
3, 14, 15... Parity generation/verification circuit, 20... MP
U, 23... MPU output check circuit, 27... BIU (bus interface unit), 30, 31... parity check circuit, 200 to 205, 26, 27, 29... 3
State buffer, 220, 221... Cache memory, 234, 235... Error check circuit.

Claims (20)

[Claims] 1. A highly reliable computer system comprising a system bus, a main storage device connected to the system bus, and a basic processing unit connected to the system bus, wherein the basic processing unit includes a first, a second, and a third basic processing unit. It is equipped with two processors to execute the same operation, and when the first processor fails, the second and third processors
High reliability characterized in that the same operation is executed by the first processor, the processing is then shifted to the same operation by the fourth, fifth, and sixth processors, and the operations by the second and third processors are stopped. How to recover your computer system. 2. A highly reliable computer system comprising a basic processing unit comprising a system bus, a main memory connected to the system bus, and a plurality of processors connected to the system bus and executing the same operation, wherein the basic processing unit comprises: a system bus; A method for restoring a highly reliable computer system, characterized in that the plurality of processors have completely different sets before the occurrence of a failure and after recovery from the failure. [Claim 3] A plurality of processors that execute the same operation;
A selection circuit that selects a plurality of outputs whose soundness has been confirmed among the processors, a plurality of interface units that output the outputs of the selected plurality of processors to the outside and take in external input, and arithmetic operations in the processor. A basic processing unit consists of a plurality of cache memories that store information necessary for processing, and an internal bus provided between them, and these are provided on a single processor board. If the basic processing unit fails, operation continues using the remaining configuration excluding the failed part.
A basic processing unit recovery method characterized by replacing the processor board as a unit when restoring the normal configuration. 4. A highly reliable computer system comprising a plurality of system buses, a main storage device connected to the plurality of system buses, and a plurality of basic processing units connected to the plurality of system buses. The unit includes a plurality of processors that execute the same operation, a selection circuit that selects a plurality of outputs whose soundness has been confirmed from among the processors, outputs each of the selected outputs to the outside, and receives an external input. multiple interface units for storing information, multiple cache memories for storing information necessary for calculations in the processor,
The internal bus provided between these units is mounted on a single processor board, and normally the multiple processors execute calculations, and if the internal circuit of the basic processing unit fails, operation continues except for the failed part. ,
A method for restoring a highly reliable computer system, comprising transferring processing to another basic processing unit on the system bus and stopping a failed basic processing unit when restoring the normal configuration. Claim 5: A plurality of processors that execute the same operation;
A selection circuit that selects a plurality of outputs whose soundness has been confirmed from among the processors, a plurality of interface units that output each of the selected outputs to the outside and take in external inputs, and a selection circuit that is necessary for calculations in the processor. A basic processor consisting of multiple cache memories that store information, and an internal bus provided between them, and multiple independent calculation units consisting of a processor, an interface unit, a cache memory, and an internal bus. Normally, calculations are executed using multiple calculation units, and when the basic processor fails, the failed calculation unit is stopped and operation is continued with the normal operation unit, and when the basic processor is restored, the normal calculation unit is restarted. A basic processor recovery method characterized by replacing a basic processor that continues to operate only as a unit with another basic processor. 6. A highly reliable computer system comprising a plurality of system buses, a main storage device connected to the plurality of system buses, and a plurality of basic processors connected to the plurality of system buses, wherein the basic processor is , multiple processors performing the same operation,
A selection circuit that selects a plurality of outputs whose soundness has been confirmed among the processors, a plurality of interface units that output the selected outputs to the outside and take in external inputs, and arithmetic operations in the processor. It is composed of a plurality of cache memories for storing information necessary for the processing, and an internal bus provided between them, and a plurality of independent calculation units each consisting of a processor, an interface unit, a cache memory, and an internal bus are provided. The feature is that in the event of a failure, the faulty processing unit is stopped and operation continues in the normal processing unit, and upon recovery, processing is taken over from the operation in the normal processing unit to a new basic processor and then stopped. A method for restoring highly reliable computer systems. 7. A highly reliable computer system comprising a plurality of system buses, a main storage device connected to the plurality of system buses, and a basic processing unit connected to the plurality of system buses and constituted by one processor board, The basic processing unit is a multi-system system consisting of a processor that executes the same operation, an interface unit that outputs the processor output to the outside and takes in external input, and a cache memory that stores information necessary for the operation in the processor. A basic processing unit that has a failure continues to operate with the remaining configuration excluding the failed part, and also transfers processing to a new basic processing unit connected to the system bus and then stops. A method for restoring highly reliable computer systems. 8. A highly reliable computer system in which a basic processor composed of a plurality of processors that execute the same operation is connected to a system bus and operated,
1. A method for restoring a highly reliable computer system, characterized in that a product set of a plurality of basic processors that execute predetermined processing before a failure occurs and after a failure occurs is emptied. 9. A system bus comprising a plurality of slots for inserting boards, into which a main storage board and one basic processor board composed of a plurality of processors that execute the same operation are inserted. In a high-reliability computer system that operates as a high-reliability computer system, the basic processor board has a display means indicating an inoperable state in a part thereof, and recovery from a degraded operating state due to a malfunction of a part of the processor is performed as follows. How to restore a trusted computer system. a. The old basic processor board detects that the new basic processor board is inserted into an empty slot and is ready for operation, and saves the task being executed to the main memory. b. The new basic processor board executes the task saved in the main memory, and the display means of the old basic processor board displays the stopped state. c. Stop the old basic processor board. 10. A system bus comprising a plurality of slots for inserting boards, into which a main storage board and a basic processor board consisting of a plurality of processors that execute the same operation are inserted and operated. A recovery method for a highly reliable computer system in which recovery from a degraded operation state due to failure of some processors is performed as follows. a. The old basic processor board detects that the new basic processor board is inserted into an empty slot and is ready for operation, and saves the task being executed to the main memory. b. The new basic processor board performs self-diagnosis and executes the tasks saved in the main memory only when the board is normal. c. Stop the old basic processor board. 11. A system bus comprising a plurality of slots for inserting boards, into which a main storage board and a plurality of basic processor boards each consisting of a plurality of processors that execute the same operation are inserted. In highly reliable computer systems that operate in How to recover a computer system. a. The old basic processor board saves the task being executed and the identification number indicating its own board to the main memory in response to a signal from the board removal request means provided therein. b. The new basic processor board inputs the task and identification number saved in the main memory and continues to execute the processing that the old basic processor board should have executed. c. Stop the old basic processor board. 12. A system bus comprising a plurality of slots for inserting boards, into which a main storage board and a plurality of basic processor boards each consisting of a plurality of processors that execute the same operation are inserted. In highly reliable computer systems that operate in How to recover computer system. a. The old basic processor board saves the task being executed and the identification number indicating its own board to the main memory in response to a signal from the board removal request means provided therein. b. The new basic processor board performs a self-diagnosis, and only if it is normal, inputs the task and identification number saved in the main memory, and continues executing the process that the old basic processor board should have executed. c. Stop the old basic processor board. [Claim 13] A computer system comprising a plurality of slots for inserting boards on the system bus, and the slots are composed of a main storage board and a plurality of processors that execute the same operation, and a failure has occurred in some of the circuits. In a high-reliability computer system that operates with multiple basic processor boards inserted, which continues to operate in the remaining configuration except for the faulty part, when all of the multiple slots have operating boards inserted, any Remove the board, insert the new basic processor board in its place, transfer the processing of the old basic processor board that is still operating with some circuits due to a failure to the new basic processor board, and stop the old basic processor board. 1. A method for restoring a highly reliable computer system, comprising: removing the board from the slot, and inserting the removed arbitrary board into the slot position after removal and operating the board. 14. A processor board and a main memory board that are equipped with a plurality of processors that perform the same calculation and that continue to operate by the remaining processors except for the faulty processor when a fault occurs are installed in slots in a storage rack, and these boards In a highly reliable computer system in which processor boards and main memory boards installed in slots are connected via a system bus, all of the processor boards and main memory boards installed in the slots are in operation, and a spare processor board for replacement in the event of a failure is installed in the slot. A highly reliable computer system that is not installed in 15. A board installed in a plurality of slots provided in a board storage rack, means for supplying power to the board when the board is installed, and electrically connected to the board when the board is installed in the slot. The board is equipped with a system bus inside the panel, and the board performs input/output of data between the processor board equipped with the processor, the main memory board that stores data used for processing by the processor, and the outside. In a highly reliable computer system including an input/output interface board that performs
A means for outputting the output of a processor whose soundness has been confirmed to the system bus by having three or more processors that take in data from an input/output interface board and perform the same calculation based on this data, and a means for preventing failure of some of the processors. High reliability characterized in that the processor starts operating by installing the board, and the processing tasks on the plurality of processor boards are different from each other. computer system. 16. A computer board that houses a storage rack having a plurality of slots, a board installed in the slot of the storage rack, and a system bus connected to the board, which performs data processing among the boards. The processor board includes a plurality of processors that perform the same operation, an output section for externally outputting a selected processor output, and an abnormality detection section that detects a processor abnormality and excludes the abnormal processor. A computer board characterized by: 17. A storage rack having a plurality of slots, a board installed in the slot of the storage rack that includes a processor board that processes data, and a main memory board that stores data necessary for data processing. , and a system bus connected to the board, the processor board having a removal request means for requesting removal from the storage rack, and a first storage means for storing tasks executed by the processor. a second storage means for storing the board number of the processor board; a means for transferring the task and the processor number to the main memory board in response to the removal request and stopping calculations on the processor board; and a main memory board. Receive the above task and board number,
A computer board characterized by comprising means for starting an operation by the processor board. 18. A processor board storage rack comprising a plurality of processors, wherein when one of the processors fails, the output of the processor paired with this processor and whose health has been confirmed is outputted to the outside. In a computer system that is installed in a slot and in which multiple boards installed in the slot are connected by a system bus, the slot receives the necessary data transfer from the processor board including the failed processor, and the transfer is completed. A computer system characterized in that another processor board capable of starting calculations by multiple processors can be installed. 19. A processor board including a plurality of processors and display means for indicating the operating status of the processors is provided on a system bus, and this processor board is connected to other processor boards on the system bus. means for detecting that another processor board is connected, means for transmitting data held in the own processor board to the system bus when the means detects that another processor board is connected, and means for displaying the own processor board after data transmission is completed. 1. A computer system comprising: means for changing the display state of the computer; and means for stopping the processor of its own processor board after data transmission is completed. 20. A system bus includes a plurality of processor boards each having a plurality of processors and display means for indicating the operating status of the processors, and each of these processor boards stores a unique identification number for each processor board. storage means, stop request means for externally instructing the stop of this processor board, means for detecting a processor board stop request command from the stop request means, and when the stop request command is detected by the means, a stop request command is sent to the own processor board; means for transmitting retained data and a unique identification number stored in the storage means to the system bus; means for changing the display state of the display means of its own processor board after completion of transmission of data; and means for changing the display state of the display means of its own processor board after completion of transmission of data A computer system comprising means for stopping a processor on its own processor board.