JPH04247531A - Fault detecting system - Google Patents

Abstract

PURPOSE:To present the fault detecting system which does not define the operational not-coincidence of each arithmetic circuit as a fault according to asynchronous signals concerning the fault detecting system of the duplex arithmetic circuits. CONSTITUTION:An arithmetic stepping circuit 7 is provided to operate respective duplex arithmetic circuits 1 and 2 only for arbitrary clocks, and a means is provided to step one arithmetic circuit only for (n) clocks while stopping the operation of the other arithmetic circuit when non-coincidence is detected between the arithmetic circuits 1 and 2 or to step one arithmetic circuit only for (m)(>n) clocks while stopping the operation of the other arithmetic circuit. When coincidence is detected by operating only one or the other among the arithmetic circuits 1 and 2 by the means, the stop is canceled and when non- coincidence is detected in the both cases, it is recognized as the fault. 3,4: interruption signal/timer signal, 5: comparator circuit, 6: clock preparing circuit, I: fault, II: announcement to host device.

Description

[Detailed description of the invention]

0001

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for detecting a fault in a duplexed arithmetic circuit in an arithmetic processing device having a duplexed arithmetic circuit.

In recent years, there is a strong demand for no-stop and no-down processing in arithmetic processing devices. For this purpose, a method is generally used in which the arithmetic processing units are duplicated and when one of the arithmetic processing units detects a failure, it is switched to the other one.

In order to accurately detect a failure in the arithmetic processing unit at this time, for example, the internal arithmetic circuits are duplicated and compared, and when a discrepancy is detected, a failure detection method is used that determines that the arithmetic processing unit is at fault. be.

In this case, if, for example, an interrupt signal or a timer signal is input asynchronously to the duplicated arithmetic circuit, the arithmetic circuit may detect a mismatch even though it is not a fault. Therefore, there is a need for a failure detection method that does not detect inconsistencies caused by such asynchronous events.

[0005]

[Prior Art] FIGS. 3 to 5 are diagrams for explaining conventional failure detection methods, in which (a) shows an example of the configuration of an arithmetic processing unit, and (b1) and (b2) show operation time charts. ing. An example in which one instruction is executed in one clock will be described below.

A conventional fault detection method for an arithmetic processing device having duplex arithmetic circuits 1 and 2 includes, for example, comparing the operations of duplex arithmetic circuits 1 and 2 in synchronization with a clock in a comparator circuit 5; A common fault detection method is to detect a mismatch as a fault in the arithmetic processing device.

However, in this conventional method, the interrupt signals
Or, when calculating an asynchronous event caused by a timer signal, etc., there was a problem that due to the difference in characteristics between each calculation circuit 1 and 2, if one side calculated the asynchronous event and the other did not, it would be detected as a failure. .

For example, in the operation time chart shown in FIG.
(or timer signal ■) is the arithmetic circuit 1, 2
, the duplexed arithmetic circuits 1 and 2 generate the acceptance signal ■ with the same clock, and the duplexed arithmetic circuits 1 and 2, for example, the program counter ( PC) is
At the same clock timing, an interrupt entry address "8000" is generated, and from the generated address,
Starts interrupt processing execution (calculation) synchronously. Therefore, in this case, the duplexed arithmetic circuit 1,
2, no mismatch is detected.

However, in the operation time chart shown in FIG.
This shows a case where the clock occurs at almost the same timing as the clock for 2.

In this case, the duplicated arithmetic circuit 1,
2, due to variations in the operating characteristics of the circuits that accept the asynchronous signals (2) and (2), the acceptance signals (2) may be generated using different clocks.

Therefore, the duplicated arithmetic circuits 1 and 2
The program counter (PC) generates the interrupt entry address "8000" at different timings,
Execute the interrupt processing.

When the comparator circuit 5 compares the values of the program counters (PC) of the duplicated arithmetic circuits 1 and 2, a comparison error occurs in the above case, and the arithmetic processing unit detects the error. Recognized.

[0013] The above comparison targets are not particularly limited, and in addition to the program counter (PC),
For example, there are execution sequence circuits, operation results of the arithmetic unit (ALU), main registers, etc.

[0014]

[Problem to be Solved by the Invention] Therefore, for example, the above-mentioned interrupt signal (■) or timer signal (■) is supplied to each arithmetic circuit 1 and 2 as a common circuit, so that one of the asynchronous events as described above can be computed. However, there is a method that can be considered to prevent the other circuit from not performing operations, but this method has the problem that if a fault occurs in the common circuit, the fault cannot be detected. .

In view of the above-mentioned drawbacks of the conventional art, the present invention does not use a common circuit for generating an interrupt signal (2) or a timer signal (2), and moreover, one side calculates an asynchronous event while the other calculates an asynchronous event due to the difference in the characteristics of each calculation circuit. It is an object of this invention to provide a failure detection method that does not cause a failure even when no calculation is performed.

[0016]

[Means for Solving the Problems] FIG. 1 is a diagram showing the basic configuration of the present invention. The above problems are solved by a fault detection method configured as follows.

In an arithmetic device having duplex arithmetic circuits 1 and 2 and a comparison circuit 5 for comparing the duplex arithmetic circuits 1 and 2, each of the duplex arithmetic circuits 1 and 2 is clocked by an arbitrary clock. The duplexed arithmetic circuit 1 has an arithmetic step circuit 7 that increments by 1.
.
Or, stop the step of 2 and start the other arithmetic circuit 2,
1 by n clocks, and the arithmetic step circuit 7 stops the other arithmetic circuit 2, or 1 from advancing, and one arithmetic circuit 1, or 2 is set to m.
means for incrementing only the clock, and means for incrementing both arithmetic circuits 1 and 2 when a comparison circuit 5 for comparing the duplicated arithmetic circuits 1 and 2 detects a match; When a mismatch between the operations of the duplicated arithmetic circuits 1 and 2 is detected, stopping the progress of one of the duplicated arithmetic circuits 1 and 2;
On the other hand, step 2 or 1 by n clocks,
If the comparison circuit 5 detects a match during that time,
If the stoppage of the step of one of the above 1 or 2 is canceled and the comparison circuit 5 does not detect a match by the above operation, the step of the other 2 or 1 is stopped, and the step of the other 2 or 1 is stopped. The arithmetic circuit 1 or 2 is stepped by m clocks that are larger than the above n clocks, and if the comparison circuit detects a match during that time, the step of the other arithmetic circuit 2 or 1 is stopped. The configuration is such that only when the comparator circuit 5 does not detect a match in any of the above operations, the host device is notified of the mismatch.

[0018]

[Operation] In the fault detection method of the present invention, an asynchronous interrupt signal (■), a timer signal (■), etc. are input to a duplexed arithmetic circuit, and a comparison is made between, for example, a program counter (PC) of the duplexed arithmetic circuit. If a mismatch is detected, for example, the operation of the arithmetic circuit 1 is stopped, and the other arithmetic circuit 2 is made to step forward, for example, every clock.

Therefore, the program counter (PC) of the arithmetic circuit 1 has become the entry address "8000" for the asynchronous interrupt processing, but the arithmetic circuit 2 still has the entry address "8000" for the asynchronous interrupt processing. If not, the step operation described above causes the arithmetic circuit 2 to be set to the entry address "8000" for interrupt processing.
” and it will detect a match.

If the opposite is the case, that is, the program counter (PC) of the arithmetic circuit 2 has reached the entry address "8000" for the asynchronous interrupt processing, but the arithmetic circuit 1 still has the entry address "8000" for the asynchronous interrupt processing. If the address is not "8000", the above operation causes the program counter (
PC) will further lead, and no match will be detected.

Therefore, in the case of the present invention, a fixed number of clocks n
If a match cannot be obtained after incrementing by 1, the operation of arithmetic circuit 2 that was incremented is stopped, and arithmetic circuit 1 is changed to 1.
Step by step every clock.

However, at the time when the arithmetic circuit 1 is advanced by the n clocks, the timing relationship in which the initial mismatch has occurred has been established, and therefore no coincidence has yet been obtained. Therefore, in the present invention, the arithmetic circuit 1 side is n
By stepping forward by m clocks, which are more than the clock, in the case of an asynchronous event caused by the asynchronous signal (2) or (2), the program counters (PCs) of the arithmetic circuits 1 and 2, for example, can be brought into agreement.

Therefore, in the present invention, the asynchronous signal {the above-mentioned interrupt signal
, or the timer signal ■}, even if the operation of each arithmetic circuit becomes inconsistent, it will not be considered a failure.
In addition, it is possible to resynchronize and accurately detect failures.

[0024]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Examples of the present invention will be described below in detail with reference to the drawings. The above-mentioned FIG. 1 is a diagram showing the principle configuration of the present invention, and FIG. 2 is a diagram showing an embodiment of the present invention in the form of an operation time chart.

The present invention includes an arithmetic step circuit 7 that operates each of the duplex arithmetic circuits 1 and 2 by an arbitrary clock, and when a mismatch between the arithmetic circuits 1 and 2 is detected, one of the arithmetic circuits 1 , or 2, and the other arithmetic circuit 2, or 1 is stepped by n clocks, or the other arithmetic circuit 2, or 1 is incremented by n clocks.
Or, by stopping the operation of 1, one of the arithmetic circuits 1
, or 2 by m clocks greater than n, and when a match is detected by operating only one or the other of the arithmetic circuits 1 and 2,
A means necessary to carry out the present invention is a means for canceling the suspension of the arithmetic circuit on the halted side and recognizing that there is a failure in the arithmetic processing device when a mismatch is detected in any case. Note that the same reference numerals indicate the same objects throughout the figures.

Hereinafter, while referring to FIG. 1, according to FIG. 2,
A failure detection method according to the present invention will be explained. FIG. 1 is a diagram illustrating the principle of the present invention, and is a schematic diagram of an arithmetic processing device having dual arithmetic circuits 1 and 2. As shown in FIG.

In this figure, 1 and 2 are arithmetic circuits, 3 and 4
is an interrupt signal ■, or a timer signal ■ supply circuit,
5 is a comparison circuit that compares the duplicated arithmetic circuits based on clock timing, and if there is a mismatch, the arithmetic step circuit is
Notify 7. 7 is an arithmetic step circuit that can step the arithmetic circuits 1 and 2 by an arbitrary clock. In this embodiment, it is assumed that one instruction is executed in one clock, as explained in the conventional method shown in FIG.

When the comparison circuit 5 detects a mismatch,
As shown in the operation time chart of FIG. 2, the arithmetic step circuit 7 instructs the arithmetic circuit 2 (indicated by arithmetic circuit #2) to stop stepping, and also The circuit (indicated by #1) is instructed to advance by n clocks (for example, 2 clocks in this embodiment).

[0029] In this embodiment, due to the above operation,
The program counter (PC) #2 of the arithmetic circuit 2 has stopped at "200C", for example, and the program counter (PC) #2 of the arithmetic circuit 1 has stopped.
The program counter (PC) #1 is from interrupt entry address “8000” to “8002”, “8
004''.

[0030] While stepping by the n (=2) clocks,
When the comparison circuit 5 detects a match, the arithmetic step circuit 7 instructs the arithmetic circuit 2 to stop the step. If the comparator circuit 5 still detects a mismatch after incrementing by the n (=2) clocks, in the present invention, the arithmetic step circuit 7 increments the arithmetic circuit 1. to stop.

In this embodiment, as is clear from FIG. 2, the program counter (PC) #1 of the arithmetic circuit 1
stops at address "8004". Then, the arithmetic circuit 2, which has been in a stopped state, is instructed to advance by m clocks, which is greater than n clocks, and in this example, by only 3 clocks, for example.

While incrementing by the m (=3) clocks, the comparator circuit 5 detects a match {in this example, when the program counter (PC) indicates address "8004", the arithmetic circuit 1, 2 program counter (PC)
If the values of #1 and #2 match, then the arithmetic step circuit 7 instructs the arithmetic circuit 1 to cancel the step stop. Therefore, the arithmetic circuits 1 and 2 synchronously execute the asynchronous interrupt processing from address "8004" indicated by the program counter (PC).

If the comparator circuit 5 detects a mismatch even after incrementing by m (=3) clocks, it is recognized that there is a failure in the arithmetic processing unit, and the arithmetic increment circuit 7 Notify the higher-level device.

As described above, the present invention includes the arithmetic step circuit 7 that operates each of the duplex arithmetic circuits 1 and 2 by an arbitrary clock, and when a mismatch between the arithmetic circuits 1 and 2 is detected, one of the arithmetic circuits 1 and 2 is activated. The operation of the arithmetic circuit 1 or 2 is stopped and the other arithmetic circuit 2 or 1 is made to advance by n clocks, or the other arithmetic circuit 2 is stopped.
, or by stopping the operation of 1, one of the arithmetic circuits
1 or 2 by m clocks greater than n, and when a coincidence is detected by operating only one or the other of arithmetic circuits 1 and 2, the stop side The feature is that when the arithmetic circuit is stopped and a mismatch is detected in any case, it is recognized as a failure of the arithmetic processing device.

[0035]

As explained above in detail, the fault detection method of the present invention is an arithmetic step system that operates each of the duplexed arithmetic circuits by an arbitrary clock in an arithmetic processing device including duplexed arithmetic circuits. If a mismatch between the duplicated arithmetic circuits is detected, the operation of one arithmetic circuit is stopped and the other arithmetic circuit is advanced by n clocks, or the operation of the other arithmetic circuit is stopped. In the case where a means is provided for stopping one arithmetic circuit and incrementing one arithmetic circuit by m clocks greater than n, and a coincidence is detected by operating only one or the other of the duplicated arithmetic circuits, If the suspension of the arithmetic circuit on the stopped side is canceled and a mismatch is detected in any case, it is recognized as a failure of the arithmetic processing unit, so the asynchronous signal supplied to the redundant arithmetic circuit is (2) Even if the operation of each arithmetic circuit becomes inconsistent, it is not considered a failure, and synchronization can be reestablished. Only in the case of a true failure, the system notifies the higher-level device, so it is possible to accurately This provides the effect of enabling failure detection.

[Brief explanation of the drawing]

[Figure 1] Principle configuration diagram of the present invention

[Fig. 2] A diagram showing an embodiment of the present invention in the form of an operation time chart.

[Figure 3] Diagram explaining the conventional failure detection method (Part 1)

[Figure 4] Diagram explaining the conventional fault detection method (Part 2)

[Figure 5] Diagram explaining the conventional failure detection method (Part 3)

[Explanation of symbols]

1, 2 Arithmetic circuit 3, 4 Interrupt signal, timer signal supply circuit 5 Comparison circuit 7 Arithmetic step circuit■ Interrupt signal
■ Timer signal

Claims (1)

[Claims] [Claim 1] Duplicated arithmetic circuits (1, 2);
In an arithmetic device having a comparator circuit (5) for comparing the duplex arithmetic circuits (1, 2), an arithmetic increment step that advances each of the duplex arithmetic circuits (1, 2) by an arbitrary clock. If the comparator circuit (5) for comparing the duplicated arithmetic circuits (1, 2) detects a mismatch, the arithmetic step forward circuit (7) switches between the two arithmetic circuits (1, 2). 1, or 2), and means for incrementing the other arithmetic circuit (2, or 1) by n clocks; and the arithmetic step circuit (7).
stops the progress of the other arithmetic circuit (2 or 1),
means for incrementing one arithmetic circuit (1, or 2) by m clocks; and the duplex arithmetic circuit (1, 2).
A means is provided to advance both arithmetic circuits (1, 2) when a comparison circuit (5) for comparing the two arithmetic circuits (5) detects a match. When a mismatch is detected, one (1, or 2) of the duplexed arithmetic circuits (1, 2) stops advancing, and the other (2, or 1) advances by n clocks. If the comparator circuit (5) detects a match during that time, the stoppage of one of the steps (1 or 2) is released, and the above operation causes the comparator circuit (5) to detect a match. If not detected, the other (2, or 1) stops advancing, and one arithmetic circuit (1, or 2) advances by m clocks, which is greater than the above n clocks, and during that time If the comparison circuit detects a match, the stoppage of the other arithmetic circuit (2 or 1) is released, and in any of the above operations, the comparison circuit (5) detects a match. A fault detection method characterized by notifying a host device of the mismatch only when there is no discrepancy.