JPH06131314A - Abnormality monitoring device for cpu - Google Patents

Abstract

PURPOSE:To prevent processing speed from being lowered and to reduce cost by asynchronously monitoring other central processing units(CPU) concerning the CPU abnormality monitoring device for performing fail safe processing in a multi-CPU system constituted by connecting plural CPU. CONSTITUTION:Plural CPU 11-13 are connected through tristate buffers 61-63. The CPU 11-13 judge the normality of signals generated from the other CPU while originally executing processing according to programs in ROM 41-43 and transmit abnormality detecting signal from output ports 71-73 when any abnormality is detected. When these signals are received, respective units U11-U13 turn the tristate buffers 61-63 and output ports 71-73 to high impedance states and disconnect the unit themselves from a circuit. The normal CPU performs the backup of processing to be executed by the abnormal CPU together with the original processing.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a central processing unit abnormality monitoring apparatus, and more particularly to a central processing unit abnormality monitoring apparatus for performing fail-safe processing in a multi central processing unit system in which a plurality of central processing units are connected.

[0002]

2. Description of the Related Art In recent years, a multi-CPU system in which a plurality of central processing units (CPUs) are connected to perform a plurality of processes simultaneously in parallel tends to be widely used due to a demand for improvement of functions in electric devices and the like. .

In such a multi-CPU system, a plurality of CPUs mutually utilize calculation results of other CPUs. Therefore, if an abnormality occurs in any of the CPUs and the abnormality is left untreated, the processing in the other CPUs is also affected. Therefore, in the multi-CPU system, when an abnormality occurs in each CPU, it is required to detect the abnormality and perform some kind of fail-safe processing.

Conventionally, proposals have been made for devices that meet such requirements, for example, Japanese Patent Laid-Open No. 60-1.
Japanese Patent No. 86902 discloses an apparatus for detecting an abnormality by synchronizing processes in two CPUs and monitoring signals transmitted from the other CPU.

That is, the two CPUs in the device described in the above publication are activated in synchronization with each other, and thereafter,
First, a predetermined signal indicating that the self is operating normally is transmitted. Then, when receiving a predetermined signal emitted from the other CPU, the other CPU determines that it is normal, and performs the processing to be executed by itself.

Further, when a predetermined signal is not received at a predetermined timing after the start-up, it is judged that an abnormality such as a runaway has occurred in the other CPU, and the CPU which seems to have occurred is temporarily reset. To do. Then, when the two CPUs are synchronized, the above-mentioned processing is repeated in each CPU.

As described above, according to the apparatus described in the above publication, when an abnormality occurs in each CPU constituting the multi-CPU system, the other CPU can detect the abnormality as soon as possible. Therefore, even if an abnormality occurs in one of the CPUs, the abnormality does not cause the entire system to run away.

[0008]

However, in order to detect the abnormality of the CPU in the above conventional apparatus, it is required that the two CPUs are synchronized. Therefore, in each CPU, in addition to the processing to be originally executed,
Is required, and the processing speed is reduced by the processing time and waiting time required for synchronization.

Further, in order to synchronize the processes in a plurality of CPUs, it is necessary to synchronize the clock timings of the respective CPUs with high reliability in addition to synchronizing the program start timing. Hardware such as a very complicated timing circuit and judgment circuit is required.

As described above, the above-mentioned conventional apparatus has the multi-C
There is a problem in that the processing speed in the PU system is remarkably reduced and complicated hardware is required, which causes an increase in cost.

The present invention has been made in view of the above points, and another C is provided for each CPU of the multi-CPU system.
It is an object of the present invention to provide a CPU abnormality monitoring device capable of preventing a decrease in processing speed and realizing it at low cost by providing a monitoring means for asynchronously monitoring the state of a PU.

[0012]

FIG. 1 shows a principle diagram of an abnormality monitoring device of a central processing unit for achieving the above object.

Central processing unit abnormality monitoring device 1 according to the present invention
Reference numeral 0 denotes a plurality of central processing units 1a to 1c constituting the multi-central processing unit system and each central processing unit 1a.
Monitoring means provided for each ~1c 2a~2c, circuit breaking means 3 a to 3 c, the backup unit 4 a to 4 c, and the communication line 5 connecting the unit U ₁ ~U ₃ around the central processor 1a~1c each other It is composed of

The monitoring means 2a to 2c are circuit breaking means 3a.
~3c and through the communication line 5 for monitoring the output signal of the central processing unit 1a~1c configuring other units U ₁ ~U _3. Then, based on the output signal, another unit U
₁ the central processing unit 1a~1c of ~U ₃ monitors whether functioning normally, when an abnormality is detected, the abnormality detection signal specifying which of the abnormality to the central processing unit 1a~1c has occurred Emit.

The circuit breaking means 3a to 3c are provided for each unit U.
Controls conduction between _{1 to} U ₃ and the communication line 5. That is, when the units U _{1 to} U _{3 to} which it belongs are normal,
The units U _{1 to} U ₃ and the communication line 5 are brought into conduction.
The monitoring means 2a~2c other units U ₁ ~U ₃
From When receiving an abnormality detection signal indicating that the abnormality in the central processing unit 1a~1c units U ₁ ~U ₃ which itself belongs is occurring, to block the unit U ₁ ~U ₃ which itself belongs and a communication line 5 .

The backup means 4a~4c, when the other units U ₁ ~U ₃ is disconnected from the communication line 5 through the respective circuit breaker means 3 a to 3 c, blocked central unit U ₁ ~U ₃ processor 1a~1c a should execute processing, then, to be executed by the normal CPU 1a~1c other units U ₁ ~U _3.

[0017]

In the central processing unit abnormality monitoring apparatus 10 having the above structure, each of the central processing units 1a to 1c independently executes the processing to be executed by itself. The calculation result in each of the central processing unit 1a~1c is supplied to the other units U ₁ ~U ₃ through the communication line 5.

The monitoring means 2a to 2c issue an abnormality detection signal when the signals supplied from the central processing units 1a to 1c of the other units U _{1 to} U ₃ are abnormal. This abnormality detection signal informs the other units U _{1 to} U ₃ of the unit in which the abnormality has occurred, and at the same time, the unit U to which it belongs.
Also ₁ ~U ₃ of the central processing unit 1 a to 1 c, informing the occurrence of an abnormality in the other units U ₁ ~U _3.

The circuit breakers 3a to 3c are communication lines 5
When an abnormality detection signal indicating that the units U _{1 to} U ₃ to which it belongs is abnormal is received via the unit, the units U _{1 to} U 3
_{Disconnect 3} from communication line 5. Therefore, thereafter, the units U _{1 to} U in which the central processing units 1a to 1c have shown an abnormality
₂ is disconnected from the multi-CPU system, it does not adversely affect the process in other normal units U ₁ ~U _3.

Further, the normal CPU 1 a to 1 c, suppressed with a backup unit 4 a to 4 c, the minimum is degraded as a whole system for processing backup is performed in the blocked unit U ₁ ~U ₃ To be done.

[0021]

FIG. 2 shows a central processing unit (CPU) according to the present invention.
3 is a circuit diagram of an embodiment of the abnormality monitoring device of FIG. The CPU abnormality monitoring device 20 of the present embodiment is applied to a multi-CPU system having three CPUs 11 to 13, and each CP
It is configured by connecting three units U _{11 to} U ₁₃ provided independently for each U to each other.

The configuration of each unit U _{11 to} U ₁₃ will be described below. The units U _{11 to} U ₁₃ are similar in configuration to each other, and therefore, the unit U ₁₁ is convenient for description.
I will explain mainly.

The unit U ₁₁ includes a CPU 11, a watchdog timer (WDT) 21, a read only memory (RO).
M) 31, a random access memory (RAM) 41, a decoder 51, a tri-state buffer 61, an output port 71, an input port 81, and a local bus 91 interconnecting these.

The WDT 21 monitors the output of the CPU 11, and if a predetermined signal is not output within a predetermined time, the CPU
It is a circuit that outputs a predetermined signal when it is determined that 11 has an abnormality. In the apparatus of this embodiment, as shown in FIG. 2, the output terminal of the WDT 21 (“low” output when an abnormality is detected)
Is connected to the reset terminal (reset by "low" input) of the CPU 11 via the 3-terminal OR gate 11a. Therefore, when the WDT 21 detects an abnormality, the reset signal is always supplied to the CPU 1.

The ROM 31 stores a program executed by the CPU 11 as shown in FIGS. The CPU 11 becomes a part of the multi-CPU system by executing the program stored in the ROM 31. Further, the CPU abnormality monitoring device 2 of this embodiment
At 0, the CPU 11 executes this program to realize the monitoring means 2a and the backup means 4a.

The output terminal of the decoder 51 is connected to the output enable (OE) terminal of the tri-state buffer 61 via a 2-terminal OR gate 61a.
The other input terminal of the OR gate 61a is connected to the output terminal of the three-terminal OR gate 11a with the inverter 61b interposed therebetween.

The tri-state buffer 61 is a low-active tri-state buffer, and when a "low" signal is supplied to the OE terminal, the local bus 91 and the shared bus 1 are connected.
00 is turned on and a "high" signal is supplied to the OE terminal, the output terminal is set to a high impedance state and the unit U ₁₁ is disconnected from the shared bus 100. Shared bus 1
00 is the tri-state buffers 61 to 63 in each of the units U _{11 to} U ₁₃ , the shared memory 110 and the shared input / output port (I / O port) commonly used by each unit.
It is a communication line that connects 111 to each other.

The output port 71 is a low active tristate port like the above-mentioned tristate buffer 61, and when a "high" signal is supplied to the OE terminal, the output terminal is held in a high impedance state. As a result, the stop (reset) signals 103 and 106 to the other CPUs 12 and 13 are transmitted to the NAND gates 12b and 13 respectively.
Separate from b. The OE terminal of the output port 71 is connected to the reset terminal of the CPU 11 via the inverter 71a.

The input port 81 is a 2-input input port.
Each terminal is the other unit U ₁₂, U₁₃CPU 1
Connect to reset terminals 2 and 13 (points B and C in Fig. 2)
Has been done. Each unit U₁₂, U₁₃Input port at
The CPUs 11 and 13 are connected to the ports 82 and 83, respectively.
Reset terminal (points A and C in FIG. 2) and CPU1
1 and 12 reset terminals (points A and B in Fig. 2) are connected
To be done.

Therefore, in any of the units U _{11 to} U ₁₃ constituting the CPU abnormality monitoring device 20, the CPU 11
When a reset signal is supplied to the reset terminals of ~ 13, it is possible to detect that the CPU is reset in another unit.

Further, the WDT 21 is connected to the 3-terminal AND gate 11a connected to the reset terminal of the CPU 11.
In addition to the output terminal of the reset switch 112, the output terminal of the reset switch 112 and the two-terminal NAND gate 11b are connected. The input terminals of the NAND gate 11b are respectively connected to the communication line 10
Output port 7 of units U ₁₂ , U ₁₃ via 1, 102
One of the output terminals of 2, 73 is connected.

Similarly, in the other units U ₁₂ and U ₁₃ , WDTs 22 and 23 are connected to the three-terminal AND gates 12a and 13a provided at the reset terminals of the CPUs 12 and 13, respectively.
In addition to the reset switch 112 and the NAND gate 12
a and 13a are connected, and the NAND gates 12a and 13 are connected.
At the input terminal of a, communication lines 103, 104 and 105,
The output port of another unit is connected via 106.

Next, the operation of the CPU abnormality monitoring device 20 will be described. Prior to that, each of the units U _{11 to} U will be described.
The configuration of the program executed by the CPUs 11 to ₁₃ in ₁₃ and the advantages in the development process of the CPU abnormality monitoring device 20 of this embodiment due to this will be described.

FIG. 3 shows the ROM 4 of each unit U ₁₁ -U ₁₃ .
The example of the content of the program stored in 1-43 is shown. Each of the CPUs 11 to 13 has a corresponding R
By executing the programs stored in the OMs 41 to 43, the original processing as a part of the multi-CPU system and the processing as a part of the CPU abnormality monitoring device are performed.

Therefore, the programs stored in the respective ROMs 41 to 43 are the programs (31a + 3) for the CPUs 11 to 13 to perform the original processing imposed on them.
1b to 33a + 33b) and backup means 4a to 4
A program (31a to 33) for performing processing as c
a) and programs (31c to 33c) for performing the processing as the monitoring means 2a to 2c.

In the program example shown in FIG. 3,
The programs for each CPU to perform the original processing are the minimum required programs 31b to 33b (1k bytes) and the programs 31a to 33a (63k bytes) that complement them and enable high-precision processing. ) And is configured separately. And this minimum required program 31
b to 33b are programs for backup means in units U _{11 to} U ₁₃ , which are different from each other.

In other words, the programs 31c to 33c for monitoring means are the only new programs comparing the CPU abnormality monitoring device 20 of this embodiment with the multi-CPU system having no abnormality monitoring function.

On the other hand, in the case of the conventional device which monitors a plurality of CPUs in synchronization with each other in synchronization with each other, a very complicated program is required. For example, two CPUs
In a device that synchronizes the two, first, a timing program as an operating system for operating both is required. Then, it is necessary to create a program for each CPU to perform necessary processing while monitoring each other in a format adapted to the timing program.

Therefore, when developing a program in the conventional apparatus, prior to the development of the program for the original processing, the communication method between the CPUs, what kind of state should be judged as abnormal, etc. should be thoroughly examined. There is a need to.
Usually, the timing program as described above is C
Since the number of PUs is limited to two for development, it is difficult to flexibly deal with the case where the number of CPUs incorporated in the system changes later.

On the other hand, the CPU abnormality monitoring device 20 of this embodiment
The new program in is only the monitoring means program as described above. Further, the monitoring means program has an independent relationship with the program for each CPU to perform the original processing. For this reason, as a development procedure, after sufficiently conducting test research for the original treatment,
An abnormality monitoring function equivalent to fail-safe can be considered, and the development man-hours can be significantly reduced compared to the conventional device.

Furthermore, since the monitoring means program is developed after the original processing has been thoroughly examined, it is possible to flexibly deal with the fluctuation of the number of CPUs used in the system. It also has an advantage that it is easy to clearly understand what state should be judged as abnormal.

The operation when each of the CPUs 11 to 13 executes the program shown in FIG. 3 will be described below.

Each of the CPUs 11 to 13 is a multi-C.
A program (31a + 31b to 33a +) for independently performing the original processing as the CPU configuring the PU system
33b) is executed. At this time, since the reset terminals of the CPUs 11 to 13 are held at "high" level, the output terminals of the inverters 61b to 63b become "low" level.

Therefore, the output levels of the decoders 51-53 appear at the output terminals of the OR gates 61a-63a as they are, and the tri-state buffers 61-63 make the CPU 1
As the programs 1 to 13 are executed, the state becomes the enable state or the high impedance state.

Next, when the monitoring means programs 31c to 33c are activated at a predetermined timing, each unit U ₁₁
Independently ~U every _13, to monitor the signal output from the other units U ₁₁ ~U _13. Then, for example, when a predetermined signal is not transmitted within a predetermined time, or when a plurality of units U ₁₁
If clearly abnormal logic signals from ~U ₁₃ is outputted, it is determined that the abnormality in their unit U ₁₁ ~U ₁₃ has occurred.

When no abnormality is detected during the execution of the monitoring means program, the original processing is again executed. When an abnormality is detected, the output ports 71 to 7
An abnormality detection signal is transmitted from 3 to the abnormal units U _{11 to} U ₁₃ .

For example, if the unit U ₁₁ is obviously abnormal, an abnormal signal is transmitted from the units U ₁₂ and U ₁₃ via the communication lines 101 and 102. Therefore, Nand Gate 1
The output terminal of 1b becomes "low" level, and the reset terminal of the CPU 11 is connected to the reset terminal of the CPU 11 through the 3-terminal AND gate 11a.
A "low" level reset signal is transmitted.

[0048] Further, abnormality occurs in the unit U _11, when the signal is inconsistent with the output signal of the unit U ₁₂ is transmitted, the abnormality detection signal is transmitted from the unit U _12, U13 the unit U ₁₁ At the same time, an abnormality detection signal from the unit U13 to the unit U12 is also transmitted. In this case, the output terminal of the NAND gate 11b of the unit U ₁₁ becomes “low” level as in the above case, but the output terminal of the NAND gate 12b of the unit U ₁₂ becomes “high”.
It remains at the level and the CPU 12 is not reset.

Thus, the CPU abnormality monitoring device of this embodiment is
The unit 20 is three units U₁₁~ U ₁₃By majority decision
Unit U₁₁~ U₁₃Is configured to detect abnormalities in
Can be detected with high accuracy.

As described above, the reset terminals of the CPUs 11 to 13 have the three-terminal AND gates 11a to 13a.
Via WDT 21-23, NAND gates 11b-13
The output terminal of b and the reset switch 112 are connected. Therefore, when any one of them becomes the "low" level, each of the CPUs 11 to 13 is reset.

By the way, one of the CPUs 11 to 13 is
3 terminal AND gates 11a to 13a for setting
When the output terminal goes to "low" level, the unit U₁₁
~ U ₁₃Inverters 61b-63b, 71a-7
The outputs of both 3a are inverted and become "high" level. Obey
And that unit U₁₁~ U₁₃In Tri-state
The OE terminals of the buffers 61 to 63 and the output port 81 are "H".
It will be fixed at "i" level.

Therefore, the tri-state buffer 6
1 to 63 and the output ports 71 to 73 are held in a high impedance state and are electrically disconnected from the CPU abnormality monitoring device 20. That is, the tri-state buffers 61 to 63 and the output ports 71 to 73 have a function as circuit breaking means in the CPU abnormality monitoring device 20 of this embodiment.

Further, as described above, the output terminals of the three-terminal AND gates 11a to 13a are different from each other in the unit U.
It is connected to an input port 81 to 83 of ₁₁ ~U _13. Each unit U ₁₁ ~U _13, When "low" level signal to one terminal of the input port 81 to 83 is supplied, error occurs in the unit U ₁₁ ~U ₁₃ whose terminal is considerable and to decide. Then, the backup of the processing to be executed by the units U _{11 to} U ₁₃ where the abnormality is considered to occur is started.

That is, if an abnormality occurs in the unit U ₁₁ , a reset signal to the CPU 11 is transmitted to the input ports 82 and 83, and each unit U ₁₂ and U ₁₃ is obliged to back up the processing of the unit U _11. . In the apparatus of the present embodiment, as shown in FIG. 3C, the ROM 33 of the unit U ₁₃ stores the minimum necessary program for the processing of the CPU 11, so that this backup is performed by the unit U _13. Become.

Therefore, after that, the CPU 13 has the program 33a + 33b of the processing which should be executed by itself.
In addition to the above, the program 31b to be executed by the CPU 11 is also executed. Therefore, it is possible to minimize the adverse effect of the unit U ₁₁ being cut off from the system.

Similarly, when the unit U ₁₂ is cut off, the unit U ₁₁ performs the backup processing, and when the unit U ₁₃ is cut off, the unit U ₁₂ performs the backup processing.

Thus, the CPU monitoring device 2 of this embodiment
According to 0, detection of an abnormality and backup processing for the abnormality that has occurred can be performed without synchronizing the operations of the CPUs 11 to 13. Therefore, the processing speed is remarkably improved as compared with the conventional device in which the respective CPUs need to be synchronized, and the hardware and software configurations of the device can be remarkably simplified.

FIG. 4 shows the ROMs 41 to 4 of the apparatus of the above embodiment.
3 shows another example of the contents of the program stored in 3. The same parts as those in FIG. 3 are designated by the same reference numerals and the description thereof will be omitted.

As shown in FIG. 4 (A), the ROM 41 has a program 1 for processing that the CPU 11 should originally execute.
31a (corresponding to 31a + 31b in FIG. 3) and CP
Simple program 13 for backup of U12 and U13
2b and 133b and a monitoring means program 31c are stored.

The simplified programs 132b and 133b for backing up the CPUs 12 and 13 are the programs 132a and 133a for the CPUs 12 and 13 stored in the ROMs 42 and 43, respectively (3 in FIG. 3).
2a + 32b, 33a + 33b) is a newly created simple program.

Similarly, a simplified program 131b for backing up the CPU 11 stored in the ROMs 42 and 43.
Is also a program newly created based on the program 131a stored in the ROM 41.

Therefore, the ROM 4 of each unit U _{11 to} U ₁₃
When the programs having the configurations shown in FIG. 4 are stored in 1 to 43, the program executed at the time of backup and the program executed at the normal time are programs created by completely different routes.

On the other hand, the causes of the abnormality in each of the units U _{11 to} U ₁₃ are the hardware cause due to overheating and the like.
It is considered to be a software cause caused by a program bug. Therefore, if the backup programs 31b to 33b and the program to be executed under normal conditions are created on the same route as shown in FIG. 3, when an abnormality occurs due to software, the backup process is performed. The same anomaly may occur.

However, in the program having the configuration shown in FIG. 4, the program executed at the normal time and the program executed at the backup time are created by different routes. Therefore, it is unlikely that the programs 131a to 133a for normal times and the programs 131b to 133b for backup of the units U _{11 to} U ₁₃ contain the same bug.

Therefore, if the program configuration used for the CPU abnormality monitoring device 20 is configured as shown in FIG. 4, the development man-hour is extra compared to the case of using the program of the configuration shown in FIG. It is possible to secure a higher level of reliability as a CPU system.

[0066]

As described above, according to the present invention, an abnormality occurring in any one of the central processing units can be detected promptly without synchronizing the operations of the central processing units constituting the multi-central processing unit system. You can Therefore, the processing speed is remarkably improved as compared with the conventional device which requires the synchronization of each central processing unit, and it can be realized at a low cost due to the epoch-making simplification of the hardware and software configurations of the device. Become.

When an abnormality occurs in any of the central processing units, the unit to which the central processing unit belongs is disconnected from the multi-central processing unit system and the backup processing is performed by another central processing unit.
The adverse effects of the occurrence of anomalies are minimized, and the system as a whole has the feature that high-precision processing can always be executed.

[Brief description of drawings]

FIG. 1 is a principle diagram of an abnormality monitoring device of a central processing unit according to the present invention.

FIG. 2 is a circuit diagram of an embodiment of an abnormality monitoring device of a central processing unit according to the present invention.

FIG. 3 is one of contents of a program used in the apparatus of this embodiment.
It is a figure showing an example.

FIG. 4 is a diagram showing another example of the contents of a program used in the device of this embodiment.

[Explanation of symbols]

1a-1c, 11-13 Central processing unit (CPU) 2a-2c Monitoring means 3a-3c Circuit breaking means 4a-4c Backup means 5, 101-106 Communication lines 11a, 12a, 13a 3 terminal and gate 11b, 12b, 13b NAND gates 21, 22, 23 Watchdog timer (WDT) 31, 32, 33 Read only memory (ROM) 41, 42, 43 Read only memory (ROM) 51, 52, 53 Decoder 61, 62, 63 Tri-state buffer 61a, 62a, 63a gate 71, 72, 73 output ports 81, 82 and 83 input ports 100 shared bus _{U 1 ~U 3, U 11 ~U} 13 units

Claims (1)

[Claims] 1. A central processing unit abnormality monitoring device for monitoring an abnormality of each central processing unit in a multi-central processing unit system configured by connecting a plurality of central processing units via communication lines, wherein each central processing unit Is installed in the central processing unit for monitoring whether or not the other central processing unit is functioning normally based on the signal supplied from the other central processing unit. An abnormality occurs in the central processing unit which is provided corresponding to each of the central processing units and which is provided with a monitoring unit that emits an abnormality detection signal that identifies the unit and the monitoring unit that is provided corresponding to another central processing unit. When an abnormality detection signal indicating that the central processing unit and the communication line are received, a circuit breaking unit that cuts off between the central processing unit and the communication line and between the monitoring unit and the communication line, A central processing unit, which is provided with a backup unit provided in advance for each central processing unit so that another normal central processing unit can execute the processing to be executed by the central processing unit that is cut off from the communication line. Abnormality monitoring device for processing equipment.