JPH06168151A - Duplex computer system - Google Patents

Abstract

PURPOSE:To execute error processing more surely by a CPU when noncoincidence occurs in the output of a duplexed CPU. CONSTITUTION:When a fault occurs in the operation of either a master CPU 21 or a slave CPU 22, the noncoincidence of CPU output is detected by a comparator 23. A reset signal is supplied to the master CPU 21 and the slave CPU 22. respectively replying to the noncoincidence of the CPU output, and the master CPU 21 and the slave CPU 22 are initialized in a specific state by the reset signal. As a result, a comparatively insignificant fault due to a power source noise, etc., can be easily restored by initialization. Also, the master CPU 21 and the slave CPU 22 can be operated again from the same state by the reset signal even when the run away of the CPU on one side occurs.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a duplicated computer system, and more particularly to a duplicated computer system having a master CPU and a slave CPU that execute the same processing.

[0002]

2. Description of the Related Art Generally, a computer system which requires high reliability employs a dual CPU configuration. A conventional typical system configuration of such a duplex system is shown in FIG.

As shown in FIG. 4, this system is provided with two CPUs, a master CPU 11 and a slave CPU 12. The master CPU 11 and the slave CPU 12 receive the input d from the system bus 14 and perform exactly the same operation. Then, only the output e of the master CPU 11 is output to the system bus 14.

Output of master CPU 11 and slave CPU
The outputs of 12 are always compared in operation clock units by the comparison circuit 13, and if they do not match, the comparison error signal b is turned on. In this case, the comparison error signal b is supplied to the non-maskable interrupt input of each of the master CPU 11 and the slave CPU 12. As a result, master C
The PU 11 and the slave CPU 12 start the same processing. Then, the comparison error is released and the system takes appropriate error handling.

However, when the CPU outputs do not match, the master CPU 11 and the slave CPU 12
Since either of them is operating abnormally, there is no guarantee that the non-maskable interrupt will be accepted normally. For this reason, for example, when the CPU is out of control, the comparison error signal continues to be turned on, and error processing cannot be performed.

Assuming that the cause of such a CPU output mismatch is an external factor such as external noise, it may adversely affect not only the CPU but also other logic. There is a possibility that the processing cannot be recovered only by software error processing.

[0007]

Conventionally, since the CPU output is notified of the inconsistency by the interrupt signal, there is a drawback that the interrupt signal is not accepted by the CPU depending on the occurred fault and the error processing cannot be normally executed. .

The present invention has been made in view of the above point, and when the CPU outputs do not match, the CPU can more reliably execute the error processing.
The purpose is to provide a redundant computer system.

[0009]

Means and Actions for Solving the Problems
The redundant computer system includes a master CPU and a slave CPU that execute the same processing, and these master CPUs.
And a comparison means for comparing outputs of the slave CPUs to detect a mismatch of the CPU outputs, and a reset for supplying a reset signal to the master CPU and the slave CPU in response to the mismatch of the CPU outputs detected by the comparison means. The master CPU and the slave CPU are configured to restart from the same state in response to the reset signal when a mismatch of the CPU outputs occurs.

In this dual computer system, when a failure occurs in the operation of either the master CPU or the slave CPU, the comparing means detects the mismatch of the CPU outputs. In response to the mismatch of the CPU outputs, a reset signal is supplied to each of the master CPU and the slave CPU, and the master CPU and the slave CPU are initialized to a specific determined state by the reset signal. Therefore, even when one of the CPUs is out of control, the master CPU and the slave CPUs can be restarted from the same state by the reset signal. Further, when a mismatch of CPU outputs is detected, an error flag is set. Therefore, by referring to that error flag in response to the reset signal,
It is possible to recognize whether the cause of the reset signal is due to the mismatch of the CPU outputs or the normal reset signal, and it is possible to cause the CPU to execute the error processing more reliably.

[0011]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 shows a second embodiment of the present invention.
The configuration of the redundant computer system is shown. This dual computer system is applied to a host computer and various other electronic devices that require high reliability. The dual computer system includes a master CPU 21, a slave CPU 22, a comparison circuit 23, and an OR. Gates 24, 25,
A comparison error flag 26, a peripheral LSI 27, and a system bus 28 are provided.

Master CPU 21 and slave CPU 2
2 are each realized by a microprocessor, and execute exactly the same processing according to an input e from the system bus 28. The operations of the master CPU 21 and the slave CPU 22 are executed in synchronization with the same clock CLK. The output f from the master CPU 21 is supplied to the system bus 28 for system operation control, data transfer, memory access, and the like, and also the comparison circuit 23.
Is supplied to.

On the other hand, the output of the slave CPU 22 is not supplied to the system bus 28 but only to the comparison circuit 23. In addition, the master CPU 21 and the slave CPU
22 is initialized to a predetermined state when it receives the corresponding reset signals b and c.

The comparison circuit 23 successively compares the outputs corresponding to the master CPU 21 and the slave CPU 22 at the timing of the clock CLK, and generates a "1" level comparison error signal a when a mismatch is detected. This comparison error signal a passes through the OR gates 24 and 25 and the reset signal b,
It is supplied to the slave CPU 22 and the master CPU 21 as c. The comparison error signal a is supplied to the comparison error flag register 26 as a comparison error flag set signal, and is also supplied to the peripheral LSI 27 as a signal for resetting the registers.

A reset signal d from the system bus 28 and a comparison error signal a from the comparison circuit 23 are input to the OR gate 24, and the output thereof is supplied to the slave CPU 22 as a CPU reset signal b. The reset signal d is
For example, it is generated when the power of the system is turned on or when a predetermined reset switch is turned on.

A reset signal d from the system bus 28 and a comparison error signal a from the comparison circuit 23 are input to the OR gate 25, and the output thereof is supplied to the master CPU 21 as a CPU reset signal b.

The comparison error flag register 26 is for holding the comparison error flag, and the comparison error flag is set to "1" in response to the comparison error signal a.
Further, the comparison error flag is reset to "0" in response to the reset signal d from the system bus 28.

The peripheral LSI 27 is a general term for peripheral circuits such as an I / O controller provided in this system, and corresponds to a reset signal d from the system bus 28 or a comparison error signal a from the comparison circuit 23. Are initialized. Command transfer between the peripheral LSI 27 and the master CPU 21 is performed by the input / output signal line h and the system bus 2.
8 is executed.

This duplicated computer system is basically configured to notify the comparison error by a hardware reset signal instead of the interrupt signal as in the prior art. With the hardware reset signal, the cognitive state can be restored even in a situation where the CPU is out of control. The overall operation will be described below.

After the power is turned on, the master CPU 21, the slave CPU 22, the comparison error flag register 26, and the peripheral LSI 27 are reset by the reset signal d. Similar to the conventional circuit, the master CPU 21 and the slave C
The PU 22 receives the input e from the system bus 28,
The same operation is performed for each operation clock CLK. Only the output f of the master CPU 21 is the system bus 28.
Has been output to.

Output of master CPU 21 and slave CPU
The output of 22 is constantly compared by the operation circuit CLK by the comparison circuit 23. If they do not match, the comparison error signal a
Turns on. This comparison error signal a is conventionally C
Although it was connected to the non-maskable interrupt input of the PU, in this embodiment, since it is supplied as a reset pulse signal to each CPU by the OR gates 24 and 25, even if the CPU operation is abnormal, State can be moved to error handling.

That is, when the master CPU 21 and the slave CPU 22 receive the reset signal, the master CPU 21 and the slave CPU 22 are initialized to predetermined states and restart from the same state.
The operations of the U21 and the slave CPU 22 are synchronized, and thereafter, the operations are normally continued.

Further, the comparison error signal a is input not only to the CPU but also to the other circuits 7, and it is possible to reset appropriate registers and return the system to the cognitive state. At the same time, the comparison error signal a sets a comparison error flag. After resetting, the master CPU 21 determines whether the immediately preceding reset is a normal reset such as power-on or the like or a reset due to a comparison error by checking this comparison error flag, and can perform appropriate error processing. it can.

FIG. 2 shows the master CPU 21 and the slave C.
An example of the connection relationship of the PU 22 is shown. here,
The case where the comparison circuit 23 is built in the slave CPU 22 is shown.

The core unit 211 of the master CPU 21 and the core unit 221 of the slave CPU 22 have the same structure, and the address output ADD from the core unit 211 is used.
R, data output DATAOUT, control signal output CONT
OUT is supplied to the system bus 28 and the comparison circuit 23 built in the slave CPU 22. Address output ADDR from core unit 221 of slave CPU 22, data output DATAOUT, control signal output C
ONTOUT is not supplied to the system bus 28, but is supplied only to the comparison circuit 23. Data input DATAIN and control signal input CONTI from the system bus 28
N is commonly supplied to the core units 211 and 221.

The comparison circuit 23 has the corresponding outputs from the core units 211 and 221, that is, the address output ADDR from the core unit 211 and the core unit 22.
1, address output ADDR, data output DATAOUT from core unit 211, data output DATAOUT from core unit 221, and core unit 2
The control signal output CONTOUT from 11 and the control signal output CONTOUT from the core unit 221 are compared with each other, and when a mismatch occurs in any of them, a comparison error signal a is output.

Here, in order to clarify the input / output relationship, the data output DATAOUT and the data input DATAI.
Although described separately for N, these are actually realized by a common bidirectional bus. Further, it is a matter of course that the control signal output CONTOUT includes various status signals. Next, the operation of the CPU when receiving the reset signal will be described with reference to the flowchart of FIG.

Master CPU 21 and slave CPU 2
A reset signal is commonly supplied to 2. In this case, the master CPU 21 and the slave CPU 22 execute the following operations in response to the reset.

That is, the master CPU 21 and the slave CPU 22 respectively check the comparison error flag and determine whether or not the comparison error flag is set to "1" (steps S21 and S22).

In this case, since the output of the slave CPU 22 is not actually output to the system bus 28, the reading of the comparison error flag is executed by the master CPU 21.

If the comparison error flag is not set to "1", the master CP is a normal reset and the master CP
The U21 and the slave CPU 22 each perform system startup processing (step S23).

On the other hand, when the comparison error flag is set to "1", the reset is caused by the comparison error signal a, so the master CPU 21 and the slave CPU 2
2 executes predetermined error processing (step S
24).

The error processing is for performing processing such as failure recovery and system stop. The master CPU 21 and the slave CPU 22 each first check whether re-execution is possible (step S241), and depending on the result. Recovery processing (step S242) or system stop processing including error notification to the system administrator (step S2)
Step 43) is performed. For the restoration process, various well-known forms such as a checkpoint start process and a CPU degeneration process can be used.

As described above, in the duplicated computer system of this embodiment, when a failure occurs in the operation of either the master CPU 21 or the slave CPU 22, the comparison circuit 23 detects the mismatch of the CPU outputs. In response to the mismatch of the CPU outputs, reset signals are supplied to the master CPU 21 and the slave CPU 22, respectively, and the master CPU 21 and the slave CPU 22 are initialized to a specific determined state by the reset signal. As a result, a relatively mild failure due to power supply noise or the like can be easily recovered by initial setting.

Further, even if one of the CPUs is out of control, the master CPU 21 and the slave CPU 22 can be restarted from the same state by the reset signal. Further, when a mismatch of CPU outputs is detected, an error flag is set. Therefore, by referring to the error flag in response to the reset signal, it is possible to recognize whether the cause of the reset signal is due to the mismatch of the CPU outputs or the normal reset signal, and the error processing can be performed to the CPU more reliably. Can be run.

Although the comparison error flag register 26 is provided outside in this embodiment, if there is a CPU internal register whose value does not change due to resetting, it is also possible to use it. Further, here, when the CPU comparison error occurs, the master CPU 21 and the slave CPU 22 are immediately reset, but normally, the non-maskable interrupt is applied, and the operations of the master CPU 21 and the slave CPU 22 are not synchronized with each other. , It is also possible to configure to reset for the first time. Further, error processing can be realized by a dedicated service processor.

Further, the comparison circuit 23 may not output a pulse signal, but may output a signal which becomes “1” when the CPU outputs do not match and outputs “0” when they match as the comparison error signal a. It is possible. In this case, the master CPU 21 and the slave CPU 22 stop all operations when the comparison error signal a is "1" (reset state). At this time, since the CPU outputs match, the comparison error signal a becomes "0", and the master CPU 21 and the slave CPU 22 are released from the reset state and restarted. In addition, the master CPU 21 and the slave CP
It is also possible to integrate U22 on the same chip and realize it as one microprocessor.

[0039]

As described above, according to the present invention, the CP
When a U output mismatch occurs, the CPU can be more surely caused to execute the error processing, and the duplication computer system having sufficiently high reliability can be realized.

[Brief description of drawings]

FIG. 1 is a block diagram showing the configuration of a dual computer system according to an embodiment of the present invention.

2 is a master C in the dual computer system of FIG.
The figure which shows the concrete connection relation of PU and slave CPU.

3 is a flowchart illustrating a CPU operation when a reset signal is received in the duplicated computer system of FIG.

FIG. 4 is a block diagram showing the configuration of a conventional dual computer system.

[Explanation of symbols]

21 ... Master CPU, 22 ... Slave CPU, 23 ... Comparison circuit, 26 ... Comparison error flag register, 27 ... Peripheral LSI.

Claims (2)

[Claims] 1. A master CPU that executes the same processing as each other
And a slave CPU, and comparing means for comparing the outputs of the master CPU and the slave CPU to detect a mismatch of the CPU outputs, and the master CPU and the slave in response to the mismatch of the CPU outputs detected by the comparing means. CPU
Reset means for supplying a reset signal to the master CP when the CPU outputs do not match.
A dual computer system, wherein the U and the slave CPU are configured to restart from the same state in response to the reset signal. 2. The dual computer system according to claim 1, further comprising a peripheral circuit which is initialized in response to a reset signal from said reset means.