JPH0630070B2 - Redundant control system - Google Patents

Description

The present invention relates to a duplex control having two processor units that share an input / output device and a duplex control unit that monitors and controls the operation of these two processor units. More specifically, the present invention relates to a duplex control system using a first-in first-out memory (FIFO) as a means for equalizing the contents of memories in two processor units.

(Prior Art) Conventionally, as one technique for improving the reliability of a control device, two processor units are provided, and their operations are monitored, and which side is engaged in actual work and which side is in a standby state. There is a redundant system provided with a redundant control system for controlling or controlling.

In such a system, in order to maintain the continuity of the actual work, it is necessary to match the contents of the memories in the two processor units, and as a value equalizing means therefor, there has been one using a FIFO conventionally. .

In this case, data from the memory in the processor unit on the actual work side is written to the FIFO by a write operation from the processor unit on the actual work side, and its contents are read by a read operation from the processor on the standby side. And is written in the memory in the processor unit on the standby side.

(Problems to be Solved by the Invention) By the way, as a memory content equalization means,
When a FIFO is used, if the memory content once stored in the FIFO is destroyed by the runaway of the processor unit on the actual work side, such as a program runaway, it will be handed over to the standby side as it is, and it will collapse together. A problem occurs.

The present invention has been made in view of the above circumstances, and an object thereof is to monitor read / write access from the actual work side and read / write access from the standby side to the FIFO to detect prohibited access. Is to realize the duplex control system which can prohibit the operation of the FIFO and protect the contents thereof to improve the system reliability.

(Means for Solving the Problems) FIG. 1 is a block diagram showing the basic configuration of the present invention. In the figure, PC1 and PC2 are two processor units, and DXC is these two processor units PC.
First, a first-in first-out memory that monitors the operation of the PC2 and controls which side is used for actual work and which side is used for the standby side, and equalizes the contents of the memory in the two processor units. (FIFO)
2 is a redundant control unit including 1.

The FIFO 1 receives the memory contents (data) from the processor unit side in actual work, writes (stores) the data based on the shift-in signal SI, and stores the data on the standby side in the processor unit side. The data stored therein is read out toward the memory based on the shift-out signal SO.

In the redundant control unit, 2 is a FIFO for controlling shift-in SI and shift-out SO of the FIFO1.
It is a control means.

(Operation) The FIFO control means 2 has two processor units PC
1, the read / write signal WRI output from the PC2 and the duplex control unit DXC, the control declaration signal CTL, and the duplex control signal DCS are input, and the shift-in SI and the shift-out SO are controlled by the logic of each of these signals. To do. This prohibits access to the FIFO and protects it except when necessary.

Embodiments Embodiments of the present invention will be described in detail below with reference to the drawings.

FIG. 2 is a configuration block diagram showing an embodiment of the present invention. In the figure, the same parts as those in FIG. 1 are designated by the same reference numerals. Each of the processor units PC1 and PC2 has a processor CPU and a main memory MMU. In the duplex control unit DXC, reference numeral 3 is a monitoring means for monitoring the signals RDY1 and RDY2 indicating the operating state output from each processor unit and determining which processor unit is given the control right. Duplex control signals DCS _L and DCS _R indicating which side the right is to be output.

The FIFO control means 2 uses the duplication control signal DCS _L ,
DCS _R , the read / write signals WRI _L and WRI _R from the two processor units PC1 and PC2, and the control declaration signals CTL _L and CTL _R are input respectively, and FIF is input.
The shift-in SI and shift-out SO of O1 are controlled according to the following logical expressions.

SI = WRI _L・ CTL _L・ DCS _L + WRI _R・ CTL _R・ DCS _R SO = ▲ ▼ _L・ ▲ ▼ _L + ▲ ▼ _R・ ▲ ▼ _R However, WRI is a read / write signal from the outside. CTL is a control declaration signal and the DCS asserted by the unit performing the actual work is duplicated (the subscript _L of each signal indicates the left processor unit, _R indicates the right processor unit) With the control signal, the duplex control unit asserts the DCS of the unit to which the control right is to be given.
Shift-in SI and shift-out SO are controlled only when the above-mentioned logical expression from the FIFO control means 2 is followed, and the data in the FIFO1 can be written and read out, and otherwise, to the FIFO1. Access is prohibited and data can be protected.

In the above embodiment, it is assumed that the access is made from two processor units, but the duplex control unit DXC may be made accessible.

(Effects of the Invention) As described in detail above, according to the present invention, in a system using a FIFO as an equalization means, FIFO access can be performed only when a predetermined logical expression is satisfied. The protection of the FIFO access can be improved, and a highly reliable duplex control system can be provided.

Further, in the present invention, in particular, the control of the shift-out signal SO given to the FIFO1 (condition of data reading from the FIFO) is performed by the read / write signal WRI and the control declaration signal CTL, that is, the shift-in signal. The control of the signal SI (condition for writing data into the FIFO) is performed by the read / write signal WRI, the control declaration signal CTL, and the duplex control signal DCS, while the shift
The out signal SO has a great feature in that the duplication control signal DCS is intentionally excluded.

Further, according to the present invention which is characterized in such a point, when a failure occurs in one of the processor units and the actual work is switched to the other processor unit, the other processor unit outputs the duplex control signal DCS. All data stored in the FIFO can be read immediately without being affected by assertion (on).

This means that the FIFO stores data up to immediately before one of the processor units is operating normally and the control right is switched, and this also includes information on how far control was normally executed. Therefore, the other processor unit newly entering the actual work can accurately determine from which point the control operation should be taken over, effectively maintaining the continuity of the control. It has a special effect of being able to do.

By the way, when the duplexing control signal DCS is added to the condition of the shift-out signal SO, the other processor which has been in the waiting state before reading all the data stored in the FIFO. In some cases, the unit may enter a control operation, in which case the control operation already performed before one processor unit is switched is repeated in the other processor unit (that is, the previously performed operation is performed again). This will result in deterioration of controllability.

[Brief description of drawings]

FIG. 1 is a basic configuration block diagram of the present invention, and FIG. 2 is a configuration block diagram showing an embodiment of the present invention. PC1, PC2 ... Processor unit DXC ... Duplication control unit 1 ... FIFO 2 ... FIFO control means 3 ... Monitoring means

Claims (1)

[Claims] 1. A duplex control system having two processor units and a duplex control unit for monitoring operations of the two processor units and controlling which side is used for actual work and which side is a standby side. The memory content (data) is input to the redundant control unit from the processor unit side that is actually working, and the memory content is stored based on the shift-in signal SI. A first-in first-out memory (FIFO) whose contents stored in the memory are read out based on a shift-out signal SO, and a shift-in signal SI and a shift-in signal supplied to the FIFO.
A duplex control system comprising: a FIFO control means for controlling the out signal SO according to each of the following logical expressions. SI = WRI _L・ CTL _L・ DCS _L + WRI _R・ CTL _R・ DCS _R SO = ▲ ▼ _L・ ▲ ▼ _L + ▲ ▼ _R・ ▲ ▼ _R However, WRI is an external read / write signal,
It is asserted at the time of writing (subscript _L of each signal indicates from the left processor unit, _R indicates from the right processor unit). CTL is a control declaration signal and is asserted by the unit that is actually performing the work. DCS is a duplication control signal, and the duplication control unit asserts the DCS of the unit to which the control right is to be given.