JPH07168731A - Electronic computer - Google Patents

Abstract

PURPOSE:To improve reliability by continuing the inspection and repair of a program without interrupting a mission by executing the program on a RAM together with the program on a ROM, inspecting the program on the RAM of the program on the RAM while comparing it with that of the other system by a computer circuit after the execution, and repairing the program when there is any abnormality. CONSTITUTION:This electronic computer is provided with triple systems of (a), (b) and (c). When a comparator circuit 9 judges that the system (a) is abnormal, a transfer circuit program data transmission/reception program 12b stored in a ROM 2b of the normal system (b) transmits a part of a program 7b stored in a RAM 3b of its own system (b) equal with a part of a loaded program 7a of a RAM 3a of the system (a) and the data in a data area 6b to a transfer circuit 8. Then, a transfer circuit program data transmission/reception program 12a stored in the ROM 2a of the system (a) rewrites a part of the program 7a stored in the RAM 3a and the data of a data area 6a with a part of the loaded normal program 7b received from the transfer circuit 8 and the data in the data area 6b.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a computer installed in an environment where there is a risk of radiation exposure, such as an artificial satellite, a space shuttle, a space station, etc.

[0002]

2. Description of the Related Art Conventional electronic computers of this type are roughly classified into two types. FIG. 3 shows a first conventional computer.
FIG. 2 is a diagram showing a typical configuration of an electronic computer mainly composed of a readable / writable memory of the type: 1 is a central processing unit (hereinafter abbreviated as CPU), 2 is a read only memory (hereinafter abbreviated as ROM), 3 Is a readable / writable memory (hereinafter R
AM is abbreviated. 4 is a bus (consisting of a data bus, an address bus, and a control bus), 5 is a mounted program stored in a RAM and a part of ROM, 6 is a data area (including a stack area) on the RAM, 13 is a space area on the RAM. Although not shown in the figure, I /
An O interface, a power supply, a clock, a DMA controller, an interrupt processing circuit, a safety circuit, etc. are often added, but they are omitted here because they are not directly related to the present invention.

FIG. 4 is a diagram showing a typical configuration of a second type of conventional electronic computer, which is a computer mainly composed of a read-only memory, in which 1 is a CPU, 2 is a ROM,
Reference numeral 3 is a RAM, 4 is a bus, 5 is a mounted program stored in a ROM, 6 is a data area (including a stack area) on the RAM, and 13 is a space area on the RAM.

Next, the operation of these electronic computers will be described. The on-board programs stored in the ROM 2 or the RAM 3 are sequentially read by the CPU 1 via the bus 4, decoded, processed, and fulfill various functions such as input / output data processing, control calculation, failure detection, etc. required by the electronic computer. . At this time, the data area 6 on the RAM is the CPU 1 as a storage place for variable parameters and temporary data and a stack saving place.
Used as appropriate under the control of.

[0005]

The first type of conventional computer, which is a computer mainly composed of RAM, rewrites an on-orbit program stored in the RAM on orbit or a spare area by a command from a ground station. Use it to patch the onboard programs. So-called on-orbit reprogramming was possible. Therefore, it is possible to flexibly deal with the case where the installed program is changed, such as a program change or addition due to an unexpected trouble occurrence on the orbit and a program change or addition due to a change in mission request. However, although it is possible to reprogram in orbit, it takes time to create and verify the reprogram on the ground when performing it, and it is possible to promptly respond to program changes and additions due to unexpected malfunctions in orbit. No, it could not contribute to improving the reliability of time-critical missions. In addition, most of the semiconductor elements currently used as RAM for space use have a weak defense against radiation and have a drawback that a bit status is inverted in orbit, which is a so-called single event error. .

On the other hand, in the second type of ROM-based electronic computer, the energy level required for bit inversion of the ROM is much higher than that of the RAM, so that a single event error due to radiation does not pose a problem and is reliable in this respect. The feature is that it is highly functional. However, the installed programs are all R
Since it is written in the OM, reprogramming in orbit is generally impossible, and it is not possible to flexibly respond to program changes and additions due to unexpected malfunctions in orbits and program changes and additions due to changes in mission requirements. There was a drawback. In addition, there is a drawback in that it is not possible to flexibly respond to changes and additions of programs for improving the efficiency of tests in actual equipment tests even on the ground.

The present invention has been made to solve the above-mentioned problems in the conventional electronic computer.
It has both high radiation reliability of the M-based computer and system flexibility due to the RAM orbital reprogramming function of the RAM-based computer, and minimizes the deterioration of system reliability for time-critical missions. The purpose is to obtain an electronic computer that can be kept to the limit.

[0008]

An electronic computer according to the present invention comprises a central processing unit, a transfer circuit, a program for transmitting / receiving a program and data on a RAM, and a program for transmitting data for abnormality determination to a comparison circuit. Triple or more systems including a written ROM, a RAM capable of writing the programs and data, and a transfer circuit for transferring the programs and data between the RAMs of the respective systems, and output from the respective systems It is provided with a comparison circuit for comparing and judging data and outputting a command for transferring a program of a normal system to an abnormal system to two systems.

[0009]

In the electronic computer according to the present invention, the on-board program on the RAM is combined with the on-board program on the ROM to execute,
After execution, the loaded program on the RAM is compared and inspected by the comparison circuit, and if there is an abnormality, the program and data equivalent to the program having the abnormality from the other system are copied and restored. After that, the installed program on the partially replaced RAM is used, and if there is a further abnormality, the inspection and repair are similarly executed. This enables a highly reliable system that can continue inspection and repair of programs without interruption of mission.

[0010]

【Example】

Example 1. An embodiment of the present invention will be described below with reference to FIGS. FIG. 1 is a block diagram of an electronic computer according to the present invention, which will be described with reference to this figure. For the sake of explanation, the system is a triple system of a, b and c. The loaded program 5a stored in the first ROM 2a and the loaded program 7a stored in the first RAM 3a are sequentially read out via the first bus 4a and decoded and processed by the first CPU 1a. First
The data area 6a of the RAM 3a is used as a storage area for variable parameters and intermediate data, a stack area, etc. under the control of the first CPU 1a. The second and third systems operate similarly. On-board programs 5a, 5 for each system
b, 5c and 7a, 7b, 7c are simultaneously activated by interrupts such as a real-time clock and execute independently.

The on-board program 5a stored in the first ROM 2a is activated by an interrupt such as a real-time clock, and the initialization / input / output processing program 10a is first executed. After that, the execution is transferred to the on-board program 7a stored in the first RAM 3a to perform application calculation such as control calculation. After the loading program 7a stored in the first RAM 3a is completed, the comparison circuit data transmission program 11a stored in the first ROM 2a is executed and stored in the comparison circuit 9 in the data area 6a of the first RAM 3a. The data of the calculation result of the installed program 7a stored in the first RAM 3a is transmitted, and the comparison circuit 9 waits for the determination. The second and third systems operate similarly. The comparison circuit 9, after receiving all the data of the calculation results of the installed programs 7a, 7b, 7c, makes the comparison judgment. First RO
The transfer circuit program / data transmission / reception program 12a stored in the M2a is terminated if the result of the comparison judgment of the comparison circuit 9 is normal in the entire system, whereby the installed program 5a stored in the first ROM 2a and the first RAM 3a. One execution cycle of the on-board program 7a stored in is ended. The second and third systems operate similarly.

When it is determined by the comparison circuit 9 that a certain system is abnormal, the transfer circuits 8 of the normal system and the abnormal system, which are arbitrarily selected, are ready for transfer. For the sake of explanation, it is assumed that the system a is abnormal and b and c are normal. The transfer circuit program / data transmission / reception program 12b stored in the arbitrarily selected second ROM 2b of the normal system is equivalent to a part of the installed program 7a stored in the first RAM 3a determined to be the abnormal system. Part of the installed program 7b and the data area 6 stored in the second RAM 3b of the own system
The data of b is transmitted to the transfer circuit 8, and the process ends. The transfer circuit program / data transmission / reception program 12a stored in the first ROM 2a of the abnormal system transfers a part of the installed program 7a and the data in the data area 6a stored in the first RAM 3a which is determined to be abnormal. 8 is rewritten with a part of the mounted program 7b stored in the second RAM 3b of the normal system and the data in the data area 6b, and the processing is completed.

FIG. 2 is a flow chart of processing of the electronic computer according to the present invention, which will be described in detail with reference to this figure. For the sake of explanation, the system is a triple system of a, b and c. The loaded programs 5a, 5b and 5c stored in the ROMs 2a, 2b and 2c of the respective systems are simultaneously activated by an interrupt such as a real time clock. Explaining one system, first, the initialization / input / output processing 21 is executed. After that, the execution is transferred to the first module 14a of the installed program 7a stored in the RAM 3a, and the arrow 22 40, the module 15a, and the module 16a are sequentially executed. RAM3a
After completion of all the modules of the installed program 7a stored in the ROM, the installed program 5a stored in the ROM 2a
Execution returns to arrow 41. To the comparison circuit 9, the module 14a and the module 1 of the installed program 7a stored in the RAM 3a stored in the data area 6a of the RAM 3a.
5a and the data of the calculation results of the module 16a are transmitted, and the comparison circuit 9 waits for judgment 24. ROM of other system
Installed programs 5b and 5c stored in 2b and 2c and installed programs 7b and 7 stored in RAMs 3b and 3c.
Execution is performed in the same manner for c.

The comparator circuit 9 is independently executed in each system stored in the data areas 6a, 6b and 6c of the RAMs 3a, 3b and 3c.
Modules 14a, 15a, 16a of the installed programs 7a, 7b and 7c stored in
Module 14b, module 15b, module 16
After receiving all the data of the calculation results of b, the module 14c, the module 15c and the module 16c, the comparison judgment is started 30. It is judged 32 whether or not the calculation results of the same type modules (for example, the module 14a, the module 14b, and the module 14c) of the respective systems are the same.
Then, 31 comparison judgments are repeated for all modules of the same type in each system. If the calculation results of all modules are the same, it is determined that the whole system is normal 33, and the process ends.

When the judgment of the comparison circuit 9 is decided, the ROM 2
The on-board program 5a stored in a terminates the judgment waiting 24 of the comparison circuit 9 and resumes execution. If the result of the comparison judgment of the comparison circuit 9 is normal for the entire system, the process ends 29, whereby the installed program 7 stored in the RAM 3b and the RAM 3a.
One execution cycle of a is completed. ROM2 of other system
Onboard programs 5b, 5c and R stored in b, 2c
Installed programs 7b and 7c stored in AM3b and 3c
In the same manner, one execution cycle is finished.

Next, the case where the comparison circuit 9 determines that there is an abnormality will be described. If the calculation result of one module is also different from other multiple systems, the system of the module with the different calculation result is judged as the own system abnormality, and any system of the multiple systems with the same calculation result requests the normal transmission of the own system. It is determined 35 that there is a request for normal transmission of the own system and that of the remaining system does not exist. For the sake of explanation, for example, the module 15a is the self-system abnormality, the module 15
It is assumed that it is determined that b is the own system normal transmission request and that the module 15c is not the own system normal transmission request. The transfer circuit 8 of the RAM 3a in which the abnormal module 15a is written and the transfer circuit 8 of the RAM 3b in which the normal module 15b is written are set to the ready state 36. An arrow 44 to which the message of the own system abnormal reception request and the information of the module 15a to be rewritten are transmitted 37 to the installed program 7a stored in the RAM 3a. Further, a message requesting normal transmission of own system and information of the module 15b to be transmitted are transmitted 38 to the installed program 7b stored in the RAM 3b, and the arrow 4 indicates
5 and end 39.

When the judgment of the comparison circuit 9 is decided, the ROM 2
The on-board program 5b stored in b terminates the judgment waiting 24 of the comparison circuit 9 and resumes execution. When the result of the comparison judgment of the comparison circuit 9 indicates that the own system normal request is present, the program of the module 15b stored in the RAM 3b is transmitted 27 to the transfer circuit. In addition, the data 6b stored in the RAM 3b is transmitted 28 to the transfer circuit, and the processing ends 29.

When the comparison circuit 9 makes a decision, R
The on-board program 5a stored in the OM 2a also has a comparison circuit 9
The judgment waiting 24 is ended and the execution is restarted. Comparison circuit 9
If the result of the comparison judgment of is the own system abnormal reception request, R
The program of the module 15b stored in the AM 3b is received from the transfer circuit, and the module 15a stored in the RAM 3a is rewritten 25. Further, the data 6b stored in the RAM 3b is received from the transfer circuit, and RA
The data 6a stored in M3a is rewritten 26, and the process ends 29.

Example 2. Another embodiment will be described.
First ROM by interrupts such as real-time clock
The on-board program 5a stored in 2a is activated and first executes the initialization / input / output processing program 10a. After that, the execution is transferred to the on-board program 7a stored in the first RAM 3a to perform application calculation such as control calculation. The installed program 7a stored in the first RAM 3a
After the above, the comparison circuit data transmission program 11a stored in the first ROM 2a is executed, the data of the processing time of the on-board program 7a is transmitted to the comparison circuit 9, and the comparison circuit 9 waits for the determination. The second and third systems operate similarly. The comparison circuit 9 receives all the processing time data of the on-board programs 7a, 7b, 7c executed independently in each system, and then makes a comparison judgment for the appropriate range.

Example 3. Another embodiment will be described.
First ROM by interrupts such as real-time clock
The on-board program 5a stored in 2a is activated and first executes the initialization / input / output processing program 10a. After that, the execution is transferred to the on-board program 7a stored in the first RAM 3a to perform application calculation such as control calculation. The installed program 7a stored in the first RAM 3a
After the above, the comparison circuit data transmission program 11a stored in the first ROM 2a is executed, the history data of the execution path of the on-board program 7a is transmitted to the comparison circuit 9, and the comparison circuit 9 waits for the determination. The second and third systems operate similarly. The comparison circuit 9 receives all the history data of the execution paths of the on-board programs 7a, 7b, and 7c executed independently in each system, and then makes a comparison / judgment for the appropriate path.

Example 4. Another embodiment will be described.
First ROM by interrupts such as real-time clock
The on-board program 5a stored in 2a is activated and first executes the initialization / input / output processing program 10a. After that, the execution is transferred to the on-board program 7a stored in the first RAM 3a to perform application calculation such as control calculation. The installed program 7a stored in the first RAM 3a
After the above, the comparison circuit data transmission program 11a stored in the first ROM 2a is executed, the program sum check data of the on-board program 7a itself is transmitted to the comparison circuit 9, and the comparison circuit 9 waits for the determination. The second and third systems operate similarly. The comparator circuit 9 receives all the program sum check data of the on-board programs 7a, 7b, and 7c executed independently in each system, and then makes a comparison judgment with respect to the appropriate value.

[0022]

As described above, according to the present invention, the RAM is
The on-board program above is combined and executed with the on-board program on the ROM. After the on-board program on the RAM is executed, it is compared and inspected by the comparison circuit, and if there is an abnormality, it is equivalent to the program with the abnormality from the other system. Programs and data can be copied and repaired. Even after the abnormality is detected, the system does not degenerate (it does not stop as a system), and the installed program on the partially replaced RAM is used. It is possible to carry out. Therefore, even in a time-critical mission, there is an effect that it is possible to obtain a highly reliable system capable of sustaining program inspection and repair without interruption. Also, since it is a RAM-based computer, it is possible to perform so-called on-orbit reprogramming, such as applying a patch to the installed program stored in RAM, and changing or adding programs due to changes in mission requirements, etc. This has the effect of being able to deal flexibly when changing.

Further, the data to be compared is not the calculation result of the on-board program but the comparison circuit that uses the processing time of the on-board program, the history of the execution path, or the sum check of the program itself as the data to be compared. The amount is reduced (one for each module of the program) and the processing time of the comparison circuit is reduced. Therefore, the processing performance of the computer as a whole is improved.

[Brief description of drawings]

FIG. 1 is a configuration diagram showing an electronic computer according to an embodiment of the present invention.

FIG. 2 is a flowchart showing details of the operation of the electronic computer according to the embodiment of the present invention.

FIG. 3 is a configuration diagram of a conventional RAM-based electronic computer.

FIG. 4 is a configuration diagram of a conventional ROM-based electronic computer.

[Explanation of symbols]

 1 CPU 2 ROM 3 RAM 4 Bus 5 ROM on-board program 6 Data area 7 RAM on-board program 8 Transfer circuit 9 Comparison circuit 10 Initialization / I / O program 11 Comparison circuit data transmission program 12 Transfer circuit program / data transmission / reception program 13 space areas

Claims (4)

[Claims] 1. Three or more central processing units for independently processing data, three or more read-only memories for writing data in advance and storing it, and three for temporarily writing data and storing it The read / write memory described above, the transfer circuit for transferring data between each of the three or more read / write memories, and the appropriateness of the operation result of the program independently executed by each of the three or more central processing units are determined. In a computer configured by one data comparison circuit, a first area in which each of the three or more read-only memories can write a program for transmitting / receiving a program and data to / from the transfer circuit And a second area in which a program for transmitting data to the comparison circuit can be written, while the above three units are provided. Each of the above readable and writable memories has a first area for writing a program transmitted / received to / from the transfer circuit and a second area for writing data transmitted / received to / from the transfer circuit. Characteristic electronic calculator. 2. Three or more central processing units for independently processing data, three or more read-only memories for writing data in advance and storing it, and three for temporarily writing data and storing it. The read / write memory described above, the transfer circuit for transferring data between each of the three or more read / write memories, and the appropriateness of the processing time of the program independently executed in each of the three or more central processing units are determined. In a computer configured by one time comparison circuit, a first area in which a program for transmitting and receiving a program and data to and from the transfer circuit can be written in each of the three or more read-only memories. And a second area in which a program for transmitting data to the comparison circuit can be written,
On the other hand, in each of the three or more readable / writable memories, a first area for writing a program transmitted / received to / from the transfer circuit and a second area for writing data transmitted / received to / from the transfer circuit. An electronic computer having the area of 3. Three or more central processing units each independently processing data, three or more read-only memories for writing data in advance and storing the same, and three units for temporarily writing data and storing it. The read / write memory described above, the transfer circuit that transfers data between each of the three or more read / write memories, and the appropriateness of the execution path of the program independently executed by each of the three or more central processing units are determined. In a computer constituted by one path comparison circuit, a first area in which each of the three or more read-only memories can write a program for transmitting and receiving a program and data to and from the transfer circuit. And a second area in which a program for transmitting data to the comparison circuit can be written,
On the other hand, in each of the three or more readable / writable memories, a first area for writing a program transmitted / received to / from the transfer circuit and a second area for writing data transmitted / received to / from the transfer circuit. Computer having an area of. 4. Three or more central processing units for independently processing data, three or more read-only memories for writing data in advance and storing the same, and three units for temporarily writing data and storing it. The read / write memory described above, the transfer circuit for transferring data between each of the three or more read / write memories, and the sum check of the program executed in each of the three or more central processing units and the matching with the reference value In a computer configured by one sum check comparison circuit for determining the above, in each of the three or more read-only memories, a program capable of transmitting and receiving a program and data to and from the transfer circuit can be written. 1 area and a second area in which a program for transmitting data to the comparison circuit can be written, On the other hand, in each of the three or more readable / writable memories, a first area for writing a program transmitted / received to / from the transfer circuit and a second area for writing data transmitted / received to / from the transfer circuit. Computer having an area of.