JPH07182189A - Computer system, processor chip and fault restoring method - Google Patents

Abstract

PURPOSE:To provide a computer system of high performance which can prevent the deterioration of its performance caused by the multiplication and the fault detecting/switching operation in a highly reliable computer device that has its multiplex component units. CONSTITUTION:One or more of processors 11, 12, 13, 21, 22 and 23 are connected to the triplex system buses 1, 2 and 3. Furthermore three processors operates synchronously with each other on different buses and construct a logical processing unit. The outputs of buses 1-3 are compared with each other by a memory or an I/O device so that the correct output is selected. The I/O device is connected to a triplex, duplex or non-multiplex system bus of a 2nd layer in consideration of the reliability, the economical properties, the universal applicability, etc.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a highly reliable computer having a multiple structure, particularly a computer system which operates with a high frequency clock, has a plurality of processing units and has a high processing capability, and a fault recovery after a fault occurs. It is related to the method.

[0002]

2. Description of the Related Art In the field of fault-tolerant computers, as a method of improving the reliability of computers, it is common to multiplex modules with a high failure rate so that even if one module fails, the remaining modules will operate correctly. It is taken. The range of this multiplexing is a CPU, a memory, a bus, etc., and various error check functions are added to these to achieve high reliability.

As a conventional example, for example, JP-A-58-13
In the 7054, the processing board, main memory, and input / output control device are composed of two redundant boards, which are commonly called pair & spare (the processing unit requires a total of four processors). , Fully synchronized operation. Within each board, the output stages are compared and collated. If they do not match, the board is considered to have failed and no access to the external bus is made. The information of the failed board is passed to the spare side and only the spare side can keep the system running.

Further, in JP-A-2-202636, 3
It is composed of three independent processing boards (each of which operates at a clock having the same frequency but a different phase), and each processing board consists of a processor, a cache memory, and a local memory. Each processing board operates synchronously when accessing the global memory and when a counter called a cycle counter overflows.

Further, in Japanese Patent Laid-Open Nos. 4-241038 and 4-241039, three processors are mounted on the same processing board and operate in perfect synchronization with the same clock. The two outputs selected by the selection circuit of the processor are output to the outside. The access path from the processor to the cache memory or the outside is determined by opening or closing the gate of the internal bus according to the determination result of the selection circuit.

Further, in Japanese Patent Laid-Open No. 59-160899, two processors and one processor are provided on the same processing board.
When two caches are installed and the processing board performs processing, instructions and data are loaded from the duplicated main memory into the cache (store-in cache), and the two processors perform a synchronous operation and execute the result. To compare. A series of processing is completed normally (that is,
When the processing of the duplexing processor is always the same) or when the cache overflows, the cache contents are written back to the main memory. This method improves reliability by ensuring that correct data is always secured in (at least one of) the duplicated main memory. The failure of the processing unit only needs to be correctly detected (it is not necessary for the unit to continue). When a processing unit fails, the processing performed by the processing unit is re-executed by another processing unit based on the correct (old) data in the main memory.

Further, as shown in FIG. 31, as one method for improving the reliability of a conventional computer system, the processors are tripled, each processor executes the same instruction, and the outputs are compared and selected by a majority circuit. , There is a method to output to the system bus. This allows the system to continue normal operation in the event of a single processor failure.

[0008]

According to the prior art,
Various methods have been used to realize a fault-tolerant computer that continues to operate normally even if one part fails, but these methods operate with a high-frequency clock and require multiple processing units. There were the following problems when trying to build a high-performance computer.

In the above-mentioned Japanese Patent Laid-Open No. 58-137054, since the processing unit is composed of two pairs and spares, four processors are required for each processing unit. In general, a processor chip capable of high-speed operation is very expensive as compared with other components, and thus such a configuration has a high cost.

Further, Japanese Patent Laid-Open No. 2-20263 of the above-mentioned conventional example.
No. 6 is composed of three independent processor boards. Since each processor board operates with clocks with the same frequency (not exactly the same) but different phases, a special mechanism for synchronization between the processor boards is required, and high-speed performance such as multiprocessors is achieved. It seems difficult to apply the method.

Further, Japanese Patent Laid-Open No. 4-24103 of the above-mentioned conventional example.
In JP-A-4-241039, the processing unit is configured by the same board, three processors are mounted, and they operate in perfect synchronization with the same clock, and high performance due to multiprocessor can be applied. However, a circuit for confirming the validity of the output of the processor is inserted between the processor and the cache memory, which becomes an obstacle to the no-wait operation and the high-frequency operation of the processor, which also hinders the high performance.

Further, Japanese Patent Laid-Open No. 59-1608 of the above-mentioned conventional example.
In No. 99, the processing board operates with an independent clock, the inside is composed of two processors, and when the processor fails, another processing unit processes from the contents stored in the main memory at the previous flash timing of the cache memory. It is a checkpoint method to re-execute,
Even in normal processing, there is an overhead such as flushing of the cache memory, and there is a drawback of returning to the checkpoint in the event of a failure, resulting in poor performance.

In the system shown in FIG. 31, one logical CP is used.
A majority decision circuit is required for each U, and considering a multiprocessor configuration having a large number of logical CPUs, a relatively large amount of H / W is required. Further, the frequency of the CPU is also easily restricted by the additional circuit, and in the case of a processor having a cache, a bus transaction for taking snoop and coherency of the cache occurs, but such processing causes an overhead, resulting in performance degradation. Is reduced.

The present invention has been made in order to solve the above-mentioned problems, and provides a high-performance fault-tolerant computer, particularly a standard high-performance processor chip using the latest technology and a peripheral chip set. It is to provide a fault-tolerant computer capable of exhibiting extremely high performance by fully exhibiting its high speed and incorporating the latest operating system including multiprocessor technology.

Further, there is provided a computer system having a failure recovery method that does not reduce reliability and a failure recovery method that does not degrade performance when a failure occurs in the above-described computer and its recovery processing.

Further, the same hardware configuration provides a computer hardware configuration capable of supporting both a system requiring reliability and a system requiring performance.

[0017]

A computer system according to the present invention is characterized by having the following elements. (A) three or more buses for transferring data, (b) a processing unit having three or more processors individually connected to the plurality of buses and operating in the same manner, (c) access from the processors via the bus Device, a selection unit for selecting a bus between the three or more buses and the devices, and a control unit for controlling data transfer between the bus and the device selected by the selection unit.

A plurality of processing units are provided, and one bus is provided with a plurality of processors.

The selecting means selects one bus from a plurality of buses when transferring data from the bus to the device and connects the device to the device, and selects a plurality of buses when transferring data from the device to the bus. It is characterized by connecting with a device.

The control unit is provided with a failure detecting means for comparing the data of the three or more buses to detect the occurrence of a failure and controlling the bus selection of the selecting means based on the detection result. Is characterized by.

The computer system is characterized by comprising disconnecting means for disconnecting a bus having a failure based on the detection result of the failure detecting means.

The subsystem is a main storage device,
The device is a memory, and the control unit is a memory control unit that transfers data between the memory and the bus.

It is characterized in that a plurality of the main memory devices are provided and are connected to the plurality of buses, respectively.

The subsystem is a peripheral device system, the device is an input / output device, and the control unit is an input / output control device for transferring data between the input / output device and the bus.

The peripheral device system is characterized by including three or more second buses corresponding to the plurality of buses and three or more bus bridges respectively connecting the buses and the second buses.

The peripheral device system is characterized in that a third bus consisting of one bus is provided between the selecting means and the input / output device.

The peripheral equipment system is characterized in that it comprises two selection means and a fourth bus composed of two buses between the two selection means and the input / output device.

The plurality of main storage devices are characterized by including a primary main storage device that sends data to the bus and a secondary main storage device that does not send data to the bus.

The primary main memory device comprises a checking means for checking the validity of the data transferred to the bus, and a replacement means for replacing the secondary main memory device with the primary main memory device based on the check result of the checking means. It is characterized by

The above-mentioned checking means selects a plurality of redundant code generating means for generating a redundant code for checking the validity of the data transferred from each bus, and selects a correct redundant code from the generated plurality of redundant codes. A redundant code selecting means for storing is provided.

The checking means is provided with a plurality of redundant code checking means for checking the redundant code corresponding to each bus.

The computer system is characterized in that it has, as operation modes, a synchronous operation mode in which three or more buses are operated in synchronization and an individual operation mode in which three or more buses are operated asynchronously.

In the individual operation mode, the selection means controls data competition from a plurality of buses to the device and outputs data from the device to any of the corresponding buses.

The computer system further processes the bus acquisition request output to the plurality of buses in the synchronous operation mode as one bus acquisition request, and the bus acquisition request output to the plurality of buses in the individual operation mode. Is provided as an individual bus acquisition request.

The computer system has, as operation modes, a synchronous operation mode for synchronously operating three or more buses and an individual operation mode for asynchronously operating the three or more buses. The plurality of main storage devices individually operate. It is characterized by having a memory that is accessed using different addresses in the modes.

The above-mentioned computing system is characterized by comprising a mode designating means for designating the operation mode and a mode setting means for setting the mode designated by the mode designating means.

The processor chip of the present invention is characterized by having the following elements. (A) first processor, (b) second processor, (c) reset means for individually resetting the first and second processors, (d)
Stop means for individually stopping the operations of the first and second processors, (e) Bus usage request output means for individually outputting the bus usage requests of the first and second processors, (f) the first And bus use permission input means for individually inputting the bus use permission to the second processor, and (g) common means for commonly performing other input / output of the first and second processors.

Further, it is characterized in that three or more buses and three or more processor chips corresponding to each bus are provided, and the first and second processors are connected to the same bus.

Further, it is characterized in that four buses are provided.

Further, according to the present invention, there is provided a first processing unit including first, second and third processors which are respectively connected to the first, second and third buses and perform the same operation, and a first processing unit. , A first processor of a computer system having a second processing unit having fourth, fifth and sixth processors respectively connected to the second and third buses and performing the same operation, fails in the first processor. The failure recovery method when it occurs is characterized by having the following steps. (A) a continuous execution step in which the processing being executed in the first processing unit is continuously executed by the second and third processors, and (b) after the continuous execution step, the operation of the first processing unit is stopped. , A single unit processing step in which the next processing is started by the second processing unit.

The above continuous execution step includes (a) an output suppressing step for suppressing the outputs of the first processor and the fourth processor, and (b) an operation of the first bus for the operation of the second and third buses. And a follow-up step for continuously executing the operation excluding the output of the fourth processor, wherein the single unit processing step (a) permits the output of the fourth processor after the operation of the first processing unit is stopped. A permitting process,
(B) A synchronization process for synchronizing the first bus with the second and third buses is provided.

The following steps include a bus following step in which the operation of the first bus is stopped for one cycle or more for a predetermined cycle and then the operation of the first bus is followed by the operations of the second and third buses, and a fourth step. A processor follow-up step of stopping the operation of the processor for a predetermined cycle and performing a synchronous operation delayed from the fifth and sixth processors by a predetermined cycle, wherein the synchronizing step includes the operation of the fifth and sixth processors for a predetermined cycle. A processor synchronization step of stopping and synchronizing the operation of the fourth processor and a bus synchronization step of synchronizing the operation of the first bus with the operation of the second and third buses are provided.

Further, according to the present invention, there is provided a first processing unit including first, second and third processors which are individually connected to the first, second and third buses and which perform the same operation, respectively. Failure of the first processor of the computer system including the second processing unit including the fourth, fifth and sixth processors which are respectively connected to the first, second and third buses and perform the same operation In the method for recovering from a failure in the case of occurrence of (a), (a) the process being executed by the first processing unit is continuously executed by the second and third processors, and the process being executed by the second processing unit is executed. A continuous execution step of continuously executing by the fifth and sixth processors, (b) a replacement step of replacing the first and fourth processors with a new processor during the continuous execution step, (c) After exchanging step, and further comprising a first and fourth processor synchronization process to be operated in synchronization with other processors.

The synchronization means includes (a) a bus following step of operating the first bus by delaying the operation of the second and third buses by one cycle or more by a predetermined cycle, and (b) first and fourth operations.
The processor following step of operating the other processor by delaying the operation of the other processor by a predetermined cycle, and (c) stopping the operation of the second, third, fifth, and sixth processors by a predetermined cycle to perform the first and fourth operations. It is characterized by including a processor synchronization step of synchronizing with the operation of the processor and (d) a bus synchronization step of synchronizing the operation of the first bus with the operation of the second and third buses.

[0045]

The computer system according to the present invention is a triple system in which the processor and the system bus are integrated to improve the system performance. By operating the integrated processor and system bus synchronously with the same clock, the system performance can be improved. On the other hand, subsystems such as the main storage device are not tripled because they are not required to be as fast as the processors and system buses, and are expensive when multiplexed. Since the processor and the system bus are tripled, but the subsystem is not tripled, selection means is provided for the subsystem to control data transfer to and from the tripled bus. . The present invention is characterized in that the system processor and the system bus are integrated and multiplexed in addition to the conventional multiplexing of processors. The reliability of the entire system can be improved by multiplexing the bus. On the other hand, the subsystem does not need to operate with higher performance than the processor and the system bus, and does not require high speed processing. In addition, there is a drawback in that the cost of the system increases if the subsystems such as the main storage device are tripled. Therefore, in the present invention, the processor and the system bus are integrated and tripled, and the subsystem selects these tripled outputs by the selection means. In addition, the processor and system 3
By duplicating, it becomes possible to detect an error by a simple method of comparing three outputs as compared with the case of simply duplicating. When the processor or bus is simply duplicated, it is not possible to determine which one is causing a failure by simply comparing the two outputs, and a special error detection function that uses a parity check or redundant code such as ECC is provided. Must have. On the other hand, in the case of triplicate, it is possible to specify the faulty one by a simple circuit of taking a majority vote.

In the second invention, a plurality of processors are provided on one bus to improve the bus usage efficiency.

In the third invention, the selecting means selects one bus from a plurality of buses and transfers the data to the device, and conversely transfers the data from the device to the plurality of buses. Even if data is tripled, data can be transferred without contradiction.

In the fourth aspect of the invention, the fault detecting means can detect the fault by simply comparing the data on the buses, and the fault can be detected by a simple structure. When there are three or more buses in this way, redundancy functions such as parity and ECC can be eliminated.

In the fifth aspect of the invention, when a fault is found, the bus is disconnected, and the faulty bus does not affect other buses.

The sixth invention is characterized in that the subsystem is a main memory. Since the main storage device is expensive in price, it cannot be multiplexed in the same number as the processors and buses, and thus is shared by a plurality of processors and a plurality of buses.

The seventh invention is characterized in that a plurality of main storage devices are provided and each main storage device is connected to a plurality of buses. By thus providing a plurality of main storage devices, the reliability of the main storage devices is improved.

The eighth invention is characterized in that the peripheral equipment system is connected to a plurality of buses.
The peripheral device system has an input / output device as a device and an input / output control device as a control unit. As described above, even when the peripheral device system is connected as a subsystem, data can be transferred to and from the plurality of buses described above. Also in this peripheral device system, the triple processor and bus are selectively connected to the input / output device by the selection means in the peripheral device system.

In the ninth invention, a second bus (local bus) exists in the peripheral device system, and the second bus is provided corresponding to each of the plurality of buses described above. There is. When connecting the second buses, they are connected via a bus bridge. In this way, the reliability can be improved by multiplexing the local buses in the peripheral device system.

In the tenth aspect of the invention, the bus in the peripheral device system is a single bus. This is a configuration in consideration of the economical efficiency of the peripheral device system.

In the eleventh aspect of the invention, the bus in the peripheral device system is duplicated, and when the bus in the peripheral device system is duplicated, two selecting means are provided to duplicate the bus. Connected to the bus. In this way, the tripled bus can be connected to each of the doubled buses.

In the twelfth aspect of the invention, when the main memory devices are multiplexed, one of them is used as the primary main memory device and data is sent to the normal bus. Data other than the primary main memory is not sent to the bus as the secondary main memory. In this way, data transfer from the main memory device to the bus is performed without contradiction.

In the thirteenth aspect of the present invention, since the primary main storage device is provided with a checking means for checking the validity of data, when any failure is detected by the checking means, one of the secondary main storage devices is set as the primary storage device. Change to main memory.

In the fourteenth invention, a plurality of redundant code generating means for generating a redundant code for checking the correctness of data is provided corresponding to each bus, and the generated code is an error-free code. Select and memorize. Therefore, the reliability of the generated redundant code is increased.

In the fifteenth aspect of the invention, since the redundant code check means for checking the redundant code corresponding to each bus is provided, the validity of the data output to each bus can be individually checked. In addition, it is possible to check for a failure occurring between the memory in the main memory and the bus.

In the sixteenth aspect of the invention, there is provided an individual operation mode for operating the above-mentioned plurality of buses asynchronously. Therefore, when operating the buses synchronously, the reliability of the system is improved, and when operating asynchronously individually, each processor and each bus can perform separate processing to improve performance. You can

The seventeenth invention is characterized in that, in the individual operation mode, the selecting means operates differently from the synchronous operation mode. In individual mode operation, each bus operates individually, so that access to subsystems competes with each other. Therefore, the selection means controls this conflict and handles it consistently. On the other hand, when the data from the device is output to the bus, it is output to the individual bus unlike the case where the synchronous operation is performed.

In the eighteenth invention, there is provided arbitration means for performing different processing in the synchronous operation mode and the individual operation mode. Since multiple buses perform the same operation in the synchronous operation mode, bus acquisition requests from multiple buses are processed as one bus acquisition request, and in the individual operation mode, multiple buses operate individually. Therefore, each bus acquisition request is processed as an independent bus acquisition request.

The nineteenth aspect of the invention is characterized in that, when there are a plurality of main memory devices and individual operations are performed, each memory of the main memory device is assigned to a different address space. . In the case of the individual mode operation, since the processor and the bus operate individually, when there are a plurality of main memory devices, they can be individually accessed to provide a wide range of memory space.

In the twentieth aspect of the invention, there is a mode designating means for designating the synchronous operation mode and the individual operation mode described above, and the mode designating means is provided for setting the system to the mode designated by the mode designating means. . Therefore, the system can be switched to a desired mode when the power is turned on or the system is reset.

In the twenty-first aspect of the invention, for the processor chip enclosing two processors, reset means, stop means, bus use request output means and bus use permission input means are provided for the first and second processors, respectively. Are designed to work individually. Other signal lines (data line and address line) are shared by the first and second processors. In such a processor chip, the first
The second processor and the second processor can be synchronized to perform the same operation, or the first and second processors can be operated separately.

The twenty-second aspect of the invention is characterized by including three or more processor chips described above, and the first and second processors of each chip are connected to the same bus. Therefore, it is possible to provide a system that enables both the synchronous operation mode and the individual operation mode in the computer system described in the first invention.

In the twenty-third aspect of the invention, the bus is quadrupled, and the system reliability can be further improved.

The twenty-fourth aspect of the present invention provides a failure recovery method for avoiding a decrease in reliability when a failure occurs in a triple system. When a failure occurs in the first processor, the second and third processors continue processing, and the processing of the first processing unit is ended at an appropriate time, and then the second processor Since the processing unit is used to perform the processing, it is possible to increase the chances that the system is triplicated and operate, and to maintain the reliability of the system.

In the twenty-fifth aspect of the invention, the processing is continued so that the bus in which the failure has occurred follows another normal bus, and the following operation is performed when the next processing is avoided by the second processing unit. It is designed to terminate and synchronize the three buses.

In a twenty-sixth aspect of the present invention, the above-described method of the follow-up operation is further embodied. After stopping the first bus for a predetermined cycle, the bus is followed by another bus and the fourth processor is provided. A predetermined cycle is stopped so that another processor is made to follow it. Also,
When the synchronization is to be restored, the normal processor is stopped for a predetermined cycle for synchronization, and the bus that is operating following is synchronized with another normal bus.

In the twenty-seventh aspect of the present invention, deterioration of the performance at the time of failure recovery processing is avoided. In order to maintain the performance, it is desirable to maintain the number of operable processors for processing. Therefore, even if the first processor fails, performance is maintained by keeping the second and third processors operating. Then, the failed first processor is replaced with the fourth processor connected to the same bus. In the replacement of the first and fourth processors, the newly inserted first and fourth processors are operated in synchronization with the other processors, so that the number of operating processors before and after the failure becomes equal.

The twenty-eighth invention shows a procedure of a synchronous operation after replacing the processor. Specifically, the first bus follows other buses, and the first and fourth buses
To let other processors follow other processors. After that, the normal processor is stopped for a predetermined cycle, synchronized with the first and fourth processors, and finally the three buses are synchronized, whereby the synchronization after the processor replacement can be achieved.

[0073]

【Example】

Example 1. FIG. 1 is a schematic diagram of a computer system of the present invention. In this figure, the system bus is tripled,
Connect a processor to each on each system bus.
Therefore, one logical CPU is composed of three processors and normally executes the same instruction. When the same transaction is synchronously executed on the tripled system bus and the memory is accessed, the selection circuit selects one of the accesses that is judged to be correct in operation and outputs the result to the interface unit. , Other system buses also receive the same response from the memory device. Therefore, in a normal state, the movement of the triple system bus continues to be synchronized. If something goes wrong with one of the processors,
Since the movement of the system bus is different from that of the other two, the fault is detected by the selection circuit and removed from the selection target. Therefore, the failure of the processor does not affect the contents of the memory, and the system can continue normal operation. According to such a configuration, since there is no additional circuit between the plurality of logical CPUs (the processor and the system bus are directly connected), cache coherency can be taken at high speed. Further, since the number of selection circuits does not increase in proportion to the number of logical CPUs, the amount of hardware can be relatively small even in a large-scale multiprocessor system, and a high-performance and highly reliable computer can be easily constructed. .

FIG. 2 is a diagram showing another example of the present invention. 2 is different from FIG. 1 in that the logical CPU is 2
It is a point that has been duplicated. Logical CPU1 and logical CPU2
Operate independently, and all processors in each logical CPU perform the same operation in synchronization. Logical CP like this
Duplexing U improves bus usage efficiency and system performance.

FIG. 3 is a diagram showing another structure of the present invention. 2 is different from FIG. 2 in that the main storage device is
This is a duplicated point. The memory A and the memory B are arranged in the same address space and store the same data.
As shown in FIG. 3, this configuration duplicates the memory module, the selection circuit, and the interface unit. At the time of writing data to the memory, both memories (memories A and B) are written, and at the time of reading, either of the contents is output to the triple system bus. In addition, this system has the ability to detect failures in the memory, selection circuit, and interface unit. If a failure is detected in these parts, disconnect it from the system, and use the other system's memory, selection circuit, or interface unit to operate the system. continue. With such a configuration, the system can continue normally with respect to a one-point failure of the memory, the selection circuit, and the interface circuit as well as the processor, and a computer system with higher reliability can be constructed.

FIG. 4 is a diagram showing another structure of the present invention. 1 to 3, the case where the three system buses are operated in the same manner to improve reliability has been described, but in the case of FIG. 4, each processor is operated individually to obtain a high-performance system. It is a thing.
In this configuration, the triple processor can be switched to operate individually by a command from the S / W. That is, the selection circuit has a mode in which contention control of memory access between system buses is performed and sequential access is performed. Therefore, the system having the configuration shown in FIG. 2 has two logical CPs.
Expanded from U to 6 logical CPUs, improving the computing performance of the system. According to such a configuration, one hardware configuration can be applied to both a system that requires reliability and a system that requires the computing performance of the CPU, and the hardware can be used efficiently. Further, FIG. 4 shows a case where the memory A and the memory B have separate address spaces. As described above, the triple processor can be switched to operate individually by the command from the system S / W, and the double memory can be switched to be accessible as another space. Have a mode. By doing so, the computing capacity of the CPU is increased, the memory space that can be used from the S / W is also increased, and the system performance is improved. As described above, according to this configuration, one hardware configuration can support both a system requiring reliability and a system requiring system performance, and can effectively use hardware resources.

FIG. 5 is a diagram showing another structure of the present invention. A feature of FIG. 5 is that the second layer system bus and the input / output device connected to the second layer system bus are connected to the above-described configuration. In this system, the second hierarchy system bus is also tripled, and the selection circuit and the interface unit are connected to the tripled second hierarchy system bus. The selection circuit and the interface unit are the same as the selection circuit and the interface unit used in the memory described above. As described above, in FIG. 5, even when the system has the second layer system bus, it can be considered as a subsystem including these second layer system buses. That is,
The system bus of the first layer and the system bus of the second layer are connected by a bus adapter and can be considered to be similar to a continuous system bus. As shown in FIG.
In the configuration shown in (2), the second hierarchy system bus is connected to each of the tripled system buses via a bus adapter. Therefore, the second layer system bus is also 3
Be duplicated. The triplicated system bus and controller are
It is accessed through the selection circuit and the interface unit. The triple layered system of the first layer system bus, the bus adapter and the second layer system bus perform synchronous operation when there is no failure, and when the processor or the bus adapter fails, the operation is out of synchronization. The fault is detected by the selection circuit. Then, the system in which the failure has occurred is disconnected, only correct data is provided to the control device and memory, and the system does not stop. Generally, the second-tier system bus is slower than the first-tier system bus, but it is economical to make a control device at a low cost, compatibility that the previous model can be used as it is, and a commercially available control device You can select the one that satisfies the versatility of being used as it is. With such a configuration, it is possible to construct a high-performance and highly reliable computer system using the latest technology while maintaining economy, compatibility and versatility.

FIG. 6 is a diagram showing another structure of the present invention. 6 is different from FIG. 5 in that the second hierarchical system bus included in the subsystem is a single bus. Thus, when the second hierarchy system bus is a single bus, data can be transferred by providing a selection circuit between the first hierarchy system bus and the second hierarchy system bus. In the configuration shown in FIG. 6, 3
The second layer system bus is connected to each of the duplicated system buses via a bus adapter and a selection circuit. When there is no failure, the triple system bus performs a synchronous operation, and when a failure occurs in the processor or bus adapter, the operation is out of synchronization and the failure is detected by the selection circuit. Then, the first system bus of the fault occurrence system is disconnected. Correct data is supplied to the control device and memory on the second hierarchy system bus by the selection circuit, and the system does not stop. As shown in FIGS. 5 and 6, the second layer system bus can be tripled or singled. In particular, the second layer system bus shown in FIG. 6 satisfies compatibility and versatility, and can be economically constructed. Further, as compared with the configuration shown in FIG. 5, a selection circuit for each control device is unnecessary, which is more economical. With such a configuration, it is possible to construct a high-performance and highly reliable computer system using the latest technology while maintaining economy, compatibility and versatility.

FIG. 7 is a diagram showing another structure of the present invention. 7 is different from the above-mentioned configuration in that the second hierarchical system bus is duplicated. When the second layer system bus is duplicated, the selection circuit is duplicated to interface with the tripled first layer system bus. In the configuration shown in FIG. 7, of the tripled bus adapters, two selection circuits for selecting any one output and two interface units are provided, and the second hierarchy system bus can be duplicated. The second-tier system bus has an error detection function, and when a fault occurs on the second-tier system bus, one of the two selection circuits having no fault accesses the bus adapter. In this way, the processor, the bus adapter, the memory, the selection circuit / interface unit, the first
And even if one failure occurs in the second layer system bus, the system does not stop and the processing can continue. With such a configuration, it is possible to construct a high-performance and highly reliable computer system using the latest technology while maintaining economy, compatibility and versatility.

FIG. 8 is a diagram for explaining the operation when disconnecting a defective CPU in the above-mentioned configuration. In this configuration, the system is composed of first, second, and third system buses, and the logical CPU includes the first, second, and third processors, executes the same operation, and executes the logical C
PU2 comprises fourth, fifth and sixth processors performing different identical operations, the first processor being on the first system bus and the second processor being on the second system bus. , The third processor is connected to the third system bus, respectively. Similarly, the fourth processor is connected to the first system bus, the fifth processor is connected to the second system bus, and the sixth processor is connected to the third system bus. Each is connected to the system bus. When any one of the processors in the logical CPU (for example, the first processor) fails, the processors on the remaining two buses (second and third processors) to which the failed processor is not connected Therefore, it is good to turn off the program currently being executed (other logical CP
U is executed until the program can be migrated) and stopped normally, and then the non-failed processor (fourth processor) on the bus having the failed processor (first bus) is replaced by the other two. Restores to the same internal state as the processor (fifth and sixth processors) and has no faulty logic C
The PU (logical CPU 2) executes the same instruction, and therefore the three system buses perform the same operation. The process that was being executed by the failed logical CPU is
(Logical CPU2 = fourth, fifth, and sixth processors). As described above, according to this restoration method, the failed logical CPU can be separated without discarding the program being executed, and the normal logical CPU and the system bus can continue the triple synchronous operation, and the computer with high reliability can be obtained. The system can be built.

FIG. 9 is a diagram showing an example of replacing a failed processor. As shown in FIG. 9, when three processors are mounted on one CPU board, C
The PU board unit is replaced. In the configuration shown in FIG. 9, each processor (first, second, third processor, or fourth processor) of the logical CPU (logical CPU 1 or 2) is
The fifth and sixth processors have the same exchange module (C
CPU board (CP) that is located in the PU board and that contains the failed processor (first processor in the example)
Replace the U board 1) with a normal CPU board with all processors intact. The CPU board to be replaced is
Access to the triple system bus is suppressed, and the operation of the system bus is not disturbed. 3 CPU boards after replacement
The redundant system bus can be accessed. As described above, in the configuration shown in FIG. 9, the operating state of the system returns to the state before the occurrence of the failure, the computing performance is restored, and the durability against the next failure can be achieved. A computer system that can be maintained over a long period can be constructed. Especially, even when the replacement module is pulled out, the triplicate operation of the bus can be continued and the reliability is not deteriorated.

FIG. 10 is a diagram showing another example of replacing a failed processor. In FIG. 10, two processors are mounted on one CPU board. The two processors mounted on one CPU board are connected to the same system bus. With such a configuration,
When a processor fails, the CPU board unit with two processors is replaced. In the configuration shown in FIG. 10, each processor (first and fourth, or second and fifth, or third) connected to the same system bus (first or second or third system bus) And 6) are arranged in the same exchange module (CPU board), and the CPU board (CPU board 1) including the failed processor (the first processor in the example) is replaced by a normal one in which all the processors have no failure. Replace with CPU board. The system bus to which the CPU to be replaced is connected is disconnected from other parts of the system (for example, memory), and the system is not affected by the replacement.

FIG. 11 is a diagram showing a configuration in the case where the CPU boards having the two processors shown in FIG. 10 are integrated and enclosed in one chip. High reliability, because the operating state of the system returns to the state before the failure occurred, the computing performance is restored, and the durability against the next failure can be achieved.
A computer system that can maintain high performance over a long period of time can be constructed. In particular, the number of pins of the connector portion of the replacement module is small, the amount of hardware is reduced, and it is advantageous for downsizing and cost reduction. Further, since the number of logical CPUs does not decrease, there is no deterioration in performance. As shown in FIG. 11, in this system,
Multiple processors connected to the same bus are packed in the same chip. Connect this chip to each system bus 3
Build a highly reliable computer system. With such a configuration, a compact, inexpensive, high-performance and highly reliable computer system can be constructed by using a chip in which a plurality of microprocessors are packaged.

Example 2. Although the outline has been described in the above-described embodiment, a specific embodiment of the above-described configuration will be described here. In FIG. 12, reference numerals 1, 2, and 3 are tripled system buses. 10 is a processing unit, and 11, 12 and 13 are processing units 10.
Is a triple processor that is connected to the system buses 1, 2, and 3 via bus interface units 14, 15, and 16, respectively. Similarly, 20 is a processing unit, 21, 22, 22 are processors, and 24, 25, 26 are bus interface units. Reference numeral 50 is a main memory device, 51 is a memory array block, 52 is a memory interface unit, and 53 is a selection circuit for selecting one output from the three system buses or sending the memory output to a plurality of system buses. Similarly, 60 is a main memory, 61 is a memory array, 62 is a memory interface unit, and 63 is a selection circuit. 9
0 is an arbitration circuit that determines the user of the system bus, 101, 102 and 103 are the system bus and the second
Bus bridge connecting the system buses of layers, 110 is 3
Second layer system bus interface unit for selecting any one of the outputs of the duplicated bus bridge, 10
Reference numeral 4 is a second layer system bus. 111, 112, 1
Reference numeral 13 is an input / output control device connected to the second layer system bus 104, and 121, 122 and 123 are input / output devices connected to the input / output control devices 111, 112 and 113 (floppy disk, magnetic tape, printer). Is. Also, 201, 202, and 203 are bus bridges that connect a system bus and another layer-2 system bus, and 20.
4, 205 and 206 are the bus bridges 201 and
A system bus of the second layer, which is tripled and connected to 202 and 203. 211, 212, 213 I / O interface units 221, 222, 223 for selecting outputs of the second-level system buses 204, 205, 206 are I / O interface units 211, 212, 213.
I / O device control devices 231, 232, 2 connected to
Reference numeral 33 is an input / output device (disk, LAN) connected to the input / output device control devices 221, 222, and 223.

(1. Normal execution operation) Next, the normal execution operation will be described. The processing unit 10 is composed of processors 11, 12 and 13, and the processors 11, 12 and 13 operate at the same clock and always execute the same instruction. Similarly, the processing unit 20 is also composed of processors 21, 22 and 23, but the processors 21, 22 and 23 operate at the same clock and always execute the same instruction. When each processing unit uses the system bus, a system bus request is simultaneously sent to each arbitration circuit 90 for each processor, and a system bus use permission signal is returned at the same time, so that the processors of the same processing unit simultaneously receive the same signal. Issue a bus transaction of.
As will be described later, the bus bridges 101, 102,
Bus transactions on the system bus of 103 or the bus bridges 201, 202, 203 are also synchronized. Therefore, the bus transactions from the processing unit to the system buses 1, 2, and 3 are synchronized during normal operation. The selection circuits 53, 63 and the memory interface units 52, 62 operate in synchronization with each other for transactions from the system bus, and for memory writes, write to both 50 and 60 main memory devices, and memory read. For one, one becomes the primary (here, 50) and the other becomes the secondary (here, 60), and only the primary (50) reads the data read simultaneously for 1, 2, and 3. Send out.

(1.1 CPU operation) Here, FIG.
Now, the operation of the processor 11 among the above operations will be described in detail. In FIG. 13, 1 is a system bus, 11 is a processor, and 14 is a bus interface unit. 1
Reference numerals 4a, 14b, 14c, 14d, and 14e are drivers, 14f is an output enable signal, and 14h is a reset signal. Reference numeral 11r is a system bus request signal, and 11g is a system bus use permission signal.

During normal execution, the reset signal 14h is insignificant and the processor can operate. The output enable signal 14f is significant and the driver 14b sends the output of the processor 11 to the system bus 1. The driver 14c sends the system bus request of the processor 11 as a system bus request signal 11r to the arbitration circuit. The arbitration circuit uses the system bus use permission signal 11
Use g to signal that the processor is able to use system bus 1.

(1.2 Operation of Main Memory Device) Further, the operation of the main memory device 50 will be described in detail with reference to FIG. Figure 1
4, the memory array block 51 includes a memory data bus 51a, an ECC data bus 51b, a memory array 51c, and an ECC array 51d. The memory interface unit 52 includes a memory control circuit 52a,
ECC generation circuit 52b, ECC check circuit 52c, primary bit 52d, AND element 52e, other primary request output line 52f, own primary request input line 52g,
Drivers 52h, 52i, 52j, AND element 52k,
52l, 52m, memory duplication designation bit 52o, AN
It is composed of a D element 52p. Memory control circuit 52a
Is a memory address range specification register 52a that specifies which part of the memory address range to access.
a. The interface unit 53 includes registers 53j, 53k, 53 for holding the states of the selector 53a, the comparison circuit 53b, the selector 53c, and the system bus.
1 and driver elements 53m, 53m and 53o. The primary bit 52d is a bit that indicates that the main storage device is the primary and drives read data. One of the primary bits 52d of the duplicated main storage devices 50 and 60 is set as a primary memory. One becomes secondary and primary bit 52
d is not set. In this example, since the main memory device 50 is primary, the primary bit 52d is set. Equivalent bit in main memory 60 (not shown in the figure, 62
(d) is not set. The main storage device 60 has the same configuration as the main storage device 50, and the constituent elements in the main storage device 60 are the same as those in the main storage device 50.
It is assumed that the number of the number series is changed to the number range of 60 (for example, 52d is changed to 62d). Here, the initial values of the various registers are the memory address range designation register 52a.
a and 62aa have the same address range set,
It is assumed that the memory duplication designation bits 52o and 62o are both set to 1. The procedure for these settings will be described later. Further, reference numeral 91 is an individual execution designating signal that designates whether the processor is to be individually executed or the triplex synchronous operation is performed,
Reference numeral 92 is a system bus selection signal. In the description here, the individual execution designation signal 91 is fixed so as to designate the triplex synchronization operation. Further, the main storage device 50
And 60 communicate with each other, the own primary request input line 52g and the other primary request input line 62f are connected, and the own primary request input line 62g and the other primary request input line 52f are connected.

The operation of the system buses is compared by the system buses 1, 2, 3 in the comparison circuit 53b, and the selection signal is transmitted to the selector 53a via the selector 53c. Then, the output of the bus that is operating normally is selected by the selector 53a and output to the memory data bus 51a (here,
A bus that is operating normally is a bus other than a bus that operates differently from the other two buses. That is, when the operation of one bus is different from that of the other two buses, that one bus is regarded as a bus that is not operating normally, and the other two buses are regarded as buses that are operating normally). The memory control circuit 52a analyzes the bus transaction, and if the address is within the range specified by 52aa, the memory control circuit 52a determines to access (read or write) its own memory and performs the following operation.

At the time of memory write, the memory control circuit 52a
Stores data on the memory data bus 51a in the memory array 5
Control is performed to write to 1c, and the data is stored in the memory array 51c. At the same time, the ECC generation circuit 52b generates an ECC code for each data on the 51a,
The ECC code is stored in the ECC array 51d via the data bus 51b under the control of the memory control circuit 52a.

At the time of memory read, the memory control circuit 52a
Performs control to read data at a desired address in the memory array 51c and the ECC array 51d. Memory data is stored in the memory data bus 51a and ECC data is stored in the EC
It is output to the C data bus 51b. The ECC check circuit 52c checks the validity of the read data from these data. If the data is valid, the content of the primary bit 52d remains unchanged and remains set. Therefore, the drivers 52h, 52i and 52j are
D element 52e and AND elements 52k, 52l, 52m
The memory data on the memory data bus 51a is output to the system buses 1, 2 and 3 under the control of the memory control circuit 52a via the.

Memory array 51c and ECC array 51d
If there is a fault in the memory, the ECC check circuit 52c detects an ECC error during memory read, and if it is a self-correctable error such as a 1-bit error, the corrected error may be sent to the memory data bus 51a. on the other hand,
When a failure that cannot be self-corrected occurs, the primary bit 52d is reset by the control of the ECC check circuit 52c, and the own memory device becomes the secondary memory. At the same time, since the memory duplication bit 52o is set, the other primary request output line 52f is output via the AND element 52p. As a result, the request to become the primary is transmitted to the paired main storage device 60 via the own primary request input line 62g, the primary bit 62d of the main storage device 60 is set, and the main storage device 60 is set.
Becomes the primary and outputs read data. Here, FIG. 15 shows the setting and resetting conditions of the primary bits of the main storage devices 50 and 60.

With the above-mentioned structure, the parts such as the processing units 10 and 20 that require high-speed operation do not include the voter or the selection circuit, and do not become an obstacle to speeding up. Furthermore, since the system bus is tripled, the reliability and fault tolerance of the bus are sufficient without adding redundant data for ensuring the validity of the data on the bus, for example, parity bits or ECC codes. However, if these redundant codes are omitted, the bus speed can be increased. The configuration for fault detection between the processor and the memory and normal system selection in this embodiment is shown in FIG. On the other hand, the conventional example is generally represented as FIG. As can be seen by comparing these figures, it is understood that this embodiment simplifies the means for fault detection and normal system selection, and enables high-speed data transfer between the processor and memory. Further, although the speed can be further increased (and the reliability can be improved) by configuring the selection circuit differently, it will be described later as another embodiment.

(1.3 Operation of Input / Output Device) The optimum configuration of the input / output device differs depending on the requirements (reliability, economy, versatility, etc.) required for the input / output device. Second
The hierarchy system bus has two different configurations, that is, the second hierarchy system bus 104 which is not multiplexed and the second hierarchy system buses 204, 205 and 206 which are tripled to meet the above demand. High reliability is required for the input / output devices that are the basis of the system such as disks and LANs.
Therefore, the tripled second layer system buses 204, 20
5, 206 to the input / output interface units 211 and 2
12 and 213. By doing this, the second
Even if a fault occurs in the hierarchical system bus, it is detected by the input / output interface unit 211 or the like, the detected faulty bus is disconnected, and the system can continue normal operation. On the other hand, some types of devices, such as floppy disks, magnetic tapes, printers, etc., do not immediately go down as a system even if they themselves fail and become unusable. There are some that can overcome obstacles. However, it is necessary to be able to support the repertoire of various devices on the market and to connect at low cost. In such a case, the configuration of the second hierarchical system bus 104 may be adopted.
The second layer system bus 104 is connected to ISA, EISA, VM.
If a general-purpose bus such as E is used, many commercially available devices can be connected. Further, as compared with the triple bus, the input / output interface unit is unnecessary, so that the cost is reduced.

Returning to FIG. 12, data transfer from the disk 231 to the main storage devices 50 and 60 will be described. The data transfer request from the disk 231 to the memory and the data thereof are issued as a memory write transaction (including data) by the input / output control device 221, and sent to the input / output interface unit 211. The input / output interface unit 211 is the second layer system bus 204, 2
The transaction is sent synchronously to 05 and 206,
The bus bridges 201, 202 and 203 respectively write to the main storage devices 50 and 60 using the system buses 1, 2 and 3. At this time, the bus bridges 201, 202, 2
03 simultaneously sends a system bus request to the arbitration circuit 90, and at the same time, the system bus use permission signal is returned from the arbitration circuit 90, so that the same transaction is issued at the same time. The write operation of the main storage devices 50 and 60 is the same as described above.

On the contrary, from the main storage devices 50 and 60 to the disk 2
The data transfer to 31 will be described. Main memory 5
The data read request from the disk 231 to 0 and 60 is
It is transmitted to the main storage devices 50 and 60 through the same three routes as the write transaction. Primary main memory 50
Sends the read data to the system buses 1, 2, and 3, and does not send it to the main storage device 60. The read data arrives at the input / output interface unit 211 via the bus bridge 201 → second hierarchy system bus 204, bus bridge 202 → second hierarchy system bus 205, bus bridge 203 → second hierarchy system bus 206, respectively. The input / output interface unit 211 selects data and sends it to the input / output control device 221. The input / output device 231 writes data to the input / output control device 221. In the above operation, all the tripled parts operate in synchronization.

Here, the input / output interface unit 2
The operation 11 will be described with reference to FIG. In the figure,
Reference numerals 204, 205, and 206 denote triple-layered second-level system buses, 211 denotes an input / output interface unit, and 2
11a is a selector, 211b is a comparison circuit, 211c, 2
11d and 211e are driver elements, 211f and 211g.
Is a bus monitor and 211h is a driver element.

In the figure, the system bus 20 of the second layer
4, 205 and 206 are operating in synchronization. The signals from the system buses 204, 205, 206 of the second layer to the input / output control device 221 are compared by the comparison circuit 211b to determine the system bus that is operating normally, and the selector 21
1a selects and outputs. The bus monitor 211g monitors the bus transaction, determines a signal to be sent to the input / output control device 221, and outputs the signal to the driver element 211h.
Is sent to the input / output control device 221. I / O controller 2
21 to the second layer system bus 204, 205, 206
The bus monitor 211f monitors the signal going to the driver, determines the signal to be sent, and outputs the signal to the drivers 211c, 211c.
the second layer system bus 204 via d, 211e,
It is sent to 205 and 206.

Next, returning to FIG. 12, data transfer from the magnetic tape 122 to the main storage devices 50 and 60 will be described. The input / output control unit 112 reads data from the magnetic tape 122, issues a memory write transaction, and reaches the second layer system bus interface unit 110 via the second layer system bus 104. The second layer system bus interface unit 110 sends a memory write transaction to the three bus bridges 101, 102 and 103, and the bus bridge 101 → system bus 1 and the bus bridge 102 → system bus 2, respectively.
The main storage devices 50 and 60 are reached via the bus bridge 103 and the system bus 3. The main storage devices 50 and 60 write the received data in the memory arrays 51 and 61, respectively. On the contrary, from the main storage device 50, 60 to the magnetic tape 1
The data transfer to 22 will be described. The I / O controller 112 issues a memory read transaction to the second level system bus 104, and reaches the main storage devices 50 and 60 through the same three routes as the memory write transaction. The primary main memory device 50 sends the read data to the system buses 1, 2, 3 and the main memory device 60 does not send it. The read data is the bus bridge 10 respectively.
It is selected by the second layer system bus interface unit 110 via 1, 102, 103 and sent to the second layer system bus 104. The input / output device 112 receives the read data from the second layer system bus 104 and writes it on the magnetic tape 122. The above-mentioned tripled parts are all synchronized.

Now, the operation of the interface unit 110 will be described with reference to FIG. In the figure, 10
1, 102 and 103 are triple bus bridges, 10
4 is a second layer system bus, 110 is an interface unit, 110a is a selector, 110b is a comparison circuit, 1
10c, 110d and 110e are driver elements, 101
f and 101g are bus monitors, and 101h is a driver element.

In the figure, bus bridges 101, 10
Reference numerals 2 and 103 are synchronously operating. Bus bridge 10
The signals going from the first, 102, and 103 to the second layer system bus 104 are compared by the comparison circuit 110b, the normally operating system bus is determined, and the selector 110a selects it. The bus monitor 101g monitors the bus transaction, determines a signal to be sent to the second layer system bus 104, and the driver element 101h outputs the signal to the second layer system bus 104. Second level system bus 10
The signal going from the bus bridge 4 to the bus bridges 101, 102, 103 is monitored by the bus monitor 101f, and
The signals that need to be sent to the first, the second, and the third, 103, and 103 are determined and sent to the bus bridges 101, 102, and 103 via the drivers 110c, 110d, and 110e.

(2. Operation and Restoration Processing When Processor Fails) Next, a case where one processor fails will be described. The operation from failure occurrence to recovery is different from the normal operation, and either reliability or performance is sacrificed and deteriorates. In other words, the processing from failure occurrence to recovery differs depending on whether reliability is maintained or performance is maintained. Along with this, the units for online replacement of processors are different. In order to maintain reliability, the processing units other than the processing unit including the failed processor should always perform the triple synchronization operation, and therefore the unit of online exchange is preferably the processing unit unit. On the other hand, to maintain performance,
Processors other than the system bus including the failed processor should always operate and maintain the same number of processing units as in the normal state. Therefore, the unit of online replacement is preferably the system bus unit. Both cases will be described below.

(2.1 Case of Maintaining Reliability) Description will be made with reference to FIG. A case where the processor 11 of the processing unit 10 has a failure while the two processing units are performing different calculations will be described. Due to the failure of the processor 11, the operation of the system bus 1 differs from that of other system buses, and the failure is detected by the selection circuits 53 and 63. Immediately after the selection circuit, the processor 1 on the system bus 1
The outputs of 1 and 21 are disabled (driver 14 in FIG.
f is not significant), and instead the main memory device 50 enters the follow-up mode in which the output of the system bus 2 is sent to the system bus 1. Therefore, a transaction on the system bus 1 can be sent normally even if the processor 11 has failed, and another processor 21 connected to the system bus 1 can continue the synchronous operation with the processors 22 and 23. it can. Therefore, the failed processing unit 10 is stopped at a timing convenient for S / W (for example, when switching tasks) so that a bus transaction will not occur thereafter. Once the processing unit 10 is stopped, the system bus 1 can be returned from the follow-up mode to the three-party comparison mode. This is because, despite the failure of the processor 11, the processor 21 continues to execute the same operation as the processors 22 and 23 in the follow-up mode, so that the internal state is the same as the other processors. When the output of the processor 21 is enabled and the memory control circuit is returned from the follow-up mode to the three-way comparison mode, the three-way comparison by the synchronous operation of the processors 21, 22, and 23 becomes possible. Subsequently, the processing unit 10 including the processor 11 is replaced online, and when the system starts to use again, the original state is restored.

When the system bus 1 is in the follow mode, FIG.
In the comparison circuit 53b shown in FIG. 4, only the system buses 2 and 3 are compared, and the system bus 1 is not a target for comparison and selection. Also, when reading a memory, the AND element 52e
The driver control signal from 1 is suppressed by masking it with the AND circuit 52k to which the control signal from the comparison circuit 53b is input, and the driver 52h does not drive the data. On the other hand, under the control of the comparison circuit 53b, the contents of the register 53e, which holds the contents of the system bus 3 for each clock, are output via the driver 53e. By doing so, the contents of the system bus 3 (same as the system bus 2) are output to the system bus 1. However, a state that is delayed by one cycle is propagated.

(2.2 When Performance is Maintained) The operation will be described again with reference to FIG. A case where the processor 11 of the processing unit 10 has a failure while the two processing units are performing different calculations will be described. Due to the failure of the processor 11, the operation of the system bus 1 differs from that of other system buses, and the failure is detected by the selection circuits 53 and 63. The operation of the system bus 1 is masked by the selection circuit 53, and the operation of the system bus 1 is not transmitted to the memory. In the case of performance maintenance, the processor 11 connected to the system bus 1,
21 is one online exchange unit, and these are exchanged online. At this time, processors 12 and 13, 2
2 and 23 continue the synchronous operation, and the performance can be maintained as before the failure. After the online exchange, the system bus 1 is set to the follow-up mode and is operated in synchronization with the system buses 2 and 3. Then, the processing unit 10 is initialized at a convenient S / W timing (for example, when switching tasks). By doing so, the newly inserted processor 11 starts the synchronous operation with the processors 12 and 13. Further, similarly, the processing unit 20 is initialized at a convenient timing of S / W (for example, when switching tasks). Similarly, the newly inserted processor 21 starts synchronous operation with the processors 22 and 23. Processor 1
The outputs of Nos. 1 and 21 are enabled, and the memory control circuit is returned from the follow-up mode to the three-way comparison mode to restore the original synchronous operation.

(3. Switching between High-Reliability Mode / High-Performance Mode) Here, an example will be described in which a high-reliability computer system and a high-performance computer system are used with the same hardware configuration. As shown in the table of FIG. 20, the computer hardware of this embodiment has a high-reliability mode for achieving high reliability and a high-performance mode for achieving high performance.
Reliability and continuous operation are improved by triple processor and dual main memory. On the other hand, in high-performance mode, each processor operates individually to increase the number of processing units, and main memory also has different addresses. High performance is achieved by supporting a wide address space by storing a range of data.

The inside of the arbitration circuit 90 will be described with reference to FIG. In the figure, 90a is a CPU individual execution designation bit for designating CPU high performance / high reliability, and 9
0b and 90c are majority circuits that take the majority of the three inputs,
90d, 90e, 90f, 90g, 90h and 90i are selectors, 90j is an arbitration circuit for selecting one from four parties, 90k is an arbitration circuit for selecting one from 12 parties, 90l, 90m and 90n are OR elements, 90o, 90p are majority circuits, 90q, 90r, 9
0s, 90t, 90u, 90v are selectors, 90w, 9
0x and 90y are OR elements, 91 is a CPU individual execution mode designating signal, and 92 is a system bus selection signal which bundles the outputs of 90l, 90m, and 90n and indicates which system bus is selected in the individual execution mode. . Signal line 1
1r to 23r are system bus request signals from the processors 11 to 23, which indicate that the processor requests the system bus. Signal lines 11g to 23g are system bus use permission signals to the processors 11 to 23. Indicates that the system bus is allowed to be used. The signal lines 101r to 103r and 201r to 203r are bus bridges 101 to 103 and 201 to 203, respectively.
The system bus request signal from indicates that the bus bridge requests the system bus.
g-103g, 201g-203g is the bus bridge 10
The system bus use permission signals 1 to 103 and 201 to 203 indicate that the processor is permitted to use the system bus.

The operation in the high performance mode will be described. In FIG. 21, the CPU individual execution mode bit 90a of the arbitration circuit 90 is set to individually execute the CPU and improve the processing performance. In addition, in FIG.
Memory duplication designation bits 52o of the selection circuits 50 and 60,
The individual memory access is set by 62o, the primary bits 52d and 62d are set together, and the range of the memory address is set in the memory address range designation registers 52aa and 62aa, respectively. The address ranges set in the memory address range specification registers 52aa and 62aa are different (preferably consecutive without overlapping).
To set. By setting the above registers and bits immediately after powering on the system or immediately after resetting the system, the system can be used in the high performance mode thereafter.

The six processors and the six bus bridges transmit the system bus use request to the arbitration circuit through the signal lines 11r to 23r, respectively, and one of the twelve parties receives one.
One processor is selected by the arbitration circuit 90k for selecting a person. After that, for example, it is assumed that the processor 11 is selected. An output from the arbitration circuit 90k passes through the selector 90d, and a bus use right signal 11g for the processor 11 is output to the processor 11d.
Be transmitted to. Since the CPU individual execution mode bit 90a is set, the selector 90d selects the output of the arbitration circuit 90k instead of the output of the arbitration circuit 90j. At the same time, the output of the arbitration circuit 90k passes through the OR element 90l,
It is output as the system bus selection signal 92. The contents of the CPU individual execution mode bit 90a are also output as the CPU individual execution designation mode signal 91. Then, in FIG.
Then, the selector 53c selects the system bus selection signal 92 by the CPU individual execution designation mode signal 91, the selector 53a selects the system bus 1 by this signal, and the processor 11 can access the memory. In this way, the six processors can perform operations independently. If each processor has a cache, a large amount of processing can be executed with a small number of bus accesses, so that a marked improvement in performance can be expected compared to the case where the processing is executed by two processing units.

Further, at the time of memory access, in the two main storage devices 50 and 60, the individual values are set in the memory access range designation register 52aa, and both the primary bits 52d and 62d are set. The device operates as a primary (that is, read / write) for each individual memory space. Set the memory duplication designation bit 52o and AND
The ECC check circuit 5 is masked by the circuit 52p.
It prevents the output of 2c from affecting the other main memory. In this way, it is possible to support a larger memory space than when using dual memory, and for applications that use a lot of memory and cases where a large number of programs are processed in parallel. As a result, the frequency of saving the memory to the disk can be reduced, and improvement in performance can be expected.

Now, the procedure for setting the high performance mode or the high reliability mode immediately after power-on or system reset will be described. FIG. 22 shows the flow. When the computer of this embodiment is powered on or reset and released, the processor executes the diagnosis of hardware resources such as the main memory, the bus and the processor itself. At this time, the mode may be either high performance or high reliability, whichever is more convenient. If the diagnosis is OK, a processing unit determines the execution mode to be set. The execution mode is switch information outside the computer,
It is determined by the content of the non-volatile memory, the content of a specific address of a normal main storage device, or means such as input from the system console and a combination thereof.
When the execution mode is determined, the processing unit determines various registers (90a, 52aa,
52d, 52o, 62aa, 62d, 62o). FIG. 23 shows an example of values to be set. Once these registers are set, the desired mode is reached. Next, the operating system is started up and the system is put into operation. At this time, the operating system may generate the processor management table and the memory management table according to the currently recognized processing unit or memory space, and the portability of the standard operating system is not impaired.

As described above, in this embodiment, each processing is performed in the high-reliability computer system including the system bus, the main storage device connected to the system bus, and one or a plurality of processing units connected to the system bus. The unit and the main storage device are connected by a plurality of system buses of three or more that execute the same operation, each processing unit is composed of three or more processors that execute the same operation, and the processor is a bus interface unit. Individually connected to the system bus by
The main memory device includes a memory array for storing data, a selection circuit for selecting one of the outputs of the three system buses, a selected output, and a data read from the memory array. Of the memory interface unit for outputting to the system bus, and is composed of a failure detection and a failure part disconnection mechanism for continuing the operation by the remaining configuration of the circuit except the failure part.

Also, two or more main memory devices are connected to a plurality of system buses, three or more, and hold the same data, and each main memory device has means for detecting an error in the held data. Is characterized by.

Further, there are three or more bus bridges connected to these system buses for executing the same operation, and the system buses of the second layer are connected to the respective bus bridges. A selection circuit for selecting any one of the outputs, and an input / output interface unit for outputting the selected output to the input / output control device and for receiving data from the input / output control device. .

Further, there are three or more bus bridges connected to these system buses for executing the same operation, and a selection circuit for selecting any one output of the above three bus bridges and a selected output. Is output to the second layer system bus and a signal from the second layer system bus is sent to the three bus bridges.

In this embodiment, the system bus is composed of a first system bus, a second system bus, and a third system bus, and performs the same operation.
The second processor and the third processor perform the same operation, and the first processor is on the first system bus, the second processor is on the second system bus, and the third processor is on the third system bus. It is connected to each of the 3 system buses,
Similarly, the fourth processor is connected to the first system bus and the fifth processor.
Is connected to the second system bus and the sixth processor is connected to the third system bus. In the high reliability computer system in which the processing unit is one online exchange unit, any one of the above three processors is connected. When one of them fails, the remaining two processors normally stop the execution of the program currently being executed, and then the program is restarted at the 4th, 5th and 6th.
The processing is transferred to the same calculation by the processor.

The function of detecting a processor failure by monitoring the operation of the system bus to which it is connected, the function of individually suppressing the output of each processor, and the operation of the system bus of other system buses. Has a system bus follow-up function for forcibly synchronizing with operation (following operation), suppresses output of the first processor when the first processor fails, and simultaneously connects to the first system bus The output of the fourth processor is suppressed, the first system bus executes the same operation as the second or third system bus, and the fourth processor which has not failed performs the same operation as the fifth and sixth processors. After the second processor and the third processor are stopped, the output of the fourth processor is permitted again, and the first system bus restarts the synchronous operation with the second and third system buses. The features. In addition, each processor has a function of stopping for one cycle or a plurality of cycles when a failure is detected in the bus and a system bus that is performing a follow-up operation with respect to another system bus.
Has a function of performing a follow-up operation delayed by a cycle or a plurality of cycles, and a function of stopping an arbitrary processor for one cycle or a plurality of cycles by a command. When the first processor fails, the output of the first processor is output. By suppressing the output of the fourth processor connected to the first system bus and stopping the output for one or more cycles, the first system bus can be connected to the second or third system bus one or more times. The same operation is executed after a cycle delay, and the fourth processor, which has not failed, is synchronized with the fifth and sixth processors by a fixed cycle delay,
After the second and third processors are stopped, the command causes the fifth and sixth processors to stop for one or more cycles to allow the output of the fourth processor, and then the first system bus changes to the second , And resumes synchronous operation with the third system bus.

In the high reliability computer system in which the processors (first and fourth, second and fifth, third and sixth) connected to the same system bus are one online exchange unit, the first processor If is broken, the second and third,
Each of the fifth and sixth processors has a function of continuing the synchronous operation, and the exchange unit including the first and fourth processors is operated while operating the second and third processors and the fifth and sixth processors. After the replacement, the first system bus has a function of following the second or third system bus.
The operation of the processor is matched with the operation of the second or third processor, and subsequently the operation of the fourth processor is matched with the operation of the fifth or sixth processor.

Further, each processor board has means for suppressing output to the system bus, and the memory interface unit outputs means for outputting a signal change in which the output of the system bus is delayed by a fixed cycle of the operation of another system bus. Of the processors (for example, the first, second, and third processors) that form the processing unit, and has one of the processors compared to the other two processors,
Each processor and each system bus have means for canceling the reset after a certain cycle delay, and each processor and each system bus have means for stopping a certain cycle operation. When the first and fourth processors are replaced online, the first system bus The second, the third
The following system bus is made to follow a certain cycle delay,
When the operation of the first processor is matched with the operation of the second or third processor, the reset of the first processor is released after a certain cycle delay from the release of the reset of the second and third processors. The operation of the processor is matched with the operation of the second or third processor delayed by a fixed cycle, and the operation of the fourth processor is matched with the operation of the fifth or sixth processor delayed by the fixed cycle. After the completion of the above, the second, third, fifth, and sixth processors and the second and third system buses are stopped for a fixed cycle, and at the same time, the outputs of the first and fourth processors are permitted, The bus interface unit changes the first system bus from the follow-up mode to the mode for comparing with the other two system buses, and the first processor changes the second,
It is characterized in that the third processor, the fourth processor, and the fifth and sixth processors and the first system bus restore synchronous operation with the second and third system buses.

In addition, this embodiment has the first and second main memory devices in the high reliability computer system,
The first main memory device has a first memory interface unit, a first selection circuit, a first memory array, and a second memory
The main memory of the second memory interface unit,
A second selection circuit and a second memory array are provided, and each selection circuit is connected to three system buses, respectively, compares the system buses, detects a failure of the failed system bus, and does not fail. It has means for selecting a signal of the system bus and loading it into the main memory device. Further, the first and second memory interface units normally operate synchronously, and the signals of the selected system bus are first and second. Means for simultaneously sending to the two memory arrays, means for generating a check code for checking the read data from the first and second memory arrays, and the check data for checking the correctness of the read data. Means, primary and secondary modes are retained, and the memory interface unit in the primary state is connected to the system bus. The memory interface unit in the secondary state does not send a signal to the system bus, the first and second memory interface units are exclusively in the primary and secondary modes, and the memory interface unit is set to the primary mode. When the data held in the main storage device has an error that cannot be self-corrected, it has a function of exchanging the primary and the secondary of the two memory interface units.

Further, there is a mode in which three or more processors executing the same operation execute different operations in response to a command, and the selection circuit sequentially controls the outputs of the three system buses to perform memory control. And a memory interface unit having means for outputting data from the memory to any of the system buses.

Further, in the high-reliability computer system in which the right to use the system bus decides the use request from each processor by the arbitration circuit, the arbitration circuit of the system bus has a triple synchronous operation mode and an individual operation mode. In the triple synchronous operation mode, however, the bus request signals from the three processing units and the three bus bridges, which are expected to have the same operation, are combined into one by the majority circuit, and then the bus arbitration is performed. And means for performing bus arbitration for bus request signals from all processing units and all bus bridges in the individual operation mode, and the two means can be selected by a command from software. It is characterized by having.

In addition, there is a mode in which three or more processors that execute the same operation execute different operations depending on the command, and the selection circuit sequentially outputs the output of each system bus to the memory by performing contention control. And a memory interface unit having means for outputting data from the memory to any system bus, and the two memories are modes accessed at different addresses. And

Further, means for designating the operation mode of the system bus and the operation mode of the main memory device by an external switch, a memory of a specific address, a non-volatile memory element, etc., and an operation mode and an operation mode of the main memory device by software. Just after the system is powered on or reset, the system bus operating mode or main memory operating mode can be set based on the external switch information, the memory of a specific address, or the contents of the non-volatile memory. It is characterized by having a procedure of reading, setting the mode by means necessary for mode setting, and booting the operating system after they are completed.

According to this system, in order to improve the performance of the CPU, the processor, the cache memory, and the system bus are integrated and tripled, and they are operated synchronously with the same clock. A main memory device that is not required to be as fast as a processor is connected to a tripled system bus by an interface device. When the reliability of the main storage device is required, this is duplicated. I / O devices have variations in configuration (I / O bus triple, double, non-redundant) due to the required properties of I / O (reliability, economy, versatility, compatibility). There is.

Further, according to this system, among the tripled system buses, the system bus to which the processor requiring the failure occurrence / recovery processing is connected follows another system bus, thereby causing the failure occurrence. It is possible to adopt a configuration that avoids a decrease in reliability during time or a configuration that avoids a decrease in performance during recovery processing.

Further, according to this system, the mode in which the triplicated system bus and the processors connected thereto are individually operated, and the mode in which the duplicated main memory device is recognized as an individual address space ,
By having a mode in which the multiplexed I / O buses can be individually accessed, a high-performance computer system can be constructed with the same hardware.

Example 3. A configuration example of a system bus of a second layer different from that of the first embodiment is shown. This embodiment will be described below with reference to FIG. In the figure, the same reference numerals as those in FIG. 1 indicate the same parts as those in FIG. 301 and 302 are bus switches, 303 and 304 are second-level system buses, 311, and 312 are input / output interface units that select the output of the second-level system buses 303 and 304, 321 and 322 are input / output control devices,
Reference numerals 331 and 332 are input / output devices (disk, LAN).

Regarding memory access from the CPU,
The description is omitted because it is the same as that of the first embodiment. Here, memory access from the input / output devices 331 and 332 will be described. The second level system bus 30 in this embodiment.
3, 304 need to add a fault detection function such as parity on the bus. The parity generation is performed by the bus bridge or the bus switch and the input / output interface unit, so that the input / output interface unit or the bus switch can detect the fault of the second hierarchy system bus and select the correct data of the bus. In this case, the tripled second layer system buses 201 and 2 of the first embodiment are used.
Comparing reliability and economic efficiency with Nos. 02 and 203, the input / output interface unit can be made smaller and less expensive than the triple bus of the first embodiment, which is economical. If you can not add parity to, there may remain reliability problems). Further, it is economically disadvantageous as compared with a non-redundant bus without parity etc., but it can be said that reliability is considerably high because continuous operation by failure detection / isolation can be performed when a failure occurs.

Here, from the disk 331 to the main storage device 5
Data transfer to 0 and 60 will be described. The data transfer request and data from the disk 331 to the memory are converted into a write transaction by the input / output control device 321 and sent to the input / output interface unit 311. The input / output interface unit 311 is a second layer system bus 303,
Send a transaction (including data) to 304,
The bus switches 301 and 302 are reached, respectively. One of the bus switches 301 and 302 becomes the primary, sends the transaction to the bus bridges 101, 102 and 103, and writes the transactions to the main storage devices 50 and 60 via the system buses 1, 2 and 3, respectively. If there is a failure in the second-tier system bus, the failure detection mechanism of the bus such as parity detects it in the bus switches 301 and 302, and the one without failure becomes the primary, and the transaction is sent to the bus bridges 101, 102 and 103. Send out. Therefore, the system can be continued without stopping even if a failure occurs in the second layer system bus.

On the contrary, from the main memory 50, 60 to the disk 3
A case where data is transferred to 31 will be described. The transfer request for the memory data of the main storage devices 50 and 60 from the disk 331 is transmitted to the main storage devices 50 and 60 through the same three routes as the write transaction. The primary main memory device 50 transfers the read data to the system buses 1, 2,
3 to the main storage device 60, but not to the main storage device 60. The read data reaches the bus switches 301, 302 via the bus switches 101, 102, 103, and the bus switch 3
01 and 302 compare the data from the bus switches 101 to 103 and send the correct data to the second layer system buses 303 and 304, respectively, and the input / output interface unit 311 receives the both data and selects the correct one. , To the input / output control device 321. The input / output control device 321 transfers the read data from the memory to the disk 331.
To store. If there is a failure in the second hierarchical system bus 303 or 304, it is detected by the input / output interface unit 311 by a bus failure detection mechanism such as parity, and the input / output interface unit 311 selects the data having no failure, Transfer to the input / output control device 321. Therefore, the system can be continued without stopping even if a failure occurs in the second layer system bus.

The operation of the bus switch 301 will now be described with reference to FIG.
It will be described based on 5. In the figure, 101, 102,
Reference numeral 103 is a bus bridge, and 303 is a second layer system bus, which is composed of a normal bus 303a and a parity bus 303b. Reference numeral 301 denotes a bus switch, which is a selector 301a,
Comparing circuit 301b, driver elements 301c, 301d,
301e, parity check circuit 301f, parity generation circuit 301g, driver element 301h, primary bit 301i, other primary request output signal 301j, own primary request input signal 301k, bus monitor 301
l, driver element 301m, bus monitor 301o, AN
It is composed of a D element 301p. Normally, one of the primary bits 301i and 302i (the primary bit of the bus switch 302) is exclusively set. Here, it is assumed that the primary bit 301i is set.

In the case of a signal to be sent from the bus bridges 101, 102, 103 to the second layer system buses 303, 304, the bus bridges 101, 102, 103 perform a synchronous operation and their output signals are compared by the comparison circuit 301b. The normally operating output is selected and output by the selector 301a. The output is monitored by the bus monitor 301l to determine a signal to be output to the normal bus 303a, and the driver 301h detects the signal and outputs the signal to the normal bus 303a of the second layer system bus.
Output to. At the same time, the parity signal is the parity generation circuit 3
01g and is output to the parity bus 303b by the driver element 301h. In this case, bus switch 301
The bus switch 302, which is a pair of, operates exactly the same, so that the second hierarchical system buses 303 and 304 operate synchronously by the bus switch 302.

On the other hand, the second layer system buses 303, 30
In the case of a signal to be sent from 4 to the bus bridges 101, 102, 103, since the second layer system buses 303, 304 are in synchronous operation, the bus switches 301 and 302 are in synchronous operation. The bus monitor 301o monitors the bus transaction, and the bus switches 101, 102, 1
03, if there is a signal to be sent, the parity signal 303
b and the signal of the normal bus 303a are checked by the parity check circuit 3
01f checks the validity of the second layer system bus 303. If there is no error, since the primary bit 301i remains set, the output control signal from 301o is transmitted to the drivers 301c, 301d and 301e via the AND element 301p. Therefore, the signals of the normal bus 303a are transmitted to the drivers 301c, 30
1d and 301e output, bus switch 101, 10
2, 103 receives. If there is an error, the primary bit 301i is reset and the bus switch 301 is set to the second
No signal is output from the hierarchical system bus 303. At the same time, the other primary request signal 301j is output, the paired bus switch 302 is input as its own primary request input signal 302k, and the primary bit 302i is set,
If there is no error in the second layer system bus 304, that signal is output and the bus switches 101, 102 and 103 receive it.

Here, the input / output interface unit 3
The operation 11 will be described with reference to FIG. In the figure, 303a is a normal bus of the first second hierarchy system bus, 303b is the same parity bus, 304a is a normal bus of the second second hierarchy system bus, 304b is the same parity bus, 311a is a selector, 311b is parity. Check circuits 311c and 311d are parity generation circuits, 31
1f is a driver element, 311g is a bus monitor, and 321 is an input / output control device.

In the figure, the system bus 30 of the second layer
Reference numerals 3 and 304 indicate a synchronous operation of the system bus of the second layer, and signals from 303 and 304 to the input / output control unit 321 are checked by the comparison circuit 311b for parity of both system buses of the second layer to operate normally. The second-tier system bus that is operating is determined, and the selector 311a selects and outputs it.
The bus monitor 311e monitors the bus transaction and determines the signal to be sent to the input / output control device 321.
The driver element 311f outputs the signal to the input / output control device 321.
Send to. A signal sent from the input / output control device 321 to the second hierarchical system buses 303 and 304 is a bus monitor 311.
g monitors the signal, determines the signal to be transmitted, and sends the signal via the drivers 211h and 211i to the normal bus 303a, 3b.
04a. At the same time, the parity generation circuit 311c,
Parity data is generated at 311d and the parity bus 30 is generated.
3b, 304b.

As described above, in this embodiment, each processing unit is composed of three or more processors that execute the same operation, and the processors are individually connected to the system bus by the bus interface unit. Which have three or more bus bridges that perform the same operation and are connected to each other, and two selection circuits that select one of the outputs of the three bus bridges, and the selected output is a second hierarchical system bus. And two second layer system bus interface units for outputting the signals from the second layer system bus to three bus bridges.

Example 4. The main storage device shown in the first embodiment has the following problems in terms of reliability. When the memory is written, the data on the memory data bus 51a is used to
The generation circuit 52b generates the ECC, but the selector 53a
If there is a failure in the memory data bus 51a on the path from to the ECC generation circuit 52b, the ECC generation circuit 52b will generate ECC for the changed illegal data, and when reading the data, the ECC check circuit Data error cannot be detected at 52c. Therefore, if the main storage device is the primary memory, erroneous data will be output to the triple system bus as it is. Further, at the time of memory read, when the main storage device is a primary memory and there is a failure between the point where the ECC check circuit 52c on the memory data bus 51a takes in the data and the point where the system bus 1, 2, 3 branches. , The ECC check circuit 52c has not detected an error, the correct data is changed and is sent to the system buses 1, 2, and 3 as invalid data. If this happens, the system will malfunction.

Therefore, as another embodiment, an example in which the selection circuit has higher performance and higher reliability than those shown in the first embodiment is shown in FIG.
7 shows. In the figure, the memory array block 51 is
It is composed of a memory data bus 51a, an ECC data bus 51b, a memory array 51c, and an ECC array 51d. The memory interface unit 52 includes a memory control circuit 52a, a primary bit 52d, an AND element 52.
e, other primary request output line 52f, own primary request input line 52g, ECC check circuits 52h, 52i, 5
2j, OR element 52n, memory data bus driver 52
It is composed of k, 52l and 52m. The interface unit 53 includes a selector 53a, a comparison circuit 53b, system bus drivers 53c, 53d, 53e, ECC generation circuits 53f, 53g, 53h, and a selector 53i. The primary bit 52d is a bit indicating that the main storage device is the primary and drives read data. One primary bit of the main storage device duplicated in the main storage devices 50 and 60 is set as a primary. And the other primary bit is not set as secondary. In this example, since the main storage device 50 is the primary storage device, the primary bit 52d is set and the equivalent bit of the main storage device 60 (not shown, 62d) is not set.

The operation of the system buses from the system buses 1, 2 and 3 is compared by the 53b comparison circuit, and the output of the bus which is operating normally is selected by the selector 53a and output to the memory data bus 51a. At the same time, the ECC generation circuit 53
f, 53g, and 53h generate ECC data from the data of the system buses 1, 2, and 3, and the ECC data generated from the data of the bus that is operating normally is selected by the selector 53i and output to the ECC data bus 51b. It The memory control circuit 52a analyzes the bus transaction,
If it is an access (read or write) to its own memory, the following operation is performed.

At the time of memory write, the memory control circuit 52a
Stores data on the memory data bus 51a in the memory array 5
Control is performed to write to 1c, and the data is stored in the memory array 51c. At the same time, the ECC data bus 51
The ECC data on b is stored in the ECC array 51d under the control of the memory control circuit 52a. Compared with Example 1, E
Since the failure detection by the CC data device 53b and the ECC generation by the ECC generation circuits 53f, 53g, and 53h can be performed at the same time, and the writing to the memory array 51c and the ECC array 51d can be performed at the same time, the memory write operation is completed in a short time. This state is shown in FIG. Also, EC
Since the data for generating C is directly taken from the system buses 1, 2, and 3 different from 51a, if the memory data bus 51a fails and the illegal data is written to the memory array 51c, at the time of reading. It can be detected as an ECC error. Further, the ECC generation circuits 53f, 53g, 5
If a bus near 3h fails, the selector 5
An incorrect ECC code is selected in 3i and the ECC array 51 is selected.
Although written in d, it can still be detected at the time of reading.

At the time of memory read, the memory control circuit 52a
Performs control to read data at a desired address in the memory array 51c and the ECC array 51d. Memory data is stored in the memory data bus 51a and ECC data is stored in the EC
It is output to the C data bus 51b. These data are passed through the memory data bus drivers 52k, 52l, 52m and then checked for validity by the ECC check circuits 52h, 52i, 52j. ECC check circuit 52
When any of h, 52i, and 52j detects an ECC2 bit error, those outputs reset the primary bit 52d via an OR element. If the data is valid, the content of the primary bit 52d remains unchanged and remains set. Therefore, the system bus driver 53
c, 53d, and 53e are controlled by the memory control circuit 52a via the AND element 52e so that the memory data bus 5
The memory data on 1a is output to the system buses 1, 2, and 3. Since this is done, the failure at one point of the data path in the memory array block 51, the memory interface unit 52, and the interface unit 53 is E
Only one of the system buses 1, 2 and 3 can detect incorrect data even if it is detected by the CC check circuits 52h, 52i and 52j, or if it is not detected, the system malfunction can be avoided.

As described above, in this embodiment, the means for generating the check code for the validity of the memory data is tripled, and the check code generation means is tripled.
It is characterized in that it is connected to each of the two system buses and has a function of selecting and storing one of them according to the output of the comparison circuit of the system bus. In addition, 3 means for checking the validity of the memory data by the check code are provided.
It is characterized in that it is connected to each of the data paths to the redundant and triple system buses.

Example 5. Further, as another embodiment, FIG. 29 shows an example in which a plurality of processors are enclosed in one chip.
In the figure, 1 is a system bus, 41 is an LSI in which two processors are enclosed, and has processors 11 and 12 inside, 41a is a reset signal of the processor 11,
41b is a reset signal of the processor 12, 41c is a system bus request signal of the processor 11, 41d is a system bus request signal of the processor 12, 41e is a system bus use permission signal of 11, 41f is a system bus use permission signal of the processor 12, 41g Are processors 11 and 1
Other input / output signals for 2 include address, data and control lines. 42 is a bus interface unit, 42
a to 42h are driver elements, 42i is an output enable signal, 42j is a reset signal for the processor 11, and 42k is a processor 12 reset signal.

The operation will be described. Processor 11,
12 performs individual calculations, and when a request to use the system bus 1 is generated, the system bus request signal 41
c and 41d are sent to the arbitration circuit, and when they receive the system bus use permission signals 41e and 41f from the arbitration circuit, respectively, the input / output signal 41g.
To use the system bus 1 via the drivers 42a and 42b. Here, the system bus 11 is used by the arbitration circuit by the processor 11,
Since it is limited to one of 12, only one signal other than reset, system bus request, and system bus use permission signal is used at a time, so that they can be commonly used. On the other hand, the system bus request and the system bus use permission signal are not common to clarify the user of the bus to the external circuit. Also, the reset is not common so that it can be reset for each processor.

By clearly distinguishing the reset and bus usage rights for each processor, even if one processor is stopped while the system is running, the other processor can execute the processing synchronously in the follow-up mode. it can. Therefore, the reset of the processing unit due to the resynchronization processing and the interruption of the normal processing due to the initialization processing are limited to the interruption of the execution of one processor at a time, and the performance degradation can be suppressed.

As described above, according to this embodiment, the first and fourth processors, the second and fifth processors, and the third and sixth processors are enclosed in the same chip, and even if they are in the same chip, each processor is A reset can be input from outside the chip to each processor, and each processor has a means to control the stop of the processor from outside the chip. The system bus use request output to the outside and the bus use permission input that is the response are controlled per processor. It is characterized by being possible.

As described above, by separating a part of the input signals (reset, bus enable signal) of a plurality of processors for each processor and commonizing the other signal lines and enclosing them in one LSI, a small number of I High-performance chips can be realized with / O pins.

Further, by enclosing a plurality of processors in one chip and using most of the input / output signals as common pins, it is possible to realize the same performance with a small number of parts and a small number of pins, and the reliability is improved. To do.

Example 6. Further, another embodiment of the present invention will be described with reference to the drawings. In FIG. 30, 1, 2, 3,
Reference numeral 4 is a quadruple system bus. Reference numeral 10 is a processing unit, and 11, 12, 13, and 14 are quadruple processors constituting the processing unit 10, and bus interface units 15, 16, 17, 1,
8 are connected to the system buses 1, 2, 3, and 4, respectively. Similarly, 20 is a processing unit, and 21, 22, 22, and 24 are processors, 25, and 2.
Reference numerals 6, 26 and 27 are bus interface units.
50 is a main memory device, 51 is a memory array block, 52 is a memory interface unit, and 53 is a selection circuit for selecting one of the four system bus outputs.
Similarly, 60 is a main memory, 61 is a memory array,
62 is a memory control circuit, and 63 is a selection circuit. 90 is an arbitration circuit that determines the user of the system bus, 101, 102, 103 and 104 are bus bridges that connect the system bus and the second layer system bus, and 110 is one of the outputs of the quadrupled bus bridge. Second layer system bus interface unit to select one, 1
Reference numeral 05 is a second layer system bus. 111, 112,
Reference numeral 113 is an input / output control device connected to the second hierarchical system bus 105, and reference numerals 121, 122 and 123 are input / output devices connected to the input / output control devices 111, 112 and 113, respectively.

Next, the operation will be described. During normal operation, the processors 11, 12, 13, 14 perform the same operation, the processors 21, 22, 23, 24 also perform the same operation, and the bus bridges 101, 102, 103, 1
04 performs the same processing, and therefore the system buses 1, 2,
3 and 4 perform the same operation.

One processor (eg processor 1
When a failure occurs in 1), the operation of the system bus 11 is different from the other three, and the selection circuits 53 and 63 and the second hierarchical system bus interface unit 110 do not select the system bus 1 in which the failure has occurred. The system can continue to run normally. That is, the processors 12, 13, 14
Can continue the same operation, the processors 22, 23, 24 can also continue the same operation, and the bus bridges 102, 103, 1
The same calculation can be continued in 04, so that the system bus 2,
3 and 4 continue the same operation.

In this state, the operator or maintenance staff waits for the processor 11 to be replaced. During this period, it is usually desirable to have several hours to one day, but in some cases, it may be necessary to wait for several days. During this time, another processor may further fail. However, in this case as well, the system bus is operating in triple synchronization,
The failure can be correctly detected by the selection circuits 53 and 63 and the second hierarchical system bus interface unit 110 and can be disconnected (that is, not selected), and the system can continue to operate normally.

After the processor 11 is replaced, the system bus 1 is set to the follow-up mode and the other system buses 2, 3,
4 and then the processors 11, 12,
13 and 14 are reset / initialized at the same time to match the internal states, similarly, the processors 21, 22, 23 and 24 are reset / initialized at the same time to match the internal states, and the tracking mode of the system bus 1 is released. Return to the normal execution state.

By quadrupling the system bus as described above, even if one processor fails, the system bus is tripled and synchronized until the replacement of the processor is completed. Each selection circuit can determine a normal bus by a so-called majority vote, and can correctly detect and isolate a failure even with respect to the failure of another processor. Therefore, it is possible to realize a configuration in which performance and reliability are not deteriorated when a failure occurs.

Example 7. With this configuration, another operation example will be described. 30, in normal operation, the processors 11, 12, and 13 execute the same operation, and the processors 21, 22, and 23 also execute the same operation, and the bus bridge 1
01, 102, 103 perform the same processing, and therefore the system buses 1, 2, 3 perform the same operation. Processor 1
4, 24 and the bus bridge 104 are stopped as spares. Therefore, the power consumption is smaller than when the processors 14 and 24 and the bus bridge 104 are operating.

One processor (eg processor 1
When a fault occurs in 1), the operation of the system bus 11 is different from the other two, and the selection circuits 53 and 63 and the second hierarchical system bus interface unit 110 do not select the faulty system bus 1, The system can continue to run normally. That is, the processors 12 and 13 can continue the same operation, the processors 22 and 23 can also continue the same operation, and the bus bridges 102 and 103 can also continue the same operation, so that the system buses 2 and 3 continue the same operation.

Processors 11 and 21, bus bridge 10
1 is stopped, then the processors 14 and 24 and the bus bridge 104 are started to operate (here, the synchronous operation with other processors is not performed), and then the system bus 4 is set to the follow-up mode and the other system bus Do the same operation as a few. The processors 12, 13 and 14 are reset and initialized at the same time to adjust the internal states, and the processor 2
2, 23, 24 are reset / initialized at the same time, the internal states are matched, the follow-up mode of the system bus 4 is released, and the system enters the triplex synchronous execution state of the system buses 2, 3, 4.

In this state, the operator or maintenance staff waits for the processor 11 to be replaced. During this period, it is usually desirable to have several hours to one day, but in some cases, it may be necessary to wait for several days. During this time, another processor may further fail. However, in this case as well, the system bus is operating in triple synchronization,
The failure can be correctly detected by the selection circuits 53 and 63 and the second layer system bus interface 110, and can be disconnected (that is, not selected), and the system can continue to operate normally.

After the processor 11 is replaced, the processors 14 and 24 and the bus bridge 104 are stopped, and then the processors 11 and 21 and the bus bridge 101 are started to operate. Subsequently, the system bus 1 is set to the follow-up mode, the same operation as that of the other system buses 2 and 3 is performed, and then the processors 11, 12, and 13 are simultaneously reset / initialized, the internal states are adjusted, and similarly, the processor 21 ,
22 and 23 are reset and initialized at the same time, the internal states are matched, the follow-up mode of the system bus 1 is released, and the system returns to the original normal execution state.

As described above, the system bus is quadrupled, three of them are operated synchronously, and one of them is spare, so that even if one processor fails, the replacement work of the processor is completed. Up to 3 system buses
By performing the redundant synchronous operation, each selection circuit can determine a normal bus by a so-called majority vote, and can correctly detect and disconnect the failure even for the failure of another processor. Therefore, it is possible to realize a configuration in which performance and reliability are not deteriorated when a failure occurs. Moreover, since only three system buses are normally operated, the power consumption is smaller than that in the fifth embodiment, and a power source having a small capacity is sufficient, which is economically advantageous.

As described above, in this embodiment, the system bus is composed of the first, second, third and fourth system buses, performs the same operation, and each processing unit has the first and second processing buses. With second, third and fourth processors,
Performing the same operation, the first processor is on the first system bus, the second processor is on the second system bus, the third processor is on the third system bus, and the fourth processor is on the fourth system bus.
Are connected to the fourth system bus, similarly, the fifth processor is connected to the first system bus, the sixth processor is connected to the second system bus, and the seventh processor is connected to the third system bus. In addition, the eighth processor is connected to the fourth system bus respectively, and the processors (first, fifth, and second) connected to the same system bus are connected.
And 6th, 3rd and 7th, 4th and 8th) are one online exchange unit, and in the case of a failure of the 1st processor, the 2nd and 6th, 3rd and 7th ,
Each of the fourth and eighth processors has a function of continuing the synchronous operation, and an exchange unit including the first and fifth processors is referred to as a second and a sixth, a third and a seventh, and a fourth and an eighth. Has a function of following the first system bus with the second, third, or fourth system bus after replacing the first processor with the second processor or the third system bus. Alternatively, the operation of the fifth processor is subsequently adjusted to the operation of the fourth processor, and the operation of the fifth processor is then adjusted to the operation of the sixth, seventh, or eighth processor.

The system bus comprises first, second, third and fourth system buses, and the processing unit comprises first, second, third and fourth processors. To the first system bus, the second processor to the second system bus, the third processor to the third system bus, and the fourth processor to the fourth system bus.
The respective processing buses are connected to each other, and similarly, the other processing unit includes fifth, sixth, seventh, and eighth processors, and the fifth processor is connected to the first system bus and the sixth processor. Is connected to the second system bus, the seventh processor is connected to the third system bus, and the eighth processor is connected to the fourth system bus. The first, second, and third system buses are connected. Perform the same operation, and the fourth system bus is stopped as a standby system.
The second and third processors execute the same operation, the fourth processor is stopped, the fifth, sixth, and seventh processors execute the same operation, and the eighth processor A high-reliability computer system in which the processors (first and fifth, second and sixth, third and seventh, fourth and eighth) that are stopped and connected to the same system bus are one online exchange unit In the case where the first processor fails, means for the second and sixth, third and seventh processors to continue the synchronous operation, and immediately to bring the fourth processor into the state of the second or third processor. And an exchange unit including means for synchronizing the eighth processor to the sixth or seventh state, the exchange unit including the first and fifth processors, the second and sixth, the third and seventh, and the fourth. After replacing the 8th processor while operating, It has a feature that allows follow operation in the second or third or fourth system bus Mubasu, first
The operation of the second processor is matched with the operation of the second, third or fourth processor, and subsequently the operation of the fifth processor is matched with the operation of the sixth, seventh or eighth processor. To do.

[0164]

As described above, according to the present invention, the factors that hinder the high frequency operation of the processor are not included,
Higher reliability can be achieved by triple processor. In addition, a high-performance and highly reliable computer can be constructed, and I / O can be configured to require reliability, and there is an effect that a configuration requiring economic efficiency can be obtained.

Further, there is an effect that it is possible to construct a computer system whose reliability is not deteriorated and a computer system whose performance is not deteriorated at the time of failure occurrence / recovery processing.

Further, it is possible to construct both a system requiring high reliability and a system requiring high performance with the same hardware.

Furthermore, by enclosing a plurality of processors in one package, a high-performance system can be realized in a smaller size.

In particular, according to the first aspect of the invention, since the processor and the system bus are tripled, the performance of the multiplexed computer can be improved.

According to the second invention, since a plurality of processors are present on one bus, the performance of the computer system is further improved.

According to the third invention, since the data transfer is controlled by the selection circuit, the data transfer between the multiplexed bus and the non-multiplexed device can be performed without contradiction.

According to the fourth invention, since the bus is tripled, the fault detecting means can easily detect the fault.

According to the fifth invention, it is possible to provide a system in which reliability is not deteriorated even if a failure occurs because the failed bus is disconnected.

According to the sixth invention, since the main storage device is connected to the tripled bus, the reliability of data transfer to the main storage device can be improved.

According to the seventh invention, since the main memory device is duplicated, the reliability of the memory portion can be improved.

According to the eighth invention, it becomes possible to connect the peripheral equipment system to the triple system.

According to the ninth invention, the system in the peripheral device system is tripled, so that the peripheral device system itself can be made highly reliable.

According to the tenth aspect of the invention, since the bus in the peripheral device system is a single bus, the peripheral device system can be manufactured at low cost.

According to the eleventh invention, the bus inside the peripheral device system is duplicated, so that it can be made cheaper than the triplicated bus as described above, and higher in reliability than the single bus.

According to the twelfth aspect of the invention, even when there are a plurality of main storage devices, the data can be transferred without contradiction by causing the primary storage device to transmit the data.

According to the thirteenth invention, when the checking means determines that the data is not valid, the primary main memory device can be replaced, so that the valid data is transferred even if a failure occurs. be able to.

According to the fourteenth aspect, since the check code generation is tripled, the reliability of the main storage device can be improved.

Further, according to the fifteenth invention, since the checking means is tripled, the reliability of the main storage device can be improved.

According to the sixteenth invention, since the synchronous operation mode and the individual operation mode are provided, a highly reliable computer and a high performance computer can be realized by the same hardware.

According to the seventeenth invention, in the individual operation mode, the selection circuit performs control for the individual operation, so that no special change is required to the other parts in the individual operation mode.

In the eighteenth invention, the arbitration means can support the synchronous operation mode and the individual operation mode, so that the bus can be normally acquired in any operation mode.

According to the nineteenth invention, when a plurality of main memory devices are present, each address space is made different in the individual mode, so that it is possible to access a wider address space. Become.

According to the twentieth aspect, either mode can be arbitrarily set by the mode designating means and the mode setting means when the system is started up or when the system is reset.

According to the twenty-first invention, two chips are provided in one chip.
It is possible to control the processors individually while enclosing one processor.

According to the twenty-second aspect, since the processor chip described above is used in the system, a high performance system can be realized in a smaller size.

According to the twenty-third aspect, since the bus is quadrupled, a more reliable system can be obtained.

According to the twenty-fourth aspect, since the processor is operated in such a manner that the reliability is maintained even when a failure occurs, the reliability can be maintained even when the failure occurs.

According to the twenty-fifth aspect, it is possible to provide a highly reliable computer system even when a failure occurs and after the failure is recovered.

According to the twenty-sixth aspect, failure recovery can be performed by simply stopping a plurality of cycles.

According to the twenty-seventh invention, a high-performance system can be provided even when a failure occurs.

According to the twenty-eighth aspect of the invention, it is possible to realize a failure recovery method for continuing the processing while maintaining the performance even with the occurrence of the failure described above, with only a fixed cycle delay.

[Brief description of drawings]

FIG. 1 is a schematic configuration diagram of the present invention.

FIG. 2 is a schematic configuration diagram in the case of two logical CPUs according to the present invention.

FIG. 3 is a schematic configuration diagram when the memory of the present invention is duplicated.

FIG. 4 is a schematic configuration diagram of a high performance mode of the present invention.

FIG. 5 is a schematic configuration diagram having a peripheral device system of the present invention.

FIG. 6 is a schematic configuration diagram having a peripheral device system of the present invention.

FIG. 7 is a schematic configuration diagram having a peripheral device system of the present invention.

FIG. 8 is a diagram for explaining an operation when disconnecting a defective CPU according to the present invention.

FIG. 9 is a diagram showing replacement of the CPU board of the present invention.

FIG. 10 is a diagram showing replacement of the CPU board of the present invention.

FIG. 11 is a schematic diagram of a processor chip of the present invention.

FIG. 12 is a block diagram of a high reliability computer according to an embodiment of the present invention.

FIG. 13 is a block diagram around a processor according to an embodiment of the present invention.

FIG. 14 is a block diagram of a main memory device according to an embodiment of the present invention.

FIG. 15 is a diagram showing setting / resetting of a primary bit according to an embodiment of the present invention.

FIG. 16 is a diagram showing a failure detection means according to an embodiment of the present invention.

FIG. 17 is a diagram illustrating a failure detection unit according to a conventional example.

FIG. 18 is a block diagram of an input / output interface unit according to an embodiment of the present invention.

FIG. 19 is a block diagram of an interface unit according to an embodiment of the present invention.

FIG. 20 is a diagram showing a high reliability mode / high performance mode according to an embodiment of the present invention.

FIG. 21 is a block diagram of an arbitration circuit according to an embodiment of the present invention.

FIG. 22 is a flowchart immediately after power-on / reset according to an embodiment of the present invention.

FIG. 23 is a diagram showing a setting example of a mode setting related register according to an embodiment of the present invention.

FIG. 24 is a block diagram of a high reliability computer according to another embodiment of the present invention.

FIG. 25 is a block diagram of a second layer system bus interface unit according to another embodiment of the present invention.

FIG. 26 is a block diagram of an input / output interface unit according to another embodiment of the present invention.

FIG. 27 is a block diagram of a main memory device according to another embodiment of the present invention.

FIG. 28 is a diagram showing means for detecting a failure according to another embodiment of the present invention.

FIG. 29 is a block diagram around a processor according to another embodiment of the present invention.

FIG. 30 is a block diagram of a high reliability computer according to another embodiment of the present invention.

FIG. 31 is a block diagram of a conventional high reliability computer.

[Explanation of symbols]

 1 System Bus 2 System Bus 3 System Bus 10 Processing Unit 11 Processor 12 Processor 13 Processor 14 Bus Interface Unit 15 Bus Interface Unit 16 Bus Interface Unit 20 Processing Unit 20 Processing Unit 21 Processor 22 Processor 23 Processor 24 Bus Interface Unit 25 Bus Interface Unit 26 bus interface unit 50 main storage device 51 memory array 52 memory interface unit 53 selection circuit 60 main storage device 61 memory array 62 memory interface unit 63 selection circuit 90 arbitration circuit 101 bus bridge 102 bus bridge 103 bus bridge 104 second level system Mubus 110 Second layer system Bus interface unit 111 Input / output control device 112 Input / output control device 113 Input / output control device 121 Input / output device 122 Input / output device 123 Input / output device 201 Bus bridge 202 Bus bridge 203 Bus bridge 204 Second layer system Bus 205 Second layer system bus 206 Second layer system bus 211 Input / output interface unit 212 Input / output interface unit 213 Input / output interface unit 221 Input / output control device 222 Input / output control device 223 Input / output control device 231 Input / output device 232 Input / output Device 233 Input / output device

 ─────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Hiroaki Yasunaga 325 Kamimachiya, Kamakura City Mitsubishi Electric Corporation Computer Works

Claims (28)

[Claims] 1. A computer system having the following elements: (a) three or more buses for transferring data, (b) a processing unit comprising three or more processors individually connected to the plurality of buses and operating in the same manner. (C) A device accessed from the processor via a bus, a selection unit that selects a bus between the three or more buses and the device, and a data transfer between the bus and the device selected by the selection unit. A subsystem having a control unit for controlling the. 2. The computer system according to claim 1, wherein there are a plurality of processing units, and a plurality of processors are connected to one bus. 3. The selecting means, when transferring data from a bus to a device, selects one bus from a plurality of buses to connect with the device, and when transferring data from the device to the bus, the selecting means selects a plurality of buses. The computer system according to claim 1, wherein the computer system is selected and connected to a device. 4. The control unit includes failure detection means for comparing the data of the three or more buses to detect the occurrence of a failure and controlling the bus selection of the selection means based on the detection result. The computer system according to claim 1, wherein 5. The computer system according to claim 1, wherein the computer system comprises disconnecting means for disconnecting a bus having a failure based on the detection result of the failure detecting means. 6. The sub-system is a main storage device, the device is a memory, and the control unit is a memory control unit that transfers data between the memory and the bus. The computer system according to 2, 3, 4, or 5. 7. The computer system according to claim 6, comprising a plurality of the main storage devices, each of which is connected to each of the plurality of buses. 8. The subsystem is a peripheral device system, the device is an input / output device, and the control unit is an input / output control device for performing data transfer between the input / output device and the bus. The computer system according to claim 1, 2, 3, 4, or 5. 9. The peripheral device system includes three or more second buses corresponding to the plurality of buses, and three or more bus bridges respectively connecting the buses and the second buses. The computer system according to claim 8. 10. The computer system according to claim 8, wherein the peripheral device system comprises a third bus consisting of one bus between the selecting means and the input / output device. 11. The peripheral device system comprises two selection means, and a fourth bus composed of two buses between the two selection means and the input / output device. The described computer system. 12. The main storage device comprises a primary main storage device that sends data to the bus and a secondary main storage device that does not send data to the bus. Computer system. 13. The primary main memory device comprises a check means for checking the validity of data transferred to the bus, and a replacement means for replacing the secondary main memory device with the primary main memory device based on the check result of the checking means. The computer system according to claim 12, further comprising: 14. The checking means selects a plurality of redundant code generating means for generating a redundant code for checking the correctness of the data transferred from each bus, and a correct redundant code from the plurality of generated redundant codes. 2. A redundant code selecting means for storing the data in a stored form.
The computer system according to 3. 15. The computer system according to claim 13, wherein said checking means includes a plurality of redundant code checking means for checking a redundant code corresponding to each bus. 16. The synchronous operation mode in which the computer system synchronously operates three or more buses as an operation mode,
2. The computer system according to claim 1, further comprising an individual operation mode for operating three or more buses asynchronously. 17. The selection means controls data competition from a plurality of buses to a device in the individual operation mode, and outputs data from the device to any of the corresponding buses. The described computer system. 18. The computer system further processes a bus acquisition request output to a plurality of buses as one bus acquisition request in the synchronous operation mode, and a bus output to a plurality of buses in the individual operation mode. 17. The computer system according to claim 16, further comprising arbitration means for processing the acquisition requests as individual bus acquisition requests. 19. The synchronous operation mode in which the computer system synchronously operates three or more buses as an operation mode,
8. An individual operation mode for asynchronously operating three or more buses, wherein the plurality of main memory devices include memories that are accessed using different addresses in the individual operation modes. Computer system. 20. The computing system according to claim 16, further comprising a mode designating means for designating the operation mode, and a mode setting means for setting the mode designated by the mode designating means. Computer system. 21. A processor chip (a) first processor, (b) second processor having the following elements:
(C) resetting means for individually resetting the first and second processors, (d) stopping means for individually stopping the operations of the first and second processors, (e) the first and second Bus usage request output means for individually outputting the bus usage request of the processor, (f) bus usage permission input means for individually inputting the bus usage permission to the first and second processors,
(G) Sharing means for sharing the other inputs and outputs of the first and second processors. 22. Three or more buses and three or more processor chips according to claim 21 corresponding to each bus are provided, and the first and second processors are respectively connected to the same bus. Computer system. 23. The computer system according to claim 1, wherein the bus is provided with four buses. 24. A first processing unit comprising first, second and third processors respectively connected to the first, second and third buses respectively and performing the same operation, and first and second processing units. , A second processor including fourth, fifth, and sixth processors that are respectively connected to the third bus and perform the same operation.
In a failure recovery method when a failure occurs in a first processor of a computer system including the processing unit of (1), a failure recovery method including the following steps (a) being executed by the first processing unit: (B) After the continuous execution step, the operation of the first processing unit is stopped and the second processing unit executes the next processing. Single unit processing step to start. 25. The continuous execution step comprises: (a) an output suppressing step of suppressing the outputs of the first processor and the fourth processor; and (b) an operation of the first bus for the second and third buses. The following single-unit processing step includes (a) stopping the operation of the first processing unit and then outputting the output of the fourth processor. 25. The failure recovery method according to claim 24, further comprising: a permitting step of permitting, and (b) a synchronizing step of synchronizing the first bus with the second and third buses. 26. A bus tracking step of stopping the operation of the first bus for a predetermined cycle or more for a predetermined number of cycles and then causing the operation of the first bus to follow the operations of the second and third buses. A processor tracking step of stopping the operation of the fourth processor for a predetermined cycle and performing a synchronous operation delayed by a predetermined cycle from the fifth and sixth processors is provided, wherein the synchronizing step includes the operations of the fifth and sixth processors. A processor synchronization step of stopping a predetermined cycle to synchronize with the operation of the fourth processor and a bus synchronization step of synchronizing the operation of the first bus with the operation of the second and third buses are provided. Item 25. The failure recovery method according to Item 25. 27. A first processing unit having first, second and third processors respectively connected to the first, second and third buses and performing the same operation, and first and second processing units. , A second processor including fourth, fifth, and sixth processors that are respectively connected to the third bus and perform the same operation.
In a failure recovery method when a failure occurs in the first processor of the computer system including the processing unit of (1), (a) the processing being executed in the first processing unit is continued by the second and third processors. And execute the processing being executed in the second processing unit,
A continuous execution step of continuously being executed by the fifth and sixth processors, (b) an exchange step of exchanging a new processor for the first and fourth processors during the continuous execution step,
(C) A failure recovery method comprising a synchronization step of operating the first and fourth processors in synchronization with another processor after the replacement step. 28. The synchronizing means comprises: (a) a bus following step of operating the first bus by delaying the operation of the second and third buses by one cycle or more by a predetermined cycle, and (b) the first and fourth operations. The processor following step of delaying the operation of the other processor by a predetermined cycle from the operation of the other processor, and (c) stopping the operation of the second, third, fifth, and sixth processors for a predetermined cycle to perform the first and fourth operations. 28. The fault according to claim 27, further comprising a processor synchronization step of synchronizing the operation of the processor with (d) a bus synchronization step of synchronizing the operation of the first bus with the operation of the second and third buses. How to recover.