JPH09244909A - Information processing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To construct the system of high reliablity and a high processing speed without making a software be conscious of a fault tolerant function in a fault tolerant computer system. SOLUTION: The I/O output data of processor modules 1.1-1.n are respectively compared in bus adapters 2.1-2.n provided corresponding to the processor modules 1.1-1.n. At the time, not only its own compared result but also the compared results 101 of both adjacent bus adapters are referred to and normality / abnormality judgement is performed. In the case of the abnormality of a master processor module, a master right is shifted to the next and the I/O output data from a new master are outputted to an I/O port 4. In the case of the abnormality of slave processor modules 1.1-1.n, the processor module is cut off from this system.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an information processing system, and more particularly to a fault tolerant information processing in which a plurality of processor modules having a redundant configuration are synchronously operated in parallel and at the same time, correct data can always be selected and sent to a peripheral device. It is about the system.

[0002]

2. Description of the Related Art In order to realize a fault tolerant system in an information processing system, a plurality of CPUs (processors) are provided in a redundant manner, and the redundant CPUs perform parallel processing while mutually performing synchronous operations. A method of comparing these output data (including commands) with each other is adopted.

As an example of this comparison method, Japanese Patent Laid-Open No.
As shown in Japanese Patent No. 313931, there is a method according to majority logic. FIG. 8 is a conceptual diagram thereof. In FIG. 8, the majority output of each of the data outputs of the plurality of CPUs 80.about.80.n (n is an integer of 3 or more) is taken by the majority decision circuit 81, and the result is shown. The data is sent to the common bus 82.

Reference numeral 83 is a peripheral device, and 84 is a memory.

[0005] As another method, there is also a technology in which the CPU performs software communication processing between CPUs to compare check data at certain check points to realize fault tolerance.

[0006]

In the conventional example shown in FIG. 8, the data outputs of the plurality of CPUs 80. 1-80.n are arranged in the immediate vicinity of these CPUs (directly connected to the CPU). Since the majority decision circuit 81 adopts the majority decision logic, it is indispensable to set one for each processing cycle of the processor.
A majority logic process will be entered. Therefore, CPU
There is a problem that the processing speed of is decreased.

On the other hand, in the method of realizing the fault tolerant property by software, it is necessary to include a data check process in the software, and a majority circuit and a data selection circuit must be provided in order to finally output correct data. Therefore, not only software but also hardware becomes complicated. There is also a drawback that the overhead for data check increases and the processing speed decreases.

An object of the present invention is to prevent a decrease in processing speed,
Another object of the present invention is to provide a high-speed and highly reliable information processing system that enables a program to be created without being aware of the existence of a fault-tolerant system in terms of software so that the fault-tolerant function can be fully exhibited.

[0009]

SUMMARY OF THE INVENTION In accordance with the present invention, there is provided a plurality of redundantly configured processor modules, each having at least a processor, a memory, and a local bus connecting the processor and the memory. An information processing system having a fault-tolerant structure, which always outputs correct data to a peripheral device via a system bus interconnecting the processor modules, the output of the corresponding processor module being provided corresponding to each of the processor modules. An information processing system including a plurality of comparison means for comparing data with output data of another processor module and a control means for outputting correct data to the system bus according to the comparison result is obtained.

Further, according to the present invention, a plurality of redundant processor modules, one of which is a master and the rest of which are slaves, operate in synchronization with each other, and a system bus which interconnects these processor modules. An information processing system, including: a data processor including a command from a master processor module, transferred to a peripheral device via the system bus, the data processing system being provided corresponding to each of the processor modules. A plurality of comparing means for comparing the current data of the corresponding processor module with the data from the system bus in response to the data transmission to the system bus, and a plurality of comparing means provided corresponding to the comparing means. By referring to the comparison output of the means and the comparison output of both adjacent comparison means, the corresponding process Includes a plurality of failure determination means for determining failure of the module, and control means for controlling transfer of the master right according to the determination result of these failure determination means and always controlling the processor module with no failure to operate as the master. An information processing system characterized by the above is obtained.

When the failure determination means corresponding to the master processor module determines that there is a failure, the control means transfers the master right of the failed master processor module to the next processor module according to a predetermined order. The feature is that it is controlled.

Further, the control means is characterized in that, when the failure determination means corresponding to one slave processor module determines that there is a failure, the processor module that has this failure is separated from the system bus.

Further, each of the fault detecting means refers to a total of three comparison outputs of the comparison output of the corresponding comparison means and the comparison outputs of both the adjacent comparison means, and determines the failure of the corresponding processor module according to a predetermined decision logic. It is characterized by doing so.

[0014]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The operation of the present invention will be described. In the present invention, the data output of the CPU is not directly compared in the immediate vicinity of the CPU, but is compared as the data on the system bus connected to the I / O port having the interface with the peripheral device. Further, instead of making the CPU alone redundant, a plurality of processor modules having MPU (processor), memory, and I / O (peripheral circuit) are provided in a redundant structure, and data comparison is performed corresponding to each processor module. Means are provided for comparing the data output of the corresponding processor module with the data output of the other processor module.

By doing so, since the data comparison processing is performed outside the processor module, no comparison processing is included in the processing of the MPU inside the processor module, so that no overhead is added. Further, since the fault tolerant function by this comparison processing is realized by hardware, it is not necessary to be aware of the fault tolerant function when creating software.

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a system block diagram of an embodiment of the present invention. In FIG. 1, the plurality of processor modules 1.1 to 1 · n have a redundant configuration and have the same configuration as each other. Therefore, only the configuration of the module 1.1 is shown.

The module includes an MPU 10, a local memory (MEM) 11 and a peripheral circuit (I / O) 12.
And a local bus 13 that connects these elements to each other, and all the processor modules 1.1 to 1n
Are operating in parallel and in synchronization with each other.
Since this synchronizing operation is a well-known technique, it will not be described here.

It is assumed that one of these processor modules operates as a master and the other operates as a slave, and output data from the master processor module passes through a system bus 3 and an I / O port 4 to a peripheral device (P
CU) 5, 6 are to be supplied. Although the I / O port 4 is used in FIG. 1, the I / O port 4 is not essential, and the system bus 3 is connected to the PC.
U5 and 6 may be directly connected.

Bus adapters 2.1 to 2n are provided corresponding to the respective processor modules. These bus adapters output data from the corresponding processor module to the system bus 3 and output data from the master processor module. And has a function of judging normality / abnormality by comparing with each other, and also derives normal data to the I / O port 4 (not particularly required) via the system bus 3 according to the result of the judgment, In some cases, it has a function of controlling to disconnect the abnormal processor module.

The normal / abnormal determination of the output data of the corresponding processor module in the bus adapters 2.1 to 2 · n is performed by comparing the output data of the corresponding processor module with the output data of the master processor module (C
In addition to (referred to as MP-0), reference is made to the comparison result (referred to as CMP-R, L) 101 from the bus adapters located on both sides, and the predetermined decision logic (described in detail in FIG. 3).
It is performed according to.

In the bus adapter corresponding to the master processor module, the output data output by the master processor module to the system bus 3 is compared with the output data of the local bus 13 at that time, and this comparison signal (CMP-0 ) And a comparison signal (CMP-R, L) 101 from both adjacent bus adapters, it is determined whether the master processor module is normal or abnormal.

When it is determined that this master processor module is abnormal, the master right transfer signal 102 is generated,
Although the master right is transferred, the mode of this transfer is set in advance so that the processor module is sequentially transferred to the right adjacent processor module or the left adjacent processor module.

FIG. 2 shows the functional blocks of each of the bus adapters 2.1-2.n. The comparison unit 20 compares the output data from the local bus 13 of the corresponding processor module with the output data of the master processor module input from the system bus 3 via the I / O buffer 23 and detects a match / mismatch. , Comparison result (CMP
−0) 103 is generated.

The error detection unit 21 receives the comparison result (CMP
-0) 103 and the comparison result (CMP-R, L) 101 from both adjacent bus adapters are input, and normal (T) / abnormal (F) determination is performed according to the determination logic shown in FIG. is there.

In the state of FIG. 3, it can be determined that the output data of the corresponding processor module is correct (T).
Further, in the case of the state, since it is considered that the failure is not the failure of the corresponding processor module but the failure of the system bus 3 or the like, the output data of the corresponding processor module is not abnormal and the determination result is T. At this time, it is conceivable that the system bus 3 is preliminarily configured in duplicate and the working bus which is considered to be the fault is switched to the redundant bus side.

In the state of ,, since either one of the adjacent processor modules is determined to be abnormal, assuming that the probability of multiple failures is extremely low, the failure probability of the corresponding processor module is considered to be almost zero. Therefore, T is output as normal without referring to its comparison result CMP-0.

In the state of (1), since it can be clearly determined that the corresponding processor module has a fault, the state becomes F. In the state of (2), if the probability of multiple failures is extremely low, CMP-0 is "0". Is considered to be abnormal, and is therefore determined to be F.

The redundancy management section 22 receives the judgment result 106, which is a fault detection signal generated from the error detection section 21, as input, and performs master right transfer control and bus output right control. That is, when the determination result 106 is T and the corresponding processor module is the master, the output data of this master processor module is transmitted to the peripheral device via the buffer 23 and the system bus 3 by the bus output right 107 which is originally active. 5 and 6 are derived.

If the determination result is T and the corresponding processor module is a slave, nothing is done.

If the determination result is F and the corresponding processor module is the master, the master right transfer signal 102 is made active and transmitted to the bus adapter on the right side to transfer the master right. .

If the determination result is F and the corresponding processor module is a slave, the bus output right 107 is kept inactive thereafter to disconnect the corresponding processor module from the system bus, and the redundancy management section is set to the bypass state.

FIG. 4 shows an example of a timing chart showing the operation of the embodiment of the present invention, and the left half shows the case where the comparison result is normal.

One machine cycle T of the system is set as one frame, and check (CHK) frames and output frames are alternately set. The output frame is the output period to the peripheral devices 5 and 6, and the check frame has two CHK slots as shown in the figure.

The output data from the master processor module are compared and determined by the comparison unit 20 and the error detection unit 21 in each bus adapter in the first CHK slot. In this case, since it is normal, the redundancy management unit 2 of the bus adapter corresponding to the master processor module
When the second bus output right 107 is activated, the output data of the master processor module from the bus adapter register (buffer 23) is transmitted to the peripheral device via the system bus 3 and I / O port 4 in the next output frame period. It is output.

The right half of FIG. 4 shows the operation timing at the time of abnormality. When the output data abnormality of the master processor module is determined in the first CHK slot, the error detection unit 21 of the corresponding bus adapter detects the failure detection signal 10
6 is generated, and the master management right 102 is issued from the redundancy management unit 22.
Is activated and output, and this processor module is disconnected from the system.

In response to this, the master right is transferred to the adjacent processor module on the right side, and the redundancy management section 22 corresponding to this processor module recognizes that the corresponding processor module is the master and at the same time outputs the bus output right 107.
Is activated to supply the output data of the corresponding processor module to another processor module via the system bus 3.

In the second CHK slot, the same comparison and determination processing as described above is performed, and normal data is supplied to the peripheral equipment.

5 and 6 are flow charts showing the operation of the embodiment of the present invention. Referring to FIG. 5, there is shown an operation flow chart of the bus adapter corresponding to the master processor module. First, I / O signal output data is outputted (step 51). Next, this output data is compared with the I / O signal output data returned via the buffer 23 via the system bus (step 52).

Based on the comparison result CMP-O and the comparison results CMP-R and L from both adjacent bus adapters, a judgment is made according to the judgment logic shown in FIG. 3 (step 5).
3). If this determination result is "T", the I / O signal output data of this master processor module is I
It will be supplied to the peripheral device via the / O port.

If the judgment result is "F", the master right is transferred to the processor module on the right side (step 5).
6), I / O of the new master processor module
The signal output data is supplied to the peripheral device (step 5)
7).

FIG. 6 is an operation flow chart of the bus adapter corresponding to the slave processor module. The I / O signal output data from the master processor module is compared with the I / O signal output data of the corresponding processor module ( In step 61), a judgment is made based on this comparison result and the comparison results from both adjacent bus adapters (step 62).

If the judgment result is "T", the processing is ended, and if "F", it is considered as a failure of the corresponding processor module, and this processor module is disconnected from the system (step 64).

In FIG. 1, the system bus 3 is a bus having a bus type topology, and it is desirable that the bus 3 has a hardware synchronization mechanism. Therefore,
A bus having a time division multiplex synchronization mechanism or a token bus type synchronization mechanism is used.

However, since the bus adapter of each processor module receives the comparison result from both adjacent bus adapters, the comparison signal (CMP) 101 has the ring topology even if the system bus 3 itself has the bus topology. I am trying.

FIG. 7 shows a case where the system bus 3 is also configured as a ring topology, and in this case as well, a bus protocol of a synchronous system such as a time division multiplex synchronous system or a token ring system is used.

[0047]

As described above, according to the present invention, the output data of the processor modules are compared as the data on the system bus connected to the I / O port. Since the comparison is not performed on the bus, there is no need to insert a comparison cycle for each processing cycle of the CPU (MPU), and therefore, the processing speed can be improved.

Further, since each processor module is provided with a comparison / determination unit for performing data comparison and determination and the processing is performed by hardware, the software does not have to be aware of the fault tolerant function and has high reliability. The effect is that a system can be built.

[Brief description of drawings]

FIG. 1 is a system block diagram of an embodiment of the present invention.

FIG. 2 is a block diagram of the bus adapter of FIG.

FIG. 3 is a diagram showing the decision logic of the error detection unit of FIG.

FIG. 4 is a time chart showing the operation of the embodiment of the present invention.

FIG. 5 is an operation flow diagram of a bus adapter corresponding to a master processor module.

FIG. 6 is an operation flow diagram of a bus adapter corresponding to a slave processor module.

FIG. 7 is a system block diagram of another embodiment of the present invention.

FIG. 8 is a block diagram of a conventional fault tolerant computer system.

[Explanation of symbols]

 1.1-1.n processor module 2.1-2.n bus adapter 3 system bus 4 I / O port 5,6 PCU 10 MPU 11 memory 12 I / O (peripheral circuit) 13 local bus 20 comparison unit 21 error Detection unit 22 Redundancy management unit 23 Buffer

Claims (5)

[Claims] 1. A plurality of redundant processor modules each having at least a processor, a memory, and a local bus connecting these processors and memories, and a system bus interconnecting these processor modules. An information processing system having a fault-tolerant configuration that always outputs correct data to peripheral devices, and outputs output data of a corresponding processor module and output data of another processor module provided corresponding to each of the processor modules. An information processing system comprising: a plurality of comparing means for comparing; and a controlling means for outputting correct data to the system bus according to the comparison result. 2. A master processor module comprising: a plurality of redundantly configured processor modules, one of which is a master and the rest of which are slaves, and which operate in synchronization with each other; and a system bus which interconnects these processor modules. An information processing system configured to transfer data including a command to a peripheral device via the system bus, which is provided corresponding to each of the processor modules,
A plurality of comparing means for comparing the current data of the corresponding processor module with the data from the system bus in response to the data transmission from the master processor to the system bus, and corresponding comparing means. A plurality of failure judgment means for judging a failure of the corresponding processor module by referring to the comparison output of the corresponding comparison means and the comparison output of both the adjacent comparison means, and the master right of the master right according to the judgment result of these failure judgment means. An information processing system, comprising: a control unit that performs a transfer control and that controls a processor module having no failure to operate as a master. 3. The control means, when failure determination means corresponding to the master processor module determines a failure,
3. The information processing system according to claim 2, wherein the master right of the faulty master processor module is controlled to be transferred to the next processor module according to a predetermined order. 4. The control means, when the failure determination means corresponding to one slave processor module determines that there is a failure, the processor module that has the failure is separated from the system bus. The information processing device according to item 2 or 3. 5. Each of the fault detection means refers to a total of three comparison outputs of the comparison output of the corresponding comparison means and the comparison outputs of both adjacent comparison means, and determines the failure of the corresponding processor module according to a predetermined decision logic. The information processing system according to any one of claims 2 to 4, wherein