JPH1011308A - Information processor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To surely recognize a fault in an information processor and to improve a reliability of an information processor more than before by generating a pseudo fault as against data processed by means of a software, etc., and every kind of information except the data. SOLUTION: Master processor 10-1 and slave processors 10-2 and 10-3 execute the pseudo fault in bus output information which is generated in the internal circuit 3 of a self processor by a fault generating circuit 13 and a fault generating circuit control part 16. Then, the pseudo fault is detected by a coincidence detecting circuit 2 and a part of the internal circuit 3. Thus, not only various kinds of information generated by the software bu also a signal generated by a hardware such as a parity, etc., become the object of pseudo fault occurrence. Then, the fault of buss output information generated inside the self processor is recognized by the occurrence of the pseudo fault.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an information processing apparatus having a pseudo failure generating function and achieving high reliability. In recent years, as information processing devices have been widely used in various fields, if the information processing device breaks down,
This may have a significant economic impact. For this reason, failures are hard to occur as much as possible, and even if a failure does occur, the failure can be reliably detected, and furthermore, the processing is continued without stopping the information processing device while maintaining the consistency of the processing contents. There has been a demand for a highly reliable information processing device that can be used.

Therefore, in the present invention, at least three processing units constituting a multiplexing unit are connected by a bus, and the same processing is performed simultaneously in synchronization with the same clock to detect a failure and perform necessary processing. Simultaneously, a pseudo-failure generating means for generating a pseudo-failure is added to a high-reliability information processing device using one of the multiplexing units as a master processing device and the remaining processing devices as slave devices. ,
Further, the reliability is improved.

[0003]

2. Description of the Related Art A conventional example will be described below. FIG.
Is an explanatory diagram of a conventional example. Conventionally, in order to achieve high reliability of a computer, for example, a plurality of computers are operated in parallel, and data of processing results is compared. In such parallel processing, an extra device is required to compare the data of the processing results, and the processing time is long. Therefore, conventionally, a highly reliable information processing device that increases the reliability of the information processing device and performs more efficient processing has been proposed.

The high-reliability information processing device has at least three processing devices connected via a bus and simultaneously performing the same processing in synchronization with the same clock, and one of the processing devices is designated as a master. This is a device that uses a processing device, and uses the remaining processing devices as slave devices.

In this case, the master processing device has a function of sending information generated by the internal circuit to the bus and a function of taking information on the bus into the internal circuit, and the slave device stores the information generated by the internal circuit. A device (multiplexing unit) having a function of only taking in information on the bus without sending the information to the bus (multiplexing unit).
Multiplexing control means is provided for detecting a failure based on a comparison between output information generated by each processing device and bus information output on the bus, and causing an internal circuit to perform necessary processing.
Note that the above-described processing devices and the bus are collectively referred to as a TMR information processing device. For example, the high-reliability information processing apparatus is configured as illustrated.

In this case, the processing device 1 is replaced by the master processing device 1
0-1 and the processing units 2 and 3 are set as slave processing units 10-
2, 10-3. Each of the master processor 10-1 and the slave processors 10-2 and 10-3 is provided with a coincidence detection circuit 2 and an internal circuit 3. The internal circuit 3 includes an MPU 4 and a storage device 5. Etc. are provided.

When a pseudo-failure occurs in the high-reliability information processing apparatus, software instructs a processing apparatus that causes the pseudo-failure, and the MPU 4 changes an output signal of the processing apparatus. Then, the pseudo failure is detected by the coincidence detection circuit 2. In such a processing device, the coincidence detection circuit 2 of the master processing device 10-1 always detects only a match and cannot detect a mismatch, so that a pseudo failure cannot be detected.

[0008]

The above-mentioned prior art has the following problems. (1): The pseudo-failure in the TMR information processing device is generated by changing only the value of the output data to the bus by the software in the failure-producing processing device by software. However, this method has not been able to cause a pseudo-failure of a signal generated by hardware such as parity.

(2): Since the master processor takes in the data output to the bus by itself and detects the coincidence, the master output device detects the pseudo failure even if the output data is pseudo-failed by software. I couldn't.

[0010] The present invention solves such a conventional problem, and makes it possible to generate a pseudo-failure for data processed by software or the like and for all information other than the above-mentioned data. It is an object of the present invention to make it possible to surely confirm the information and to further improve the reliability of the information processing apparatus.

[0011]

FIG. 1 is a diagram illustrating the principle of the present invention. The present invention is configured as follows to achieve the above object. (1): The same processing is performed simultaneously in synchronization with the same clock 3
At least one processing device is connected via the bus 1, one of which can be set as the master processing device 10-1, and the other can be set as the slave processing devices 10-2 and 10-3. The slave processing devices 10-2 and 10-3 have a function of sending the bus output information generated by the own device to the bus 1 and a function of taking the information on the bus 1 into the inside. Do not send to bus 1
A failure detecting means (corresponding to the coincidence detecting circuit 2) which has a function of taking the above information into the inside and detects a failure by detecting coincidence between the bus output information generated by itself and the information fetched from the bus 1 in each processing device. An information processing apparatus provided with a part of the internal circuit (3), wherein each of the processing devices includes a pseudo-failure generating means (a fault generating circuit (13) and a fault generating circuit (13); Circuit control unit 1
6), wherein the pseudo failure is detected by the failure detection means.

(2): Three or more processing units that simultaneously perform the same processing in synchronization with the same clock are connected via a bus 1, one of which is a master processing unit 10-1, and the other is a slave processing unit. The master processor 10-1 has a function of sending bus output information generated by itself to the bus 1 and a function of importing information on the bus 1 into the master processor 10-1. Processing device 10-2,
10-3 has a function of taking in the information on the bus 1 without sending the bus output information generated by its own device to the bus 1, and providing each processing device with the bus output information generated by its own device and the bus. 1. An information processing apparatus provided with a failure detecting means (a coincidence detecting circuit 2 and a part of an internal circuit) for detecting a failure by detecting a coincidence with the information taken in from the information processing apparatus 1. Pseudo failure generation means (fault generation circuit 14 and failure generation circuit control unit 1) for causing a pseudo failure when the bus output information is taken into the failure detection means in the own device.
7), and the pseudo failure is detected by the failure detection means.

(3): Three or more processing units that simultaneously perform the same processing in synchronization with the same clock are connected via a bus 1, one of which is a master processing unit 10-1, and the other is a slave processing unit. The master processor 10-1 has a function of sending bus output information generated by itself to the bus 1 and a function of importing information on the bus 1 into the master processor 10-1. Processing device 10-2,
10-3 has a function of taking in the information on the bus 1 without sending the bus output information generated by its own device to the bus 1, and providing each processing device with the bus output information generated by its own device and the bus. 1. An information processing apparatus provided with a failure detection means (a coincidence detection circuit 2 and a part of an internal circuit) for detecting a failure by detecting a coincidence with information taken in from each of the first and second information processing apparatuses. Fault generating means (fault generating circuit 15 and fault generating circuit control unit 18) for causing a false fault when the faulty information is taken into fault detecting means in its own device, and the pseudo fault is detected by the fault detecting means. I tried to make it.

(4): In the information processing apparatus of (1) to (3), the pseudo-failure generating means of each of the processing apparatuses includes a fault-generating target signal selecting means for selecting a fault-generating target signal,
Only selected signals are broken.

(5) In the information processing apparatus of (1) to (3), the pseudo-failure generating means of each of the processing apparatuses includes master failure instruction means for causing a failure to occur only in the master processing apparatus. A pseudo failure is generated only when the device is set as a master processing device.

(6) In the information processing apparatus of (1) to (3), the pseudo failure generating means of each of the processing apparatuses includes: a failure generating target specifying means for specifying a processing apparatus to be subjected to a failure; Comparing means for comparing the specification information of the generation target specifying means with the processing apparatus identification information in the apparatus is provided, and only the specified processing apparatus is set as a failure occurrence target by the coincidence detection signal of the comparing means.

(7) In the information processing apparatus of (1) to (3), the pseudo failure generating means of each processing apparatus determines which data of the packet transferred on the bus is to be a failure target. A failure occurrence timing instructing means for instructing, a counting means for indicating which data of a packet is currently being transferred by counting a bus output timing signal, and a comparison for comparing the values of the failure occurrence timing instructing means and the counting means. Means for causing data in a packet specified by the match detection signal of the comparing means to fail.

(8): In the information processing apparatus of (1) to (3), the pseudo-failure generating means of each of the processing units is configured to set whether the pseudo-failure generation is valid or invalid. Equipped with valid / invalid information setting means to enable / disable
Disabled instruction is enabled.

(9): In the information processing apparatus of (8),
When a pseudo-failure is generated, the pseudo-failure generating means of each of the processing devices clears the setting information of the fault-generation valid / invalid information setting means and suppresses subsequent pseudo-failure generation.

(10) In the information processing apparatus according to any one of (1) to (3), the pseudo failure generating means of each of the processing units generates the pseudo 1 bus request signal due to the occurrence of 0 failure of the bus request signal. A failure information control means for waiting for the occurrence of a simulated failure.

(11) In the information processing apparatus according to any one of (1) to (3), the pseudo failure generating means of each processing apparatus includes: a counting means for changing a count value by a system clock; and a count value of the counting means. Is provided with detecting means for detecting that a preset value has been set, and a pseudo failure is generated at the timing when the count value of the counting means reaches the set value.

(12) In the information processing apparatus of (1) to (3), the pseudo failure generating means of each of the processing apparatuses includes a counting means for changing a count value by a bus clock, and a count value of the counting means. Is provided with a detecting means for detecting that the count value has reached a preset value, and a pseudo failure of the bus request signal is generated at the timing when the count value of the counting means reaches the set value.

(13) In the information processing apparatus according to any one of (1) to (3), the pseudo failure generating means of each processing apparatus includes a counting means for changing a count value by a transfer cycle on a bus, and the counting means. Detecting means for detecting that the count value of the counter has reached a preset value, and generating a pseudo failure for signals other than the bus request signal at the timing when the count value of the counting means reaches the set value. I made it.

(Operation) The operation of the present invention will be described below with reference to FIG. (a): Operation of the above (1) Each of the processing devices (for example, the master processing device 10-1, and the slave processing devices 10-2, 10-3) is provided with a simulated fault generating means (the fault generating circuit 13 and the fault generating circuit 13). Circuit control unit 1
According to 6), the bus output information generated by the internal circuit 3 of the own device is caused to fail in a pseudo manner. The pseudo failure is detected by the failure detection means (a part of the coincidence detection circuit 2 and the internal circuit 3).

In this way, not only various kinds of information generated by software but also signals generated by hardware such as parity can be subjected to a pseudo failure. Then, due to the occurrence of the pseudo failure, the failure of the bus output information generated in the own device can be confirmed.

(B): Operation of the above (2) Each of the processing units (for example, the master processing unit 10-1, and the slave processing units 10-2, 10-3) is provided with a simulated fault generating means (fault generating circuit 14, And fault occurrence circuit control unit 1
According to 7), when the bus output information generated by the internal circuit 3 of the own device is taken into the fault detecting means in the own device, a pseudo failure occurs. The pseudo failure is detected by the failure detection means (a part of the coincidence detection circuit 2 and the internal circuit 3).

In this way, not only various kinds of information generated by software but also signals generated by hardware such as parity can be subjected to a pseudo failure. Then, by the occurrence of the pseudo failure, it is possible to confirm the failure in the data input unit of the failure detecting means provided in the own device.

(C): Operation of the above (3) Each of the processing units (for example, the master processing unit 10-1, and the slave processing units 10-2, 10-3) is provided with a simulated fault generating means (fault generating circuit 15, And fault occurrence circuit control unit 1
According to 8), when the information output on the bus is taken into the failure detecting means in the own device, the failure is simulated. The pseudo failure is detected by the failure detection means (a part of the coincidence detection circuit 2 and the internal circuit 3).

In this way, not only various kinds of information generated by software but also signals generated by hardware such as parity can be subjected to a pseudo failure. Then, by the occurrence of the pseudo failure, it is possible to confirm the failure in the bus data input unit of the failure detecting means provided in the own device.

(D): Operation of the above (4) When a pseudo fault is generated, the pseudo fault generating means of each processing device selects a fault generating target signal by the fault generating target signal selecting means, and responds to the selected signal. Only a false failure occurs. In this way, it is possible to arbitrarily generate a pseudo failure for all signals.

(E): Operation of the above (5) By giving instruction information to the master failure instruction means, a pseudo failure is generated only in the master processing unit. With this configuration, it is possible to generate a pseudo fault only in the master output device without generating a pseudo fault in the slave processing device.

(F): Operation of the above (6) When the processing device information of the fault occurrence target is specified in the fault occurrence target specifying means for specifying the processing device of the fault occurrence target, the comparing means specifies the information of the designation of the fault occurrence target specifying means. Is compared with the processing device identification information in the own device. Then, based on the coincidence detection signal of the comparing means, a pseudo failure is generated only in the designated processing device. In this way, it is possible to cause a pseudo failure only in an arbitrary output device.

(G): Operation of the above (7) The fault occurrence timing instructing means of each processing unit instructs what data of a packet transferred on the bus 1 is to be a failure target, and the counting means operates the bus. The output timing signal is counted. Then, the comparing means compares the values of the fault occurrence timing instructing means and the counting means, and causes the data in the packet designated as having the same value to fail. By doing so, it becomes possible to cause a pseudo failure in the middle of a packet that was impossible with software.

(H): Operation of the above (8) When information indicating the validity / invalidity of failure occurrence is set in the failure occurrence validity / invalidity information setting means of each processing device, a pseudo failure is generated based on the information. Or not.
In this way, the validity / invalidity of the pseudo failure can be arbitrarily selected.

(I): Operation of the above (9) When a pseudo fault is generated, the setting information of the fault occurrence valid / invalid information setting means is cleared, and the subsequent pseudo fault is suppressed. In this way, a pseudo failure can be generated intermittently.

(J): Operation of the above (10) Due to the occurrence of 0 failure of the bus request signal, the failure information control means of each processor waits for the occurrence of a pseudo failure until the original bus request signal becomes 1. Let By doing so, it is possible to generate a pseudo fault in which the bus request signal causes a 0 fault.

(K): Operation of the above (11) The counting means of each processing device changes the count value by the system clock, and the detecting means detects that the count value of the counting means has reached a preset value. I do. Then, a pseudo failure is generated at a timing when it is detected that the count value of the counting means has reached the set value. In this way, a pseudo failure can be generated at an arbitrary timing of the system clock.

(L): Operation of the above (12) The counting means of each processing device changes the count value by the bus clock, and the detecting means detects that the count value of the counting means has reached a preset value. To detect. Then, at the timing when it is detected that the count value of the counting means has reached the set value, a pseudo failure of the bus request signal is generated. In this way, a pseudo failure can be generated at an arbitrary timing of the bus clock.

(M): Operation of the above (13) The counting means of each processing device changes the count value according to the transfer cycle on the bus, and the detecting means sets the count value of the counting means to a preset value. Detect that it has become. Then, at the timing when it is detected that the count value of the counting means has reached the set value, a pseudo failure occurs for signals other than the bus request signal. In this way, a pseudo fault can be generated at an arbitrary timing of the transfer cycle on the bus.

[0040]

Embodiments of the present invention will be described below in detail with reference to the drawings. It is assumed that the “information” of the pseudo failure occurrence target described below includes data, address, bus control information, and the like.

§1: Description of TMR system information processing device ...
FIG. 2 is a configuration diagram of a TMR information processing apparatus. Hereinafter, the overall configuration of the TMR information processing device (high reliability information processing device) will be described with reference to FIG.

(1): Definition of TMR Information Processing Device The TMR information processing device is connected via the bus 1 and performs at least three processing devices (having the same configuration) which simultaneously perform the same processing in synchronization with the same clock. Device), wherein one of the processing devices can be set as a master processing device 10-1, and the other processing devices can be set as slave processing devices 10-2 and 10-3. Hereinafter, a minimum configuration triple processing apparatus (hereinafter, referred to as “TMR information processing apparatus”) 10 including three processing apparatuses will be described as a basic configuration of a TMR information processing apparatus (TMR: Triple Modular Redundanc).
y).

The slave processor 10-2 shown in FIG.
10-3 has the same configuration as that of the master processing device 10-1 (only internal setting information is different), but is not shown. The TMR information processing device is a device that satisfies the following conditions.

: At least three processing devices are connected by the bus 1. : The three processing units perform the same processing in synchronization with the same clock. : Among the processing devices, one processing device is set as the master processing device 10-1, and the remaining processing devices are set as the slave processing devices 10-2 and 10-3.

The master processor 10-1 outputs the bus output information generated by the internal circuit 3 to the bus 1,
The information on the bus 1 is taken in. : The slave processors 10-2 and 10-3 do not output the bus output information generated by the internal circuit 3 to the bus 1,
Only take in the above information.

Each processing device detects a failure based on a comparison between the bus output information generated by the internal circuit 3 and the bus information output on the bus 1, and causes the internal circuit 3 to perform necessary processing. Has functions.

(2): Description of the specific configuration of the entire TMR information processing apparatus In the TMR information processing apparatus, the master processing apparatus 10-
1 and the slave processors 10-2 and 10-3 have the same configuration, except for the internal setting information (master or slave setting information). In each of these processing units,
The coincidence detection circuit 2, the internal circuit 3, the failure generation circuits 13, 14, 15, and the failure generation circuit control units 16, 1, respectively.
7, 18, a master information register 20, a bus output timing generation circuit 21, an AND circuit 22, and a gate 2
3, 24, etc. are provided. The internal circuit 3 has M
PU4 is provided.

The master processor 10-1 performs a process of transmitting information generated by the internal circuit 3 to the bus 1 and a process of importing information on the bus 1 to the internal circuit 3. Also,
The slave processors 10-2 and 10-3 do not send the information generated by the internal circuit 3 to the bus 1, but only perform the process of taking the information on the bus 1 into the internal circuit 3. However, when an abnormal (error) state of the processing device is detected in the state set in the master processing device, a process for suppressing transmission of information generated by the internal circuit 3 to the bus 1 is performed.

In the master processor 10-1 and the slave processors 10-2 and 10-3, the output information generated by the internal circuit 3 of each processor and the bus information output on the bus 1 Is detected based on the comparison of (i) and the internal circuit 3 performs necessary processing.

(3): Description of each part of the TMR information processing apparatus Hereinafter, each part of the TMR information processing apparatus will be described. The coincidence detection circuit 2 detects coincidence between the output information (bus output information) generated by the internal circuit 3 and the information output on the bus 1. In this case, the failure generation circuit 1
If any of the failure generation circuits 3, 14, and 15 is set to be valid (set to a pseudo failure generation state), a signal (pseudo failure signal) passing through the pseudo failure generation circuit is input to the coincidence detection circuit 2.

The internal circuit 3 is a circuit inside each processing device and performs various internal processes. The failure generation circuits 13, 14, 15 are controlled by the failure generation circuit control units 16, 17, 18 to be enabled / disabled (a state in which a pseudo failure is generated / a state in which a pseudo failure is not generated). For example, the fault occurrence circuit control units 16, 1
If the control is invalidated by 7 and 18, the input signal is passed as it is and output without generating a pseudo fault. Also, when set to be valid, the input signal of the failure generating circuit is pseudo-failed and output.

: Fault occurrence circuit control units 16, 17, 18
Controls the failure generating circuits 13, 14, and 15. The master information register 20 sets information (eg, 1: master, 0: slave) by the MPU 4 and outputs the set information to the AND circuit 22.

The bus output timing generation circuit 21
The bus output timing is generated based on information from the MPU 4 and output to the AND circuit 22. The AND circuit 22 controls the gate 23 by a logical AND operation of the information set in the master information register 20 and the timing information generated by the bus output timing generation circuit 21. For example, the master information register 20
Is set to the value "1" indicating that it is a master,
The AND circuit 22 outputs the signal generated by the bus output timing generation circuit 21 to the gate 23 to open the gate 23.

When a value "0" indicating a slave is set in the master information register 20, the AND circuit 22 blocks the signal generated by the bus output timing generation circuit 21 from passing therethrough (AND circuit). 22 output signal = 0), the gate 23 is closed.

That is, when set in the master processor, the gate 23 is opened by the signal generated by the bus output timing generation circuit 21, and the output information generated by the internal circuit 3 is output to the bus 1. When set in the slave processor, the signal generated by the bus output timing generation circuit 21 is blocked by the AND circuit 22 and the gate 23 is kept closed, so that the output information generated by the internal circuit 3 is 1 is controlled so as not to be output.

The gate 24 is always open regardless of the setting of the master / slave, and is always the bus 1
Is output to the internal circuit 3.

§2: Description of Basic Operation—See FIG. 2 Hereinafter, the basic operation of the TMR information processing apparatus will be described with reference to FIG. In the following description, the master processing device 1
Only the pseudo processor 0-1 generates a pseudo failure, and the slave processor 10
At -2 and 10-3, it is assumed that no pseudo failure occurs.

(1): When the master processor 10-1 is outputting data to the bus 1 and a fault is generated by the fault generator 13 and the fault data is output to the bus 1, the master processor 10-1 The failure detection data is input to the coincidence detection circuit 2 of itself, and the failure data is also input to the input data from the bus 1, and the result of the coincidence detection is "match".

On the other hand, the slave processors 10-2, 10-
Normal data is input to the match detection circuit No. 3 for its own generated data, failure data is input to the input data from the bus 1, and the result of the match detection is "mismatch". As described above, the failure detection circuit can confirm the failure of the output data of the own processing device.

(2): When the master processor 10-1 outputs data to the bus 1 and causes the failure generation circuit 14 to cause the internal fetched data to fail, the coincidence detection circuit 2 of the master processor 10-1 outputs Fault data is input to the generated data, normal data is input to the input data from the bus 1, and the match detection result of the match detection circuit 2 is "mismatch".

On the other hand, the slave processors 10-2, 10-
The match detection circuit 2 receives normal data as its own generated data and normal data as input data from the bus 1, and the match detection result by the match detection circuit 2 is "match". In this manner, the failure of the data input unit of the own processing device of the coincidence detection circuit 2 can be confirmed.

(3): When the master processor 10-1 outputs data to the bus 1 and causes the failure generation circuit 15 to cause the bus fetched data to fail, the master processor 10-
The match detection circuit 2 receives normal data as its own generated data, fault data as input data from the bus 1, and the match detection result by the match detection circuit 2 is “mismatch”.

On the other hand, the slave processors 10-2, 10-
The match detection circuit 2 receives normal data as its own generated data and normal data as input data from the bus 1, and the match detection result by the match detection circuit 2 is "match". In this manner, the failure occurrence circuit can confirm the failure of the bus data input unit.

§3: Description of a specific example of the processing apparatus ... FIG.
FIG. 3 is a detailed configuration example of the processing apparatus. Hereinafter, a detailed configuration example of the TMR information processing apparatus will be described with reference to FIG.

In this example, the failure generating circuits 13, 1
The exclusive OR circuits (hereinafter referred to as “EX-
OR "25), and the EX-OR 25 is configured to generate a pseudo failure. The internal circuit 3 includes a failure detection circuit 29 for detecting a failure based on a detection result of the coincidence detection circuit 2 and various circuits such as failure generation circuit control units 16 to 18, a master information register 20, a bus output timing generation circuit 21, and the like. An MPU 4 for controlling is provided.

The EX-OR 25 is controlled by a control signal (1 or 0) from each of the failure generation circuit control units 16, 17, and 18, and the validity / invalidity of the failure generation function is controlled. In this case, the fault occurrence circuit control units 16, 17, 1
If the control signal from 8 is "1", it becomes valid (pseudo fault occurrence state), and the input signal is inverted to generate a pseudo fault. If the control signal is "0", the control signal is invalid (a state in which no pseudo failure occurs) and the input signal is passed as it is.

§4: Explanation of failure detection circuit check processing
.. See FIGS. 3 to 8 Hereinafter, the failure detection circuit check processing will be described with reference to FIGS. (1): Description of the entire process by a flowchart ... FIG.
FIG. 4 is a flowchart of a failure detection circuit check process. Hereinafter, the failure detection circuit check processing will be described with reference to FIG. In addition, S1 to S3 indicate each processing step.
The processing described below is processing by the internal circuit 3.

In the checking process by the internal circuit 3,
A three-step check process is performed. First, a "confirmation of a coincidence detection circuit function" process is performed (S1), then a "confirmation of failure point detection" process is performed (S2), and finally, "operation confirmation after a failure occurs during TMR operation" is performed. (S3). Hereinafter, each process will be described in detail.

(2): Confirmation processing of the coincidence detection circuit function
Referring to FIG. 3, first, the match detection circuit 2 correctly “matches” without using the failure generation circuits 13, 14, and 15 (disabling them all).
Is performed for all of the coincidence detection target signals. Next, the failure detection circuit 13 causes “0 failure” and “1 failure” to occur for all of the coincidence detection target signals, and the coincidence detection circuit 2 correctly “matches” (master processing device 10−
1), "mismatch" (slave processing devices 10-2, 10-
Confirm that 3) is satisfied. With the above processing, the function of the coincidence detection circuit can be confirmed.

(3): Process for confirming a failure detection point--see FIGS. 5, 6, and 7 FIG. 5 is an operation explanatory diagram 1, FIG. 6 is an operation explanatory diagram 2, and FIG. 7 is an operation explanatory diagram 3 . Failure occurrence circuits 13, 14,
Since there are 15 possible locations, confirmation processing of a failure detection location is performed according to the following procedure.

The output of the failure generation circuit control section 16 is set to “1”, and the EX-OR 25 (see FIG. 3) in the failure generation circuit 13 inverts the signal from the internal circuit 3 to (1).
→ 0, 0 → 1) and output to the bus 1. ... See FIG. 5: The output of the failure generation circuit control unit 17 is set to “1”, and the EX-OR 25 in the failure generation circuit 14 inverts the signal sent from the internal circuit 3 of the processing unit to the coincidence detection circuit 2. I do. ... See FIG. 6: The output of the failure generation circuit control unit 18 is set to “1”, and the EX-OR 25 in the failure generation circuit 15 inverts the signal fetched from the bus 1 and inputs the inverted signal to the coincidence detection circuit 2.
With the above processing, the failure detection location can be confirmed. ...
Refer to FIG. 7 (4): Operation check after occurrence of failure during TMR operation ... FIG.
FIG. 8 is an operation explanatory diagram 4. In FIG. 8, the master processing device 10-1 is a processing device A, and the slave processing device 10
2 is a processing device B, a slave processing device 10-3 is a processing device C, a failure generation circuit 13 is a failure generation circuit a, and a failure generation circuit 14 is a failure generation circuit b.

In addition, the mark “は” indicates that the match detection result of the match detection circuit 2 of the corresponding processing device is “match” (no failure),
The mark “x” indicates that the match detection result of the match detection circuit 2 of the corresponding processing device is “mismatch” (with failure), and “× ○ ×”, “×
It is assumed that a double failure such as “× O” is impossible.

In the operation confirmation processing after the occurrence of a failure during the TMR operation, each state during the TMR operation is generated according to the example of FIG. 8, and the TMR operation at that time is confirmed. In this case, it is assumed that the processing device A operates as a master processing device.

For example, processing units A, B, C = “○ ××”
Is generated, the processing devices A and B use no failure generation circuit, and the processing device C uses the failure generation circuit a. Also,
In order to generate the processing devices A, B, and C = “xxx”, the processing device A uses the failure generation circuits a and b simultaneously, and the processing devices B and C use the failure generation circuits not.

§5: Description of a specific configuration example of the processing device
-See FIGS. 9 to 18 A detailed description will be given below based on FIGS. 9 to 18 based on a specific configuration example of the processing apparatus.

(1): Description of Example 1—See FIG. 9 FIG. 9 is an explanatory diagram of Example 1. This example is an example in which only a selected signal causes a pseudo failure (failure signal selection). In this example, the failure occurrence circuit control units 16, 17, 1
8, ERRGEN register 31 and ERR
An EN register 32, a decoder (DEC) 33, and an AND circuit section 34 having a plurality of AND circuits 35 are provided. The EX-OR2 is provided for each of the failure generation circuits 13, 14, and 15.
5 is provided.

The ERRGEN register 31 is a register (fault signal indication register) in which a target signal causing a pseudo fault is set, and is controlled by the MPU 4. This register holds the signal even when there is no setting instruction from the MPU 4. Also, ER
The REN register 32 is a register (pseudo failure occurrence valid flag register) for instructing validity / invalidity of failure occurrence (whether or not to cause a failure), and is a register controlled by the MPU 4. In this case, for example, "1" is set in the EREN register 32 to give a valid instruction for the occurrence of a failure.
Is set, and EREN is used to issue an invalid instruction for failure occurrence.
"0" is set in the register 32.

The data set in the ERRGEN register 31 is decoded by a decoder 33, and
The signal is sent to the AND circuit 35 of the circuit section 34. Also, ERR
Data (instruction data) set in EN register 32
Is also sent to the AND circuit 35 of the AND circuit section 34.
Then, the output signal of the AND circuit unit 34 is sent to each EX-OR 25 of the failure generating circuit.

Data a, data b... Data h shown in FIG.
Is the data subject to failure, which is set in the ERRGEN register 31 and which is to be failed is decoded by the decoder 33. The EREN register 32 indicates the validity / invalidity of occurrence of a failure.
U4 sets data "1". When the ERREN register 32 is set to "1", a signal specified by the ERRGEN register 31 is input to the EX-OR 25, and a pseudo failure occurs. In this way, it is possible to cause a pseudo-failure only in the designated signal.

(2) Description of Example 2—See FIG. 10 FIG. 10 is an explanatory diagram of Example 2. In this example, only the master processing device 10-1 is provided with a means for causing a failure, and a pseudo failure is generated only when the processing device is set as a master (only the master has a failure). In this example,
A master information storage register 40, AND circuits 41 and 42, and a master failure instruction register 43 are provided in the failure generation circuit control units 16 to 18, respectively.
The EX-OR 25 was provided in 4.

The master information storage register 40 is an MPU
The register is controlled by a value of "4". The value "1" is set at the time of a master, and the value "0" is set at the time of a slave. Data (set signal) is set in the master failure instruction register 43 in response to a set instruction (soft set) from software, and holds data other than the set instruction.

For example, when the value “1” is set in the master failure instruction register 43 and the value of the master information storage register 40 is “1”, the value “1” is output from the AND circuit 42 to the EX-OR 25. As a result, the EX-OE 25 causes data to fail in a pseudo manner, and a failed output signal (pseudo fault signal) is generated.

(3) Description of Example 3—See FIG. 11 FIG. 11 is an explanatory diagram of Example 3. This example is an example in which means for designating a processing device to be subjected to a failure is provided so that a failure occurs only in the designated processing device (failure only when the UID matches).

In this example, as shown in FIG. 11A, regardless of the master / slave setting, the master processor 10-1, the slave processors 10-2, 10-3
, A unique unit ID (hereinafter referred to as “UID”) is set. In this case, the U
The ID is # 1, and the UID of the slave processor 10-2 is #
2. The UID of the slave processing device 10-3 is # 3 (UID: unit identification information). The UID is, for example,
It is stored in a ROM in each processing device, and is read and used.

Then, in order to generate a pseudo failure, FIG.
As shown in FIG.
7 and 18 are provided with a UID information register 45, a compare circuit (comparison circuit) 46, a failure UID instruction register 47, and an AND circuit 48, respectively. An OR 25 is provided.

The operation at the time of occurrence of the pseudo failure is as follows.
Data is set in the failure UID instruction register 47 according to a set instruction from software, and holds data other than the set instruction. When a failure occurs only in a certain processing device, the failure UID indication register 47
, The UID of the processing device that causes the failure is set, and when the match is detected by the compare circuit 46, the EX-OR 25 causes the failure. In this way, a pseudo failure can be generated in any processing device.

(4) Description of Example 4—See FIG. 12 FIG. 12 is an explanatory diagram of Example 4. This example is an example in which means for designating the number of data in a packet transferred on the bus 1 as a failure target is provided, and data in the specified packet is failed (the failure data in the packet). Specified). As shown in FIG. 12A, a counter 50, a compare circuit 51, and a failure occurrence timing instruction register 52 are provided in the failure occurrence circuit control units 16, 17, and 18, respectively. , EX-O
This is an example in which R25 is provided.

In this case, the counter 50 includes the selector 5
3, a flip-flop circuit (FF) 54, and an adder circuit (+1) 55.
6, 57, and an OR circuit 58 are provided. The failure occurrence timing instruction register 52 is set by a software setting instruction, and holds a value other than the setting instruction. The counter 50 counts up at the bus output timing output from the bus output timing generation circuit 21.

When a pseudo failure is generated at a certain timing, a value is set in the failure generation timing instruction register 52. The match of the value of the counter 50 is detected by the compare circuit 51, and the EX-OR is detected only when the match is detected.
25 causes a pseudo failure. The timing at this time is as shown in FIG.

In this example, the packet is composed of five pieces of data, and is output to the bus 1 for five cycles. Further, in this example, the failure occurrence timing instruction indicates −1 of the timing output to the bus 1. Further, since the fourth data of the packet is an example of failure, “4” is set in the failure occurrence timing instruction register 52.

If there is no bus output, the counter 50 indicates the value “0”, and the addition circuit 5 outputs the value at the bus output timing.
The value is incremented by one. When the value of the counter 50 becomes 4, the value of the failure occurrence timing instruction register 52 and the value of the counter 50 match, and at that timing the compare circuit 5
1 is inverted, and the EX-OR 25 causes a pseudo failure.

(5) Description of Example 5—See FIG. 13 FIG. 13 is an explanatory diagram of Example 5. Example 5 is to clear the EREN register 32 due to the occurrence of a pseudo failure,
This is an example in which a pseudo failure is generated intermittently (E
RREN register: cleared when a pseudo failure occurs).

In this example, an OR circuit 61 and an AND circuit 62 are provided in the fault occurrence circuit control section of Example 1 shown in FIG. 9, and the EREN register 32 is controlled by these circuits. The other configuration is the same as that of the first embodiment. Example 5 operates as follows.

The EREN register 32 is a register (pseudo-failure occurrence valid flag register) for setting a pseudo-failure occurrence valid flag (for example, 1: valid, 0: invalid). Are set according to the output from the controller, and hold the value except for the set instruction.

When a pseudo failure is to be generated, the OR circuit 61 and the AND circuit 6
The value “1” is set to the EREN register 32 via the “2”. Further, a desired failure signal instruction value is set in the ERRGEN register 31. A pseudo-failure is generated at a certain timing by the setting of the value. When a fault occurs, the output of the OR circuit 61 is changed (for example, the value is changed from 0 to 1) at the timing of the occurrence of the fault. Pseudo-failure occurrence valid flag set = 1
(Pseudo failure occurrence valid) is cleared. Then, the occurrence of the subsequent pseudo failure is suppressed.

(6): Description of Example 6—See FIGS. 14 and 15 FIG. 14 is an explanatory view of Example 6 (part 1), and FIG. 15 is an explanatory view of Example 6 (part 2). Example 6 shows that the bus request signal 0
This is an example in which a pseudo-failure is caused to wait until the original bus request signal becomes 1 in order to cause a failure (holding failure occurrence information for a 0 failure of the bus request signal).

As shown in FIG. 14A, a failure information holding circuit 65 for holding failure information and a selector 66 for switching a bus request signal when a failure occurs.
And a flip-flop circuit 67 for holding the output signal of the selector 66. The failure information holding circuit 65
The detailed configuration of the selector 66 is as shown in FIG.

As shown, the failure information holding circuit 65 is provided with OR circuits 68 and 72, AND circuits 69 and 71, and a flip-flop circuit 70, and the flip-flop circuit 70 has a bus clock (BUS-CLK). ) Is supplied. The operation of Example 6 is as follows.

The fault information holding circuit 65 receives invbr1 and invbr0 as fault information.
vbr1 is a signal for causing one failure, and invb1
r0 is a signal for causing a 0 failure. And in
vbr1 and invbr0 are mutually exclusive signals,
When invbr1 is set in the fault information holding circuit 65, one fault occurs, and when invbr0 is set, zero fault occurs.

The invbr1 and invbr0 are set (instructed) by the ERRGEN register 31 (see FIG. 9). When invbr0 is set, invbr0, which is a signal for causing a 0 failure, is supplied to the OR circuit
8, when the original bus request signal is 0, A
Flip-flop circuit (FF) 70 through ND circuit 69
Is held.

When the original bus request signal is 1, the signal invbr0 for causing a 0 failure is A
After passing through the ND circuit 71 and further through the OR circuit 72, the select signal a is inactivated, the select signal b is activated, "0" is output, a pseudo failure occurs, and the flip-flop circuit 70 receives ""0" is set.

That is, when a 0 failure occurs in the bus request signal, when the original bus request signal is 0, 0
The failure information is held in the flip-flop circuit 70, and when the original bus request signal becomes “1”, the bus request signal has the value 0 activated by the select signal b.
Is output and a pseudo failure occurs, and the flip-flop circuit 7
0 is cleared.

The operation state of each section is as shown in FIG. For example, invbr0 = 0, invbr1 =
0, the output of the FF (flip-flop circuit) 67 becomes 0 when the FF (flip-flop circuit) 70 = 0 and the original bus request signal = 0. invbr0 = 0, inv
When br1 = 0, FF70 = 0, and the original bus request signal = 1, the output of FF67 becomes 1.

Invbr0 = 0, invbr1 = 0, F
When F70 = 1 and the original bus request signal = 0, FF
67 output = 0. invbr0 = 0, invbr
1 = 0, FF70 = 1, original bus request signal = 1
At this time, the output of the FF 67 becomes 1.

Invbr0 = 0, invbr1 = 1, F
When F70 = 0 and the original bus request signal = 0, FF
67 output = 0. invbr0 = 0, invbr
1 = 1, FF70 = 0, original bus request signal = 1
At this time, the output of the FF 67 becomes 1.

Invbr0 = 0, invbr1 = 1, F
When F70 = 1 and the original bus request signal = 0, FF
67 output = 0. invbr0 = 0, invbr
1 = 1, FF70 = 1, original bus request signal = 1
At this time, the output of the FF 67 becomes 1.

Invbr0 = 1, invbr1 = 0, F
When F70 = 0 and the original bus request signal = 0, FF
67 output = 0. invbr0 = 1, invbr
1 = 0, FF70 = 0, original bus request signal = 1
At this time, the output of the FF 67 becomes 1.

Invbr0 = 1, invbr1 = 0, F
When F70 = 1 and the original bus request signal = 0, FF
67 output = 0. invbr0 = 1, invbr
1 = 0, FF70 = 1, original bus request signal = 1
At this time, the output of the FF 67 becomes 0. As described above, it is possible to cause a pseudo failure of the bus request signal 0.

(7) Description of Example 7—See FIG. 16 FIG. 16 is an explanatory diagram of Example 7. Example 7 is an example in which a failure occurs at the timing when the value of the counter becomes all 0s (a pseudo failure occurs at the counter all 0s).

In Example 7, a counter 75 and a compare circuit 76 are provided in the failure generation circuit control section, and EX-
OR25 was provided. The counter 75 includes a selector 77 including AND circuits 80 and 81 and an OR circuit 82.
A flip-flop circuit (FF) 78 and a subtraction circuit 79 for subtracting −1 are provided. The system clock is input to the counter 75, and the output of the counter 75 and the all
(All “0”) signal is input, the two signals are compared, and the resulting signal (match detection signal) is output to the EX-OR 25.

The operation of Example 7 will be described below with reference to FIG. For example, assume that the set data = 4 and the value 4 is set in the flip-flop circuit 78. In this state, the subtraction circuit 79 subtracts -1 every time the system clock is input, and subtracts the value of the flip-flop circuit 78. At this time, the match is not detected by the match detection by the compare circuit 76, and the EX-OR 25 does not generate a pseudo failure and outputs a normal signal.

Thereafter, the subtraction by the subtraction circuit 79 is performed, and when the value of the flip-flop circuit 78 becomes 0, a match is detected by the match detection in the compare circuit 76, and the output of the flip-flop circuit 76 becomes 1. For this reason, EX
A pseudo failure occurs due to -OR25, and the output is inverted.

(8) Description of Example 8—See FIG. 17 FIG. 17 is an explanatory diagram of Example 8. Example 8 is an example in which when the failure target signal is a bus request signal, the counter is counted by the bus clock (counting timing of the counter: CLK).

In Example 8, a counter 85 and a compare circuit 86 are provided in the failure generation circuit control unit, and EX-
OR25 was provided. The counter 85 includes a selector 87 including AND circuits 90 and 91 and an OR circuit 92.
A flip-flop circuit (FF) 88 operating in synchronization with a bus clock (bus-clk) and a subtraction circuit 89 for subtracting -1 are provided. And the counter 8
5, the set data and the soft set signal are input, and the output of the counter 85 and the all-zero signal (all "0") are input to the compare circuit 86. EX-OR2
5.

The operation of Example 7 will be described below with reference to FIG. When a pseudo failure is generated at an arbitrary timing, the timing at which the failure occurs is set in the counter 85, and the counter is counted down by a bus clock (bus-clk). For example, it is assumed that the set data = 4 and the value 4 is set in the flip-flop circuit 88 by the soft set signal.

From this state, every time the bus clock is input to the flip-flop circuit 88, the subtraction circuit 89 subtracts -1.
Is subtracted, and the value of the flip-flop circuit 89 is subtracted. At this time, the match is not detected by the match detection by the compare circuit 86, and no pseudo failure occurs in the EX-OR 25.
Normal signal is output.

Thereafter, the subtraction by the subtraction circuit 89 is performed, and when the value of the flip-flop circuit 88 becomes 0, a match is detected by the match detection in the compare circuit 86, and the output of the compare circuit 86 becomes 1. For this reason, EX-OR2
5 causes a pseudo-failure, resulting in an inverted output. In this way, a pseudo failure can be generated at an arbitrary timing only by changing the set data.

(9) Description of Example 9—See FIG. 18 FIG. 18 is an explanatory diagram of Example 9. Example 9 is an example in which when the failure target signal is other than the bus request signal, the counter is counted by the transfer cycle on the bus (counting timing of the counter: bus output).

In Example 9, a counter 100 and a compare circuit 101 are provided in the fault occurrence circuit control section, and the fault occurrence circuit is provided with E
An X-OR 25 was provided. The counter 100 has A
A selector 102 including ND circuits 105 and 106 and an OR circuit 107, a flip-flop circuit (FF) 103 operating in synchronization with the bus output timing, and a subtraction circuit 104 for subtracting -1 are provided. In the counter 100, data is set in the flip-flop circuit 103 by a software set instruction signal (soft set), and the value of the flip-flop circuit 103 is decremented by -1 by the subtraction circuit 104 except for the set instruction. Have been.

The set data and the soft set signal are input to the counter 100, and the output of the counter 100 and the all “0” signal are input to the compare circuit 101. The result signal (coincidence detection signal) is output to the EX-OR 25.

The operation of Example 7 will be described below with reference to FIG. When a pseudo failure occurs at an arbitrary timing, the timing at which the failure occurs is set in the counter 100, and the value of the counter 100 is counted down by a bus output timing signal. For example, set data = 4
Assume that the value 4 is set in the flip-flop circuit 103 by the soft set signal.

From this state, every time the bus output timing signal is input to the flip-flop circuit 103, the subtraction circuit 1
04 subtracts −1, and subtracts the value of the flip-flop circuit 103. At this time, the match is not detected in the match detection by the compare circuit 101, and the EX-OR 25 does not generate a pseudo failure and outputs a normal signal.

Thereafter, the subtraction by the subtraction circuit 104 is performed, and when the value of the flip-flop circuit 103 becomes 0, a match is detected by the match detection in the compare circuit 101, and the output of the compare circuit 101 becomes 1. For this reason,
A pseudo failure occurs due to the EX-OR 25, and the inverted output is output. In this way, just changing the set data,
A pseudo failure can be generated at an arbitrary timing.

[0124]

As described above, the present invention has the following effects. (1): Since information is pseudo-failed by hardware, pseudo-failure may occur for signals other than data, for example, signals generated by hardware such as parity and bus request signals. it can. For this reason,
Since the failure can be confirmed by generating a pseudo failure for all kinds of information, the reliability of the information processing apparatus can be further improved.

(2): By providing a plurality of locations where a false failure is caused by hardware in one processing unit, failure detection that could not be performed conventionally can be performed even in the master processing unit.

(3): Failure of data processed by software and various signals other than the data can be simulated. Therefore, the failure of the information processing device can be reliably confirmed for all data, signals, and the like, and the reliability of the information processing device can be further improved.

In addition to the above effects, the following effects are provided corresponding to each claim. (4): In claim 1, each processing device causes the pseudo-failure generating means to pseudo-fail the bus output information generated by itself. The pseudo failure is detected by the failure detection means.
In this way, not only various kinds of information generated by software but also signals generated by hardware such as parity can be set as a target of occurrence of a pseudo failure. Then, due to the occurrence of the pseudo failure, the failure of the bus output information generated in the own device can be confirmed.

(5): In claim 2, each processing device causes a pseudo-failure when the bus output information generated by the own device is input to the fault detection unit in the own device by the pseudo-failure generating means. The pseudo failure is detected by the failure detection means. In this way, not only various kinds of information generated by software but also signals generated by hardware such as parity can be set as a target of occurrence of a pseudo failure. Then, by the occurrence of the pseudo failure, it is possible to confirm the failure in the data input unit of the failure detecting means provided in the own device.

(6): In claim 3, each processing device causes a pseudo-failure when the information output on the bus by the pseudo-failure generating means is taken into the fault detecting means in the own apparatus. The pseudo failure is detected by the failure detection means. In this way, not only the various information generated by the software,
A signal generated by hardware such as parity can also be a target of occurrence of a pseudo failure. Then, by the occurrence of the pseudo failure, it is possible to confirm the failure in the bus data input unit of the failure detecting means provided in the own device.

(7): In claim 4, when the pseudo fault generating means of each processing device generates a pseudo fault, the fault generating target signal selecting means selects the fault generating target signal and only the selected signal is generated. Generate a pseudo failure. In this way, it is possible to arbitrarily generate a pseudo failure for all signals.

(8): In claim 5, by giving the instruction information to the master failure instruction means, a pseudo failure is generated only in the master processing device. With this configuration, it is possible to generate a pseudo fault only in the master output device without generating a pseudo fault in the slave processing device.

(9): In claim 6, when the processing device information of the fault occurrence target is specified in the fault occurrence target specifying means for specifying the processing device of the fault occurrence target, the comparing means changes the specification information of the fault occurrence target specifying means. This is compared with the processing device identification information in the own device. Then, based on the coincidence detection signal of the comparing means, a pseudo failure is generated only in the designated processing device.
In this way, it is possible to cause a pseudo failure only in an arbitrary output device.

(10): In claim 7, the fault occurrence timing instructing means of each processing unit instructs what data of the packet transferred on the bus is to be a failure target, and the counting means sets the bus output timing. Count the signal. And
The comparing means compares the values of the fault occurrence timing instructing means and the counting means, and if the two match, causes the data in the designated packet to fail. By doing so, it becomes possible to cause a pseudo failure in the middle of a packet that was impossible with software.

(11) In the eighth aspect, when information indicating the valid / invalid of the occurrence of a failure is set in the failure occurrence valid / invalid information setting means of each processing device, a pseudo failure can be generated based on the information. Or not. If you do this,
It is possible to arbitrarily select the validity / invalidity of the pseudo failure occurrence.

(12) According to the ninth aspect, when a pseudo fault occurs, the setting information of the fault occurrence valid / invalid information setting means is cleared, and the subsequent pseudo fault occurrence is suppressed. In this way, a pseudo failure can be generated intermittently. (13) In the tenth aspect, the fault information control means of each processing unit causes the pseudo-failure to wait until the original bus request signal becomes 1 due to the occurrence of the 0 bus request signal. By doing so, the bus request signal becomes 0
A pseudo failure that causes a failure can also be generated.

(14): In claim 11, the counting means of each processing device changes the count value by the system clock, and the detecting means detects that the count value of the counting means has reached a preset value. . Then, a pseudo failure is generated at a timing when it is detected that the count value of the counting means has reached the set value. In this way, a pseudo failure can be generated at an arbitrary timing of the system clock.

(15) In the twelfth aspect, the counting means of each processing device changes the count value by the bus clock, and the detecting means detects that the count value of the counting means has reached a preset value. I do. Then, at the timing when it is detected that the count value of the counting means has reached the set value, a pseudo failure of the bus request signal is generated. In this way, a pseudo failure can be generated at an arbitrary timing of the bus clock.

(16) According to the thirteenth aspect, the counting means of each processing device changes the count value by a transfer cycle on the bus,
The detecting means detects that the count value of the counting means has reached a preset value. Then, at the timing when it is detected that the count value of the counting means has reached the set value, a pseudo failure occurs for signals other than the bus request signal. In this way, a pseudo fault can be generated at an arbitrary timing of the transfer cycle on the bus.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating the principle of the present invention.

FIG. 2 is a configuration diagram of a TMR information processing apparatus according to an embodiment.

FIG. 3 is a detailed configuration example of a processing apparatus according to the embodiment;

FIG. 4 is a flowchart of a failure detection circuit check process according to the embodiment.

FIG. 5 is an operation explanatory diagram 1 in the embodiment.

FIG. 6 is an explanatory diagram 2 of the operation in the embodiment.

FIG. 7 is an operation explanatory diagram 3 in the embodiment.

FIG. 8 is an operation explanatory view 4 in the embodiment.

FIG. 9 is an explanatory diagram of Example 1 in the embodiment.

FIG. 10 is an explanatory diagram of Example 2 in the embodiment.

FIG. 11 is an explanatory diagram of Example 3 in the embodiment.

FIG. 12 is an explanatory diagram of Example 4 in the embodiment.

FIG. 13 is an explanatory diagram of Example 5 in the embodiment.

FIG. 14 is an explanatory diagram of Example 6 in the embodiment (part 1).
It is.

FIG. 15 is an explanatory view of Example 6 in the embodiment (part 2);
It is.

FIG. 16 is an explanatory diagram of Example 7 in the embodiment.

FIG. 17 is an explanatory diagram of Example 8 in the embodiment.

FIG. 18 is an explanatory diagram of Example 9 in the embodiment.

FIG. 19 is an explanatory diagram of a conventional example.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Bus 2 Match detection circuit 3 Internal circuit 10-1 Master processing unit 10-2, 10-3 Slave processing unit 13, 14, 15 Failure generation circuit 16, 17, 18 Failure generation circuit control unit 20 Master information register 21 Bus output Timing generation circuit 29 Failure detection circuit 40 Master information storage register 45 UID information register 46 Compare circuit 47 Failure UID indication register 52 Failure occurrence timing indication register 63 Error valid flag register 65 Failure information holding circuit

Claims (13)

[Claims] An information processing system comprising: a bus connected to three or more processing units which simultaneously perform the same processing in synchronization with the same clock;
The base is set as a master processing device, and the rest can be set as slave processing devices.The master processing device has a function of sending bus output information generated by the device to the bus and a function of taking in information on the bus, The slave processing device has a function of taking in information on the bus without sending the bus output information generated by the device to the bus, and the processing device includes a bus output information generated by the device itself and a bus. An information processing apparatus comprising: a failure detection unit configured to detect a failure by detecting coincidence with information taken in from a computer, wherein each of the processing units includes a pseudo failure generation unit configured to cause a pseudo failure of bus output information generated by the processing unit. An information processing apparatus, comprising: detecting the pseudo failure by the failure detection unit. 2. Three or more processing units which perform the same processing simultaneously in synchronization with the same clock are connected via a bus.
The table is set as a master processing device, and the rest can be set as slave processing devices.The master processing device has a function of sending bus output information generated by itself to the bus, and a function of taking in information on the bus, The slave processing device has a function of taking in information on the bus without sending the bus output information generated by the device to the bus, and the processing device includes a bus output information generated by the device itself and a bus. An information processing apparatus provided with a failure detecting means for detecting a failure by detecting coincidence with information fetched from the apparatus, wherein each of the processing apparatuses fetches the bus output information generated by the own apparatus into the failure detecting means in the own apparatus. An information processing apparatus, comprising: a pseudo-failure generating means for causing a pseudo-failure at the time, wherein the pseudo-failure is detected by the fault detecting means. 3. A processing system comprising: three or more processing units which simultaneously perform the same processing in synchronization with the same clock;
The base is set as a master processing device, and the rest can be set as slave processing devices.The master processing device has a function of sending bus output information generated by the device to the bus and a function of taking in information on the bus, The slave processing device has a function of taking in information on the bus without sending the bus output information generated by the device to the bus, and the processing device includes a bus output information generated by the device itself and a bus. An information processing apparatus comprising: a failure detection unit configured to detect a failure by detecting coincidence with information acquired from the information processing apparatus, wherein each of the processing devices captures information output on a bus to the failure detection unit in the own device. An information processing apparatus, further comprising: a pseudo-failure generating means for causing a pseudo-failure to occur, wherein the pseudo-failure is detected by the fault detecting means. 4. The apparatus according to claim 1, wherein said pseudo-failure generating means of each of said processing devices includes a fault-generating target signal selecting means for selecting a fault-generating target signal, and causes only the selected signal to fail. The information processing apparatus according to 2 or 3. 5. The pseudo-failure generating means of each of the processing devices includes master fault instruction means for setting a fault occurrence target only for the master processing device, and generates a pseudo-failure only when the processing device is set as the master processing device. The information processing apparatus according to claim 1, 2 or 3, wherein the information is generated. 6. A pseudo failure generating means of each of the processing devices includes: a failure generating target specifying means for specifying a processing target of the fault generating; and processing device identification information in the own device. And a comparing means for comparing with a processing unit designated by the coincidence detection signal of the comparing means as a failure occurrence target.
Or the information processing device according to 3. 7. A pseudo-failure generating means of each of the processing devices, the fault occurrence timing instructing means for instructing what data of a packet transferred on the bus is to be a failure target, and counting a bus output timing signal. Counting means for indicating which data of the packet is currently being transferred, and comparing means for comparing the values of the failure occurrence timing instructing means and the counting means. 4. The information processing apparatus according to claim 1, wherein data in the packet is broken. 8. The pseudo fault generating means of each of the processing devices includes fault generation valid / invalid information setting means capable of setting whether pseudo fault generation is valid or invalid, and the pseudo fault generation valid / invalid. The information processing apparatus according to claim 1, wherein the instruction is enabled. 9. A pseudo-failure generating means of each of the processing units, when a pseudo-failure is generated, clears setting information of the fault-generation valid / invalid information setting means and suppresses subsequent pseudo-failure generation. 9. The information processing apparatus according to claim 8, wherein: 10. The pseudo failure generating means of each of the processing devices,
4. The system according to claim 1, further comprising fault information control means for waiting for the occurrence of a pseudo fault until the original bus request signal becomes 1 in order to generate a 0 fault in the bus request signal. An information processing apparatus according to claim 1. 11. The pseudo failure generating means of each of the processing devices,
A counting means for changing a count value according to a system clock; and a detecting means for detecting that the count value of the counting means has reached a preset value, at a timing when the count value of the counting means has reached the set value. 4. The information processing apparatus according to claim 1, wherein a pseudo failure occurs. 12. The pseudo failure generating means of each of the processing devices,
A counting means for changing the count value by the bus clock; and a detecting means for detecting that the count value of the counting means has reached a preset value, and at a timing when the count value of the counting means has reached the set value. 4. The information processing apparatus according to claim 1, wherein a pseudo failure of a bus request signal is generated. 13. The pseudo failure generating means of each of the processing devices,
Counting means for changing the count value according to a transfer cycle on the bus; and detecting means for detecting that the count value of the counting means has reached a preset value, wherein the count value of the counting means has reached the set value. 4. The information processing apparatus according to claim 1, wherein a pseudo-failure is generated for a signal other than the bus request signal at a predetermined timing.