JPS6113266B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a control device for duplex shared memory between multiple processing units.

First, an example of the overall configuration of a multiple processing device including a dual shared memory, which is the premise of the present invention, will be described with reference to FIG.

Figure 1 shows four processing units 3 (CPU1 to CPU
4) is configured to share the duplex shared memory 1 (M1, M2), and the processing device 3 (hereinafter referred to as CPU) has a connection mechanism 4 (ME1 to ME1) with the shared memory 1.
ME4): hereinafter referred to as a memory expander), and the shared memory 1 has processing unit connection mechanisms 2 (P1 to P4: hereinafter referred to as ports) provided corresponding to each CPU. In FIG. 1, only one reference numeral is given to the same configuration. For example, for CPU1 to CPU4, CPU
1 is given the code 3, and CPU2 to CPU4 are not given a code. This also applies to other parts. Therefore, in the following explanation, CPU
3 represents CPU1 to CPU4. The memory expander 4 and the ports 2 of both shared memories are connected by the shared memory-to-CPU interface 5, and the shared memory 1 is connected to each CPU via the memory expander 4, the shared memory-to-CPU interface 5, and the port 2. Data is transferred to and from the Both shared memories are connected by a shared memory-to-shared memory interface 6, and both shared memories operate synchronously. each
The CPU has an input/output bus 7 and various input/output devices 9.
, and mutual interrupt communication and mutual monitoring are performed using the inter-CPU communication bus 8.

In such a system configuration, the memory expander 4 has an internal configuration as shown in FIG.
Receive address A and write data WD from the CPU, send addresses A1 and A2 and write data WD1 and WD2 to both shared memories M1 and M2 respectively via interfaces 5 and 5', and read data from both shared memories. It receives and checks RD1 and RD2, and sends the normal data RD to the CPU. At this time, the data RD1 and RD2 of both systems are normal and errors are detected, but a case may occur in which the two data are different. (If a 1-bit parity check is performed, a 2-bit error is considered normal.) In FIG. 2, 10 is an address buffer, 11 is a write data buffer, 1
2 is a read data selection circuit, 13 and 13' are read data buffers, 14 and 14' are read data selection circuit inputs, and 15 is a read data selection circuit output.

Typical examples of conventional read data selection circuits are shown in FIGS. 3 and 4.

Figure 3 shows a method in which if both systems are normal, the data is ORed and sent to the CPU. 1 each for both systems
The read data 14 from the first system is checked by an error detection circuit (parity check circuit) 16 (the same goes for the error detection circuit 18), and if there is an error, or 1
When the system timeout error 25 is detected, the 1st system error detection signal 17 is turned on, and the data 14 from the 1st system is turned on.
is inhibited and not sent by the CPU. The same applies to the second system. In this method, even if there is a data error that is not detected by the error detection circuit 16, the error can be detected by the CPU by ORing the data of both systems, and the data quality can be improved, but the shared memory of one system is If a timing system failure causes a series of data errors that cannot be detected by such an error detection circuit, all
This results in the CPU going down. For example, if a series of data errors that cannot be detected by the error detection circuit occur, jumping to the wrong destination or entering another routine may cause soft errors such as runaway programs, and eventually all CPUs will go down.

Figure 4 shows a method in which if both systems are normal, predetermined data is sent to the CPU. In this method, if the predetermined shared memory repeatedly makes undetectable data errors, it will result in a software error, similar to the above, and all CPUs will go down. Recent CPU usage is such that when it goes down, it is often impossible to back it up manually, and on the other hand, in such systems, full-duplex CPU systems are used to increase reliability.
Input/output synchronization, consistency check, rationality check,
Every effort has been made to ensure that the system does not go down even if one CPU performs incorrect calculations, such as mutual diagnosis. Therefore, it is undesirable for all CPUs to go down due to a failure in one system's common memory in the case shown in FIG. 4.

The purpose of the present invention is to eliminate all errors when an undetectable data error occurs in such a single-sided shared memory.
The purpose is to provide a dual shared memory control device that prevents the CPU from going down.

A feature of the present invention is that each memory expander (or each CPU) is provided with a memory section (priority selection flip-flop 20) that can be set and reset by a program or some other means, as shown in FIG. When both system read data are normal, which one to send to the CPU is determined by turning on/off this storage section. By doing this, multiple CPUs
Among them, some CPU groups preferentially use data in common memory 1 system, and the remaining CPU groups preferentially use data in shared memory 2 system.
It is possible to prevent all CPUs from going down even if undetectable data errors occur one after another in single-system shared memory.

In other words, when determining that both systems are normal, all multiple
Instead of having the CPU only import data read from one memory and not from the other memory, each read data from both memory systems must be sent to a specific CPU.
I decided to incorporate it into. Therefore, the CPUs are divided into two groups, and one group always reads data read from one memory when both systems are normal, and the other group always reads data read from the other memory when both systems are normal. I decided to incorporate it. The storage unit provided for the CPU specifies which group the data should be imported into. The grouping is arbitrary; for example, if there are two CPUs, the configuration is such that one CPU reads data read from one memory, and the other CPU reads data read from the other memory. . Furthermore, even if there are three or more, grouping is done in one pair (n
-1), n/2 to n/2, or something else. Both are determined by the scale of the system and the number of CPUs that can be allowed to go down in the worst case.

Embodiments of the present invention will be described with reference to FIGS. 5 to 12.

FIG. 6 shows the configuration of the CPU 3 (including the memory expander 4). CPU internal bus 2 controlled by CPU internal bus controller (BC) 30
9 includes a memory expander (ME) 4, a memory control unit (MCU) 28, and a basic processing unit (BPU).
32, an input/output control mechanism (IOP) 33 is connected. The memory control device 28 stores programs and their
Main memory 27 that stores data dedicated to the CPU
control. An optional mechanism such as a floating point arithmetic unit (FPP) 31 is connected to the basic arithmetic unit 32 . The input/output control device 33 controls the input/output bus 7 and transfers data between the input/output device and the main memory or shared memory. memory expander 4
is connected to the dual shared memories M1 and M2 via two shared memory-to-CPU interfaces 5. Main memory 27 and shared memory 1 (M
1, M2) is distinguished by memory address, and memory addresses equal to or higher than a specific memory address are allocated to the shared memory.

FIG. 7 shows the configuration of the shared memory 1 (including port 2). A memory control device 35 and port 2 are connected to a shared memory bus 36 controlled by a shared memory bus control device 37 . The memory control device 35 controls a memory 34 that stores data shared among multiple CPUs. port 2
(P1 to P4) are connected to the CPUs 1 to 4 via a shared memory to CPU interface 5. The shared memory internal bus control device 37 is connected to the shared memory internal bus control device of the shared memory of another system (not shown) via the shared memory-shared memory interface 6, and the shared memory of both systems simultaneously connects to a specific CPU.
Synchronization control is performed to perform data transfer with.

FIG. 8 shows an example of the configuration of the memory expander 4. As shown in FIG. CPU internal bus address 47
The address comparison circuit 44 detects whether the address is a shared memory address (addresses higher than a specific address are allocated to the shared memory), and when a memory activation signal 49 is received at the shared memory address, the shared memory is activated. The signal 46 is turned on, the address A and data WD are set in the address buffer 10 and the write data buffer 11, and the address 38 (A1, A1,
A2), write data 39 (WD1, WD2), and start signal 40 (REQ1, REQ2) are sent. Read data 41 from both system shared memories M1 and M2
(RD1, RD2), response signal 42 (ANS1, ANS
2) is returned, the read data buffer 1
At the same time, the response control circuit 43 is activated. The response control circuit 43 sends a response signal 52 to the basic arithmetic unit 3 via the CPU internal bus 29 when the responses from the shared memories M1 and M2 of both systems are complete.
2. Reply to input/output control mechanism 33. At this time,
Data from either system selected by the read data selection circuit 12 in the above-described manner is output as read data 50. In addition, the response control circuit 43
detects a timeout error and outputs a 1-system timeout error detection signal 25 and a 2-system timeout error detection signal 26 to the data selection circuit 12. In addition, when the data selection circuit 12 detects an error in both data systems, the error signal (ERR) 5
1 is replied along with the response signal (ANS) 52.
The read data selection circuit 12 is provided with a priority selection flip-flop, which will be described later.
This is performed when the register write signal (REG WRITE) 55 is turned on while the register address decoding circuit (DECODE) 45 detects that 4 is the register address for the flip-flop, and the register data (REG DATA) is turned on.
Set when 53 specific hit is “1”, “0”
It is reset when

The detailed configuration of the read data selection circuit 12 is shown in FIG. The read data buffer 13 in the memory expander is read from the shared memory of both systems.
Data 14, 14' set in 13' are checked for errors by error detection circuits 16, 18. If an error occurs in the error check, or if the timeout error detection signals 25 and 26 are on, the read data error detection signals 17,
19 is turned on, prohibiting data from that system from being sent to the CPU, and allowing data from other systems to be sent to memory. If both systems are normal, either the read data 1 priority selection signal 21 or the read data 2 priority selection signal 22 output from the priority selection flip-flop 100, whichever is on, is sent to the CPU. When both systems have an error, both systems read data error signal (ERR) 20 is turned on. The priority selection flip-flop 100 is rewritten when the set signal 24 is turned on, and when the data signal 23 is "1", the read data 1 selection signal 21 is turned on, the read data 2 selection signal 22 is turned off,
The opposite is true when the data signal 23 is "0". Further, when an abnormality is detected in both systems, the OR gate 20A sends an abnormality detection signal 20 to the corresponding CPU.

FIG. 5 provides further details. The errors that can be checked by the parity check circuits 16 and 18 are parity errors, and even if there is a parity error, as described in the description of the conventional example in FIG. Detection of 2-bit errors is impossible. Therefore, when both parity check circuits 16 and 18 are normal, there are two cases: true normality and false normality. A false normal is a case where an error that cannot be detected occurs in the parity check circuits 16 and 18. In this case, memory M
The probability that an undetectable error will occur in both M1 and M2 at the same time is low, while the probability that an undetectable error will occur is high.

Therefore, when the parity check circuits 16 and 18 detect that both are normal, it is desirable to assume that an undetectable error has occurred in one of them. Therefore, when the shared memories M1 and M2 are viewed from a plurality of CPUs, when both are normal, the memories M1 and M2 are combined with the CPU in order to make use of both read data. In other words, multiple CPUs are divided into two groups, and when both are determined to be normal, one group is combined to capture the memory read data from one of M1 and M2, and the other group captures the read data from the other memory. Combine as much as possible. This binding is due to flags stored in flip-flop 100 of each CPU response.

The overall operation shown in FIG. 5 will be explained.

○B In the case of determination that M1 and M2 are normal.

In this case, parity check circuits 16, 18
generates a signal indicating normality (set to "0").
Note that "1" is generated when an error is detected). As a result, or gates 14A and 15A
"0" is output, and the inverter 14B,
The output of 15B is 1.

On the other hand, it is assumed that the flip-flop 100 in the figure is set so that the Q output is "1" (this setting is based on the data line 23, timing line 2
4).

With the output of this flip-flop 100,
The or gate 14C opens and the or gate 15C closes. Then, open AND gate 14D,
Select read data RDIN1 from M1,
This selected data RDIN1 is OR gate 14
Send it to the corresponding CPU via E. On the other hand, the AND gate 15D is closed and the read data RDIN2 from M1 is blocked and is not sent to the corresponding CPU.

As a result, in the CPU and flip-flop shown in FIG. 5, when both systems M1 and M2 are normal, M1 is selected preferentially.

Therefore, when M1 is truly normal, the corresponding CPU reads the data of M1, which is truly normal. On the other hand, M1
If M2 is false normal and M2 is true normal, then
The CPU reads the data of the false normal M1. Therefore, the corresponding CPU will generate a soft error due to this false normal data, and in the worst case, it will go down.

However, if M1 is falsely normal and M2 is truly normal, CPUs in groups other than the group to which the CPU to which the flip-flop 100 shown in FIG. 5 corresponds belong will preferentially connect to M2. Therefore, the CPU belonging to the other group reads the correct data and performs normal processing. Therefore, in this embodiment, when the CPUs are grouped into two groups, even if one side has an undetectable error under normal conditions on both systems, a CPU belonging to one of the specified groups will not be created. become. On the other hand, the fourth
In the conventional example shown in the figure, all CPUs are soft-downed, and the effect is greater than in this example.

○B In the case of M1 normal and M2 abnormal.

Based on the output "1" of the inverter 14B and the output "1" of the OR gate 14C (because the error output signal 19 of the OR gate 15A becomes "1"), the AND gate 14D outputs the output RDIN1 of M1. On the other hand, the AND gate 15D is locked by the output "0" of the inverter 15B. Therefore, OR gate 14E uses RDIN1 of M1 as CPU
send to

As a result, only the output of the normal memory is selected under M1 normality and M2 abnormality.

○C When M1 is abnormal and M2 is normal.

This is the opposite of ○B, and the AND gate 15D opens and the normal output RDIN2 of M2 is taken into the CPU.

○D When both M1 and M2 are abnormal.

The outputs of both inverters 14B and 15B become "0", and AND gates 14D and 15
D blocks both RDIN1 and RDIN2 and blocks the CPU
Sending of data to is suppressed.

The configuration of the response control circuit 43 is shown in FIG. Among the responses from the shared memory of both systems, first M
When the 1 response signal (ANS1) 5 is returned, the 1 system response storage circuit 56 is set and the 2 system timeout detection circuit 59 is activated. 2 series M as is
If there is no response signal 5' from the 2nd system, a timeout is detected, the 2nd system timeout detection circuit 61 is set, and the 2nd system timeout error signal 26 is turned on, but if the 2nd system response signal 5' is returned within the specified time. , the second system timeout detection circuit 59 is reset, and the response signal 52 is turned on. CPU
When it receives the response signal 52, it turns off the activation signal, so the shared memory activation signal 46 also turns off, and the response storage circuits 56, 57 and timeout circuits 60, 61 in the response control circuit 43 are reset to the initial state. .

Next, the configuration of port 2 is shown in FIG. When the activation signal (REQ) 40 from the memory expander 4 is turned on, a bus occupancy request signal (B.REQ ₁ ) 64 is turned on to the shared memory bus. Bus control circuit 3
0, the request signals from each port are prioritized and the bus occupancy permission signal (B.
SEL ₁ ) 65 is output. When port 2 receives this signal, it puts the address and write data on the shared memory bus, and outputs the memory activation flip-flop 69.
is set, and its output is the memory activation signal 66.
is output to the shared memory bus 36. After memory write or read operation, read data (RD)
67, a response signal (ANS) 68 is returned via the shared memory bus 36, so it is sent to the memory expander 4, and the response signal 68 also resets the memory activation flip-flop 69.

The various parts of the embodiment have been described above. FIG. 11 shows a time chart during memory access, and FIG. 12 shows a time chart when rewriting the priority selection flip-flop 100. Note that both are interlocked in the program so that they are not performed at the same time.

Next, a usage example of how to control the priority selection flip-flop 100 in this embodiment will be described in the 13th example.
This will be explained with reference to FIG.

Figure 13 shows the case of a two-CPU system, where (A) shows the state when all devices are normal, CPU 1 turns on the built-in priority selection flip-flop, uses read data from system 1 shared memory M1, CPU2
also turns off the built-in priority selection flip-flop and uses the read data from the 2-system shared memory M2. That is, in a memory expander compatible with CPU1, the flip-flop is flagged to select M1 with priority, and in a memory expander compatible with CPU2, the flip-flop is flagged to select M2 with priority. Flagged. As a result, when both the M1 and M2 systems are normal, the CPU 1 takes in the read data of M1, and the CPU 2 takes in the read data of M2, as shown by the solid line in (A). (The broken line indicates a route where the read data is not used.) Here, M1 performs A-system work, and M2 performs B-system work. Therefore, for example,
If M1 is abnormal and undetectable,
CPU1 may become a soft error and CPU1 may go down, but since M2 is normal (M
1. The probability of M2 simultaneous abnormality is small and ignored. ), CPU
2 will never go down. Conversely, if M2 is abnormal, CPU1 can be prevented from going down.

On the other hand, in the examples shown in FIGS. 3 and 4, both CPUs 1 and 2 go down.

Let's be more specific.

Assume that a minor failure occurs in M1. This minor failure refers to a case where an error occurs as a result of checking the read data of M1 in the parity check circuit. Under this M1 light failure, as shown in (B), CPU1
is switched to M2's read data acquisition, and the business continues as it is. When M2 has a minor failure, (C)
CPU2 and M1 are coupled as shown in FIG. Therefore, normal operation continues even if there is a minor failure in either M1 or M2.

On the other hand, assume that a serious failure occurs in M1. A major failure is an error that cannot be detected by the parity check circuit. In this case, as shown in (D), M1-CPU1, M
2 - The combination of CPU2 continues as it is, and the entire CPU
I can avoid being knocked down 1 or 2. Even if M2 has a major failure, it will remain coupled as shown in (E).

In cases (D) and (E), the CPU using the data in the memory where the major failure occurred will automatically check the rationality.
Detects an abnormality by performing a mutual diagnostic check, etc. and shuts it down. However, other CPUs do not use the data in the severely damaged memory, so they can continue working.

Figure 14 shows a case where there are three CPUs, one of which is a standby system. In this case, minor and major failures in the shared memory are almost the same as in the case of two CPUs in Figure 13, but if a CPU fails, the priority selection flip-flop can be rewritten by a program, so It is possible to reconfigure the system as follows. Now, in Fig. 14A, when CPU2 goes down due to a failure, CPU3 detects that CPU2 is down through mutual monitoring and starts backing up, but at this time, CPU2 selects which side of the shared memory to give priority to. (This information is stored in the OS configuration management table on the main memory of each CPU.) In the case of this figure, since the system 2 shared memory M2 was selected with priority, CPU 3 itself was selected with priority. By turning off the flip-flop and using the data in the 2-system shared memory M2, it is possible to reconfigure the system exactly the same as before the failure, as shown in FIG. 14B. When CPU1 fails, the situation will be as shown in Figure 14C.

FIG. 15 shows the procedure when the CPU 2 in FIG. 14A goes down. If you are even more careful, a severe failure of the 2nd system shared memory M2 will cause the CPU to fail.
2 may have gone down, so first 1
It is also possible to once reconfigure the system using the data in the system shared memory M1, diagnose the shared memory M2, and then switch to using the contents of the shared memory M2.

FIG. 16 shows another embodiment of the present invention, which differs from FIG. 5 in that a flip-flop 70 for specifying a dual-system data-OR method that can be rewritten by a program is added. By turning on the flip-flop 70 specifying the data OR method for both systems, when both systems are normal, the data on both systems can be OR'ed and sent to the CPU, as in the conventional example shown in FIG. Since the data is checked by the CPU, if the data of both systems differ, an error is detected and the process is stopped. Depending on the usage conditions, it may be extremely dangerous for erroneous data to be imported into the processing device.
Rather, it is suitable for situations where it is better to stop all processing units.

FIG. 17 shows still another embodiment of the present invention. The priority selection flip-flop in the memory expander, which determines which shared memory data is used, is replaced with a switch 73.
When switch 73 is on, system 1 shared memory M1
When it is off, the second system shared memory M2 is selected.
If this switch is installed at the operator's hand, the operator can switch at his/her discretion. As described above, according to the present invention, even if undetectable data errors occur one after another during data reading in one system of the duplex shared memory, all CPUs can be prevented from going down. That is, only the CPU connected to the false normal memory among the two groups goes down, and the CPUs in the other groups do not go down. This can prevent the worst case scenario of the entire system going down, and has a great practical effect. Further, according to the preferred embodiment of the present invention, even when backing up a CPU due to a failure, the system configuration can be the same as before the failure, and the reliability of the system can be greatly improved.

[Brief explanation of the drawing]

FIG. 1 is an overall configuration diagram of a multiple processing device including a general duplex shared memory, which is the premise of the present invention, and FIG. 2 is a configuration diagram of a shared memory connection mechanism in the processing device, which is the premise of the present invention. Figures 3 and 4 are
5 is a configuration diagram of a conventional example of a dual-system read data selection circuit, FIG. 5 is a diagram of an embodiment of the present invention of a dual-system read data selection circuit, and FIGS. 6 to 10 are respective parts applicable to the present invention. A configuration diagram of a specific example of
FIGS. 11 and 12 are time charts for explaining the operation of the present invention, FIGS. 13 to 15 are explanatory diagrams showing control procedures when using the present invention, and FIGS.
FIG. 7 is a diagram of another embodiment of the present invention corresponding to FIG. 5. 1... Duplex shared memory, 2... Shared memory side processing unit connection mechanism (port), 3... Processing unit (CPU), 4... Processing unit side shared memory connection mechanism (memory expander), 5... Shared Memory-processing unit interface, 12... Read data selection circuit, 100... Priority selection flip-flop.

Claims (1)

[Scope of Claims] 1 A plurality of processing devices, first and second shared memories that are commonly accessed by the plurality of processing devices, and parity processing for data read from the first and second memories. a parity check circuit provided in or corresponding to each processing device and capable of being changed by a program or other means;
and a storage unit that stores a priority determination plug that determines which of the read data of the first memory or the second memory is to be fetched by the corresponding processing device with priority; As a result of the parity check by the parity check circuit, if it is determined that both the data read from the first and second memories are abnormal, the output signal of the parity check circuit is used to suppress data transmission to the corresponding processing device. If either one of the read data from the first or second memory is determined to be abnormal, the output signal of the parity check circuit causes the read data from the memory determined to be normal to be sent to the corresponding processing device. , if both are determined to be normal, take action according to the output signal of the parity check circuit and the flag specified in the storage unit corresponding to the processing device.
A sending control means corresponding to the processing device, which causes the CPU to send read data from the memory specified by the flag among the first and second memories, and determining priority of the storage section corresponding to each of the processing devices. When the plurality of processing devices are divided into two groups, the flag is set so that the read data of one of the first and second memories is sent to the first group with priority, and the flag is set to send the read data of one of the first and second memories to the first group, and to the second group. A duplex shared memory control device configured to send data read from the other memory with priority.