JPS61213932A - Decentralized duplex computer system and its control method - Google Patents

Abstract

PURPOSE:To perform switching between an in-use and a stand-by system after confirming normal operation by loading an alteration program into a stand-by computer in parallel while carrying out automatic operation by an in-use computer. CONSTITUTION:A tool selector 2 is so operated as to connect the computer of the stand-by system with a tool coupler 4 together for transmission and a stand-by system selection button 40 is turned on. Then, the program stored in the stand-by computer is matched with a program to be loaded, which is loaded in case of correct. A matching check is made to know whether loaded information is written correctly or not and when it is confirmed that the information is written correctly, the stand-by system selection button 40 is turned off. Consequently, control and arithmetic based upon the program which is loaded newly are performed at the stand-by computer side. Then, whether a control obtained as a result is correct or not is monitored and in case of correct, switching between the in-use system and stand-by system is carried out. The system which becomes a stand-by ssystem nearly is also checked.

Description

[Detailed Description of the Invention] [Field of Application of the Invention] The present invention relates to a distributed dual system computer system, and in particular,
The present invention relates to a distributed dual-system computer system suitable for changing programs in an automatic operation state while online.

[Background of the invention]

Conventionally, in order to realize a simple and highly reliable transmission switching method in a distributed duplex system connected via transmission lines, a duplex hierarchy system, as shown in Japanese Patent Application No. 54-28702, has been developed. The method is known.

This conventional method makes effective use of the transmission system, and both dual-system computers always receive the same signal and perform the same arithmetic processing, but the transmission output to the fine-needle calculator is transmitted to the regular system (mask Only the side) computer performs maintenance, and the standby (backup) computer is used only for checking purposes.Therefore, in this method, a centralized maintenance tool is used. Online program loading to a standby computer is impossible because the standby computer is not provided with a transmission function over a transmission line and cannot send back a response.

In other words, the control program changed with the maintenance tool,
When performing online loading to a computer, the program will run out of control unless the computer's control calculations are temporarily stopped. For this reason, it was necessary to manually control the control system when loading the program.

In response to this, recent demands include taking advantage of the dual system computer, allowing the regular computer to continue automatic operation while loading the change program to the standby computer.
It is desired to develop a system that can switch between the regular system and the standby system after confirming its normal operation, and then load the same program to the computer that has become the standby system.

[Purpose of the invention]

The present invention was made in view of the above-mentioned circumstances, and its purpose is to load a change program to a standby computer in parallel and confirm its normal operation while the regular computer continues automatic operation. Later, by switching between the active system and the standby system, the distributed type 2 system can execute program changes in online automatic operation mode.
The object of the present invention is to provide a heavy-duty computer system and a control method thereof.

[Summary of the invention]

In order to achieve the above object, the present invention determines which computer among a plurality of sets of duplex computers connected to a transmission line together with a transmission control device and a maintenance tool transmits a signal to the maintenance tool. A specified tool selector is attached, and only the computer on the selected side (regular use or standby system) exchanges information with the maintenance tool, so that the change program can be written to the standby computer. Do.

A feature of this system is that after confirming its validity, switching between the regular and standby systems is performed, and the change program is written to the computer that has newly become the standby system.

As a result, according to the present invention, one program can be changed without interrupting the control by the regular computer.

[Embodiments of the invention]

An embodiment in which the present invention is applied to process control of a redundant computer system will be described below.

Figure 1 shows the overall configuration of this system.〇Detection end 71.・
...The process signals taken in from the 7n are sent to the corresponding dual system control computers 1m, iB,
...Num+ NB is captured by both the mask system and backup system. Control computer 1mu, IB・
...NA+NB creates a control signal based on the process signal and control information programmed in advance, and switches each switch 31+:G.
...Output to 3n.

Of the control signals output from both the regular and standby systems of the dual system computer, the switching devices 3I, .・River...8n
In addition to outputting to
Specify whether it is B or not. Transmission between each computer is performed via the transmission line 9.

A transmission control device 5 is provided to control signal transmission. Further, a maintenance tool 6 (consisting of a keyboard, CRT, etc.) for maintaining and monitoring program information of each computer, and a tool coupling device 4 for connecting this maintenance tool 6 and a transmission path 9 are provided.

Tool selector 21 according to the invention. - Song 2n specifies whether the computer connected to this maintenance tool 6 is the regular system (mask) side or the standby system (backup) side.

In Figure 0, which describes the signal transmission system by the transmission control device 5 with reference to Figure 3, the same reference numerals as in Figure 1 represent the same or equivalent parts.

In FIG. 3, the dual system computers CI and C2 each consist of a pair of a regular system (mask) side M and a standby system (backup) side S.

The transmission control device 5 periodically outputs a command to execute (signal) transmission from one computer to another computer based on information or commands programmed in advance.

In FIG. 3, if the command 10 is a command signal for transmitting data from computer 1 to computer 2, then this command signal 10 is received by both systems, computer 1 and IB. Computer 1, 1B, receives this command signal 10 and is prompted to send to computer 2M + 2B, but if the mask computer is set to the 1M side, it will actually send the message to computer 2M. Only the computer LM transmits to the MU s2B.

That is, the computer 11 transmits a signal 11 to the transmission wh9, and this signal 11 is received by both the mask/backup computer IA*IB of the dual system computer 2. This completes a series of transmission processing for the command signal 10 from the transmission control device 5.

The above is normal transmission between computers, but the transmission between the tool coupling device 4 and the computer according to the present invention is as follows.

When the transmission control device 5 outputs a transmission command 12 from the computer 1 to the tool coupling device 4 as a transmission command,
The computers 1 and 133 are each ready to send data to the tool coupling device 4.

However, in this case, since the destination is the tool coupling device 4, the tool selector 2. The computer specified in (Figure 1) (Figure 3 shows the case where the standby system is selected) -
That is, the transmission data 13 is transmitted from the computer IB to the transmission path 9.
It is output to the tool coupling device 4 via.

FIG. 4 shows a time chart of the transmission signal explained above.

In this figure, SYN indicates a synchronization code, and DA is a reception address that specifies the computer that should receive the signal under DAId. N is the destination address of the other party to which the transmission is to be sent, SA is the source address, and D input and T input are the transmitted and received data.0 First, on the left side of FIG.
The synchronization code SYN, the reception address DA and the destination address N are transmitted to the transmission path 9.

Each computer receives the recipient address 0 all at once, and as a result, the addresses match - that is, only the specified computer + IB receives the destination address N. My mask calculator has a synchronization code of 8YN and a receiving address of DA.

The eight sender addresses and the transmitted/received data DATA are transmitted to the transmission path 9.

Then, data reception by calculation gA2A12B is performed in the same manner as described above. The half of figure 4 is.

As is clear from the above description, signal transmission from the computer 1 to the tool coupling device 4 is shown.

As described above, the processing flow when the 25x computer transmits and receives data is shown in FIG.

In the case of a dual system, both the mask side and the backup side have the same address, so when the receiving address matches the self address (step 81), both send and receive subsequent signals. It is determined whether it is a command or a reception command (step S2), and if it is a reception command, both hand counters receive the same signal and process accordingly (step 83).

, if it is a send command, then determine whether the own computer is in master mode or backup mode (
Step 84). .

If the result of the determination is master mode, tool selector 2
It is determined whether or not the standby or system has been selected (step 85).

If the standby system is not selected, the process moves to transmission processing (step 87), and if the standby system is selected, it is determined whether the destination address is a tool connection device (step 86)6.If the destination address is a tool connection device , the transmission process is not performed, and if it is outside the tool coupling device μ, the process moves to the transmission process (step 87).

Further, if it is determined in step S4 that the own computer is in the backup mode, it is determined whether the tool selector 2 has selected the standby system (step S8).

As a result, the transmission process (step 87) is entered only when the standby system is being selected and the destination address is the tool connection device (step 89).

For this reason, the above configuration and processing procedure enable interaction between the maintenance tool and the standby computer.

By using the present invention, it is possible to online load a changed control program only to a standby computer while the regular computer continues automatic operation. The specific procedure will be explained in detail later with reference to FIG.

In other words, in FIG. 1, both the regular and standby computers receive the changed program. The standby computer then stops the control calculation and rewrites the program in its own computer using the received data.

On the other hand, the regular computer receives the changed data, but discards this data and continues automatic control calculations.

In the manner described above, online loading to the standby computer is realized. In this case, as is clear,
Mask during program loading to standby computer,
Backup switching must be prohibited. An example of the switching prevention logic is shown in FIG.

In FIG. 5, when the computers in both the A-system selection and B-system selection systems are normal, there are 30 human failure detectors.

The output of the inverter 30B is "O", and as will be seen from the explanation below, the output of the OR circuits 34A and 34B is 10", so the output of the inverter 35 and 35B is "1'".

Therefore, when the A system selection button 31A is operated, the 11
``Output is 32 OR circuits, 33 AND circuits, and OR circuit
It is supplied to the set input terminal of flip-flop 37 via circuit 36. As a result, the flip-flop 37
is set, its Q output becomes "1", and the curtain calculator is selected O. On the other hand, when the B system selection button 31B is operated, the flip-flop 37 is similarly reset, and its Q output becomes "1". 1
” and the B-system computer is selected.

If the A-system computer fails while it is selected, the A-thread failure detection 130A generates an output "l", the output of the inverter 35A becomes 0'', the AND circuit 33A is closed, and the A-system selection button 31 Human output is blocked.

At the same time, the output of the AND circuit 38B becomes "1",
This output is sent to the flip-flop 3 via the OR circuit 36B.
7 reset input terminal.

Therefore, in this state, the B-system computer is forcibly selected.

If the A-system computer is selected and fails, the human-system computer will be forcibly selected in the same way, and
Selection of B-system machines is prohibited.

Now, when the standby system selection button 40 is operated while the human system computer is selected and operating normally, the B system computer is selected, that is, the mask computer is changed from the A system as described below. Switching to B system is prohibited.

That is, when the A-system computer is normal and selected, the Q output of the flip-flop 37 is "O", so the output of the entry path 41, 43 is 10'', and the output of the inverter 44 is ''l. becomes #〇 Therefore, when the standby system selection button 40 is operated and its output becomes "1", the output of the AND circuit 45 becomes "11", and the output of the OR circuit 34B becomes "1". That is, In this state, the A system computer is forcibly selected, just as when the B system computer fails, and the
System computers cannot be selected. .

When the standby system selection button 40 is operated while the B system computer is selected and operating normally, the Q output of the flip-flop 37 is "1#", so the AND circuit 41
．． The output of 43 becomes @0'', and the inverter 449.45
The output of becomes "0". That is, in this state, the B-system computer is forcibly selected as in the case of a failure of the K-system computer, and the A-system computer is forced to be selected.
System computers cannot be selected. As described above, according to the present invention, switching between the active system and the standby system is prohibited by operating the standby system selection button 40, so that safe program loading to the standby system is possible.

Next, the processing flow when changing the program of the dual system computer (both systems) is shown in Figure 6. First, the computer in the standby system and the tool coupling device 4 are connected for transmission. Operate the tool selector 2 as shown and press the standby selection button 40 (
5) is turned on (step 5ll).

In order to check the program to be loaded and determine the changes, the storage program in the standby computer and
The program to be loaded is verified (step 812), and if it is correct, this program is loaded (step 813T814).
.

It is checked during verification whether the loaded information has been written correctly (step 815).

This verification check is performed in 1, for example, by sending the program just loaded to maintenance tool 61 and sending it to maintenance tool 6 2
This can be done by comparing and contrasting both programs.

If it is not loaded correctly, step 81
Return to step 4 and repeat program loading and verification. On the other hand, if it is confirmed that the loading has been done correctly (step 816), turn off the standby system selection button 40.
(step 517).

As a result, on the standby computer side, control and calculations are executed based on the newly loaded program. Then, it is monitored whether the control signal obtained as a result is correct (step 81 B).

The control signal can be monitored by, for example, turning on the standby system selection button 40 again, transmitting the control signal obtained by the standby computer to the maintenance tool 6, and monitoring the validity and fluctuation state of the control signal in the maintenance tool 6. If the control signal is valid (step 519
), mask/backup switching, i.e. regular system/
The standby system is switched (step 820).

Then, the same process as above is performed to load the program into the computer that has newly become a standby system due to the switching (step 521). This completes the program reloading to both the regular and standby systems.

In the embodiment illustrated and described above, tool selection is performed by hard wiring, but as a modification of the present invention, it is also possible to send a tool selection command from the tool and perform switching by software. 〇Also, it is not always necessary for the standby computer to execute exactly the same operations as the regular computer simultaneously and in parallel. In short, what is required in the present invention is to connect the standby computer to the maintenance tool 6 and exchange information with it while the regular computer is reading the normal control operations. By making the control program rewritable.

This makes it possible to rewrite programs online without interrupting control by the dual computer system.

〔Effect of the invention〕

According to the present invention, in a distributed dual-system computer system, while automatic operation continues, it is possible to make program changes only to the standby computer: the validity of the program information is checked. After checking, switch the regular/standby system and change the program of the computer that has become the new standby system. This creates a distributed dual system computer system that does not interrupt control even when programs are changed. realizable.

[Brief explanation of drawings]

FIG. 1 is a block diagram showing an example of a system configuration according to the present invention, FIG. 2 is a diagram showing a transmission processing flow of the present invention, and FIG.
FIG. 4 is a block diagram for explaining the transmission processing procedure of the present invention, FIG. 4 is a time chart thereof, and FIG. 5 is a block diagram showing an example of the logic of dual system computer selection according to the present invention.
Figure 6 is a diagram showing the processing flow when changing programs on both systems of a dual system computer in an automatic operation state.
IB-NB...Calculator, 21-2n...Tool selector, 31-3n...Switcher, 4...Tool connection device, 5...Transmission control device, 6...Maintenance tool, 7, ~7n... detection end, 8. ~8n...operation end,
9... Transmission line agent Patent attorney Michihito Hiraki Figure 1 4 Transmission control device S DA N Ying-21 One eleven one

Claims (5)

[Claims] (1) Within each group, multiple sets of dual-system computers, each of which always receives the same signal, one maintenance tool that centrally performs maintenance and monitoring of the dual-system computers, and the maintenance tool. a tool connecting device that connects each of the dual system computers;
A transmission line that connects the dual-system computer and the tool coupling device, a transmission control device that controls signal transmission between the computers via the transmission line, and outputs a calculation result of each dual-system computer. In a distributed dual-system computer system having a switch for specifying a computer as a regular system, each dual-system computer is provided with a tool selector for selecting a computer to transmit data to the tool connecting device, and the tool connecting device is connected to the tool connecting device. 1. A distributed dual-system computer system characterized in that only a computer on a selected side transmits data to a maintenance tool via the maintenance tool. (2) In the dual-system computer system according to claim 1, each dual-system computer is supplied with a detection signal from a detection terminal assigned in advance as an input. Heavy computer system. (3) Within each group, there are multiple sets of duplex computers, each of which always receives the same signal, one maintenance tool that centrally performs maintenance and monitoring of the duplex computers, and the maintenance tool and the 2
a tool connection device that connects each of the dual system computers; a transmission line that connects the dual system computers and the tool connection device; and a transmission control device that controls signal transmission between the computers via the transmission line; A control method for a distributed dual system computer system equipped with a switching device that designates the one that outputs calculation results as a regular system among each dual system computer, the method comprising: maintaining a program changed by a maintenance tool; When loading from the tool to the dual system computer, by selecting a standby computer from the dual system computer using a tool selector, signal transmission between the maintenance tool and the maintenance tool is possible, and to the standby computer, Write the changed program from the maintenance tool, operate the standby system computer according to the newly written changed program, and after confirming its validity, switch between the standby system and the regular system, and create a new standby system. A method for controlling a distributed dual-system computer system, characterized in that the modified program is written to a computer that has become a system from a maintenance tool. (4) In the control method according to claim 3,
The validity is confirmed by transmitting the results obtained by operating the standby computer according to the newly written change program to the maintenance tool, and comparing and contrasting the results with scheduled information in the maintenance tool. A method for controlling a distributed dual-system computer system, characterized in that: (5) In the control method set forth in claim 3 or 4, during loading of a modified program, 2
A control method for a distributed dual-system computer system, characterized in that switching between a regular computer and a standby computer is prohibited.