JPS63159944A - Computer system with high reliability - Google Patents

Abstract

PURPOSE:To attain the super-high reliability with a computer system by connecting an error correcting/coding circuit between the outputs of plural computers and the input of a majority circuit together with an error correcting/ decoding circuit connected to the output of a majority circuit. CONSTITUTION:An error correcting/coding circuit 2 is provided together with an error correcting/decoding circuit 4. The circuit 2 applies the error correcting/ coding operations to the signals supplied to a majority circuit 3. Thus the circuit 4 can obtain a correct result by an error correcting code despite a trouble of the circuit 3. Therefore the troubles of a computer 1 and the circuit 2 can be avoided by the circuit 3 and the trouble of the circuit 3 can be avoided by the circuit 4. Furthermore the trouble of the circuit 4 can be avoided by the parallel redundancy. In such a constitution, the trouble avoiding mechanisms of each system component element are all included in a computer system in the form of component elements. Thus the super-high reliability is ensured for the computer system.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a highly reliable computer in which a plurality of combinators are made redundant by a majority voting system.

〔overview〕

The present invention provides a highly reliable computer system equipped with a majority circuit, which includes an error correction encoding circuit that adds an error correction code to the output of the computer, and an error correction code that corrects errors in the output of the majority circuit. By providing an error correction decoding circuit, an ultra-highly reliable combinator can be obtained.

[Conventional technology]

Conventionally, in the high reliability combinator system, the majority voting system requires high reliability because even if a component fails, it does not appear on the system as a whole, and there is no interruption of system operation due to redundant switching operations or software retries. It is often used when

[Problem that the invention seeks to solve]

Incidentally, in recent years, the role of computers has been increasing in aircraft, spacecraft, etc., and it has become necessary to perform flight or internal control entirely by combi-controller control. For this reason, computers have changed from the traditional 58I (small scale integrated circuit) and MSI (medium scale integrated circuit) to LSI (large scale integrated circuit) and very large scale integrated circuit (LSI). As a result, technology is progressing in the direction of achieving both high functionality and high performance as well as compactness and low power consumption.

On the other hand, a small number of high-energy cosmic rays fly into space, and when they hit the microprocessor
The so-called single event phenomenon, in which SI loses internal information and becomes inoperable, has become a problem. This single event phenomenon is said to have a probability of occurring once every few hours to several months, and depends on the strength of the LSI, startup, etc.)
Change.

In addition, as computers have become the core of spacecraft, malfunctions and malfunctions cannot be tolerated even for a short period of time, and repairs are impossible far from the ground, so three or more computers are used to make a majority decision. High-reliability computer methods are being researched to take

However, the majority voting system has the following drawbacks, so despite its advantages, it has problems in fields that require ultra-high reliability as described above. ■ If the majority circuit fails, the entire system This may result in a malfunction.

■ If the majority circuit is made redundant, this part will need to be replaced in the event of a failure, and processing will generally become discontinuous due to software retries, etc.

SUMMARY OF THE INVENTION An object of the present invention is to provide a highly reliable combinator system capable of realizing an ultra-highly reliable combi-air system by eliminating the above-mentioned drawbacks.

[Means for solving problems]

The present invention provides a highly reliable computer system including a plurality of combiators and a majority circuit connected to the outputs of the plurality of combiators to take a majority decision, between the outputs of the plurality of computers and the input of the majority circuit. an error correction encoding circuit which is connected to the circuit and adds an error correction code to the output of each combination; an error correction decoding circuit which is connected to the output of the majority circuit and which corrects errors in the output using the error correction code; It is characterized by including.

[Effect]

In the present invention, the signal input to the majority circuit is encoded by an error correction encoding circuit, and even if ib occurs due to a failure in the majority circuit, the error correction decoding circuit Correct results can be obtained using the above error 9 correction code.

In this case, the failure of the correction encoding circuit can be avoided by the majority circuit, the failure of the majority circuit can be avoided by the error correction decoding circuit, and the failure of the error correction decoding circuit can be avoided. can be avoided by parallel redundancy.

Therefore, since the prevention of failures of each component of the system is included as a component, the drawbacks of the conventional majority voting system described above can be eliminated, and an ultra-highly reliable computer can be obtained.

In addition, the above i5i! In the present invention, the computers constituting the system include all those equipped with a combination processor function, such as microcomputers and microprocessors. Further, in the above description, the number of computers is three, but this applies to a plurality of computers.

The majority voting circuit is of a known type and is suitable for the number of bits to be used for majority voting and the number of computers used. An example of the configuration of the majority circuit itself is, for example, 198
Nikkei Combi, -ta, No. 190-2, published October 5, 1
It is shown in the article 17 "Oort φ Tolerant Control" on page 05.

Error correction encoding circuits and error correction decoding circuits may also be known. Examples of error correction code systems used in these circuits are as follows.

Note) 8EC: single error co
rrecting [Example] Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings.

FIG. 3 is a block diagram showing the configuration of an example of a conventional highly reliable computer system. 1 person for 3 computers,
The outputs of the IB and IC are input to the majority decision circuit 3 and the majority decision is made so that even if one combination unit 1 fails, the system will not fail.

On the other hand, FIG. 1 is a block diagram showing the configuration of a first embodiment of the present invention, and shows the basic configuration of the present invention.

In this example, three combinations are used: IA e IB.
eIC (!:, a majority circuit 3 that is connected to the outputs of these three combination assemblers and takes a majority vote, and a majority circuit 30 that is connected to the outputs of the three computers IA, IB, and IC and outputs of each of the three computers IA, IB, and IC).
three error correction encoding circuits 2A and 2B connected between the input and the output of each computer 1 and adding an error correction code to the output of each computer 1;
.

FIG. 2 is a block diagram showing the configuration of a second embodiment of the present invention. This embodiment shows a case where the output is duplicated in the first embodiment shown in FIG. 1, and two error correction decoding circuits 4A, 4B and two actuators 5A, 5B are provided.

The feature of the present invention is that in FIGS. 1 and 2, the number of error correction encoding circuits 2 and error correction decoding circuits 4 is 9 and K.

Next, the operation of the embodiment will be mainly described with respect to the second embodiment. Computer 1. output (4 bits of control signal, 10 bits of address, 12 bits of data, total of 24 bits)
B, T. ) are added as error correction code bits by the error correction encoding circuit 2 (in the case of 1 error correction and 2 error detection codes), and are input to the 9 majority voting circuit 3 for a total of 30 bits. be done.

The majority voting circuit 3 takes a majority vote for each bit of each 30-bit output from each computer 1, and sends the same result to two error correction decoding circuits 4A and 4B, respectively. As a result, even if each computer 1 fails, it is eliminated by majority vote. The error correction decoding circuit 4 corrects errors caused by a malfunction in the majority circuit 3 using wA correction code bits, and the error correction decoding circuit 4 corrects errors caused by malfunctions in the majority circuit 3, etc.
Send output to .

Furthermore, the error correction decoding circuit 4 and the actuator 5 have a parallel redundant configuration, and by making sure that they operate as a system even if either system stops operating, this part can be improved. Make sure that failures do not affect the entire system.

The above-mentioned explanations are summarized as means for avoiding failures. As shown in the previous table, this embodiment provides an ultra-highly reliable computer.

The arrangement of the storage devices and input devices of each combination, unit, and unit can be appropriately determined depending on the characteristics of the intended system. Examples of the configuration are shown in FIGS. 4 to 7.

In the embodiment of FIG. 4, each CPU connected to the input device,
It has a microprocessor 11 and a memory 12 in the port 1,
The output of each CPU unit 1 is passed through an error correction encoding circuit 2, a majority circuit 3 takes a majority decision, an error correction decoding circuit 4 corrects errors in the majority circuit 3, and outputs the corrected error to an output device 15. In this embodiment, since the bidirectional circuit portion of the signal line is reduced to only the CPU unit 10 portion, it is effective for a system with a small memory 2, input device FT16, etc.

In the embodiment shown in FIG. 5, the scale of the input device is larger and its control is more complicated than in the embodiment shown in FIG. 4, but it is an effective configuration when only a small memory capacity is required.

In the embodiment shown in FIG. 5, the input device of each CPU unit 1 is located on the output side of the majority circuit 3, and data is output to the majority circuit 3 based on the signal from each microprocessor, and the data is sent via the majority circuit 3. and passes input data to each microprocessor 11. When the majority circuit 3 is used in the opposite direction, it only distributes the signal to each CPU 5-=T1.

The embodiments shown in FIGS. 6 and 7 require a larger memory than the embodiments shown in FIGS. 4 and 5, and are suitable for cases where it is difficult to provide a memory for each CPU unit. It is configured to do this. In the embodiments shown in FIGS. 6 and 7, the memory 12 is placed outside the majority circuit 3 so that only one set of the memory 12 is required. Therefore, the embodiment of FIG. 6 is suitable for a case where the input device 6 is small-scale and the memory 12 is large-scale, and the embodiment of FIG. 7 is suitable for a case where both the input device 6 and the memory 12 are large-scale.

An example of the basic configuration of control in the embodiment shown in FIG. 7 is shown in FIG.

In FIG. 8, an interrupt signal 61 is added to the configuration of FIG. 7, and memories 12A and 12B and 51 input devices are provided.

Each type has two sets of 51B. Memo'J12A.

The reason for having two sets of 12B and input devices 51A and 51B is to create a redundant configuration so that even if a failure occurs, the system as a whole operates normally and repairs can be made while the system is in operation without stopping it. This is for the purpose of In addition,
The reason why the interrupt signal 61 is input in parallel to each MPU 11 is because the interrupt circuit is a relatively simple input circuit and can be considered in the same manner as the configuration shown in FIG.

FIG. 9 shows a detailed configuration of the control of the embodiment shown in FIG. 8. The operation of each component of the embodiment shown in FIG. 9 will be explained below along with the flow of signals.

(1) Clock and reset 9 Three microprocessor systems 11A, IIB.

11C is the same glue 0. It is given a reset signal and a reset signal, and performs the same operation in complete synchronization on a clock-by-clock basis.

(2) Interrupt control circuit 61 An interrupt control circuit 62 is provided in each microprocessor 11,
Interrupt input is controlled independently for each microprocessor. In addition, in consideration of a failure of the interrupt control circuit 62 and to simplify the circuit, a system is adopted in which the interrupt control circuit 61 does not pass through the majority decision circuit 3.

(3) Control line (microprocessor output) 21 Each microprocessor outputs control signals of the number φ.
For simplicity, three signal lines are used here: read/
1! :Only the signal lines for inclusion, distribution, and pass lock are sent to the majority circuit 31. Since each line of the control line 21 is aperiodic with respect to each other, it is not possible to add an error correction code and send it. is taken and
Since this majority circuit 31 has a redundant configuration, its failure can be avoided.

In FIG. 9, the control signal majority decision circuit 31 is shown as an integrated circuit, but as described above, it has a redundant configuration and can be separated from a failure location.

(4) Address signal (microprocessor output) 22 The address signal 22 output from the microprocessor is
The signals on each line are processed by an error correction coding circuit (BC) attached to each microprocessor 11.
C-BNC) 24, the data is subjected to h-shi correction coding. This is sent to the memo 12 and the system path 43 after receiving multiple waves for each bit in the majority decision circuit 32 and removing failures in the microprocessor 11 and IGcc-ENC 24. Mesori 12 and system path interface 42
In the input/output device ft51 provided ahead of , an error correction decoding circuit (ECC-DEC) 41 can remove errors in the majority circuit 32 and system path 43 to obtain a correct address value.

(5) Data signal 23 Since the data signal 23 is bidirectional, contrary to the case where data is output from the microprocessor 1111il,
There are cases where the data is input to the microprocessor 11 side.

When data is output from the microprocessor 11 side and written to the memory 12 and the input/output device [51], the BCC-ENC/DEC 25, similar to the address signal 22 in (4),
Majority circuit 33, write control &82 or ECC-DEC
/ENC 41, the correct data is passed to the memo') 12t or the input/output device 51. Conversely, when data is input and read into the microprocessor 11, the input data is sent to the input/output device 51, the memory 12, and the ECC-DEC/B.
Error correction coding is performed by the NC 41 or the write controller 82,
The signal is input to the majority circuit 33. In this case, majority circuit 3
It simply has the function of distributing data to each microprocessor 11 without performing a 3-majority voting operation. The data output from the majority circuit 33 is ECC-BNC/D
The EC 25 corrects errors occurring midway and outputs them to the microprocessor 11, so that the microprocessor 11 can receive and receive correct data.

26-bit ECC-E for address signals shown in Figure 9
Details of the NC24 and ECC-DEC81 are shown in FIG. The circuit in Figure 10 consists of B CC-ENC24 and ECC
- It includes both DEC81 and can be used as either an encoder or a decoder depending on the setting of the BNC terminal. When used as an encoder, input the address signal from the microprocessor 11 side to AGO~A25, and input the input signal t26.
Bit) Address signals encoded with ECC-ENC and error correction encoded into BOO-B25 and BPQ-5 can be obtained. As an example of the configuration of this 26 bit,) FCC-ENC, 5ED-DED (8ingle Error C
correction-Double Error
tection): The circuit using r-do is the 12th
As shown in the figure.

When used as a decoder, BOO to B25. BPO~5
The input signal that inputs the corrected address signal is decoded by 26-bit, ) ECC-DEC and converted to AOO~
A correct address signal is obtained at A25. If there is an error, a signal will be output to the E-KA terminal if it is a single error (the result is correctly corrected), and a signal will be output to the DERA terminal if there are multiple errors (the result is also incorrect). If everything is correct, neither signal will be output), so you can know the error situation. As a configuration example of 26-bit ECC-DEC,
The circuit using the 8ED-DED code is shown in Figure 13, and the syndrome matrix logic diagram of the code is shown in Figure 14.
As shown in the figure.

16-bit) ECC-EN for the data signal shown in Figure 9
Details of the C/DEC 25 and write controller 82 are shown in FIG. The circuit shown in FIG. 11 has a 16-bit error correction encoding and decoding function and a byte writing function. EC used by connecting to the microprocessor 11 side
For C-ENC/DEC25, microprocess COO-C15.

DOO~D15. DPQ to DPs are connected to the majority circuit 33 side. Also, 8H, = 8L.

=l, sL, =sL, =su, =3)1. =Q,THR
Let U=0. When the microprocessor 11 outputs data, this data is input to C00-015,
SH again! , SL, are 1, so the switch s1. COO-C15 is selected for the output of s2, 16 bits, and BCC-E
Error correction coded by NC251, DOO~Dis,D
Output to PO-DP5. Microprocessor, S1
1 reads data, conversely, DOO~Di5. D
Error correction coded data is input to PO to DP5, error corrected by 16-bit) ECC-DEC252, and C
It is output to OO-C15 and read by microprocessor IIK.

When error 2- occurs, the 26-bit) ECC shown in Figure 10
- As in the case of HNC/DEC24, 81, it is shown in ERRB and DERB as false 9.

In the case of the ECC-ENC/DEC 41 used by connecting to the input/output circuit 51 side of the input/output device 51, the microprocessor 11 is replaced with the input/output device 51.

When connected to the memory side and used as the write controller 82, coo-015, CPO to CP5 are connected to the majority circuit 3.
On the 3rd side, Doo~D15. DPQ to DP5 in memory 12
Connect each side. When writing normal 16 bits, first C00 to 015. CPO~CP5 K input error corrected data once 16 bits)ECC-DEC
Error correction with 253 and 16 bits again) 9 with BNC251
A correction coding is performed and DOO to D15. DPQ~DP5
The data is output to the memory 12 and written to the memory 12. (5H1=SL
, = 1, 8H, ~S = 8L? -8=0. T
H = 0) In addition, SH snow = 8 L, = 1, 8
If Hl-6=3I+, ~,=o, and THRU=1, a method of writing without error correction is also possible.

When 16 bits appear one after another, DOO~D15. Dr□〜D
When inputting the data read from newt 12 to Ps,
The 16-bit ECC-DEC 252 partially corrects errors in the data read from the memory 12, and sends the data to the COO-C 15,
It is outputted to CPO to CP5 and sent to the majority circuit 33. When reading 8 bits, 16 bits are read from the memory 12 in exactly the same way as when reading 16 bits, and the data is passed through the majority decision circuit 33 to the microprocessor and the ECC-BNC/D on the side 11.
The EC251 processes 16 bits, and the microprocessor 11 reads the required high byte or low byte of the 16 bits.

When writing 8 bits, is it a microprocessor? 11 outputs 8-bit data, but microprocessor 1
The ECC-ENC 251, which received the byte data of 1, uses switches S1 and 82 to set bits other than the byte data output by the microprocessor 11 to 0 to create 16-bit data, and applies a gb correction code to this data. Add. The majority decision circuit 33 takes a majority decision 9 on this and inputs it to the memory write controller 82. In the write controller 82, the error is corrected by the 16th bit E in FIG. 11, cc-DEC 253,
input to switches S1 and S2.

On the other hand, in byte writing, bytes that are not the target of writing by the microprocessor 11 need to be read from the memory 12, so first all data are read from DOO to D15, D.
P 0-DP 5K [Out L, 16 k' y)ECC
After error correction by the DEC 252, it is sent to the switch 81°S2. i1 to be written into the memory by combining the byte data sent from the microprocessor 11 and the byte data read from the memory 12 using switches 81 and 82.
Create 6-bit data, and convert this new data to 16-bit data)
Error coded with ECC-ENC251, I)oo ~D
15. Output to DPO-DP5. This is written into the memory 12. FIG. 14 shows the flow of data processing in this byte writing.

In the byte write method, data is first read out from the memo+712 in word units, the write information from the microprocessor 11 is added to it to create memory write data, and an error correction code is added again to the memory 12. , so one write requires two memory cycles, but
Only 6 bits are required for iIA correction bits. On the other hand, if a method is adopted in which an @shi correction code is added to each byte, 5 error correction bits and 2 toss bytes=10 bits are required. The byte write method is advantageous because it requires fewer memory elements.

In addition, 16-bit ECC-ENC251 and 16-bit)
ECC-iJEc252, 253 is 26-bit ECC
-HNC24 and 26bi,) A part of ECC-DEC81 was used. That is, the circuit uses only 16 pits out of 26 bits, and sets all the remaining 10 pits to 0.

Details of the majority circuits 31, 32, and 33 shown in FIG. 9 are shown in FIG. 16.

The majority voting circuit shown in FIG. 16 takes a majority vote on three A-C system data, and includes 25 majority voting channels 30.

Furthermore, if either of A to C is incorrect as a result of the majority vote, the flags ERA to ERC can indicate which one is incorrect. Majority vote Human power If the middle two systems of the A-C system completely fail, it will not be possible to take a majority vote.
In this case and for the convenience of exams, etc., 1 from Human to C type.
The circuit can also be used only for the grid.

The majority voting channel 3o in FIG. 16 has a total of 25 channels, 17 channels in one direction and 8 channels in both directions.
．． Can be used as 33. 17 channels in one direction is control line 3
Channels x 2 locations = 6 channels and 11 address channels for a total of 17 channels, and 8 bidirectional channels are used for data lines.

FIG. 17 shows the details of the circuit of one channel of the 25 majority channel 3o in FIG. 16. A, B.

C is data input, 01 is output of majority vote result, 02゜o3
．． 04 is a flag output indicating that there is an error corresponding to A to C.

S■ is a selection mode control signal that uses 8A, 8B, and SO together to stop the majority voting operation and select one of the A-C systems. In this mode, which one of the A-C systems is selected. The selected channel is indicated by 8A, 8Bi or SC, and the selected channel becomes the output of 01.

[Brief explanation of the drawing]

FIG. 1 is a schematic diagram showing the configuration of a first embodiment of the present invention. FIG. 2 is a schematic diagram showing the configuration of a second embodiment of the present invention. FIG. 3 is a professional diagram showing the configuration of a conventional example. 4 to 7 are block diagrams showing various configurations in which memories and input devices are arranged in the second embodiment shown in FIG. 2. FIG. 8 is a block diagram showing a modification of the configuration shown in FIG. 7. FIG. 9 is a diagram showing details of FIG. 8. Figures 10 and 11 are 26 bits in each Figure 9)
CC-ENC and 16-bit,)ECC-ENC/DEC
Circuit diagram showing details of. Figures 12 and 13 are 26 bits in each Figure 10)
1 is a circuit diagram showing the internal configuration of a BCC-ENC and a 26-bit ECC-DEC. FIG. 14 is a logic diagram showing a logic matrix in the decoding circuit in FIG. 13. FIG. 15 is a circuit diagram showing the internal configuration of the 16-bit ECC-ENC circuit shown in FIG. 11. Agent Patent Attorney Susumu Uchihara 42m /A Play 3 Kukosai 12m Kaya 14-r! ! J 6bit 8bit l1lyjt No. I
5 To power off 9

Claims (1)

[Scope of Claims] 1. A highly reliable computer system including a plurality of computers and a majority circuit connected to the outputs of the plurality of computers to take a majority decision, wherein the outputs of the plurality of computers and the input of the majority circuit and an error correction decoding circuit connected to the output of the majority circuit and correcting errors in the output using the error correction code. A highly reliable computer method characterized by comprising: 2. A highly reliable computer system according to claim 1, in which the error correction decoding circuit is made redundant. 3. A highly reliable computer system according to claim 1 or 2, wherein a relatively small capacity memory is arranged inside each computer. 4. A highly reliable computer system according to claim 1 or 2, wherein a relatively large capacity memory is arranged between the output of the majority circuit and the error correction decoding circuit. 5. Any of claims 1 to 4, in which an error correction decoding circuit is attached to the error correction encoding circuit, and an error correction encoding circuit is attached to the error correction decoding circuit, so that input and output are dual-directed. A highly reliable computer method described in . 6. A highly reliable computer system according to claim 5, wherein an error correction decoding circuit equipped with an error correction encoding circuit and an input/output device connected thereto are made redundant. 7. A highly reliable computer system according to claim 4, in which an error correction decoding circuit is arranged immediately before the memory. 8. The highly reliable computer system according to claim 7, wherein the memory in which the error correction decoding circuit is arranged is made redundant. 9. The highly reliable computer system according to claim 6, which employs an interrupt input control method in which the input device is controlled by an interrupt signal. 10. The highly reliable computer system according to claim 5, wherein the control signal and the address signal are output, and the data signal is bidirectional during reading and writing, and error correction is performed in both directions.