RU2264648C2 - Reserved two-processor computer system - Google Patents

Abstract

FIELD: computer science.

SUBSTANCE: device has comparison circuit, two system generators, two starting setting circuits, two identical channels, each of which has microprocessor unit, commutation device, Or circuit, error counter, pulse generator, time analyzer of intactness, trigger, OR-NOT circuit, outputs of commutation devices of both channels are combined and are output of device.

EFFECT: higher reliability.

8 dwg

Description

The present invention relates to computer technology and can be used to build reliable computing and control systems.

Known dual-processor computing system [1], containing two processors and a two-channel control device that transmits control and enable signals to the processors. In accordance with these signals, one of the processors is used as the main one, and the second as a slave. The choice of processor is carried out by the main control circuit. If the positional signals have a certain value within the set time, the trigger is cocked. The two-channel control device analyzes the signals from the two main control circuits and automatically assigns the main and slave processors.

The disadvantage of the system is that it uses a static ready signal to select a processor (when the processor program “hangs”, the signal is saved). When choosing a primary and backup processor, information about the number of failures of each processor is not used.

A known system with a backup processor for process control [2]. The system contains a primary processor for controlling the process through a set of input / output devices. The primary processor comprises a central processor and a storage device (memory) and operates in accordance with an application program. The memory stores a record of the current state of the system with the parameters of the current operation necessary for the application to work. The standby processor contains the memory and can be either in active mode or in standby mode. In active mode, it completely replaces the primary processor. In standby mode, it periodically writes to the memory buffer information about the current state coming through the dual-port memory from the primary processor. In this case, the record is checked for errors. The primary processor control unit operates independently of system status data. It can generate a fault signal and put the standby processor in active mode.

The disadvantage of the system is that when the dual-port memory device fails, the backup processor will not receive data. Only a single transition "primary-secondary" is possible.

Known fault tolerant computing system (prototype) with two processors, alternately performing the functions of the main and slave processors [3]. A computing system consists of two processors (channels), an initial installation circuit connected to the processor input of each channel, a system generator whose output is connected to the processor input of each channel, and a control circuit. Each processor can work in stand-alone mode of the main processor and in the mode of a slave processor that controls the operation of another processor. Work in the main processor mode consists in the usual execution of instructions and input / output functions; in slave mode, the processor executes the same instructions as the main processor, only all lines through which data is output are turned off. In addition, in the slave mode, a comparison circuit built into the processor checks the output of both processors. The control circuit at certain time intervals switches the operating modes of the processors to control each other's processors. If a mismatch occurs, the slave processor signals an error to the control circuit. The control circuit tries to restore the synchronism of the processors, causing an external interrupt in both processors. If the processor crashed and at that time was a slave processor, then in this case the circuit will work without a slave processor for a time equal to the period of switching the processor operating modes. Then, the failed processor will be transferred to the master mode, and the healthy processor will be transferred to the slave mode, where a malfunction of the main processor will be detected.

The disadvantage of the system is that when a system generator, which is common to two processors, fails, the entire system fails. In the case of using separate generators, a desynchronization will occur for each processor. Unsynchronization can also occur when the input data from the receiving devices is not received simultaneously.

The technical result is to increase the reliability of the system by periodically solving the diagnostic problem in each channel, temporarily analyzing the health, determining the number of failures and selecting a channel compared to the accumulated information about the number of failures in each channel.

The technical result is achieved in that in a redundant dual-processor computing system containing two identical channels, in each of which the first output of the processor is connected to the first input of the switch, the system generator, the output of which is connected to the first input of the processor of the first channel, the initial installation circuit, the output of which is connected a pulse generator, an OR element, a temporary health analyzer, a failure counter, a trigger, an IL element are introduced into the second input of the processor of the first channel, the first and second channels -NOT, whose output is connected to the second input of the switch, the second processor output through the OR element is connected to the first input of the trigger and to the second input of the temporary health analyzer, the trigger output is connected to the first input of the OR-NOT element, the second processor input is connected to the second input of the OR element and the second input of the fault counter, the output of the pulse generator through a temporary health analyzer is connected to the first input of the fault counter and to the second input of the trigger, the second output of the fault counter is connected to the second input OR OR, and also introduced a system generator whose output is connected to the first input of the processor of the second channel, the initial installation circuit, the output of which is connected to the second input of the processor of the second channel and the comparison circuit, the first input of which is connected to the first output of the failure counter of the first channel, the second input of the comparison circuit is connected to the first output of the failure counter of the second channel, the first output of the comparison circuit is connected to the third input of the OR element of the first channel, the second output of the comparison circuit is connected to the third input of ment NOR second channel, and switches the outputs are connected to the output of the system.

Figure 1 shows the structural diagram of the proposed system.

Figure 2 shows the timing diagram of the system after exiting the initial state.

Figure 3 shows the timing diagram of the system during a failure in the processor 5 of the first channel 1.

In figure 4. The time diagram of the system when the processor 5 of the second channel 1 fails.

Figure 5 shows an example implementation of a temporary analyzer health 8.

Figure 6 is its timing diagram.

7 shows an example implementation of the failure counter 10.

On Fig - its timing diagram.

The redundant dual-processor computing system shown in FIG. 1 contains two identical channels 1, two identical system generators 2, two identical initial setup circuits 3 and a comparison circuit 4. Each channel 1 contains a processor 5 connected to an OR element 6, a pulse generator 7 connected to a temporary health analyzer 8, which is connected to a trigger 9 and a failure counter 10, an OR-NOT 11 element connected to a switch 12, in addition, the processor 5 is connected to a switch 12, the OR element 6 is connected to a temporary analysis health indicator 8 and trigger 9, trigger 9, failure counter 10, and comparison circuit 4 are connected to the OR-NOT element 11. The failure counters 10 of each channel 1 are connected to comparison circuit 4. Also in the system, the corresponding system generator 2 is connected to processor 5 of the corresponding channel 1, the corresponding initial installation circuit 3 is connected to the processor 5, the OR element 6 and the failure counter 10 of the corresponding channel 1. The outputs of the switches 12 of each channel 1 are connected and are the output of the system.

The system operates as follows.

Before starting work for each channel 1, the corresponding resetting circuit 3 generates a reset signal that arrives at processor 5, a failure counter 10, and through an OR 6 element to a temporary health analyzer 8 and trigger 9. During operation, processor 5 periodically generates a health signal, which, through OR element 6 is fed to a temporary health analyzer 8 and trigger 9. In the absence of a health signal from processor 5 during a certain time interval, a temporary health analyzer 8 generates a pulse, falling on the counter of failures 10 and trigger 9. Each channel 1 gives a parallel code of the number of failures of the processor 5 from the output of the counter of failures 10 to the comparison circuit 4 and receives a channel selection signal from it, provides data to the channel output through the switch 12 in the presence of a permission signal generated element OR NOT 11 according to the signals from trigger 9, failure counter 10 and comparison circuit 4.

After the RES signal passes from the initial setup circuit 3 in the processor 5 of each channel, the diagnostic task is periodically performed at the same time as the main task, which, if successful, generates a short TestOK health pulse, which passes through the OR 6 element to the temporary health analyzer 8 and trigger 9.

The pulse generator 7 serves to clock a temporary analyzer of health 8, does not require a stable frequency, and can be performed as a relaxation circuit on a logic element.

The temporary health analyzer 8 is a counter of pulses from the pulse generator 7. The counter is reset by the health signal from processor 5 or by the reset signal of the initial setup 3. Figure 5 shows an example of the implementation of a temporary health analyzer on the counter in Gray code modulo four ; figure 6 is its timing diagram. The RESTART signal is generated by the OR element 6 from the TestOK signals of the processor 5 and RES of the initial installation circuit 3.

For a known period T of the diagnostic problem, which is determined by the inertia of the controlled object, the frequency F of the pulse generator 7 is determined from the relation

where N is the maximum number of pulses until the counter of the temporary health analyzer is filled (N = 3 is accepted in FIGS. 5 and 6).

To expand the functionality of the pulse generator 7 can be made tunable, for example, using a controlled frequency divider.

Failure of processor 5 is considered the absence of a health pulse in the time interval

If processor 5 fails, TestERR pulses from a temporary analysis of fault 8 will go with a period

Trigger 9 is used to block the passage of data from the channel by the BLOCK signal in the event that a TestERR pulse is received from the temporary analyzer. When a RESTART signal is received from the OR element 6, trigger 9 unlocks the channel.

Failure counter 10 sets the COD code for the number of channel failures and is a counter of TestERR pulses received from the temporary health analyzer 8. The counter is reset by the reset signal RES of the initial setup 3. If a pulse from the temporary analyzer is operational, the TestOK malfunction counter blocks the channel with a signal FAIL. The receipt of M pulses in the failure counter is considered a channel failure. Figure 7 shows an example implementation of the failure counter at M = 3; on Fig is its timing diagram.

и

для каждого канала 1. Схема сравнения 4 может быть реализована на ИС КР1533СП1.Comparison scheme 4 - a combinational circuit comparing COD ₁ and COD ₂ codes from the failure counter 10 of two channels 1 generates selection signals

and

for each channel 1. Comparison scheme 4 can be implemented on the IP KR1533SP1.

The switch 12 is a shaper with three states at the output and can be performed on the IP KR1533AP (3,4), KR1534AP (3-5).

(равен '0') и

(равен '1'), поступающими на элемент ИЛИ-НЕ 11 соответствующих каналов 1. В первом канале 1 сигнал OE₁ от элемента ИЛИ-НЕ 11 поступает на коммутатор 12 и, таким образом, на выходной шине устройства находятся данные/команды от процессора 5 первого канала 1.The initial state of the system (see Fig. 2) is set by the signal RES of the initial installation circuit 3 supplied to the processor 5, the failure counter 10 (sets the COD of the number of failures to “0” and the failure signal FAIL to “0”) and via the OR element 6 to a temporary analyzer of health 8 and trigger 9 (sets the BLOCK channel lock signal to '0'). During the end of the RES signal, a diagnostic (control) task is started periodically in the processor 5 of each channel with a predetermined time interval for its solution. During normal processor operation, i.e. After receiving the correct diagnostic task result for a fixed time interval, the processor 5 of each channel 1 generates TestOK service signals, which, through the OR element 6, are sent to reset the temporary service analyzer 8 and to reset the trigger 9. The frequency of the pulse generator 7 is selected so that over time To solve the diagnostic problem, a pulse with a temporary health analyzer could not receive pulses greater than N-1, where N is the maximum number of pulses before filling the counter of a temporary analyzer. Thus, if the diagnostic tasks are periodically solved by both processors and health signals are generated, then the counter of the temporary analyzer does not fill up and the TestERR fault signal is not generated at the output of the temporary health analyzer 8. Comparison scheme 4, analyzing the COD ₁ and COD ₂ codes of the number of failures from each channel 1 (they are all equal to zero), selects the first channel 1 by signals

(equal to '0') and

(equal to '1') being received by OR-NO element 11 of the respective channels 1. In the first channel 1 signal OE ₁ of OR-NO element 11 is supplied to the switch 12 and thus data / commands from the CPU are output to the device bus 5 of the first channel 1.

(равен '1') и

(равен '0'), поступающими на элемент ИЛИ-НЕ 11 соответствующих каналов 1, выбирает второй канал 1. Во втором канале 1 сигнал ОЕ₂ от элемента ИЛИ-НЕ 11 поступает на коммутатор 12 и, таким образом, на выходной шине устройства находятся данные/команды от процессора 5 второго канала 1.In the event of a malfunction of any processor 5, for example, the first channel 1 (see Fig. 3), the diagnostic problem cannot be solved in a given time interval and, therefore, the test signal TestOK ₁ from processor 5 after a selected time interval will not arrive at the time health analyzer 8. At the same time, the pulse counter of the temporary health analyzer 8 during the filling process will generate a signal TestERR ₁ , which will go to the fault counter 10, increasing its value (COD ₁ ) by one, trigger 9, which will set the BLOCK ₁ lock signal to '1' (before the next health pulse TestOK ₁ from the processor 5), prohibiting the passage of data from the processor of the first channel 1. Comparison scheme 4, analyzing the codes COD ₁ (equal to '1') and COD ₂ (equal to '0') errors from the failure counter 10 of each channel 1, by signals

(equal to '1') and

(equal to '0'), arriving at the OR-NOT 11 element of the corresponding channels 1, selects the second channel 1. In the second channel 1, the ОЕ ₂ signal from the OR-NOT 11 element is sent to the switch 12 and, thus, are located on the output bus of the device data / instructions from processor 5 of second channel 1.

(равен '0') и

(равен '1'), поступающими на элемент ИЛИ-НЕ 11 соответствующих каналов 1, выбирает первый канал 1. В первом канале 1 сигнал OE₁ от элемента ИЛИ-НЕ 11 поступает на коммутатор 12 и, таким образом, на выходной шине устройства находятся данные/команды от процессора 5 первого канала 1.In the event of a failure in the operation of any processor 5, for example, the second channel 1 (see Fig. 4), the health signal TestOK ₂ ceases to be sent to the temporary health analyzer 8, the pulse counter of which periodically generates TestERR ₂ pulses during the filling process, which arrive at the failure counter 10, which, reaching a maximum value (equal to three), generates a failure signal FAIL ₂ , trigger 9, which sets the BLOCK lock signal to '1'. Comparison scheme 4, analyzing the codes COD ₁ (equal to '1') and COD ₂ (equal to '3') errors from the failure counter 10 of each channel 1, by signals

(equal to '0') and

(equal to '1'), arriving at the OR-NOT 11 element of the corresponding channels 1, selects the first channel 1. In the first channel 1, the OE ₁ signal from the OR-NOT 11 element is sent to the switch 12 and, thus, are located on the output bus of the device data / commands from processor 5 of the first channel 1.

Sources of information

1. Patent 87333685, Japan, MKI G 06 F 11/20, 1987

2. Patent 4872106, USA, MKI G 06 F 15/00, 1989.

3. Patent 94296302, USA, MKI G 06 F 11/00, 1994 (prototype).

Claims (1)

A redundant dual-processor computing system containing two identical channels, in each of which the first output of the processor is connected to the first input of the switch, a system generator whose output is connected to the first input of the processor of the first channel, the initial installation circuit, the output of which is connected to the second input of the processor of the first channel, characterized in that a pulse generator, an OR element, a temporary health analyzer, a failure counter, a trigger, an OR-NOT element, the output of which is under is connected to the second input of the switch, the second processor output through the OR element is connected to the first input of the trigger and to the second input of the temporary health analyzer, the trigger output is connected to the first input of the OR-NOT element, the second input of the processor is connected to the second input of the OR element and the second input of the failure counter , the output of the pulse generator through a temporary health analyzer is connected to the first input of the fault counter and to the second input of the trigger, the second output of the fault counter is connected to the second input of the OR-NOT element, and also given a system generator whose output is connected to the first input of the processor of the second channel, an initial installation circuit, the output of which is connected to the second input of the processor of the second channel, and a comparison circuit, the first input of which is connected to the first output of the failure counter of the first channel, the second input of the comparison circuit is connected to the first output of the failure counter of the second channel, the first output of the comparison circuit is connected to the third input of the OR element of the first channel, the second output of the comparison circuit is connected to the third input of the OR channel of the second Nala, the outputs of the switches are connected and the output of the system.

Images