SU1727125A1 - Device for operative reconfiguration of engaged system - Google Patents

Abstract

The invention relates to automation and computing and can be used in redundant digital systems implemented on LSI, VLSI, as a device that reconfigures the structure in accordance with the results of monitoring based on hybrid backup. The purpose of the invention is to increase the reliability of the device. The device contains the first to third redundant blocks, the first. To third comparison circuits, the majority block, the decoder, the failure signal conditioner, the fourth to sixth OR elements, the first to third switching triggers, the first to third state counters, the first to third elements OR , first-sixth elements I. 3 ill., 1 tab. (Ls

Description

The invention relates to automation and computing technology and can be used in redundant digital systems based on LSI and VLSI as a device that reconfigures the structure in accordance with the results of monitoring based on the hybrid backup method.

A device is known that contains three redundant blocks, three major elements, three comparison circuits, a pulse generator, a decoder, restructuring and control registers, three AND elements, and a code converter.

The disadvantage of this device is low reliability.

Of the known devices, the closest to the proposed technical essence and the achieved effect is a device for reconfiguring a redundant system, containing from the first to the third redundant blocks, from the first to the third majoritarian blocks, from the first to the third comparison circuit, pulse generator, and switches and interrupts, first and second interrupt triggers, decoder, adjustment and control registers, encoder and majority element, first to third elements AND, control code converter to adjustment and recording switch, and outputs the first to third redundant units are connected to corresponding inputs of the first to third comparator circuits and the respective data inputs of the first to third c- majority block outputs ,:

VI GO XI

you ate

which are informational outputs of the device, the input of the results of the control device is connected to the information input of the register, the output of which is connected by the input of the control code converter to the tuning code, the first output of the decoder is connected to the control inputs of the recording switch, the output of which is connected to the control input of the adjustment register, output the reorganization register is connected with the control inputs from the first to the third majority blocks, the outputs from the first to the third comparison circuits are connected to the first informational ones The signals of the interrupt switch, the output of which is connected to the D input of the first interrupt trigger, the first information input of the write switch and the encoder, connect the first information input of the interrupt switch and the first inputs of the first information input to the tuning switch, the interrupt inputs, the command end and the control end. and the second element And, the first output of the pulse generator is connected to the synchronization input of the tuning register with the C input of the first interrupt trigger, forward The output of which is connected to the first input of the decoder and the second input of the first element I, the output of which is connected to the S input of the second interrupt trigger, the direct output of which is the output of the interrupt of the device and connected to the second input of the decoder, the first output of which is connected to the first control the input of the tuning switch and the V-input of the second interrupt trigger, the second output with the first input of the third AND element, the second information input of the recording switch and the second control input of the adjustment switch, and the second output is with the second input of the second element And, the second output of the pulse generator is connected to the third inputs of the first and second elements AND and the second input of the third element And whose output is connected to the C and K inputs of the second interrupt trigger, the output of the third element And is connected to The R input of the first interrupt trigger and the synchronization input of the control register, the output of the bits of which is connected to the inputs of the majority element, the output of which is connected to the control input of the interrupt switch, the output of the control code to control code the adjustment is connected to the second information input of the adjustment switch, the output of which is connected to the information input of the adjustment register.

The disadvantage of this device is low reliability, due to the inability to use redundant blocks with internal redundancy of part (or all) of the block circuit.

The aim of the invention is to increase the reliability of the device.

The essence of the invention is: to increase the reliability of the device for

an account of using blocks of redundant elements with an internal redundancy of a part (or the whole) of a block scheme, the switching command to the reserve being supplied from the outside, and not by the block itself; the internal control scheme in the block is missing;

in increasing the reliability of the device by increasing the flexibility of the redundancy algorithm implemented by hardware, which allows operatively, in real

time scale, perform a switch to the reserve (and back in the event of a failure) when a part of the unit fails without testing the latter when more than one failure (failure) occurs in the device.

The introduction of the failure signal conditioner and the connections due to it is necessary to determine the state of the device in which two or three redundant

block. This failure state of the device as a whole is called a fatal failure (FO).

The introduction of the first to third OR elements and the third switching trigger and the links they cause are necessary for

organizing the switching of control pulses from the outputs of the state decoder to the C inputs of the corresponding state counter,

The first to third state counters and

their relations are necessary for organizing direct control over switching to the reserve and back in the first to third redundant blocks, respectively, as well as for determining the state of the corresponding redundant blocks: operational or final failure.

FIG. 1 shows a functional diagram of the device for reconfiguration

redundant system; in fig. 2 - two structural examples of the implementation of the device without and with the use of blocks with intra-block redundancy of the whole (a) or part (b) of the block diagram with the reserve control external to the blocks; in fig. 3 -schemes of searchable operational configuration of redundant blocks with intra-block redundancy.

The device for online reconfiguration of the redundant system (Fig. 1) contains the first 1 - third 3 redundant blocks, the first 4 - third 6 comparison schemes, the majority block 7, the decoder 8, the failure signal generator 9, the fourth 10 - sixth 12 elements OR, the first 13 - the third 15 switching triggers, the first 16 to third 18 state counters, the first. 19 - the third 21 elements OR, the first 22 - the sixth 27 elements AND, information output 28 of the device, input 29 clock pulses, output 30 of the device health signal, output 31 of the device failure signal, input 32 of the initial installation of the device.

Reserved blocks 1-3 are designed to convert any binary information. These blocks have an intra-reserve, i.e. part of the block scheme (Fig. 26) or the whole scheme (Fig. 2) is duplicated, but the inclusion of this or that duplicate part in the work is carried out by a signal from the outside. With regard to VLSI (LSI), it can be a storage device (RAM), in which the same information is recorded in the first and second half of the memory cells. Managing the high-order address, it is possible to organize reading of data from one or another part of the memory. FIG. Figure 1 shows only the control inputs of the reserved blocks and their outputs. The first 4-third 6 comparison schemes are designed to determine the pair of reserved blocks, the output of which information does not match. So, the first one -. Ma 4 compares the information at the outputs of the first 1 and second 2 blocks (1.2), the second comparison circuit 5 at the outputs of the first 1 and third 3 blocks (1.3), and the third diagram 6 at the outputs of the second 2 and third 3 blocks (2.3). By comparing the signals at the outputs of these comparison circuits, it is possible to determine the block that produces the distorted information, provided that the other two are faulty.

The major block 7 is designed to mask the distorted information generated at the output of one of the blocks (1-3), i.e. performs the function of issuing information by majority vote, comparing bitwise data at all three inputs.

The decoder 8 is designed to determine the state of the device. It determines in which state, in which reserved blocks the duplicated part should be switched. Depending on the combination of signals at the inputs (0, 2, 4, 8, 16, 32) of the decoder, the pulses arriving at its V-input appear at one of its outputs (see the table of the outputs of the decoders 8).

The failure signal generator 9 (implemented using element 2I ZILI) is intended to determine such a state of the device in which 5 two or three redundant blocks are recognized as completely failed, i.e. Switching the reserve in them does not give a positive effect. In this case, it is not possible to disguise the failed block, 0 fatal failure occurs.

The first 18 - the third 20 elements OR. the adjustment switch, the first 22 - the sixth 27 elements AND, the first 13 - the third 15 switching triggers, the fourth 10 - the sixth 5 12 elements OR are intended for switching to the C input of the corresponding counter of the state of the control pulses coming from the outputs of the decoder 8.

The first 16 - third 18 state counters are not designed to directly control the switching of duplicate parts of redundant blocks, as well as to determine the block as finally failed if the number of switches was such that it exceeded some predetermined number, o what the unit indicates, which appears in this case at the output of the counter overflow.

The decoder 8 and the elements OR 10-12 0 form a state decoder, the first 22 - sixth 27 elements form a realignment switch.

The operation of the device for reconfiguring the redundant system is performed 5 as follows.

In the initial state, all the reserved blocks 1-3 are intact, all three state counters 16-18 are in the zero state. Therefore, on all six inputs 0 of the decoder 8 are zero potentials. The pulses coming from the input 29 of the clock pulses of the device to the V-input of the decoder 8, pass to the output 0 of the decoder, and then at the output 30 of the signal 5 of the serviceability of the device, which indicates that all blocks 1-3 are fully functional.

The occurrence of a failure (we believe that a failure in two blocks does not simultaneously occur 0) in one of the blocks (say, in the first) will lead to a mismatch of information at the inputs of the first 4 and second 5 comparison circuits, at their outputs according to the 1st. At the output 28 of the device, 5 information is still undistorted, the majority block 7 masks the failure. But at the input of the decoder 8, the combination 000110 is now present. Since the input 2 and input 4 receive units from the outputs of the first 4 and the second comparison circuit. Such a combination at the input of the decoder 8 commutes the pulses arriving at the V input to output 6 (see table). From output 6, the pulses through the OR element 19 arrive at the C input of the state counter 16, the zero discharge output of which controls the switching of the internal reserve in the first redundant block 1. On the falling edge of the first pulse arriving at the C input of the state counter 16, the latter goes to the state 00 ... 01 (the number of zeros is determined by the digit of the counter, which is equal to K). The unit, having output at zero output, switches the redundant part of block 1. If after this, at the outputs of comparison circuits 4 and 5, the units disappear, i.e. failure (malfunction) occurred in the reserved part of block 1, then the decoder 8 again goes to the zero state (see table), the next pulse arrives already at the output 30 of the device, and not at the C input of the state counter 16.

In the event that the data at the output of the first redundant block 1 will again be excellent given, given by the second 2 and third 3 blocks, the pulses from the synchronization input 29 of the device will continue to flow to the C input of the counter 16 of the average. On the second impulse, the counter 16 of the state will go to the state 00 ... 10, the reserved block 1 will return to the initial state (the recognized part of the unit 1 that was previously recognized will be included in the operation). If after this, the units at the outputs of the comparison circuits 4 and 5 disappeared, i.e. earlier in this part of block 1 failed, the decoder 8 again switches the pulses from the V-input to the zero output. If the recovery in the first reserved block 1 did not happen, i.e. either the two redundant parts of block 1 turned out to be faulty, or the circuit part of the whole block that is not redundant, then the 16 state will continue to flow to the C input of the counter, alternately converting it to even (zero-zero) or odd (in the zero category - one) states. Such a state of the device will remain until the counter 16 of the state reaches the state 100 ... 0. The unit, having turned into the K th discharge of the counter, arriving at its inverse V-input, stops the further possible change of its state, the reserved block 1 is recognized as completely failed. In addition, the unit from the output of the K-th digit of the counter 16 state is fed to the input 32 of the decoder 8.

Further, the operation algorithm of the device will be determined by the following considerations. Since the first reserved block

1 is recognized as completely failed, then we will now be interested in the results of comparing the data issued by the second 2 and third 3 reserved blocks. Therefore, it is now necessary to monitor the signal from the output of the comparison circuit 6, the signals from the outputs of the first 4 and second 5 comparison circuits are ignored. In the event that a unit fails at the output of comparison circuit 0 through 0, a failure occurred (failure) in the second or third reserved blocks. In which of the failure blocks, it is now impossible to determine, therefore we will try to eliminate its effect by trying to alternate the reserve in both of the blocks, i.e. try to find a workable configuration (fig. 3). It happens as follows.

Assume that the reserved blocks were in the state shown in FIG. For, where the arrow indicates the reserved part of the block, which is in operation at a given time, and the crossed out square denotes the failed part. If a

If a failure occurred in that part of the circuit that is currently not in operation (Fig. 36), the device simply does not notice such a failure. If the failure occurred in one of the working parts (FIG, Sv), then element 6 of the comparison

0 will generate a signal indicating that the data at the outputs of the second 2 and third 3 redundant blocks does not match. The device for reconfiguration begins alternate switching of the reserve, in the second 2 and third

5 blocks. Let us assume that at first the reserve was switched in the second block (Fig. 4 d), this does not lead to the choice of a workable configuration, in the third block 3 the failed part is still in operation. But according to the next clock pulse, switching occurs in the third block 3 — the configuration is selected (Fig. A). If the switching of the reserve started from the third block 3, then the first clock pulse would have found a workable configuration (Fig. Ze). After finding a workable configuration, the flow of clock pulses to the C inputs of state counters 17 and 18 is stopped.

0

If in one of the modules there was already a failed part (Fig. ZJ) and another failure occurred in another module (Fig. A), the following happens. Device again

5 attempts to find a workable configuration. If the transfer of the reserve was carried out first in the second block 2, then after the first impulse we find a workable configuration (Fig. Zl). If switching first

occurs in the third block, then after the first pulse, which switched the reserve in the third block 3, we get the configuration shown in FIG. Zi). The coincidence signal does not appear at the output of blocks 2 and 3 - switching attempts continue. On the second clock pulse, the reserve is switched in the second block 2 (Fig. GC), but such a configuration is not operational: in the third block, the failed part is in operation. On the third impulse, the reserve is switched again in the third block 3, which leads to the selection of a workable configuration (Fig. Zl).

If the failure occurred in the second redundant part of the block (Fig. 3m), a workable configuration could not be found; attempts to switch the tank will continue until one of the state counters 17 and 18 goes into the 100 ... O state, the ad finally fails another block. At the output of the failure signal generator 9 (element 2I-ZILI), a unit appears indicating that such blockings occurred in blocks 1 and 3, and so much that by reconfiguring the structure it is impossible to cope with them.

The above hardware algorithm is implemented as follows.

If the first reserved block T is recognized as completely failed, then input 1 of decoder 8 receives level 1. Decoder 8 can be in one of eight states: from 32 to 39 inclusive (see table). Of these eight states of interest are those determined by the input combination containing the one at input 0, i.e. mismatch of the data issued by the second 2 and third 3 blocks. Such states correspond to the switching of pulses from the V-input of the decoder 8 to the outputs 33, 35, 37, 38. It is considered that the signals at the outputs of the first 4 and second 5 comparison circuits can be arbitrary, since the nature of the failure of the first module is not visible. Thus, the appearance of a single potential at the output of the comparison circuit 6 will lead to switching of the pulses to one of the four (33,35,37,39) outputs of the decoder 8. Depending on the initial state of the switching trigger 15, these pulses will alternately arrive at C The inputs of the second 17 and third 18 state counters. Assuming that the trigger trigger 16 is in the single state, then the first pulse from one of the decoder outputs, passed through the OR element 12 and the open element AND 26, will flow through the OR element 20 to the C input of the second state counter 17, controlling by the second block 2. On the falling edge of this impulse, the counter goes into the next state. in addition, the trigger 15 switches to the zero state, opening the element AND 27. The next clock pulse from the output output of the decoder 8 through the now open element 27 And goes only to the C input of the counter 18 of the state controlling the switching of the reserve of the third block 3. The same impulse again translates the switching trigger 15 into a single state. This will continue until the combination at the inputs of the decoder 8 changes, and it can change only in two cases. First, a workable configuration is found, and the unit at the output of the comparison circuit 6 will disappear, which will lead to switching pulses - from four outputs 32, 34, 36,38, and they are not used. Secondly, if it is impossible to create a working configuration, then switching attempts will continue until one of the counters goes into state 10 ... 00, which will lead to switching of pulses to other n used outputs (see table) of the decoder 8. So, outputs 33, 35, 37, 39 of the decoder 8, the element OR 12, trigger

15 switchings, And 26, 27 are designed for alternate switching of the reserve (using the counter

16) in the second 2 and third 3 reserved blocks. The outputs are 12-15 decoder 8, element. OR 10, the trigger trigger 13, the And 22, 23 elements are intended for alternate switching of the reserve in the first 1 and second 2 reserved blocks at the finally failed third. It is expected that the unit at input 4 of the decoder 8 will disappear or go into a state of fatal failure.

Outputs 18, 19, 22, 23 of the decoder 8, the element OR 11, the trigger trigger 14, the elements AND 24, 25 are designed to alternately switch the reserve in the first 1 and third 3 rerun units at the finally failed second block 2. In this case, the unit is lost input 2 decoder 8.

The failure signal generator 9 records such a state of the redundant modules that the restoration of the operational state becomes impossible: in case of a final failure of two or three blocks. At its output, a unit appears in the event that any two (or all three) blocks are recognized as state counters completely failed.

In order to eliminate the influence of failures on the decision

the final failure of one block or another, the input 32 of the initial installation of the device is entered, with a frequency much lower than the frequency of the clock pulses, single pulses arrive, periodically circling the counters 16-18. The necessity of this measure is due to the fact that in the event of a failure in the block, the device gives the command to switch the reserve of the corresponding block, i.e. a command to transfer the state counter to the next state. Thus, if 2 failures occurred in the block. then he may be deemed to be mistakenly finally refused. In this case, all the bits of the counter, except zero, are zeroed, since if they are also zeroed, a situation may arise when there are two or three defective parts of the blocks in operation, i.e. a situation of two failures occurs simultaneously, and the device is not designed to combat such failures.

This device ensures device reliability by using redundant blocks with intra-block redundancy and organizing a hardware search algorithm for a workable configuration of redundant parts of blocks, which makes it possible to neutralize up to four failures of reserved parts of blocks without using test sequences that require the termination of basic functions. devices.

Claims (1)

Apparatus for operative reconfiguration of a redundant system comprising first to third reserved blocks, first to third comparison circuits, majority block, state decoder, adjustment switch, first and second switch triggers, the output of the first redundant block connected to the first inputs of the majority block, first and the second comparison circuit, the output of the second redundant block is connected to the second inputs of the majority block and the first comparison circuit and the first input of the third Comparison circuit, output q third redundant unit is connected to the second inputs of the second and third comparing circuits and the third input of a majority block, whose output is the data output device, The first, second and third outputs of the state decoder are connected to the corresponding information inputs of the adjustment switch, characterized in that, in order to increase the reliability of the device by using internal block redundancy, the third switching trigger, the first and third elements OR, the first and third the state counters and the failure signal conditioner, the initial setup input of the device is connected to the installation inputs on the first to third state counters, the counting inputs of which are connected respectively to the outputs of the first to third OR elements, the low-end outputs of each of the state counters are connected to the inputs switching the internal reserve of the first to third reserved blocks, and the high-order outputs of each the state counters are connected to their own control input, the first to the third control inputs of the state decoder and the corresponding inputs of the failure signal generator, the output of which is the output of the device’s fault signal, the clock pulse input connected to the state decoder input, the first third the informational inputs of which are connected to the outputs of the respective comparison circuits, the fourth output is the output of the signal of the health of the device, and their fifth to seventh inputs are connected to the first inputs of the first to third OR elements, respectively, the second and third inputs of which are connected to the corresponding outputs of the switching switch, the first and second control inputs of which are connected respectively to the forward and inverse outputs of the first switching trigger, whose input is connected to the first output of the state decoder, the second output of which is connected to the input the second trigger, switching, direct and inverse outputs of which are connected respectively to the third and fourth control inputs of the switching switch, the fifth and sixth control inputs which are connected respectively with the direct and inverse outputs of the third switching trigger, the input of which is connected to the third output of the state decoder. 16.1 l eight P 17.1 L GSh (f7.2 W 32 16 8 4 2 o 16.1) 16.Щ6.2) x.i) i7.D П2} pg) zg.PTP & P l / 7 P P P l l ge -about 1 I 3 2 TO F and l m Fig.Z