JPH05313930A - Highly reliable information processor - Google Patents

Abstract

PURPOSE:To provide a non-stop system having the extremely high reliability by detecting the malfunction of one of the 1st-3rd microprocessors through a logical means. CONSTITUTION:A triplexed bus cycle is started with synchronizarion secured between a 1st microprocessor 1a working in an execution mode and the 2nd and 3rd microprocessors 1b and 1c working in a monitor mode respectively. At the same time, a bus cycle start signal to inform of the bus cycle start timing is transmitted to the outside regardless of the operating modes. A logical means always compares the bus cycle start signals outputted from those microprocessors 1a-1c with each other and detects the malfunction of one of these three microprocessors. In such a constitution, it is possible to evade such a case where the continuous processings are impossible due to a malfunction that causes a bus cycle error and to obtain a non-stop system having the extremely high reliability.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a highly reliable information processing device which is required to have high reliability, and more particularly to a highly reliable information processing device which is fault tolerant to a transient malfunction of a microprocessor. Regarding

[0002]

2. Description of the Related Art In the field of microprocessors, conventional high reliability information processing devices are subject to transient malfunctions.
In order to avoid that processing cannot be continued, the microprocessor is tripled and a redundant configuration is adopted. Since there are three microprocessors, if you monitor the output of each, you can immediately know which microprocessor has malfunctioned by majority vote, and after detecting the malfunction,
Disconnect the malfunctioning microprocessor and leave the remaining 2
Processing can be continued with one microprocessor.

The FRM function can relatively easily realize the triple structure. The FRM function takes in the signal output from one microprocessor operating in the execution mode to the outside by the two microprocessors operating in the monitoring mode, and outputs it as its own signal every time the bus cycle is activated. It is to compare and check.

According to the principle of triple majority, if any one of the monitoring modes detects a mismatch, it means that the detected microprocessor malfunctions.
If the monitoring mode side detects both inconsistencies at the same time, it means that the microprocessor in the execution mode malfunctions.

Another example of the well-known triple voting structure is to transfer all signals output from three microprocessors by triple voting to the other units (for example, memory). There is something like this. The microprocessor in this case has no concept of an operation mode, and all the microprocessors output signals to the outside in the same manner.

In the triple majority operation, three signals are A,
Assuming B and C, Y = A * B + B * C + C * A *: logical product +: logical sum. As can be seen from this equation, the output Y has two signals among the three signals A, B, and C.
The value indicated by one or three signals is output. Therefore, it can be said that the output Y is always a correct value unless there are two or more errors at the same time.

[0007]

In the conventional high reliability information processing apparatus, like the FRM function, in the method of checking the output signal every time the bus cycle is activated, the three microprocessors use the bus cycle. When the two are activated at the same time, there is a sufficient effect, but in the case of a malfunction such that the bus cycle itself shifts, the malfunction may not be detected or the detection may be delayed.

For example, when the microprocessor in the management mode does not activate the bus cycle, the malfunction cannot be detected, and when the microprocessor in the execution mode activates the bus cycle earlier than the microprocessor in the monitoring mode. It is possible that a malfunction is detected only after the bus cycle is completed. In order for the processing to continue normally in the degenerate state due to duplication even after the malfunction has occurred, the bus cycle in which the malfunction has occurred must be activated again in the same way. You must detect the malfunction inside.

Generally, a transient malfunction of a highly integrated microprocessor is due to inversion of flip-flops inside the microprocessor. However, since this inversion is temporary, if the information is written again in the flip-flop that caused the inversion, the inversion is recovered. Therefore, the system in which the processing is stopped due to this temporary defect has low reliability.

On the other hand, when the data system and the control system are separated, the flip-flop in the processor is obviously used in the data system in a large proportion. However, for example, when bit inversion occurs in a large-scale register that stores an instruction, it is interpreted as a different instruction and the internal sequence is changed without fail, causing a bus cycle shift. The malfunctions in which the bus cycle is shifted in this way are not at a low rate.

Further, the method of majority-calculating all output signals by an external triple majority-computation circuit detects all malfunctions, does not adversely affect other units, and continues processing without interruption. However, since all the output signals must pass through the triple majority operation circuit, the arrival of signals such as addresses and data to other units is delayed and the performance is degraded. Further, the amount of hardware of the triple majority arithmetic circuit itself is considerably large. In this way, the decline in performance and the increase in the number of parts mean that the current high performance,
This conflicts with the demand for cost reduction, compactness, and low power consumption, and is fatal.

[0012]

According to a first aspect of the present invention, there is provided a high reliability information processing apparatus comprising a first microprocessor operating in an execution mode and second and third microprocessors operating in a monitoring mode. Highly reliable output of a bus cycle start signal for notifying the timing of starting the bus cycle to the outside when starting the tripled bus cycle synchronously, regardless of the operation mode. In the digitized information processing device, the logic means for constantly comparing the three bus cycle start signals respectively output from the first to third microprocessors, the first to third
It is configured by detecting one malfunction of the microprocessor.

Further, the high reliability information processing apparatus of the second invention is executed by the logic means of the first invention when it is determined that the first microprocessor operating in the execution mode malfunctions. Control means for logically disconnecting the first microprocessor operating in the mode and switching any one of the second and third microprocessors operating in the monitoring mode to the execution mode; and the control means, After the composition degenerates from triple to double,
Retry means for performing again the processing operation that was not normally performed due to the malfunction, and the processing is normally continued by the second and third microprocessors excluding the malfunctioning first microprocessor. ing.

On the other hand, in the high reliability information processing apparatus of the third invention, when the logic means of the first invention determines that the first microprocessor operating in the execution mode malfunctions, the information is stored in the memory. The write inhibiting means that inhibits the write signal to prevent the data from being written to the memory, thereby preventing the memory destruction due to the malfunction of the first microprocessor.

Further, the high reliability information processing apparatus of the fourth invention is responsive to the detection of one malfunction of the first to third microprocessors by the logic means of the first invention. , An interrupt means for generating an interrupt and notifying that a malfunction has occurred in the software;
~ The reset operation for initializing the third microprocessor is resynchronized with the reset means for performing a reset operation according to a request from software.

[0016]

Embodiments of the present invention will now be described with reference to the drawings.

FIG. 1 is a block diagram showing an embodiment of a highly reliable information processing apparatus of the first invention. As shown in FIG. 1, the microprocessor 1a operating in the execution mode
And the microprocessors 1b, 1 operating in the monitoring mode
C is tripled and connected to the bus 3 via the buffer 2.

During normal operation, the microprocessor 1a always sends the output signal to the outside, and the microprocessor 1a
b and 1c take in the information and compare it with their own information for checking. According to the principle of triple majority, if only the microprocessor 1b detects a mismatch, it means that the microprocessor 1b has failed, and if only the microprocessor 1c detects a mismatch, the microprocessor 1c has failed. become. If the microprocessors 1b and 1c simultaneously detect the mismatch, it means that the microprocessor 1a has failed.

The timing at which the microprocessors 1b and 1c check the information taken in themselves is when the bus cycle is activated by themselves. Therefore, when the bus cycles of the three microprocessors 1a, 1b, 1c are completely synchronized, the check function thereof works and an abnormality such as garbled data can be detected.

Three microprocessors 1a, 1b, 1
When the bus cycle is started, c outputs bus cycle start signals 1as, 1bs, 1cs for notifying the timing of the start of the bus cycle to the outside, respectively. That is, the signals 1as, 1bs, 1cs are pulse signals that are valid only for one clock cycle period when the bus cycle is started.

The exclusive OR gates 4a, 4b and 4c and the two-input AND gates 5a, 5b and 5c form a triple majority circuit. The JK type flip-flops 6a, 6b, 6c are provided to hold the outputs of the triple majority circuit, and are all "0" in the normal state.

The triple majority circuit constantly monitors the signals 1as, 1bs, 1cs for starting the bus cycle, and checks whether there is a shift in the bus cycle. If the signal 1as becomes valid earlier or later than the other two signals 1bs and 1cs,
The JK type flip-flop 6a is set to "1".

The signal 1bs is the other two signals 1a.
When it becomes effective earlier than s, 1bs or becomes effective after being delayed, a JK type flip-flop 6b
Is set to "1". Similarly, the signal 1cs is the other 2
The JK type flip-flop 6c is set to "1" when it becomes valid earlier than the two signals 1as and 1bs or becomes effective after a delay.

Therefore, the malfunction signal 7a changes to "1" when the microprocessor 1a malfunctions, the malfunction signal 7b changes to "1" when the microprocessor 1b malfunctions, and the malfunction signal 7c when the microprocessor 1c malfunctions. 7c changes to "1".

Then, the three JK type flip-flops 6a, 6b, 6c once transit to "1",
It keeps "1" until the reset signal 43 becomes valid. The malfunction total signal 9 is obtained by ORing the malfunction signals 7a, 7b, 7c by the OR gate 8. When "1", any one of the microprocessors 1a, 1b, 1
This indicates that c has malfunctioned.

FIG. 2 is a timing chart showing an example of detection of an erroneous operation in which the bus cycle of the microprocessor 1a is shifted and accelerated. As shown in FIG. 2, when the bus cycle start signal 1as becomes valid first, the malfunction signal 7a and malfunction comprehensive signal 9 are transited to "1" by the output of the AND gate 5a.

FIG. 3 is a block diagram showing an embodiment of the highly reliable information processing apparatus of the second invention. As shown in FIG. 3, the triplicated microprocessors 1a, 1b, 1
The bus cycle end signal 22 and the retry instruction signal 13 are commonly input to c, and the disconnection instruction signals 21a, 21b, and 21c are individually input. Signal 2
When 1a, 21b, 21c are enabled during execution of a bus cycle, the corresponding microprocessors 1a, 1b, 1c
After the bus cycle is completed, the logically separated state is entered, and the bus cycle is not executed at all.

When the signals 21a, 21b and 21c become invalid, the disconnection state is automatically released and the bus cycle starts to be executed. Furthermore, the microprocessor 1
The operation mode instruction signals 23a and 23b for specifying the operation mode are input to a and 1b, respectively. Signal 2
3a and 23b are in the execution mode when "1" and in the monitoring mode when "0". JK type flip-flop 1
Reference numeral 9 is a flip-flop that distinguishes these two modes, and Q = “0” during normal operation. Therefore, the microprocessor 1a is operating in the execution mode.

When the microprocessor 1a operating in the execution mode malfunctions, the microprocessor 1b, which has been operating in the monitoring mode until then, is switched to the execution mode in order to continue the processing that has been performed so far. Therefore, a reconfiguration function that can be operated by the two microprocessors 1b and 1c and a retry function that re-executes the bus cycle that was being executed when the malfunction was detected are reconfigured.

Microprocessors 1a, 1 of this embodiment
b and 1c have a reconfiguration function and a bus cycle retry function. The reconfiguration function has been made possible by previously activating the disconnection instruction signals 21a, 21b, 21c and inverting the operation mode instruction signals 23a, 23b when the corresponding microprocessors 1a, 1b, 1c are in the disconnected state. The microprocessor 1b that was operating in the monitoring mode can be operated in the execution mode.

The separated state of the microprocessor means a state in which the output signals of the address line and the data line of the microprocessor are in three states and do not electrically affect the external circuit. Further, the retry function can automatically repeat the same bus cycle once again by enabling the retry instruction signal 13 in synchronization with the input of the bus cycle end signal 22.

Next, the processing procedure after the malfunction of the microprocessor 1a operating in the execution mode is detected by the triple majority circuit will be described.

The microprocessor 1a is logically separated.

After confirming that the microprocessors 1b and 1c are executing the bus cycle, the disconnection instruction signals 21b and 2 corresponding to the microprocessors 1b and 1c.
1c is set to be valid, the retry instruction signal 13 and the bus cycle end signal 22 are made valid, and the bus cycle is forcibly ended.

The microprocessor 1b is switched to the execution mode.

The disconnection instruction signals 21b and 21c are invalidated and the bus cycle is executed again.

When the triple majority circuit detects a malfunction of the microprocessor 1a operating in the execution mode, there are two cases in the bus cycle state between the microprocessor 1a and the microprocessors 1b and 1c. is there. That is, the case where the microprocessor 1a starts the bus cycle earlier and the case where the microprocessors 1b and 1c start the bus cycle earlier.

In order for the retry function to operate normally, when the microprocessor 1a starts the bus cycle earlier, it waits until the microprocessors 1b and 1c start the bus cycle and confirms that the bus cycle has started. The bus cycle end signal 22 must be validated after confirmation. This is because even if the bus cycle is forcibly ended even though the bus cycle is not executed by itself, the retry cannot be performed because the bus cycle to be retried is unknown.

The JK type flip-flop 10 is
Bus cycle start signal 1bs of microprocessor 1b
Is set to "1" when is valid ("0"), and is reset to "0" when the bus cycle ends. Therefore, when the flip-flop 10 is in the state of "1", it indicates that the microprocessor 1b is executing the bus cycle.

When the microprocessor 1a operating in the execution mode malfunctions, the signal 7a immediately transits to "1". In response to this, the disconnection instruction signal 21a becomes valid ("1") immediately, and the microprocessor 1a
Is logically disconnected and does not output to the outside. When the microprocessors 1b and 1c execute the bus cycle, the flip-flop 10 becomes "1",
As a result, the output of the AND gate 11 becomes "1" and J
-K type flip-flop 12 is set to "1".

When the flip-flop 12 becomes "1",
The retry instruction signal 13 becomes valid (“1”), and the disconnection instruction signals 21b and 21c corresponding to the microprocessors 1b and 1c also become valid (“1”). D
The type of flip-flop 14 a, NOT gate 15 and AND gate 16 are leading edge differentiating circuits and convert them into output signals of the flip-flop 12. The pulse signal generated by the leading edge differentiating circuit is the pulse signal 1 delayed by one clock cycle by the flip-flop 14b.
4 bs, and the pulse signal 14 bs is supplied to the OR gate 18
Through, the bus cycle end signal 22 is validated to end the bus cycle.

The flip-flop 14c outputs the pulse signal 1
Pulse signal 14c after delaying 4 bs by one clock cycle
produces s. When the pulse signal 14cs becomes valid (“1”), the JK type flip-flop 19 becomes
Transition to "1", the operation mode instruction signal 23b becomes "1", and the microprocessor 1b is switched from the monitoring mode to the execution mode.

The flip-flop 14d further delays the pulse signal 14cs by one clock cycle to generate the pulse signal 14ds. The pulse signal 14ds is JK
Reset the flip-flop 12 of the type. When the flip-flop 12 is reset, the disconnection instruction signals 21b and 21c become invalid, and as a result, the microprocessor 1b in the execution mode and the microprocessor 1c in the monitoring mode recover from the disconnected state and the bus cycle is re-executed. And continue processing.

When the microprocessor operating in the monitoring mode malfunctions, neither the reconfiguration function nor the retry function is required, and the processing can be continued as it is by simply disconnecting the malfunctioning microprocessor.

FIG. 4 is a timing chart showing an example until the microprocessor 1a malfunctions, the microprocessor 1b switches to the execution mode, and the microprocessors 1b and 1c are reconfigured into the duplex configuration to operate. is there. As shown in FIG. 4, the bus cycle start signal 1
When as becomes valid first, the signal 1b is sequentially waited for until the signal 1bs becomes valid, the JK type flip-flop 10 is set valid, and the retry instruction signal 13 becomes valid. , 14c, 14d become valid, the bus cycle end signal 22 becomes valid, the operation mode instruction signal 23b becomes "1", and the microprocessor 1b executes after the disconnection instruction signals 21b, 21c become valid. Enter the mode.

FIG. 5 is a block diagram showing an embodiment of the highly reliable information processing apparatus of the third invention. As shown in FIG. 5, the triplicated microprocessors 1a, 1b, 1
c is connected to the bus 3 via the buff 2. Then, the microprocessors 1a, 1b, 1c write data to the memory 30 or read data from the memory 30 via the bus 3.

When the microprocessor 1a operating in the execution mode malfunctions and the bus cycle being executed is a memory write, the bus cycle itself is unreliable, so the data to the memory 30 is written. Writing must be suppressed. An instruction to write data to the memory 30 is given by a write pulse signal 32 generated by the memory controller 31.

When the microprocessor 1a operating in the execution mode malfunctions, the signal 7a changes to "1",
Further, the operation mode instruction signal 23a remains "1" until the reconfiguration is performed even if a malfunction is detected.
The write pulse signal is masked by the D gate 33, and data is not written in the memory 30.

Further, when the microprocessor 1b is switched to the execution mode by the reconfiguration function and the processing is restarted in the duplex configuration, the mode instruction signal 23a transits to "0", so that the output of the AND gate 34 is output. Becomes "0", and as a result, writing to the memory 30 is performed as usual.

FIG. 6 is a timing chart showing an example of the operation in which the writing of data to the memory 30 is suppressed. As shown in FIG. 6, when the signal 7a becomes "1" by the signal 1as when the microprocessor 1a malfunctions, AND
Since the output of the gate 34 becomes "1" and the output of the OR gate 33 is not influenced by the signal 32, the writing to the memory 30 is not performed.

When any one of the tripled microprocessors malfunctions and is degrading to the duplex and performing processing, when the malfunction is detected again, it is determined which microprocessor has malfunctioned. In order not to get stuck, it is necessary to give up the continuation of the process at that time. In order to avoid this, it is necessary to shorten the period during which the degeneration operation is performed, and for that purpose, it is important to return the microprocessor to the triple configuration as soon as possible from the time when the malfunction is detected. ..

The procedure for returning the microprocessor to the triple configuration is as follows.

When a malfunction of the triplicated microprocessor is detected, an interrupt is immediately requested to all the microprocessors.

The microprocessor that receives the interrupt temporarily saves the context to a predetermined location in the memory.

Issue a request to do a hardware reset of the three microprocessors.

In response to the request, hardware reset is simultaneously applied to the three microprocessors, the malfunctioning microprocessors are incorporated, and the microprocessors are started up in the triple configuration to enable the operation.

Restore the context that was temporarily saved,
Resumes processing from the state before interrupt acceptance.

FIG. 7 is a block diagram showing an embodiment of the highly reliable information processing apparatus of the fourth invention. As shown in FIG. 7, the triplicated microprocessors 1a, 1b, 1c
Are connected to the bus 3 via the buffer 2. The interrupt controller 40 is input with the malfunction comprehensive signal 9 for notifying that any one of the microprocessors 1a, 1b, or 1c has malfunctioned, and makes it one of the factors causing the interrupt. Tripled microprocessor 1
The interrupt request signal 42 is input from the interrupt controller 40 to a, 1b, and 1c. Further, the control flip-flop 41 normally holds “0”. From the microprocessors 1a, 1b, 1c, 1-bit data can be set via the bus 3. When "1" is set, "1" is held for a certain period of time and then automatically set to "1". It is reset to 0 ". The reset signal 43, which is the output of the control flip-flop 41, is supplied to the OR gate 6
1 through 1 and is logically ORed with the hardware reset signal 60 to become the reset signal 62 of the microprocessors 1a, 1b, 1c.

When the microprocessor 1a operating in the execution mode malfunctions, the malfunction total signal 9 becomes valid, and in response to this, the interrupt controller 40 makes the interrupt request signal 42 valid and the three microprocessors 1a, Request an interrupt to 1b and 1c.

Therefore, the microprocessors 1b and 1c after the degeneracy of the duplication in which the operation modes are switched are
When the interrupt is accepted, the context is saved in a predetermined location in the memory 30 and then "1" is set in the control register 41. As a result, the reset signal 62 becomes effective for a certain period, and the three microprocessors 1a, 1
b and 1c are initialized. At the same time, the JK type flip-flop 12 that indicates the operation mode and the JK type flip-flops 6a to 6c set to "1" when a malfunction is detected are also initialized.

When the reset signal 62 becomes invalid, at that time, the microprocessor 1a becomes the execution mode, and the microprocessors 1b and 1c become the monitoring mode, and they start up in synchronization with each other. After that, the normal processing is continued after the context saved in advance before the reset is restored.

Even if the microprocessors 1b, 1c operating in the monitor mode malfunction, the microprocessors 1a, 1b, 1c are resynchronized in the same manner as the above procedure.

[0063]

As described above, the highly reliable information processing apparatus of the present invention completely detects a malfunction due to a bus cycle shift, and reconfigures the duplex operation and 3 after the malfunction is detected. By ensuring that the resynchronization with the redundant configuration is performed, it is possible to realize an extremely reliable non-stop system by avoiding the inability to continue processing due to a malfunction that causes a bus cycle shift. Have

[Brief description of drawings]

FIG. 1 is a block diagram showing an embodiment of a high reliability information processing apparatus of the first invention.

FIG. 2 is a time chart showing an example of detection of an erroneous operation in which the bus cycle of the microprocessor 1a is deviated and accelerated.

FIG. 3 is a block diagram showing an embodiment of a highly reliable information processing apparatus of the second invention.

FIG. 4 is a timing chart showing an example in which the microprocessor 1a malfunctions, the microprocessor 1b switches to the execution mode, and the microprocessors 1b and 1c are reconfigured into the duplex configuration and operate.

FIG. 5 is a block diagram showing an embodiment of a high reliability information processing apparatus of a third invention.

FIG. 6 is a timing chart showing an example of an operation in which writing of data to the memory 30 is suppressed.

FIG. 7 is a block diagram showing an embodiment of a high reliability information processing apparatus of a fourth invention.

[Explanation of symbols]

1a, 1b, 1c Microprocessor 1as, 1bs, 1cs Bus cycle start signal 2 Buffer 3 Bus 4a, 4b, 4c Exclusive OR 5a, 5b, 5c AND gate 6a, 6b, 6c JK type flip-flop 7a, 7b, 7c Malfunction signal 8 OR gate 9 Malfunction comprehensive signal 10 JK type flip-flop 11 AND gate 12 JK type flip-flop 13 Bus cycle retry instruction signals 14a, 14b, 14c, 14d D type flip-flop 14bs , 14cs, 14ds Pulse signal 15 NOT gate 16 AND gate 17 NOR gate 18 OR gate 19 JK type flip-flop 20a, 20b, 20c OR gate 21a, 21b, 21c Separation instruction signal 22 Bus support Kuru termination signal 23a, 23b mode instruction signal 30 memory 31 memory controller 32 a writing pulse signal 33 OR gate 34 the AND gate 40 the interrupt controller 41 controls the flip-flop 42 an interrupt request signal 43 reset signal 60 hardware reset signal 61 OR gate 62 reset signal

Claims (4)

[Claims] 1. A first microprocessor operating in a run mode and a second and a third microprocessor operating in a monitor mode synchronously start a triplicated bus cycle. In a high reliability information processing device that outputs a bus cycle start signal for notifying the timing of starting a cycle to the outside regardless of an operation mode, the first to third microprocessors One of the first to third microprocessors is provided by logic means for constantly comparing the three bus cycle start signals output from each.
A highly reliable information processing device characterized by detecting two malfunctions. 2. When the logic means according to claim 1 determines that the first microprocessor operating in the execution mode malfunctions, the first microprocessor operating in the execution mode
Control means for logically disconnecting the microprocessor of No. 2 and switching any one of the second and third microprocessors operating in the monitoring mode to the execution mode; After the degeneracy is repeated, the retry means for performing again the processing operation that was not normally performed due to the erroneous operation is performed by the second and third microprocessors other than the erroneously operating first microprocessor. The highly reliable information processing apparatus according to claim 1, wherein the information processing apparatus is continued normally. 3. When the logic means according to claim 1 determines that the first microprocessor operating in the execution mode malfunctions, a write signal to the memory is suppressed and data is written to the memory. 2. The high reliability information processing apparatus according to claim 1, characterized in that the memory destruction due to the malfunction of the first microprocessor is prevented by the write inhibiting means for preventing it. 4. The logic means according to claim 1,
-Interrupting means for generating an interrupt in response to detection of one malfunction of the third microprocessor and notifying the malfunction of software, 2. The high reliability information processing apparatus according to claim 1, wherein the first to third microprocessors are resynchronized by a reset unit that performs a reset operation for initialization in response to a request from software. ..