JP3015538B2 - Redundant computer system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a dual computer system for improving the reliability and availability of a system by duplicating components centering on a CPU when constructing a fault-tolerant computer system.

[0002]

2. Description of the Related Art In general, in order to realize a fault-tolerant computer system with a complete hardware configuration, the inside of components such as a CPU is duplicated.

As an example of the system duplication, a system in which two modules each constituting a system are used and a bus line connecting each of the duplicated modules is duplicated has been put into practical use.
The internal circuits of each main module including the CPU are also duplicated, and the processing results between the duplicated circuits are compared.

FIG. 6 shows a configuration of a conventional fault-tolerant computer system using a duplex system. A computer 61 includes a CPU 61, a memory 62, a magnetic disk controller 63, a magnetic disk device 64, and a communication controller 65. The systems are duplicated as they are, each of which is connected by duplicated bus lines. And inside each CPU 61, 61,
Further, two ACPs (arithmetic control modules) 66a, 66
6b, the internal circuits of the memory 62, the magnetic disk controller 63, and the communication controller 65 are also duplicated. In this case, with the above bus line duplication,
Each module has two outputs to the bus, and two inputs from the bus to each module.

In this fault-tolerant computer system, the comparison of the processing results of each module is usually performed at the final output stage of each module, so that errors occurring in the module can be almost certainly detected. it can.

That is, for example, assuming data transfer between the CPU 61 and the magnetic disk controller 63,
When the CPU 61 reads data from the magnetic disk device 64, the magnetic disk control device 63 is in an operation mode of output to the bus.

At this time, the processing result in the magnetic disk control device 63 is compared immediately before output to the bus, and is output to both buses after confirming that the two systems of data match.

The CPU 61 operates as a magnetic disk drive 64.
When writing data to the ACP, the CPU 61 compares the data from each of the ACPs 66a and 66b at the final stage of output to the bus and checks the error.

In this case, unless a data error is detected by the CPU 61, the data transmitted to the input stage of the magnetic disk controller 63 hardly causes an error other than a factor such as noise on the bus.

Therefore, data transmitted from the CPU 61 via the two buses is transferred to the magnetic disk controller 63.
The comparison of the duplicated data is performed at the output stage from the magnetic disk control device 63 to the next module, that is, the magnetic disk device 64, without performing the comparison at the input stage.

In this case, in one comparison process, an error caused by data input from the bus to the magnetic disk controller 63,
In addition, errors due to data processing in the magnetic disk controller 63 can be detected. Here, the cause of the error occurrence on the bus line will be described.

For example, a module in the output mode:
An error check is performed on the data output to the bus. Therefore, erroneous data is not normally output on the bus.

However, in the case of an error due to a failure of a gate directly connected to the bus of the module in the output mode or a crosstalk noise of a signal on the bus, detection of an error in the output module is required. Without
This is detected in the processing result comparison stage on the input module side. Such a data error on the bus is a fatal injury that causes an error in both of the duplicated modules.

That is, if a data error occurs in both of the two buses, the data is input to either module regardless of whether there are two system modules or whether the inside of each module is completely duplicated. An error also occurs in the data, the processing result becomes abnormal, and the computer system becomes an error.

If a data error occurs in only one of the two buses, one of the circuits internally duplicated in the input module performs processing using erroneous data. Therefore, a difference occurs in the processing result of the duplicated internal circuit. Therefore, the comparison result at the output stage of both input modules becomes abnormal, and the computer system fails.

In recent years, the processing performance of electronic computers has been remarkably improved, and the basic clock for system operation has become higher in frequency, and the elements to be used have sharp rise / fall of signals.

In addition, the increase in the size of the computer system not only increases the number of modules connected to the bus, but also extends the bus itself, and tends to impair the reliability of signals on the bus.

That is, intermittent errors due to crosstalk, signal reflection, and the like are likely to occur on the bus, and it is difficult to connect a large number of modules via the bus as the CPU speeds up. It has become.

[0019]

For this reason, the conventional fault-tolerant computer system is suitable for configuring a microcomputer having a small system scale. However, a mini-computer is required due to a demand for a large-scale system and high-speed processing. When constructing a computer of a class or higher, it is necessary to connect a plurality of buses having different protocols via a system control unit (SCU).

The present invention has been made in view of the above problems, and
When constructing a fault-tolerant computer system using a CPU in which a plurality of modules are connected with different protocols, large-scale and high-speed operation can be achieved without causing a system stop due to a module error or a bus error. It is an object of the present invention to provide a duplicated computer system capable of ensuring high reliability.

[0021]

Means for Solving the Problems] That is, duplexing scheme of the computer according to the present invention includes a plurality of arithmetic control processor at least the two of the arithmetic and control module provided, two each the plurality of arithmetic control processor Of the first and the second connected to the arithmetic and control module of
A second system control unit, and the plurality of functions provided in the two system control units.
One arithmetic control module for each arithmetic control processor
And a first protocol converter connected via the signal line
Control unit, and the other arithmetic control module and the signal line
Second and protocol conversion control unit, the two system control unit first and second one being connected to a common respective protocol conversion control unit via the signal line and the other main memory in each connected via When,
And one and the other bus control unit is commonly connected first and second protocol conversion controller and via the signal <br/> Route in each of the above two system control units, in the two bus control units Provided from the first protocol conversion control unit.
Connected to external signal buses to control data input / output to / from external buses.
A first sequence control unit for controlling
A second sequence control unit connected to a signal line from the color conversion control unit and controlling data input / output to / from an external bus;
The first and second units between two operation control modules in each of the plurality of operation control processors and in each of the two system control units.
Between two protocol conversion controllers and the two main memories
Each of the first and second protocol conversion control units
A comparing unit provided between the connection signal lines and between the first and second sequence control units in each of the two bus control units, and for determining a match / mismatch of data signals input / output to / from each other; The first and second protocol conversion control units in the two system control units are respectively provided in the input / output unit with the two main memories and the input / output unit with the two bus control units. A system control gate circuit that is set to a cut-off state when a data signal mismatch is determined in a comparison unit between the two protocol conversion control units, and the two system control units in each of the two main memories. The first and second protocol conversion systems provided in the input / output unit
A memory gate circuit that is set to a cut-off state when a data signal mismatch is determined in a comparison unit between signal lines connecting the control unit and the two bus control units; A bus control gate circuit provided in an input / output unit with the control unit and set to a cut-off state when a data signal mismatch determination is made in the comparison unit between the first and second sequence control units; The plurality of operation control processes provided in the first and second protocol conversion control units.
Between two arithmetic and control modules in any of the
The comparison section provided in the
Means for interrupting the connection with the arithmetic and control processor in the event of a failure, and a first system controller of two arithmetic and control modules in each of the plurality of arithmetic and control processors.
Connection signal line with control unit and second system
The above-mentioned 2
In each of the two system control units
Between the first and second protocol conversion controllers and the above two
And second protocol conversion control for each main memory
Between the signal lines connected to the section and the above two bus controllers
First and second sequences in each of the
Match / mismatch at each comparison unit provided between
Based on the determination of the coincidence, is the signal passing state or blocking state
And an arithmetic control gate circuit to be set .

[0022]

In other words, the discrimination of a data signal mismatch in each of the comparing sections is detected as a module error, and the gate circuit or the cutoff means is controlled to cut off the connection with the error module. Alternatively, by continuing the operation with the other commonly connected system module, the number of maintenance replacement modules can be minimized without stopping the system.

[0023]

An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 shows the configuration of a fault-tolerant computer system based on a dual computer system according to the present invention.
14 is a main memory (memory L, memory R) which is connected to a common bus and duplicated, and 21 and 22 are duplicated system control units (SCUL, SCUR).
), 31 to 34 are internally duplicated arithmetic control processors (ACPs), 41 and 42 are connected to a common bus and duplicated bus control units (BCUL).
, BCUR), 51, 52,... Are each a distributed control processor (DCP).

FIG. 2 shows the arithmetic and control processor (ACP).
The internal control units 31 to 34 are provided with duplicated acp modules 311 and 312, respectively. One acp module 311 is connected to the signal line 31a via a gate circuit 313. And the gate circuit 314
Is connected to the other X port. Also, the other a
The cp module 312 is connected to the gate circuit 3 from the signal line 31b.
14 and is connected to the other Y port via a gate circuit 313. A comparison circuit 315 is connected between the duplicated acp modules 311 and 312.

The comparison circuit 315 compares data input and output to and from each of the two acp modules 311 and 312, and permits data input and output only when each data coincides. The gate circuit 313 that controls the connection / disconnection of the ports X and Y sets the port X from one acp module 311 to the bidirectional passing state and the port Y from the other acp module 312 to the unidirectional passing state in the output direction. The gate circuit 314 for controlling the connection / disconnection of the other ports X and Y is connected to one a
The port X from the cp module 311 is set to pass in one direction in the output direction, and the port Y from the other acp module 312 is set to pass in both directions.

Here, two X ports corresponding to one acp module 311 of the arithmetic and control processor 31 are:
The corresponding system control unit (SC
UL) 21 and (SCUR) 22 signal lines 21e and 2
It is connected to the first control centers 212 and 222 via 2e.

The two Y ports corresponding to the other acp module 312 of the arithmetic and control processor 31 are connected to the signal lines 21 of the corresponding system control units (SCUL) 21 and (SCUR) 22 respectively.
j, 22j to the second control centers 213, 223.

In each of the second to fourth arithmetic control processors 32 to 34, similarly to the case of the first arithmetic control processor 31, the two X
Ports are signal lines 2 of corresponding system control units (SCUL) 21 and (SCUR) 22 respectively.
1f, 22f, 21g, 22g, 21h, 22h connected to the first control centers 212, 222 via two Y
Ports are signal lines 2 of corresponding system control units (SCUL) 21 and (SCUR) 22 respectively.
It is connected to the second control centers 213 and 223 via 1k, 22k, 21m, 22m, 21n and 22n.

Here, each of the arithmetic control processors 31 to 34
Each of the gate circuits 313 and 314 performs a switching operation according to a normal / abnormal state of the processor itself, a normal / abnormal state of another connected module, or a memory copy mode after the main memory recovers from an abnormality. For example, one system control unit (SC
UL) 21, when an abnormality occurs, both the ports X and Y of one gate circuit 313 are set to the cutoff state,
Ports X and Y of the other gate circuit 314 are both set to pass in both directions.

Each system control unit (SCU)
L) 21 and the first control center 2 in (SCUR) 22
12, 222 and the second control centers 213, 223 are provided with the operation control units (ACPs) 31 to 34 and the main memory (memory L) and (memory R) 11, 1 which are shared in common.
2, 13, 14 or bus control unit (B
CUL) 41 and (BCUR) 42. Access control is performed between the first control centers 212 and 222 and the second control centers 213 and 223. Connected.

The comparison circuits 211 and 221 compare the respective processing result data by the corresponding first control centers 212 and 222 and the second control centers 213 and 223, and verify the coincidence / mismatch. Each of the control centers 212 and 222 is two by the comparison circuits 211 and 221.
13 and 223, the processing result data is output to the operation control processors 31 to 34 to be accessed or the signal lines 21a, 22a,
1b, 22b via the main memory (memory L), (memory
R) 11, 12, 13, 14 or signal line 2
The signals are output to the bus control units (BCUL) 41 and (BCUR) 42 via 1c, 22c, 21d and 22d.

Here, the first control centers 212 and 222 and the second control centers 213 and 22 of the system control units (SCUL) 21 and (SCUR) 22 are provided.
3 main memories (memory L), (memory R) 1
Signal line 2 serving as an input / output unit on the side of 1, 12, 13, 14
Gate circuits 214 and 224 are interposed in 1a, 21b, 22a and 22b, respectively, and signal lines 21c, 21d, 22c and 22d serving as input / output units on the bus control units (BCUL) 41 and (BCUR) 42 side, respectively.
Are provided with gate circuits 215 and 225, respectively.

The gate circuits 214, 224 and 21
5 and 225 are control centers 212 and 222 by comparison circuits 211 and 221 provided in the respective system control units (SCUL) 21 and (SCUR) 22.
The cutoff is set when the processing data mismatch between the pair 213 and 223 is found.

Main memory (memory L), (memory R) 1
1, 12, 13, and 14 are gate circuits 111,
121, 131, 141, comparison circuits 112, 122, 1
32, 142 and control / storage units 114, 124, 13
4,144.

Comparison circuits 112, 122, 132, 142
Are the respective gate circuits 111, 121, 131, 1
41 and each system control unit (SCUL) 2 via signal lines 21a, 21b, 22a, 22b.
1, (SCUR) 22 first and second control centers 21
2, 213, 222, 223 for comparing the match / mismatch of data input / output to / from the control / storage units 114, 124, 134, 144 only when the data match.
Are permitted to input and output data to and from the corresponding gate circuits 111, 121, 131, and 1 when the data do not match.
41 is set to shut off.

Control / storage units 114, 124, 134, 1
44, each having a RAM, the gate circuit 11
1, 121, 131, 141 and comparison circuits 112, 12
2, 132 and 142, data write / read control is performed, and an error correction signal (ECC) is generated / checked.

The control / storage units 114, 124,
Both 134 and 144 are provided with flip-flops 113, 123, 133 and 143 for setting the copy mode.
When "1" is set to 43, the control / storage unit 11
Only data writing is permitted to 4, 124, 134, 144, and reading operation is prohibited. FIG. 3 shows the internal configuration of the bus control unit (BCUL) 41. FIG. 3 shows only the configuration related to the first external bus 41a.

Bus control unit (BCUL) 4
1, (BCUR) 42 are two external buses 41 respectively.
a, 41b, 42a, 42b, two sequence control units 411, 412, 421, 422, and the system control unit (SCUL) 21,
(SCUR) 22 from the common duplex signal line 21c,
It performs data input / output control and protocol conversion control with 21d, 22c, and 22d. One of the signal lines 41c,
42c is a gate circuit 4 for the first external buses 41a and 42a.
13, 423 and the other signal lines 41d, 4d.
2d is a gate circuit 41 for the second external buses 41b and 42b.
4,424. One of the signal lines 41e and 42 from the second sequence control units 412 and 422
e is a gate circuit 41 for the first external buses 41a and 42a.
3, 423 and the other signal lines 41f, 42
f denotes a gate circuit 41 for the second external buses 41b and 42b.
4,424.

Here, the first sequence control section 411,
The first comparison circuits 415a and 415a are provided between one of the signal lines 41c and 42c from the first sequence control unit 421 and one of the signal lines 41e and 42e from the second sequence control units 412 and 422.
25a, and a first sequence control unit 41
The second comparison circuit 415 is provided between the other signal lines 41d, 42d from the first and second sequence controllers 412, 422 and the other signal lines 41d, 42d from the second sequence controllers 412, 422.
b, 425b are provided.

The first comparing circuits 415a and 425a are connected to the first comparing circuits 415a and 425a.
It compares the data match / mismatch between one of the signal lines 41c and 42c connected to the gate circuits 413 and 423 with the data of the signal lines 41e and 42e. Part 41
1, 412, 421, 422 or signal line 4
The signals are output to the first gate circuits 413 and 423 via 1g1 and 42g1.

In this case, when the match determination signal is output via the signal lines 41h and 42h, the data output from the sequence control units 411, 412, 421 and 422 to the corresponding first gate circuits 413 and 423, respectively. When the match determination signal is output via the signal lines 41g1 and 42g1, the first gate circuit 41
3, 423 to sequence control units 411, 412, 4
21 and 422 can be output.

The second comparison circuits 415b and 425b are connected to the second
This is for comparing the data match / mismatch between the other signal lines 41d, 42d connected to the gate circuits 414, 424 and 41f, 42f, and the comparison determination signal is sent to each sequence control via the signal lines 41h, 42h. Part 41
1, 412, 421, 422 or signal line 4
The signals are output to the second gate circuits 414 and 424 via 1g2 and 42g2.

In this case, when the match determination signal is output via the signal lines 41h and 42h, the data output from the sequence control units 411, 412, 421 and 422 to the corresponding second gate circuits 414 and 424, respectively. When the match determination signal is output via the signal lines 41g2 and 42g2, the second gate circuit 41
4, 424 to sequence control units 411, 412, 4
21 and 422 can be output.

On the other hand, the system control unit (SCUL) 21 of each sequence control unit 411, 412, 421, 422 in each of the bus control units (BCUL) 41, (BCUR) 42
Gate circuits 416 and 426 are provided in the data input / output unit for (SCUR) 22 respectively.

The gate circuits 416 and 426 are connected to the first sequence control units 411 and 421 and the second sequence control units 412 and 412 in the first comparison circuits 415a and 425a or the second comparison circuits 415b and 425b, respectively.
422 is set to be cut off when the processing data mismatch determination is made.

Distributed control processors (DCP) 51, 52
Are two input / output ports 51L, 51R, 52
L, 52R, and connects the first external buses 41a, 42a from the two bus control units (BCUL) 41, (BCUR) 42 to peripheral devices (disks and the like) (not shown). In the control processors 51 and 52, each input / output port 51L, 51R,
52L and 52R are connected to corresponding gate / comparison circuits 511 and 521, respectively.

The gate / comparison circuits 511 and 521 compare the coincidence / mismatch of data input / output between the first external buses 41a and 42a via the input / output ports 51L, 51R, 52L and 52R. Thus, data input / output to / from the control units 512 and 522 is permitted only when the data match.

The control units 512 and 522 perform communication control with various peripheral devices (not shown), that is, for example, two acps provided in the arithmetic control processor 31.
The same data simultaneously output from the modules 311 and 312 via one of the X and Y ports and the other of the X and Y ports is transmitted in parallel to the system control units (SCUL) 21 and (SCUR) 22 by two data each. The first gate circuit 41 is provided to the through bus control units (BCUL) 41 and (BCUR) 42.
After being converted into one data at 3 and 423, the data is supplied to the distributed control processors (DCP) 51 and 52 via the first external buses 41a and 42a, and communication control with peripheral devices is executed.

Here, the duplicated arithmetic control processors (ACP) 31 to 34, the system control units (SCUL) 21, (SCUR) 22, the main memories (memory L) 11, (memory R) 12, 13, 1
4. Bus control unit (BCUL) 41, (B
CUR) 42 and distributed control processor (DCP)
Both 51 and 52 have the same OS (operation system) in which hardware clock synchronization is established between them.
Will work.

The arithmetic and control processors 31 to 34
Two acp modules 311,
312 and a comparison circuit 315 for comparing the output data thereof. The comparator 311 instantaneously detects an error occurring in the acp modules 311 and 312. One of the arithmetic control processors 31 to 34 has detected an error. In that case, O
The control operation is continued by any other arithmetic control processor under the control of S.

Further, the fault tolerant
Since the computer system includes four operation control processors 31 to 38 which are internally duplicated, the four
One multiprocessor configuration is obtained.

The system control unit (SCUL)
) 21, (SCUR) 22 to perform a protocol conversion process in duplicate control centers 212, 213, 222, 2
23, comparison circuits 211 and 221 are provided between the bus control units (BCUL) 41 and (B
By providing comparison circuits 415, 425, and 416, 426 between the sequence controllers 411, 412, 421, and 422 that perform protocol conversion processing in the CUR) 42, errors in protocol conversion can be accurately and instantaneously made. Is detected. The distributed control processors (DCPs) 51 and 52 are input / output managed by the support of the OS, and are duplicated as a pair. That is,
In a fault-tolerant computer system,
Arithmetic control processors (ACP) 31, 32, main memory
(Memory L) 11, (memory R) 12, distributed control
(DCP) 51, 52
System control unit (SCUL) 2
1, (SCUR) 22 dual control center 212,21
3, 222, 223 and bus control unit (BC
UL) 41 and sequence control unit 41 of (BCUR) 42
1, 412, 421, 422 as a protocol conversion processing unit
And are connected by different protocols. Next, the operation of the fault tolerant computer system having the above configuration will be described.

Here, four operation control processors (AC
P) The first arithmetic control processor 31 of 31 to 34
A case in which the processing is executed with a focus on will be described.
In the case where one and the other modules operate in the same manner in each of the redundant configuration modules, the main memory (memory L) 11 and the system control unit (SCUL)
) 21, Bus control unit (BCUL) 41
The operation on the side will be mainly described.

FIG. 4 shows an arithmetic and control processor (ACP) 31.
FIG. 7A shows an operation state when the system is normal, and FIG. 7B shows an operation state when the system control unit (SCUL) 21 is abnormal. First, the normal operation of the fault tolerant computer system will be described.

In this case, as shown in FIG. 4A, the port X of one of the gate circuits 313 in the arithmetic and control processor (ACP) 31 is in the bidirectional passing state, and the port Y is in the unidirectional passing state in the output direction. The port X of the other gate circuit 314 is set in a one-way passing state in the output direction, and the port Y is set in a two-way passing state.

That is, when signals are input from the system control units (SCUL) 21 and (SCUR) 22 through the X port of the gate circuit 313 and the Y port of the gate circuit 314 of the arithmetic and control processor 31, the comparison circuit 315 The match / mismatch is compared and determined. In this comparison circuit 315, each system control unit (SCUL) 21, (SCU
R) When the coincidence of the signals from the 22 is determined, the corresponding acp modules 311 and 312 execute the processing in parallel.

On the other hand, in the comparison circuit 315, each of the system control units (SCUL) 21 and (SCUL)
UR) 22, when it is determined that the signals do not match, it is determined that the ACP 31 has failed by the comparison circuit 315 from the system control unit (SCUL) 21, (SCUL).
UR) 22 is notified of the failure.

Then, the first and second control centers 212, 222, 213, and 223 of the system control units (SCUL) 21 and (SCUR) 22 are disconnected from the arithmetic and control processor 31. The operation mode is changed under the OS management so that the processing is continued by the arithmetic control processors 32-34. In this case, only the operation control processor 31 having the abnormality can be separated and the continuation processing can be performed.

Next, the arithmetic and control processor (ACP) 31
When writing data to the main memory (memory L) 11 and (memory R) 12 from the ACP module 311,
The data output from the 312 is subjected to a matching check by the comparing circuit 315. When a match is determined by the comparing circuit 315, the output data from the first acp module 311 is output to the X port located in each of the gate circuits 313 and 314. Via the system control unit (SC
UL) 21 and (SCUR) 22 signal lines 2
It is sent to the first control centers 212 and 222 via 1e and 22e. The output data from the second acp module 312 is supplied to the system control unit (SCUL) 2 via the Y ports provided in the gate circuits 313 and 314.
1, (SCUR) 22 signal lines 21j, 2
2j to the second control centers 213, 223.

On the other hand, for example, the arithmetic control processor 31
If the comparison circuit 315 determines that the data do not match, it is processed as described above as “ACP31 failure”, and each system control unit (SCUL) 2
1, (SCUR) 22 first and second control centers 21
At 2, 222, 213, and 223, the OS is disconnected such that the connection with the arithmetic control processor 31 is cut off and the processing is continued by any of the other arithmetic control processors 32 to 34.
The operation mode is changed under management.

The first and second control centers 212,
Numeral 213 performs a protocol conversion process between the ACP and the main memory. The data after the protocol conversion process in the first and second control centers 212 and 213 is subjected to a coincidence check in the comparison circuit 211. Each corresponding signal line 21 from the memory side gate circuit 214
The data is output to the main memories (memory L) 11 and (memory R) 12 via the terminals a and 21b.

In this case, the data signal from the system control unit (SCUR) 42 is also
The signals are output to the common main memories (memory L) 11 and (memory R) 12 via the signal lines 22a and 22b.

If the comparison circuit 211 determines that the data does not match after the protocol conversion processing in the first and second control centers 212 and 213, the memory side gate circuit 214 is set to the cut-off state. As a result, data output to the signal lines 21a and 21b is prohibited, and an "SCUL error" is notified to the arithmetic control processors 31 and 32, the main memory (memory L) 11 and the bus control unit (BCUL) 41, and , The BCU side gate circuit 215 is also set to the cut-off state, and the bus control unit (BCUL) 41,
Data input / output with (BCUR) 42 is also prohibited.

In this case, the main memory (memory L) 1
1, (memory R) 12 operates normally by the data signal from the system control unit unit (SCUR) 42.

When data is given to the comparison circuit 112 through the gate circuit 111 of the main memory (memory L) 11 through the signal lines 21a and 21b, the coincidence is confirmed, and then the data is supplied to one system. Is output to the control / storage unit 114. Thereby, the control / storage unit 1
At 14, the given data is given an ECC (error check code) and written into the RAM.

On the other hand, when the comparison circuit 112 determines that the data obtained from the signal lines 21a and 21b via the gate circuit 111 do not match, the writing of the data to the control / storage unit 114 is prohibited. At the same time, a "memory error" is notified to the system control unit (SCUL) 21 via the signal lines 21a and 21b. In this case, the main memory (memory R) 1
2, the normal processing is performed, and the system function is maintained.

Next, when data is read from the main memories (memory L) 11 and (memory R) 12 to the arithmetic and control processor (ACP) 31, the data read from the RAM in the control / storage section 114 is compared. When sent to the circuit 112, the read data is separated into two identical data, and a match / mismatch is determined.

In the comparison circuit 112, when a match is determined, the read data is transmitted to the gate circuit 11
1 to a system control unit (SCUL) 21 via signal lines 21a and 21b,
If a mismatch determination is obtained, the gate circuit 111
Is cut off, data output is prohibited, and a "memory error" is notified via the signal lines 21a and 21b. In this case, the main memory (memory L
The system function is normally maintained by the data signal from the main memory (memory R) 12 which is commonly connected to 11).

The data or error notification signal sent from the main memory (memory L) 11 to the system control unit (SCUL) 21 via the signal lines 21a and 21b is transmitted to the first control center 212 and the second control center 212. The control center 213 performs a protocol conversion process, and the comparison circuit 211 determines the match / mismatch.

In the comparison circuit 211, when the data coincidence determination after the protocol conversion processing is performed, the first
And data signals from the second control centers 212 and 213 are sent to the arithmetic and control processor 31 via signal lines 21e and 21j, respectively.

On the other hand, if the comparison circuit 211 determines that the data does not match after the protocol conversion processing,
Memory side gate circuit 214 and BCU side gate circuit 21
5 is set to the cut-off state, the output of the data signal from the first and second control centers 212 and 213 is prohibited, and an "SCU error" is instead generated via the signal path similar to the above. Will be notified.

Here, the data signal from the signal line 21e of the system control unit (SCUL) 21 is transmitted to the bidirectional port X in one gate circuit 313.
Is transmitted to the first acp module 311 via the gate circuit 313. The data signal from the signal line 21j of the system control unit (SCUL) 21 is sent to the gate circuit 313.
Is rejected at output port Y.

On the other hand, the system control unit (S
CUR) 22 from the signal line 22j is
The signal is sent to the second acp module 312 via the bidirectional port Y of the other gate circuit 314, but the data signal from the signal line 22e of the system control unit (SCUR) 22 is rejected at the output port X of the gate circuit 314. Is done.

Thus, the duplicated acp module 311,
According to 312, each main memory (memory L) 1
1, data processing from (memory R) 12 is executed in parallel.

Next, the system control unit (S
A case where data transfer is performed from the CUL) 21 and (SCUR) 22 to the distributed control processors (DCP) 51 and 52 via the bus control units (BCUL) 41 and (BCUR) 42 will be described.

First, the data signal from the arithmetic control processor 31 or the data signal from the main memory (memory L) 11 is used when the data transfer operation between the arithmetic control processor 31 and the main memory (memory L) 11 is performed. The data signals provided to the first and second control centers 212 and 213 via similar signal paths are transmitted to the bus control unit (BC).
UL) 41, a protocol conversion process is performed, and a comparison circuit 211 compares and determines the match / mismatch.

When the comparison circuit 211 determines that the data signals match, the data signal from the first and second control centers 212.213 is sent to the signal line 21.
bus control unit (BCL)
L) 41 and (BCUR) 42 sequence control units 41
1, 412, 421, 422.

In this case, similarly, a data signal is output from the other system control unit (SCUR) 22 through the signal lines 22c and 22d from the BCU side gate circuit 225, and the data is output from the system control unit (SCUL) 21. Bus control units (BCLL) 41, (BCUR) which are ORed with the data signal
42.

On the other hand, if the comparison circuit 211 determines that the data signals do not match, the memory side gate circuit 214 and the BCU side gate circuit 215 are set to the cut-off state, so that the first and second control centers are set. 212, 21
3 is inhibited from outputting the data signal.
The "U error" is notified to the arithmetic and control processor 31.

In this case, the output of the data signal from the other system control unit (SCUR) 22 is normally performed, and the bus control unit (BCUL) 4
In (1, BCUR) 42, normal processing is continued.

Bus control unit (BCUL) 4
1 has two sequence control units 411 and 412,
Each of the two output signal lines 41c, 41d, 41e, corresponds to two external buses 41a, 41b.
41f, the signal lines 41c and 41e correspond to the first external bus 41a, and the signal lines 41d and 4e
1f corresponds to the second external bus 41b. In this case, the first external bus 41a and the second external bus 41b are distinguished according to the address when accessing the peripheral device.

That is, each of the sequence control units 41
If the peripheral device connected to the first external bus 41a is selected as the transfer destination address of the data signal in a state where the protocol conversion processing has been performed to correspond to the external buses 41a and 41b in 1,412, The data signal is output to signal lines 41c and 41e and sent to gate circuit 413.

The two data signals sent to the gate circuit 413 are matched / mismatched by the comparison circuit 415a. When the comparison circuit 415a determines that the data signals match, the gate circuit 413 is output. , A match determination signal is output via a signal line 41g1, and a data signal for one system is output to distributed control processors (DCPs) 51 and 52 via a first external bus 41a.

On the other hand, when the comparison circuit 415a determines that the data signals do not match, the gate circuit 413 is set to the cut-off state so that the output of the data signal to the first external bus 41a is prohibited. BC
UL error ”is displayed in the system control unit (SCU
L) Notifying the arithmetic control processor (ACP) 31 through 21, the gate circuit 416 is set to the cut-off state, and the signal lines 21 c, 21 d or 22 c, 2
The connection with 2d is disconnected.

In this case, the distributed control processors 51 and 52
Then, the other bus control unit (BCUR) 4
The processing is continued according to the data signal transferred from the second through the other first external bus 42a.

Next, for example, the first external buses 41a and 42a
The arithmetic and control processor (ACP) 31
Alternatively, the main memories (memory L) 11 and (memory R) 12
When a data signal is supplied from the first external bus 41a to the gate circuit 413 of the bus control unit (BCUL) 41, the data signal is separated into the same two-system data signal and the signal line 41
c and 41e, and the comparison circuit 415a determines the match / mismatch of the data signal.

When the comparison circuit 415a determines the coincidence of the data signals separated and output from the gate circuit 413, the coincidence determination signal is output to the signal line 41.
h, output to each of the sequence controllers 411 and 412, and the data signal from the gate circuit 413 is subjected to protocol conversion processing so as to correspond to the system control unit (SCUL) 21, and the signal lines 21c and 21d
Is output to

On the other hand, when the comparison circuit 415a determines that the data signals do not match, the mismatch determination signal is output to each of the sequence controllers 4111 and 412 via the signal line 41h, and the gate circuit 416
Is set to the cut-off state, the output of the data signal accompanying the protocol conversion process is prohibited, and the "BCUL error" is output to the system control unit (SCUL) 21.
To the arithmetic and control processor (ACP) 31 through

The procedure for transferring a data signal or an error signal from the system control unit (SCUL) 21 to the arithmetic and control processor 31 is the same as the procedure for transferring data from the main memory (memory L) 11 to the arithmetic and control processor 31. It is done.

Next, with the data transfer from the arithmetic control processor 31 to the distributed control processor (DCP) 51, each bus control unit (BCUL) 41,
(BCUR) 42 through the first external buses 41a, 42a and the signal lines 51L, 51R.
When a data signal is input to the data bus 11, the data signals coincide with each other via the two external buses 41a and 42a.
A mismatch is compared and determined, and 1 is determined when a match is determined.
Data signals for the systems are sent to the control unit 512.

Then, in the control unit 512, the gate
According to the data signal given from the comparison circuit 511, control processing of a peripheral device (not shown) connected to the data signal is executed.

The distributed control processor (DCP)
51, the gate / comparison circuit 511 and the control unit 51
2 is shown as a single configuration, but in order to further improve error detection accuracy, a bus control unit (BC
UL) 41 and (BCUR) 42 may have a duplex configuration.

On the other hand, when the gate / comparison circuit 511 determines that the data signal does not match, the output of the data signal to the control unit 512 is prohibited, and the control processing of a peripheral device (not shown) connected to the control unit 512 is performed. Is no longer executed, and the distributed control processor (DCP) 5
1 is error-terminated and left to processing on software.

Next, the distributed control processor 51 is relayed,
A data signal from a peripheral device (not shown) is transmitted to the first external bus 4
When the data signal is sent from the control unit 512 to the gate / comparison circuit 511 to be transmitted to the first and second signal lines 1a and 42a, it is separated into two identical data signals to correspond to the two signal lines 51L and 51R. A match / mismatch is determined by comparison.

When a match is determined in the gate / comparison circuit 511, the data signals separated into two systems are sent to the first external buses 41a and 42a through the signal lines 51L and 51R, respectively. become.

On the other hand, in the gate / comparison circuit 511,
If a mismatch is determined, the output of the data signals separated into two systems to the signal lines 51L and 51R is prohibited, and the distributed control processor (DCP) is used.
An error termination 51 is entrusted to processing on software. Next, the arithmetic and control processor (AC
The case where P) 31 fails will be described.

When the data signals are output from the first and second acp modules 311 and 312 of the arithmetic and control processor 31, the comparison circuit 315 makes a data mismatch judgment, and outputs an “ACP error” signal to the system control unit (SCUL) 21. Signal lines 21e, 21
j to the control center 212, 213, the control center 212, 213 causes the faulty ACP 31
The operation mode is changed according to the abnormality processing function of the OS so that the connection with the OS is interrupted and the processing is continued by any of the other arithmetic control processors 32 to 34.

In this case, for example, the arithmetic control processor 32
Is output separately to the two signal lines 21f and 21k, whereby the protocol conversion processing in the first and second control centers 212 and 213 is normally performed, and the system control unit (SCUL) is used. ) 21 to the main memory (memory L) 11 or the bus control unit (BCUL) 41 are kept as they are.

Therefore, no change occurs in the transfer procedure of the data signal after the system control unit (SCUL) 21, so that the error detection accuracy of the protocol conversion processing in each comparing unit does not decrease. Further, the failure ACP 31 is provided for each control center 212, 213,
Since the ACP board is completely shut off at 222 and 223, there is no influence of noise when replacing the ACP board. Next, the system control unit (SCUL
) 21 will be described.

For example, the system control unit (S
When an error notification is given to the arithmetic and control processor (ACP) 31 in response to the "SCUL error" from the CUL) 21, as shown in FIG.
Both ports X and Y at 13 are set to a cut-off state, input and output to and from the SCUL side are cut off, and both ports X and Y at the other gate circuit 314 are set to a two-way passing state.

In this case, a data signal sent from the other system control unit (SCUR) 22 to the arithmetic and control processor 31 is simultaneously input to both of the acp modules 311 and 312 via the gate circuit 314. Accordingly, the same processing for the same data signal is executed in each of the acp modules 311 and 312 as usual. And each of the above ac
The processing result data from the p modules 311 and 312 are determined by the comparing circuit 315 to be coincident / non-coincidence, and when the coincidence is determined, the respective acp modules 311 and 31 are determined.
2 is again sent to the system control unit (SCUR) 22 via the gate circuit 314.

Therefore, each of the arithmetic control processors 31 to 31
34, the other system control unit (SC
The input / output of the data signal via the UR) 22 allows the processing to be continuously executed. Next, a case where the main memory (memory L) 11 has failed will be described.

For example, control of the main memory (memory L) 11
The data signal read through the storage unit 114 is supplied to the comparison circuit 112, where the data signal is separated into two systems, and when the data signals separated into two systems are determined to be inconsistent, the main memory (memory L) 11 outputs " When the "memory error" signal is generated, the gate circuit 111 is set to the cut-off state, and writing / reading of data signals to / from the main memory (memory L) 11 is prohibited.

In this case, the main memory (memory R) 12 performs normal data input / output with respect to the system control units (SCUL) 21 and (SCUR) 22.

When an error occurs in the main memory (memory L) 11, the gate circuit 111 is set to a cut-off state, and only the error-occurring main memory (memory L) 11 is independently disconnected. Therefore, the maintenance staff can replace the memory board without impairing the system functions.

When the replacement of the memory board is completed and the main memory (memory L) 11 is restored, the other main memory (memory L) 11 whose memory access has been interrupted is replaced by the other main memory (memory L). A case where the contents of the memory (memory R) 12 are copied will be described.

That is, for example, when power is supplied to the memory board after the one main memory (memory L) 11 has been replaced by a fault, the board is first initialized and the copy flip-flop 113 is copied at the same time. Set to mode.

Then, the main memory (memory L) 11 is set to a writable / read-prohibited state. Here, each acp module 31 of the arithmetic control processor 31 is set.
1 and 312, read / write control for all addresses of the main memories (memory L) 11 and (memory R) 12 is sequentially performed.

In this case, for example, as shown in FIG. 4B, the other system control unit (SCUR)
The gate circuit 314 on the 22 side is set to the bidirectional transfer state for both ports X and Y, and the gate circuit 313 for the one system control unit (SCUL) 21 is set to the cut off state for both ports X and Y. At the time of reading the data, only the data signal from the other main memory (memory R) 12 is applied to both acp modules 311,
When the data is read from the memory 312 and the data is written, the read data is simultaneously written into both the main memories (memory L) 11 and (memory R) 12. As a result, at the time of system restoration, the copy of the common dual memory can be easily performed by using the arithmetic control processor 31 as a relay. After this, the main memory (memory L)
The 11 copy flip-flops 113 are reset,
It returns to the normal system operation state. Next, the one bus control unit (BCUL)
The case where 41 has failed will be described.

For example, the system control unit (S
CUL) 21 and (SCUR) 22 to the gate circuit 416 of the bus control unit (BCUL) 41 via the respective duplicated signal lines 21c, 21d, 22c and 22d, or the sequence control section 411, 412 to the first external bus 41a
The duplicated data signals to be output to the
When a mismatch is determined in 15a and a "BCU error" is generated, this error signal is sent from the system control units (SCUL) 21 and (SCUR) 22 to the arithmetic control processor (ACP) 31 and the distributed control processors (DCP) 51 and 52. And so on.

Then, each of the gate circuits 413, 414 and 416 of the error-generating BCU 41 is set to the cut-off state and the system is separated. In this case, normal system processing is performed through the other bus control unit (BCUR) 42. Can be continued, and the BCU board can be replaced by the maintenance staff without impairing the system function.

Therefore, according to the fault-tolerant computer system having the above-described configuration, the arithmetic and control processor (ACP) is provided with two acp modules for internal duplication, and the system control unit (SCU), main memory (memory), bus Each of the control units (BCU) is duplicated, and two signal lines from two acp modules 311 and 312 in the above-mentioned duplicated arithmetic and control processor (APC) 31 are connected to the duplicated system control unit (SCC).
UL) 21, (SCUR) 22, common redundant main memory (memory L) 11, (memory R) 12, common redundant bus control unit (BCUL) 41, (BCUR)
42, the processing results obtained from the two signal lines between the acp modules 311 and 312 and between the individual protocol conversion units and the data input / output units are compared. Since the occurrence is detected and the error generating module is isolated from the system by shutting off its gate circuit, not only the location where the error has occurred can be easily specified, but also the normal system function can be maintained through the normal module.

In addition, a of the arithmetic control processor 31
Gate circuits 313 and 314 for selectively setting the data signal transfer direction and cutoff are provided at input / output ports between the cp modules 311 and 312 and each of the system control units (SCUL) 21 and (SCUR) 22. Therefore, the system control unit (SCU) on the error generating module side is disconnected, and the data signal from the remaining system control unit (SCU) is divided into two ac signals.
The processing can be continued by supplying the same to the p modules 311 and 312 in common.

The first and second control centers 212, 213, 222, and 222 of the duplicated system control units (SCUL) 21 and (SCUR) 22 respectively.
Since the 223 has a function of shutting off each of the arithmetic control processors 31 to 34, the arithmetic and control processor (ACP) 31
In the event of a failure, the connection with the failed ACP 31 is disconnected, and the processing can be continued with the other arithmetic control processors (ACPs) 32-34.

Therefore, even if an error occurs in any module in the system, the entire system is not stopped, and only the module in which the error has occurred can be separated and replaced.

In this fault tolerant computer system, an arithmetic and control processor (ACP)
, A large-scale high-speed processing system can be constructed.

In the above embodiment, the duplicated external buses 41a and 42a from the duplicated bus control units (BCUL) 41 and (BCUR) 42 are connected through the gate / comparison circuit 511 in the distributed control processors 51 and 52, and the DCP input is performed. We also performed error detection at the output stage,
For example, as shown in FIG.
If the... Do not have the function of comparing the duplicated data signals, the duplicated bus control unit (BCUL)
The first external bus 41 of each of 41 and (BCUR) 42
a and 42a and the second external buses 41b and 42b may be configured as a common bus. In this case, error detection is performed using the parity signal.

[0119]

According to the present invention as described above, according to the present invention, a plurality of arithmetic control processor at least the two of the arithmetic and control module provided, the plurality of arithmetic control processor it
First and second system control units connected via a signal line to the two operational control module Les,
Installed in these two system control units ,
One of the plurality of arithmetic control processors
A first module connected to the control module via the signal line.
Protocol conversion control unit and the other arithmetic control module
A second protocol conversion control unit which is connected via the signal line, it first and second protocol converter control unit in each of the above two system control unit
And one and the other main memory connected to a common via Zoreto signal line, the first and second protocol converter control unit in each of the above two system control unit
And connected one and the other of the bus control unit in common through the respective signal lines, provided on the two bus control units, variable the first protocol
Connected to a signal line from the conversion control unit and connected to an external bus.
A first sequence control unit for controlling data input / output;
A second sequence control unit connected to a signal line from the second protocol conversion control unit for controlling data input / output to / from an external bus, and two operations in each of the plurality of operation control processors Between the control modules and between the first and second protocol conversion controllers in each of the two system control units and
The first and second protocol variants of each of the two main memories.
Between the connection signal lines to the switching control unit and between the first and second sequence control units in each of the two bus control units to determine the match / mismatch of the data signals input / output to each other. And an input / output unit for the two main memories and an input / output unit for the two bus control units of the first and second protocol conversion control units in the two system control units, respectively. A system control gate circuit that is set to a cut-off state when a data signal mismatch is determined in the comparison unit between the first and second protocol conversion control units; and the two main memories in each of the two main memories. The first and second processors are provided in the input / output section with the system control unit.
A memory gate circuit that is set to a cut-off state when a data signal mismatch determination is made in a comparison unit interposed between signal lines connecting the protocol conversion control unit and the two bus control units; Each of the units is provided in an input / output unit with the two system control units, and is set to a cut-off state when a data signal mismatch determination is made in the comparison unit between the first and second sequence control units. A bus control gate circuit; and the plurality of functions provided in the first and second protocol conversion control units.
Two arithmetic control modules in any of the arithmetic control processors
Data signal in the comparison section provided between
If a match is found, the connection with the
Interrupting means for interrupting connection, and a first of two arithmetic control modules in each of the plurality of arithmetic control processors .
Connection signal line with the system control unit of
That of the above-mentioned two system control units, which is interposed in the signal line connected to the two system control units.
Between the first and second protocol conversion controllers in each case
And first and second protocols of the two main memories, respectively.
Between the connection signal lines with the
First and second in each of the
Each comparison unit provided between the two sequence control units
Based on the match / mismatch determination at, the signal passing state also
Is configured with an arithmetic control gate circuit in which a shut-off state is set . Therefore, when constructing a fault-tolerant computer system using a CPU in which a plurality of modules are connected by different protocols, a module error or a bus error occurs. It is possible to achieve a large-scale, high-speed operation and high reliability without causing a system stop due to the occurrence of an error.

[Brief description of the drawings]

FIG. 1 is a block diagram showing the configuration of a fault-tolerant computer system according to an embodiment of a dual computer system according to the present invention.

FIG. 2 is a block diagram showing an internal configuration of an arithmetic and control processor (ACP) in the fault-tolerant computer system.

FIG. 3 is a block diagram showing an internal configuration of a bus control unit (BCU) in the fault-tolerant computer system.

FIG. 4 is a diagram showing an operation state inside an arithmetic and control processor (ACP) in the fault tolerant computer system.

FIG. 5 is a block diagram showing a configuration of a fault-tolerant computer system according to another embodiment of the present invention.

FIG. 6 is a block diagram showing a configuration of a conventional fault-tolerant computer system using a duplex system.

[Explanation of symbols]

11, 12, 13, 14 ... main memory (memory), 21,
22: System control unit (SCU), 31
... 34 arithmetic and control processor (ACP), 41, 42 ...
Bus control unit (BCU), 51, 52 ... distributed control processor (DCP), 111, 121, 13
1,141,214,215,224,225,31
3,314,413,414,416,423,42
4,426 gate circuits, 112, 122, 132, 1
42, 211, 221 315, 415a, 415b,
425a, 425b... Comparison circuit, 113, 123, 13
3,143 ... copy flip-flops, 114,12
4, 134, 144 ... control / storage unit, 212, 213,
222, 223: control center, 311, 312: acp module, 411, 412, 421, 422: sequence control unit, 511, 521: gate / comparison circuit, 51
2, 522: control unit, 21a to 21n, 22a to 22
n, 41c-41h, 42c-42h, 51L, 51R
, 52L, 52R ... signal lines, 41a, 41b, 4
2a, 42b ... External bus.

Claims (1)

(57) [Claims] In duplex system 1. A computer constituting a fault tolerant computer system, at least the two of the arithmetic and control module is a plurality
And a first and a second processor connected via signal lines to two operation control modules of each of the plurality of operation control processors .
A system control unit, provided in the two system control units,
One of the plurality of arithmetic control processors
A first module connected to the control module via the signal line.
Protocol conversion control unit and the other arithmetic control module
Commonly connected via a second protocol conversion control unit which is connected via the signal line, the first and signal <br/> Line respectively second protocol converter control unit in each of the above two system control unit has been one and the other of the main memory and, one and the other bus control is connected to the common via respective first and second protocol conversion controller and the signal <br/> Line in each of the above two system control unit and the unit, is provided on the two bus control units, the
Externally connected to the signal line from the first protocol conversion control unit
First sequence for controlling data input / output to / from external bus
From the second protocol conversion control unit.
A second sequence control unit connected to the signal line and controlling data input / output to / from an external bus; and between the two operation control modules in each of the plurality of operation control processors and each of the two system control units The first and second above
Between two protocol conversion controllers and the two main memories
Each of the first and second protocol conversion control units
A comparing unit provided between the connection signal lines and between the first and second sequence control units in each of the two bus control units, and for determining a match / mismatch of data signals input / output to / from each other; The first and second protocol conversion control units of the two system control units are respectively provided in the input / output unit with the two main memories and the input / output unit with the two bus control units. A system control gate circuit that is set to a cut-off state when a data signal mismatch is determined in a comparison unit between the two protocol conversion control units; and the two system control units in each of the two main memories. The above-mentioned
1, a signal line phase connecting the second protocol conversion control unit
A memory gate circuit which is set to a cut-off state when a data signal mismatch is determined in a comparison unit between the two bus control units; A bus control gate circuit provided to be set to a cut-off state when a data signal mismatch is determined in a comparison unit between the first and second sequence control units; and the first and second protocol conversions. above provided to the control unit
The two functions in any of the plurality of arithmetic and control processors
Data in the comparison unit provided between the arithmetic and control modules
If a signal mismatch is determined, the arithmetic control
Interrupting means for interrupting connection with the processor, and a first system control unit of two arithmetic control modules in each of the plurality of arithmetic control processors.
Connection signal line with knit and second system control
The above two systems interposed in the signal line connected to the unit
The first and second in each of the control units
Between the protocol conversion controllers and the two main memories
Connection signals with the first and second protocol conversion control units
Between the two lines and between the two bus control units
First and second sequence control units in each
For judgment of match / mismatch in each comparison unit provided between them
And an operation control gate circuit for setting a signal passing state or a blocking state based on the signal.