JPH04257931A - Computer system - Google Patents

Abstract

PURPOSE:To realize redundant constitution with a sumall number of hardwares by comparing the output information of a third function module with the operated results of first and second function modules and restarting an operation when they are matched, or stopping the operation when they are unmatched. CONSTITUTION:When a fault occurs at a first function module 100, first and second function modules 100 and 101 stop outputs in the state of holding the operated results of the modules them-selves. A third function module 102 outputs the correct operated result of the own module to first and second buses 106 and 107. the first and second function modules 100 and 101 compare the held operations of its own modules with the bus information outputted by the third function module 102. Then, the first module 100 stops the operation according to unmutch, and the second function module starts the operation according to the match.

Description

[Detailed description of the invention]

0001

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a computer system having a redundant configuration and capable of continuous operation even in the event of a failure.

0002

2. Description of the Related Art Conventionally, this type of computer system has adopted two methods. One method was to use a triple or more redundant configuration, identify a faulty module by majority vote, and continue operation with the remaining modules. The other method is to have duplicate modules with self-failure detection mechanisms, and when one module detects a failure, the other module continues operation.

A conventional example of the former is shown in FIG. 2, and a conventional example of the latter is shown in FIG. FIG. 2 shows an example of a conventional computer system, particularly a configuration diagram of a triplex system. In the figure, 200 to 202 are functional modules configuring the computer system, and these functional modules 200 to 202 are system components having the same function. The computer system has a triplex configuration with these functional modules 200-202. The functional module 200 outputs the operation result to the bus 206 , the functional module 201 outputs the operation result to the bus 207 , and the functional module 202 outputs the operation result to the bus 208 .
It is wired to output the operation results. The functional module 200 has a majority circuit 203 , the functional module 201 has a majority circuit 204 , and the functional module 202 has a majority circuit 205 . These majority circuits 203 to 205 are each
It is connected to three buses 206-208.

Under such a configuration, if a failure occurs in any of the functional modules 200-202, an incorrect result is output to any of the buses 206-208. For this reason, the majority circuits 203 to 205
compares information from buses 206 to 208, detects discrepancies, and identifies faulty modules by majority vote;
Continuous operation was possible by stopping operation when the own module failed, and continuing operation when other modules failed.

FIG. 3 shows another example of a conventional computer system, particularly a configuration diagram of a duplex module system having a self-failure detection mechanism. In the same figure, 30
0 and 301 are functional modules constituting the computer system, and these functional modules 300 and 3
01 are system components having the same function. The computer system uses these functional modules 300
, 301, resulting in a duplex configuration. The functional modules 300 and 301 both have buses 304 and 304.
, 305. Function module 300
outputs operation results to buses 304 and 305, and function module 301 does not output operation results to buses 304 and 305. Function module 3
00 and 301 have self-failure detection mechanisms 302 and 303, respectively, as shown. Under such a configuration, when a failure occurs in either of the functional modules 300 , 301 , the self-failure detection mechanism 302 , 3
03, the functional module related to the failure stops operating, and the other normal modules continue operating. This enabled continuous operation.

[0006]

[Problems to be Solved by the Invention] However, the above-mentioned conventional system has the following problems. That is, in the former triplex system (FIG. 2), the buses also need to be triplexed, requiring a very large number of bus signal lines. Since the bit widths of data and addresses handled in computer systems will both increase in the future, triplexing buses is a very big problem. In addition, the latter is a duplex system of modules with a self-failure detection mechanism (Figure 3).
However, in order to perform self-failure detection, it is necessary to have a redundant configuration inside the functional module, which has the problem of requiring a large amount of hardware. An object of the present invention is to solve these conventional problems, realize a redundant configuration with less hardware than the conventional system, and provide a highly reliable computer system.

[0007]

[Means for Solving the Problems] The present invention provides a computer that has a redundant configuration of functional modules so that even if one functional module fails, continuous operation can be performed using the remaining normal functional modules. In the system, the first
bus and a second bus, outputs the operation results of its own function module to the first bus, compares the operation results of its own function module and the input information from the second bus, and detects a mismatch. a first functional module that stops outputting to the first bus while holding the operation results of its own functional module; and a first functional module that is connected to the first bus and the second bus, Said second
output to the bus, and output the operation results of its own function module and the first
a second function module that compares the input information from the bus and stops outputting to the second bus while retaining the operation results of its own function module when a mismatch is detected; is connected to a bus, does not output the operation results of its own function module to the first bus and the second bus, and compares the operation results of its own function module with the input information from the first bus and the second bus. and a third functional module that outputs the operation result of the self-function module to the first bus and the second bus when a mismatch is detected and the self-function module is not in failure according to a majority vote, When the mismatch occurs, the functional module compares the output information of the third functional module from the first bus and the second bus with the held operation result of its own functional module, and operates if they match. The configuration is such that the operation is restarted, and if there is a mismatch, the operation is stopped.

[0008]

[Operation] When a failure occurs in the first functional module, the first
And the second functional module stops outputting while holding the operation result of its own module. The third functional module outputs the correct operation result of its own module to the first bus and the second bus. The first and second functional modules compare the held operation results of their own modules with the bus information output by the third functional module. The first functional module stops operating due to a mismatch, and the second functional module starts operating due to a match.

[0009]

Embodiments Next, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a configuration diagram showing an embodiment of a computer system according to the present invention. In the same figure, 100 to 10
2 has a triple configuration of first to third functional modules 100 to 102 that constitute a computer system. First to third functional modules 100 to 102
The output sides of are connected to two first buses 106 and two second buses 107, respectively. In this case, the first functional module 100 is configured to provide an output to the first bus 106 and not to the second bus 107 (indicated by the dotted arrow). Further, the second functional module 101 does not supply output to the first bus 106 (indicated by a dotted arrow), but supplies output to the second bus 107 . Additionally, the third functional module 102
does not supply output to the first bus 106 and the second bus 107 (indicated by dotted arrows).

The first functional module (abbreviated as the first module) 100 has a majority circuit 103,
Second functional module (abbreviated as second module)
101 has a majority circuit 104 104 and a third functional module (abbreviated as the third module) 102
has a majority circuit 105. majority circuit
103 to 105 are configured to receive the operation results of their own functional modules (hereinafter referred to as self-modules), and are connected to the first bus 106 and the second bus 1.
07 is connected. Majority circuit 103-105
The system compares the operation results of its own module with the information (operation results) input from the first bus 106 and the second bus 107, determines whether they match, and determines that there is an abnormality when they do not match. be. In addition, the majority circuit 103
~105 is the operation result of its own module and the first bus 10
6 and the information (operation results) inputted from the second bus 107, and determines whether or not the own module is abnormal based on a majority vote (however, if the operation results of the own module account for the majority, it is determined to be normal). ).

Next, the operation of FIG. 1 will be explained using the flowchart of FIG. Note that FIG. 4 is an operational flowchart of FIG. 1. (1) First, an outline of the operation when a failure occurs in the first functional module 100 will be explained. now,
The first to third functional modules 100 to 102 start operating. The first functional module 100 outputs the operation result to the first bus 106, and the second functional module 101 outputs the operation result to the second bus 107 (steps S1 and S11). The third functional module 102 does not output the operation results to the first bus 106 and the second bus 107 (step S21). These first to third functional modules 100
〜102 During operation of a computer system consisting of
When a failure occurs in the functional module 100, an erroneous operation result is output to the first bus 106. Each 1st~
In the third functional modules 100 to 102, the majority circuits 103 to 105 compare the operation results of their own modules with the information (operation results) input from the first bus 106 and the second bus 107, and determine whether or not they match. (Steps S2, S3, S
12, S13, S22, S23).

The first functional module 100 uses the majority circuit 103 to transmit the operation results of its own module and the second bus 1.
If the input information from 07 is different (inconsistent) and an abnormality is detected, output of the operation result to the first bus 106 is stopped (step S4). Further, when the second functional module 101 detects an abnormality in the majority circuit 104 because the operation result of its own module differs from the input information from the first bus 106 (mismatch), the second functional module 101 detects an abnormality.
Stop outputting the operation results to (step S14)
.

The majority circuit 105 of the third functional module 102 also receives the operation results of its own module and the input information from the first bus 106 and the second bus 107 (in this case, the input information from the first bus 106 is incorrect). ) is different (inconsistent), and an abnormality is detected. Furthermore, the majority voting circuit 105 of the third functional module 102 agrees with the operation result of its own module and the input information from the first bus 106 or the second bus 107 (in this case, the input information from the second bus 107). , determines that its own module is normal by majority vote,
Other modules (first functional module 100 or second functional module
It is determined that the functional module 101 ) is abnormal. As a result, the third functional module 102 outputs correct operation results to the first bus 106 and the second bus 107 in the next bus cycle (step S23
, S24).

The first functional module 100 compares the operation results of its own module with the input information (correct operation results) from the first bus 106 and the second bus 107 in the majority decision circuit 103, and determines the own module based on the majority decision. If it is determined that there is an abnormality, the operation is stopped (stopped) (steps S5, S6, S7).

Next, the second functional module 101 uses the majority circuit 104 to combine the operation results of its own module with the first functional module.
Input information from bus 106 and second bus 107 (
If the self-module is determined to be normal by majority vote, the module resumes operation (continues operation) (steps S15, S16, S17). As can be seen from the above operation description, the first functional module 100 stops operating, but the other two functional modules, namely the second and third functional modules 101 and 102
will continue driving.

(2) In (1) above, the case where a failure occurs in the first functional module 100 has been explained, but in the case where a failure occurs in the second functional module 101, the operation is as follows. . That is, the first to third functional modules 100 to 102 start operating. The first functional module 100 outputs the operation result to the first bus 106, and the second functional module 101 outputs the operation result to the second bus 107 (steps S1 and S11). Third functional module 102
does not output the operation results to the first bus 106 and the second bus 107 (step S21). In this manner, when a failure occurs in the second functional module 101 while the computer system is operating, an erroneous operation result is output from the second functional module 101 to the second bus 107 .

[0017] First to third functional modules 100 to 1
The majority circuits 103 to 105 of 02 communicate the operation results of their own module, the first bus 106 and the second bus 107.
The information (operation results) input from
, S3, S12, S13, S22, S23). When the first functional module 100 detects an abnormality in the majority circuit 103 because the operation result of its own module differs from the input information from the second bus 107 (mismatch), the first functional module 100 detects an abnormality.
The output of the operation result to the bus 106 is stopped (step S4). The second functional module 101 uses the majority circuit 104 to transmit the operation result of its own module to the first bus 1.
If the input information from 06 is different (inconsistent) and an abnormality is detected, output of the operation result to the second bus 107 is stopped (step S14).

The majority circuit 105 of the third functional module 102 receives the operation results of its own module and the first bus 10.
6 and the input information from the second bus 107 (in this case, the input information from the second bus 107 has an incorrect operation result) are different (inconsistent), and an abnormality is detected. Furthermore, the majority circuit 105 of the third functional module 102 determines that the operation result of its own module matches the input information from the first bus 106 and the second bus 107 (here, the input information from the first bus 106). Therefore, the module is determined to be normal by majority vote,
Other modules (first functional module 100 or second functional module
It is determined that the functional module 101 ) is abnormal. As a result, the third functional module 102 outputs correct operation results to the first bus 106 and the second bus 107 in the next bus cycle (step S22
~S24).

Next, the first functional module 100 uses its own module's operation result and the first functional module in the majority circuit 103.
Input information from bus 106 and second bus 107 (
If the self-module is determined to be normal by majority vote, the module restarts the operation (continues operation) (steps S5, S6, S17). In addition, the second functional module 101 compares the operation results of its own module with the input information (correct operation results) from the first bus 106 and the second bus 107 in the majority decision circuit 104, and the majority decision determines whether the own module is If it is determined that there is an abnormality, the operation is stopped (operation is stopped) (steps S15, S16, S7). As can be seen from the above operation description, the second functional module 101 stops operating, the first functional module 100 continues operating, and the third functional module 101 stops operating.
The functional module 102 will continue to operate.

(3) Next, the third functional module 10
2 will be explained about the case where a failure occurs. The first to third functional modules 100 to 102 start operating. The first functional module 100 outputs the operation results of its own module to the first bus 106, and the second functional module 101 outputs the operation results of its own module to the second bus 106.
07 (steps S1, S11). The third functional module 102 does not output the operation results of its own module to the first bus 106 and the second bus 107 (step S21). Assume that a failure occurs in the third functional module 102 while the computer system is operating in this manner. In this case, the third functional module 102 does not output an erroneous operation result based on the failure to the first bus 106 and the second bus 107 (step S21). 1st~
The majority circuits 103 to 105 of the third functional modules 100 to 102 output the operation results of their own modules and the first
The input information from the bus 106 and the second bus 107 are compared, and an abnormality is detected depending on whether or not they match (steps S2, S3, S12, S13, S122, S23).
.

First and second functional modules 100
The majority circuits 103 and 104 of 101 and 101 respectively receive the operation results of their own modules and the first bus 106.
and the input information from the second bus 107 match, so if it is determined that there is no abnormality (normality), the first and second functional modules 100 and 101
continues driving (NO route in steps S2 and S3,
NO route of S12 and S13). On the other hand, the majority circuit 105 of the third functional module 102 receives the operation result of its own module (an incorrect operation result due to the occurrence of a failure), the first bus 106 and the second bus 107.
The input information (correct operation result) is different (inconsistent) from the input information (correct operation result) and an abnormality is detected. Furthermore, the majority circuit 105 outputs the operation result of its own module (incorrect operation result) and the first
Input information from bus 106 and second bus 107 (
Since the correct operation results) do not match, it is determined by majority vote that the module itself is abnormal, and the other first and second modules 100 and 101 are determined to be normal (steps S22 and S23). As a result, the third functional module 102 stops operating (stops operation) (step S25). As can be seen from the above operation description, the third functional module 102 stops operating due to the occurrence of a failure, but the first and second functional modules 101 and 102 continue to operate.

(4) First to third functional modules 1
A case in which all numbers 00 to 102 are normal operation will be explained. In this case, the operations of the first and second functional modules 100 and 101 are similar to those described in (3) above, but the operations of the third functional module 102 are as follows. That is, the majority circuit 105 of the third functional module 102 compares the operation results of its own module with the input information from the first bus 106 and the second bus 107, and if they all match, the majority circuit 105 of the third functional module 102 selects the first to third functional modules. It is determined that the functional modules 100 to 102 are not abnormal (normal) (steps S22, S2
3). And all the first to third functional modules 1
00-102 will continue to operate.

Next, a specific example of FIG. 1 will be explained using FIG. 5. FIG. 5 is a detailed configuration diagram showing a specific example of FIG. 1. In FIG. 5, the computer system has a triplex configuration of first to third functional modules 100 to 102. These first to third functional modules 10
0 to 102 have exactly the same configuration. 1st
-Third functional modules 100-102 each have mode determining circuits 401, 501, 601,
The operation modes of the first to third functional modules 100 to 102 are determined by these mode determination circuits 401 and 501.
, 601.

The internal configuration of the first functional module 100 will be explained below. First functional module 100
is a processing unit 400 and a mode determination circuit 401
, a majority circuit 402 , a control circuit 403 , and the like. The processing unit 400 realizes the functions of the functional modules, and the processing unit 400
The output is sent to the majority circuit 402, bus drivers 406 and 40 via a processing unit operation result output line 408.
7. Mode determination circuit 4
01 is one of the three operating modes, namely modes 1 to 3.
This determines the operation mode of the relevant functional module. Here, in mode 1, the operation results of the processing unit are
In mode 2, the operation result of the processing unit is output to the second bus 107. In mode 3, the operation result of the processing unit is not output to the first bus 106 and the second bus 107. Mode determination circuit 401
The mode 1 signal line, which is the output line of
The mode 2 signal line, which is connected to one input terminal of the AND element 416 and is also an output line, is connected to the other input terminal of the OR element 410 and one input terminal of the AND element 417, which is also an output line. The mode 3 signal line is connected to one of the input terminals of AND element 414.

The majority circuit 402 is connected to the bus receiver 40.
4, the first bus 106 and the second bus 10 via 405.
7 is connected. This majority voting circuit 402 compares the operation result of its own module (the operation result of its own processing unit) with the input information (operation result) supplied from the first bus 106 and the second bus 107 via the bus receivers 404 and 405. Then, it is determined whether or not there is a mismatch, and if there is a mismatch, it is determined that there is an abnormality. In addition, the majority decision circuit 402 compares the operation results of its own module (the operation results of its own processing unit) with the information (operation results) input from the first bus 106 and the second bus 107, and determines whether the own module is abnormal based on the majority decision. (However, if the operation results of the own module account for the majority, it is determined to be normal). The majority circuit 402 corresponds to the majority circuit 103 in FIG.

The mismatch signal line, which is the output line of the majority circuit 402, is connected to one input terminal of each of AND elements 411 and 418, one input terminal of AND element 414, and one input terminal of OR element 413. . Majority circuit 4
02 own module abnormal signal line is connected to AND element 414
is connected to one of the input terminals of the Control circuit 403
is supplied with each output of the processing unit 400, the mode determining circuit 401, and the majority circuit 402, and
It controls the output to the bus 106 and the second bus 107 and the operation of the processing unit 400 . The bus driver 406 has an input terminal connected to the processing unit 400 via a processing unit operation result output line 408 , a control input terminal connected to the OR element 420 and an output terminal,
And its output end is connected to the first bus 106. Further, the bus driver 407 has an input terminal connected to the processing unit 400 via a processing unit operation result output line 408, a control input terminal connected to the output terminal of the OR element 421, and an output terminal connected to the second bus 107. It is connected.

The output terminal of OR element 410 is connected to the other input terminal of AND element 411. The output terminal of the AND element 411 is a D-type flip-flop element 412
is connected to the input terminal D of. The D-type flip-flop element 412 is intended for clock synchronization, and its output end is connected to the other input end of each of the AND elements 416 to 418. The other input terminal of the OR element 413 is connected to the output terminal Q of the holding type flip-flop element 419 , and the output terminal of the OR element 413 is connected to the processing unit 400 via the processing unit operation stop instruction line 409 . There is. The output terminal of the AND element 414 is connected to the input terminal D of the D-type flip-flop element 415. The D-type flip-flop element 415 is intended for clock synchronization, and its output terminal is connected to the OR elements 420 and 42.
1 is connected to one input terminal of each. OR element 42
The other input terminal of 0 is connected to the output terminal of AND element 416. The other input terminal of the OR element 421 is
It is connected to the output terminal of AND element 417.

The output terminal of the AND element 418 is connected to the set input terminal S of the holding type flip-flop element 419. The holding type flip-flop element 419 is
The purpose is to maintain the state. In addition, the control circuit 4
03 is OR element 410 , 413 , 420 , 4
21 and AND elements 411, 414, 416 to 4
18 and D-type flip-flop elements 412 and 415
, a holding type flip-flop element 419 , and bus drivers 406 , 407 .

Next, the internal configuration of the second functional module 101 will be explained. Second functional module 101
is a processing unit 500 and a mode determination circuit 501
, a majority circuit 502 , a control circuit 503 , and the like. Here, the processing unit 500 is the same as the processing unit 400, and the mode determination circuit 50 is the same as the processing unit 400.
1 is the same as the mode determining circuit 401. Further, the majority circuit 502 is the same as the majority circuit 402, and corresponds to the majority circuit 104 in FIG. This majority circuit 502 is a bus receiver 504
, 505 , the first bus 106 and the second bus 1
07 and is connected to the processing unit 500 via a processing unit operation result output line 508. The control circuit 503 includes the processing unit 500,
It is supplied with the outputs of the mode determining circuit 501 and the majority voting circuit 502, and controls the output to the first bus 106 and the second bus 107 and the operation of the processing unit 500. This control circuit 503 is the control circuit 4
It has the same configuration as 03, and like the control circuit 403, OR elements 410 and 413 are provided, although not shown.
, 420 , 421 and AND elements 411 , 414
, 416 to 418 , D-type flip-flop elements 412 , 415 , and holding type flip-flop element 4
19 and bus drivers 406 and 407.

From the above, the second functional module 101
is the processing unit 40 of the first functional module 100
0, mode decision circuit 401, majority decision circuit 402,
Control circuit 403, bus receivers 404, 405,
The processing unit operation result output line 408 and the processing unit operation stop instruction line 409 are connected to the processing unit 5.
00, mode decision circuit 501, majority decision circuit 502
, control circuit 503 , bus receivers 504 , 505
, a processing unit operation result output line 508, and a processing unit operation stop instruction line 509.

Next, the internal configuration of the third functional module 102 will be explained. Third functional module 102
is a processing unit 600 and a mode determination circuit 601
, a majority circuit 602 , a control circuit 603 , and the like. Here, the processing unit 600 is the same as the processing unit 400, and the mode determination circuit 6
01 is the same as the mode determining circuit 401. Further, the majority circuit 602 is the same as the majority circuit 402 and corresponds to the majority circuit 105 in FIG. This majority circuit 602 is a bus receiver 60
It is connected to the first bus 106 and the second bus 107 through lines 4 and 605, and to the processing unit 600 through a processing unit operation result output line 608.

The control circuit 603 is connected to the processing unit 600
, mode decision circuit 601 and majority decision circuit 602
are supplied with respective outputs of the first bus 106 and the second bus 106 .
It controls the output to the bus 107 and the operation of the processing unit 600. This control circuit 603 has the same configuration as the control circuit 403 , and although not shown in the figure, like the control circuit 403 , the OR elements 410 and 4
13, 420, 421, AND element 411,
414 , 416 - 418 , D-type flip-flop elements 412 , 415 , a holding type flip-flop element 419 , and bus drivers 406 , 407 .

From the above, the third functional module 102
is the processing unit 40 of the first functional module 100
0, mode determination circuit 401, majority decision circuit 402, control circuit 403, bus receivers 404, 405, processing unit operation result output line 408, and processing unit operation stop instruction line 409, respectively, to the processing unit 60.
0, mode decision circuit 601, majority decision circuit 602,
Control circuit 603, bus receivers 604, 605,
This corresponds to the processing unit operation result output line 608 and the processing unit operation stop instruction line 609.

The operation of the computer system configured as described above will be explained. In the first functional module 100, the mode determining circuit 401 is set to mode 1 as the operating mode. Therefore, the first functional module 1
00 operates in mode 1 in which the operation results of its own module, that is, the operation results of the processing unit 400, are output to the first bus 106. Therefore, in the normal state, among the output lines of the mode determining circuit 401, only the mode 1 signal line is logic 1 (the mode 2 signal line and the mode 3 signal line are both logic 0), so the OR element 410 is Output is logic 1
becomes. Since the mismatch signal line of majority circuit 402 is logic 0, the output of AND element 411 is logic 0,
The output Q of the D-type flip-flop element 412 becomes logic 0. Each output of AND elements 416 and 417 is
Since the mode 1 signal line is a logic 1 and the mode 2 signal line is a logic 0, they are logic 1s and 0s. Further, since the mode 3 signal line is logic 0, the output of the AND element 414 becomes logic 0, and the output of the D-type flip-flop 415 becomes logic 0.
The output of is also a logic zero. OR elements 420 and 421
The outputs of are logic 1 and 0 respectively. Therefore, the operation result of the first functional module 100, that is, the operation result of the processing unit 400, is the same as that of the bus driver 406.
The signal is output to the first bus 106 through the bus driver 407, but not to the second bus 107 through the bus driver 407.

Furthermore, in the second functional module 101, the mode determining circuit 501 is set to mode 2 as the operating mode. Therefore, the second functional module 101 is operating in mode 2 in which it outputs the operation result of its own module, that is, the operation result of the processing unit 500 to the second bus 107. Therefore, in the normal state, among the output lines of the mode determining circuit 501, only the mode 2 signal line is logic 1 (the mode 1 signal line and the mode 3 signal line are both logic 0), so in the control circuit 503, The output of OR element 410 is a logic one. Furthermore, since the mismatch signal line of majority circuit 502 is at logic 0, the output of AND element 411 is at logic 0, and therefore the output Q of D-type flip-flop element 412 is at logic 0. Therefore, each output of AND elements 416 and 417 is
They are logic 0 and 1 respectively. Furthermore, since the mode 3 signal line, which is the output line of the mode determining circuit 501, is at logic 0, the output of the AND element 414 is at logic 0, and the output Q of the D-type flip-flop element 415 is at logic 0. The respective outputs of OR elements 420 and 421 are logic 0 and 1, respectively, since the mode 1 signal line is logic 0 and the mode 2 signal line is logic 1. Therefore, the operation results of the second functional module 101, that is, the operation results of the processing unit 500, are output to the second bus 107 via the bus driver 407.
06 to the first bus 106.

Furthermore, in the third functional module 102, the mode determining circuit 601 is set to mode 3 as the operating mode. Therefore, the third functional module 102 is operating in mode 3 in which it does not output the operation results of its own module, that is, the operation results of the processing unit 600 to the first bus 106 and the second bus 107. Therefore, in the normal state, among the output lines of the mode determining circuit 601, only the mode 3 signal line is logic 1 (both the mode 1 signal line and the mode 2 signal line are logic 0). , AND elements 416, 417
Each output of is a logic zero. Furthermore, since the dissimilarity signal line of the majority circuit 602 is a logic 0, the output of the AND element 414 of the control circuit 603 is a logic 0, and therefore the output of the D-type flip-flop element 415 is a logic 0. Therefore, the respective outputs of the OR elements 420 1 and 421 2 are both logic 0. Therefore, the operation result of the third functional module 102, that is, the operation result of the processing unit 600 is supplied to the bus drivers 406 and 407 via the processing unit operation result output line 608.
06 and 407, and is not output to the first bus 106 and the second bus 107.

As described above, the operation when a failure occurs in the first functional module 100 during operation of the computer system will be explained using FIG. 6. In addition, Figure 6
is an operation time chart when a failure occurs in the first functional module 100 in FIG. Here, it is assumed that the computer system operates in synchronization with bus cycles.

Assume that a failure occurs in the first functional module 100 in bus cycle T. This allows the first
The erroneous operation result (erroneous data) of the functional module 100 is transmitted from the processing unit 400 to the first bus driver 406 via the processing unit operation result output line 408 and the bus driver 406
It is output to the bus 106 ((a), (b) in FIG. 6). However, in bus cycle T, the second bus 107 has
As mentioned above, the correct operation result (normal data) of the second functional module 101 is output ((a) in FIG. 6).
c)).

Next, in the first functional module 100, the majority circuit 402 determines whether the operation result of its own module (incorrect operation result of the processing unit 400) and the information from the second bus 107 (correct operation result) are different. ,
The mismatch signal line is set to logic 1. Therefore, the control circuit 403
In this case, the output of AND element 411 becomes logic 1, and D-type flip-flop element 412 is set. Moreover, since the mismatch signal line of the majority circuit 402 becomes logic 1, the processing unit operation stop instruction line 409, which is the output line of the AND element 413, becomes logic 1 (((
d)) The processing unit 400 stops while holding the operation result. In addition, the D-type flip-flop element 412
is set and its output Q becomes logic 1, the output of AND element 416 becomes logic 0, and OR element 420
The output of the bus driver 406 also becomes logic 0, the bus driver 406 is disabled, and the operation result of the processing unit 400 is transferred to the first bus 1.
06 will no longer be output.

Furthermore, in the second functional module 101, the majority circuit 502 detects that since the operation result of its own module is different from the information (erroneous operation result) from the first bus 106, the mismatch signal line becomes logic 1, and the control circuit 50
The output of the AND element 411 of 3 becomes logic 1, and the D-type flip-flop element 412 is set. Also, since the mismatch signal line of the majority circuit 502 becomes logic 1,
The processing unit operation stop instruction line 509, which is the output line of the OR element 413 of the control circuit 503, becomes logic 1, and the processing unit 500 stops while holding the operation result ((e) in FIG. 6). In addition, the D-type flip-flop element 4
12 is set and its output Q becomes logic 1, the output of AND element 417 becomes logic 0, and OR element 42
The output of 0 also becomes a logic 0, the bus driver 407 is disabled, and the operation results of the processing unit 500 are no longer output to the second bus 107 .

Furthermore, in the third functional module 102, the majority circuit 602 compares the operation result of its own module with the information from the first bus 106 and the second bus 107, and sets the mismatch signal line to logic 1 due to the mismatch. , and the own module is normal according to the majority vote (the operation result of the own module and the information from the second bus 107 match), so the own module abnormal signal line is set to logic 0. As a result, the output of the AND element 414 of the control circuit 603 becomes logic 1, and the D-type flip-flop element 415
is set. Also, since the mismatch signal line of the majority circuit 602 becomes logic 1, the OR element 4 of the control circuit 603
Processing unit operation stop instruction line 60 which is the output line of 13
9 becomes logic 1, and the processing unit 600 stops while holding the operation result ((f) in FIG. 6).

Next, the bus cycle T shown in FIG.
+1, the third functional module 102, the first
The functional module 100 and the second functional module 101 operate as follows. First, in the third functional module 102, in the control circuit 603, D
The output of the type flip-flop element 415 is a logic 1, which is supplied via OR elements 420 , 421 to the control inputs of the bus drivers 406 , 407 . Therefore, the bus drivers 406 and 407 are enabled, and the correct operation result of the processing unit 600 is transmitted to the processing unit operation result output line 608 and the bus driver 406.
, 407 via the first bus 106 and the second bus 107
((b), (c) in FIG. 6).

Furthermore, in the first functional module 100, the majority circuit 402 outputs the operation results (incorrect operation results) of its own module and the first bus 106 and the second bus 10.
Compare the correct operation results from 7 and set the mismatch signal line to logic 1 again. As a result, in the control circuit 403, the AND element 41
1 becomes a logic 1, and the output Q of the D-type flip-flop element 412 becomes a logic 1. Therefore, the control circuit 4
At 03, the output of the AND element 418 becomes a logic 1, the holding type flip-flop element 419 is set, and its output Q maintains a logic 1. Therefore, the control circuit 4
The processing unit operation stop instruction line 409, which is the output line of the OR element 413 of 03, maintains the logic 1 state, and the first functional module 100 stops operation (((
d)).

In the second functional module 101, the majority circuit 502 outputs the operation result (correct operation result) of its own module and the first bus 106 and the second bus 10.
7, and since they match, the mismatch signal line is set to logic 0. As a result, in the control circuit 503, the output of the AND element 411 becomes logic 0, and the D-type flip-flop element 412 is reset. Then, the D-type flip-flop element 41
When the output of 2 becomes logic 0, the output of AND element 418 becomes logic 0, and the holding type flip-flop element 419
is reset and its output becomes a logic zero. Therefore,
The processing unit operation stop instruction line 509, which is the output line of the OR element 413, becomes logic 0, and the processing unit 500 of the second functional module 101 continues to operate from the next bus cycle.

In the third functional module 102, the majority circuit 602 compares the operation result of its own module with the information (correct operation results) from the first bus 106 and the second bus 107, and since they match, the mismatch signal line Let be logical 0. As a result, OR element 4 of control circuit 603
Since the inputs of 13 are all logic 0, the OR element 413
Processing unit operation stop instruction line 609 which is the output line of
becomes logic 0 ((f) in FIG. 6), and the processing unit 600
resumes operation. That is, the third functional module 1
02 continues operation and operates in mode 3. As described above, the first functional module 100 stops operating, but the other two functional modules, ie, the second functional module 101 and the third functional module 102, continue operating. The operation when a failure occurs in the first functional module 100 has been explained above, but the operation when a failure occurs in the second functional module 101 is also explained.
The same is true.

Next, the first to third functional modules 100
An explanation will be given of the operation when the third functional module 102 is malfunctioning while the third functional module 102 is operating normally. In this case, in the third functional module 102,
The majority circuit 602 transmits the operation results (incorrect operation results) of its own module, the first bus 106 and the second bus 107.
Since they do not match, the mismatch signal line is set to logic 0. As a result, the processing unit operation stop instruction line 609, which is the output line of the OR element 413 of the control circuit 603, becomes logic 1, and the processing unit 600 stops its operation while holding the operation result. Furthermore, the majority decision circuit 602 compares the operation results of its own module with the information from the first bus 106 and the second bus 107, determines that its own module is abnormal based on the majority vote, and sets the own module abnormal signal line to logic 1. do. However, the output of the AND element 414 of the control circuit 603 is
Since it remains in the logic 0 state, the OR elements 420 and 421
The output of also remains in a logic zero state. Therefore, the bus drivers 406 and 407 are not enabled, and the incorrect operation of the processing unit 600 results in the first bus 106 and the second
No output to bus 107.

In this way, the third functional module 102
When the third functional module 102 fails, the third functional module 102
The majority decision circuit 602 allows you to judge the failure of your own module by majority decision, and moreover, the control circuit 60
3, the operation of the processing unit 600 is stopped. Therefore, the operation of the third functional module 102 is stopped, but the operation of the other two functional modules, namely the first and second functional modules, is stopped.
The functional modules 100 and 101 continue to operate without being affected by the failure of the third functional module 102 .

As can be seen from the above description, the first functional module 100 has a triplex configuration of the second and third functional modules 101 and 102, and these first functional modules
~Third functional modules 100~102 are interconnected by a duplicated first bus 106 and second bus 107. Even if a failure occurs in any of the first to third functional modules 100 to 102, continuous operation can be performed using the remaining two normal functional modules. Furthermore, in the present invention, the majority logic of the triplex system is enabled using two buses, the first bus 106 and the second bus 107, so the triplex system can be realized with less hardware. This has made it possible to create a computer system with excellent reliability and cost. The present invention is not limited to this embodiment, and various applications and modifications can be made without departing from the gist of the present invention.

[0049]

[Effects of the Invention] As described above, according to the present invention, it is possible to realize a triplex majority logic system using two buses, that is, with less hardware than the conventional system, and it is possible to realize a triple system with majority logic, which is reliable and inexpensive. It became possible to realize an excellent computer system.

[Brief explanation of the drawing]

FIG. 1 is a configuration diagram showing an embodiment of a computer system according to the present invention.

FIG. 2 is a configuration diagram showing an example of a conventional triplex system.

FIG. 3 is a configuration diagram showing an example of a conventional duplex system.

FIG. 4 is an operation flowchart of FIG. 1;

FIG. 5 is a detailed configuration diagram showing a specific example of FIG. 1;

FIG. 6 is an operation time chart showing one embodiment of FIG. 5;

[Explanation of symbols]

100 First functional module 101 Second functional module 102 Third functional module 103 ~ 105 Majority circuit 106 1st bus 107 2nd bus

Claims (1)

[Claims] Claim 1: A computer system in which functional modules have a redundant configuration so that even if a failure occurs in one functional module, continuous operation can be performed using the remaining normal functional modules. It is connected to the bus, outputs the operation results of its own function module to the first bus, compares the operation results of its own function module with the input information from the second bus, and when a discrepancy is detected, outputs the operation results of its own function module to the first bus. a first functional module that stops outputting to the first bus while holding operation results; and a first functional module that is connected to the first bus and the second bus, and transmits the operation results of its own functional module to the second bus. a second bus that compares the operation result of its own functional module with the input information from the first bus, and stops outputting to the second bus while holding the operation result of its own functional module when a discrepancy is detected; is connected to the first bus and the second bus, and the operation results of the own function module are not output to the first bus and the second bus, and the operation results of the own function module and the second bus are connected to the first bus and the second bus. Compare the input information from the first bus and the second bus, and if a mismatch is detected, and if the self-function module is not in failure by majority vote, output the operation result of the self-function module to the first bus and the second bus. and a third functional module, when the first bus and the second functional module do not match, the output information of the third functional module from the first bus and the second bus and the retained self A computer system that compares the operation results of a functional module, restarts the operation if they match, and stops the operation if they do not match.