JPH04344941A - Highly reliable processor - Google Patents

Abstract

PURPOSE:To improve the fault detection ratio of a processor by detecting the deviation of a bus cycle in the case of such a sequence error as to cause the deviation of the bus cycle between an executing side and a monitoring side. CONSTITUTION:A master pair 10, 11 and a slave pair 12, 13 are constituted of microprocessors 10, 12 to operate in an execution mode and the microprocessors 11, 13 to operate in a monitor mode. In the case that the output signal of the microprocessor 10 to operate in the execution mode and the output signal of the microprocessor 10 to operate in the monitor mode do not coincide with each other, the master pair 10, 11 outputs a fault detection signal 110. This signal is inputted to a bus control part 3, and by making a buffer 4 installed at the output side of the master pair 10, 11 non-conductive by a signal outputted from the bus control circuit 3, and making the buffer 5 installed at the output side of the slave pair 12, 13 conductive, the output signal of the slave pair 12, 13 is taken out.

Description

[Detailed description of the invention]

0001

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to fault detection and fault tolerance techniques for processors used in information processing devices that require high reliability.

0002

2. Description of the Related Art Conventionally, processor failures are fatal, and in information processing equipment that requires high reliability, processors are duplicated or tripled to reduce the risk of processor failure.
In order to prevent failures due to % detection and processor failures, fault-tolerant control such as alternative operation of redundant systems (standby systems) is performed to increase availability.

[0003] Recently, microprocessors have come into existence that can detect processor failures without having an external circuit by directly connecting two processors. However, in such a microprocessor, the monitoring microprocessor internally takes in the address, data, control signals indicating the access type, etc. output by the executing microprocessor every bus cycle, and uses the signals generated by the microprocessor itself. It's just a comparison.

0004

[Problems to be Solved by the Invention] In conventional processors in which the monitoring microprocessor compares addresses, data, etc. every bus cycle, it is only possible to detect failures such as garbled data; In the case of a sequence error that causes a bus cycle shift, it may not be possible to detect it. To give an extreme example, if only the executing side starts a bus cycle but the monitoring side does not, the microprocessor on the monitoring side will not be able to detect a failure because it will not compare signals. .

[0005] Furthermore, in a processor in which all comparison circuits must be implemented by external circuits, the amount of hardware of the external circuits becomes enormous, and the resulting delay time becomes large, leading to a decrease in performance.

An object of the present invention is to detect a bus cycle shift in the case of a sequence error in which a bus cycle shift occurs between the execution side and the monitoring side, thereby increasing the fault detection rate of the processor.

[0007]

[Means for Solving the Problems] In order to achieve the above object, the present invention provides a master pair and a slave pair configured of a microprocessor operating in an execution mode and a microprocessor operating in a monitoring mode. The bus cycle start signal is monitored by the bus cycle monitoring circuit, and if a discrepancy occurs between the two signals, the bus cycle monitoring circuit outputs a bus cycle deviation detection signal, this signal is input to the bus cycle end signal generation section, and the bus cycle start signal is monitored by the bus cycle monitoring circuit. The bus cycle deviation between the master pair and the slave pair is corrected by the signal output from the cycle end signal generation section.

Further, the present invention provides a master pair and a slave pair composed of a microprocessor operating in execution mode and a microprocessor operating in monitoring mode, in which the master pair outputs the output of the microprocessor operating in execution mode. If the signal and the output signal of the microprocessor operating in the monitoring mode do not match, the master pair outputs a failure detection signal, this signal is input to the bus control section, and the signal output from the bus control section causes the master pair to output a failure detection signal. The buffer provided on the output side of the pair is made non-conductive and the slave
The output signal of the slave pair is taken out by making the buffer provided on the output side of the pair conductive.

Further, the present invention provides a master pair and a slave pair composed of a microprocessor operating in execution mode and a microprocessor operating in monitor mode, in which the slave pair outputs the output of the microprocessor operating in execution mode. If the signal and the output signal of the microprocessor operating in monitor mode do not match, the slave
A failure detection signal is output from the pair, this signal is input to the bus control section, and the signal output from the bus control section makes the buffer provided on the output side of the master pair conductive, and the signal is applied to the output side of the slave pair. The output signal of the master pair is taken out by making the provided buffer non-conductive.

0010

DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, the present invention will be explained with reference to the drawings. FIG. 1 shows a block diagram of one embodiment of the invention. The processor section 1 includes four microprocessors 10 to 1.
3 and a bus cycle monitoring circuit 2. The microprocessors 10, 11 and 12, 13 are duplexed by being configured with a microprocessor that operates in an execution mode and a microprocessor that operates in a monitoring mode, respectively.
operates in run mode and microprocessors 11 and 1
3 is operating in monitoring mode. Duplicated microprocessors 10 and 11 connect to bus 6 via buffer 4.
The microprocessors 12 and 13 are connected to
It is connected to a bus 6 via a buffer 5. Normally, according to control signals 30 and 31 output from the bus control section 3, the buffer 4 is in an on state, the buffer 5 is in an off state, and information from the microprocessors 10 and 11 is sent to the bus 6. Hereinafter, the duplicated microprocessors 10 and 11 will be referred to as a master pair, and similarly the duplicated microprocessors 12 and 13 will be referred to as a slave pair. The information sent to bus 6 is input to decoder 8 via receiver 7. The decoder 8 receives access information from control lines indicating addresses and access types.
type (e.g. main memory read/write, I/O
read, I/O write, etc.) and notifies the bus cycle termination signal generation unit 9. The bus cycle termination signal generation unit 9 generates a signal (bus cycle termination signal 90) that terminates the bus cycle from the bus cycle start signals 100 and 120.
and a signal 80 indicating the access type output from the decoder 8, and the microprocessor 10
to 13.

[0011] During normal operation, the master pair and slave pair operate synchronously and perform exactly the same processing. Therefore, the bus cycle is also started at the same time. The start of a bus cycle is initiated by bus cycle start signals 100 and 120 from the microprocessors 10 and 12 operating in the execution mode, to the bus cycle monitoring circuit 2.
will be notified.

[0012] Here, the operation when a deviation occurs in the bus cycle will be explained. A block diagram of the bus cycle monitoring circuit 2 is shown in FIG. The bus cycle monitoring circuit 2 constantly monitors the bus cycle start signals 100 and 120.
A mismatch occurs between both signals [(signal 100, signal 120)
=(0,1) or (1,0)], and the exclusive OR gate 200 outputs "1". Control signal 202 is "1" only when both the master pair and slave pair are operating. Therefore, the output signal 204 of the JK flip-flop 203 is set to "1". The output signal 204 of this JK flip-flop 203 is
The bus cycle termination signal generation unit 9 is notified of the bus cycle shift detection. The JK flip-flop 203 is reset when the bus cycle ends (when the bus cycle end signal 90 is active). The truth table of the JK flip-flop used in this block diagram is shown in Table 1.

[0013]

[Table 1]

Upon receiving the signal 204, the bus cycle termination signal generation section 9 stops the operation of the bus cycle termination signal generation circuit 91. A block diagram of the bus cycle termination signal generation section 9 is shown in FIG. The JK flip-flop 902 indicates that a delayed bus cycle has started in a bus cycle in which a bus cycle shift has occurred. Either the master pair or the slave pair
When the bus cycle starts, the output of the OR gate 900 becomes "1", and if it is during the bus cycle in which the bus cycle shift has occurred (control signal 204 = 1), the AND
The output of the gate 901 becomes "1", the JK flip-flop 902 turns on, and the output signal 92 becomes "1".
1", and the output signal 90 becomes "0". control signal 9
04 is a signal that stops the operation of the bus cycle end signal generation circuit 91. When the control signal 904 is "1", the operation of the bus cycle termination signal generation circuit 91 is stopped. A
The ND gate 903 controls the period from when a bus cycle shift is detected until the delayed bus cycle is started.
This is a logic gate for setting the control signal 904 to "1". The bus cycle end signal generation circuit 91 is a logic circuit that generates a bus cycle end signal 90 from the bus cycle start timing (control signal 905) and the access type information 80 from the decoder 8, and uses a counter (not shown), etc. It consists of Normally, a control signal 905 initiates a counting operation, and when a predetermined count value is reached based on the access type, a bus cycle end signal 90 is output and the initial state is returned. When the control signal 904 is "1", the above operation is temporarily stopped, and then the control signal 92
becomes "1" (the delayed bus cycle has started), a bus cycle termination signal 90 is output after a certain period of time, and the bus cycle is forcibly terminated regardless of the access type information 80. do.

The operation of each part when a bus cycle shift occurs has been explained above, but if data integrity is required, data should not be written to memory in the bus cycle in which a bus cycle shift occurs. Retry control is required to execute the same bus cycle again. Some retry control can be easily implemented by providing a retry terminal in a microprocessor.

[0016] Regarding the above operation explanation and diagrams,
Although only the case where a bus cycle shift occurs has been described, it can be considered that the same process regarding bus control is performed even when a processor failure is detected without a bus cycle shift occurring.

The microprocessor 11 operating in the monitoring mode takes in the output signal of the microprocessor 10 into itself every bus cycle, compares it with the signal generated by itself, and if a discrepancy is detected, The bus control unit 3 is notified by the failure detection signal 110. Similarly, the microprocessor 13 checks the output signal of the microprocessor 12, and if a mismatch is detected, it notifies the bus control unit 3 using a failure detection signal 130.

FIG. 4 is a block diagram of the bus control section 3. The bus control unit 3 disconnects the failed microprocessor pair from the bus 6 in response to the failure detection signals 110 and 130 output from the processor unit 1, and further disconnects the slave pair when the master pair fails. By turning on the buffer 5 on the slave pair side, the slave pair side is controlled to send information onto the bus 6.

In the figure, when a failure in the master pair is detected during a bus cycle in which a bus cycle shift occurs, the JK flip-flop 302 is turned on at the end of that bus cycle, and the JK flip-flop 303 is also turned on. , when a failure in a slave pair is detected during a bus cycle in which a bus cycle shift occurs, it turns on at the end of that bus cycle. The control signals 30 and 31 are enable signals for the buffers 4 and 5, respectively, and when it is "1", it is in the enable state (the buffer is on), and when it is "0", it is in the enable state (the buffer is on).
”, the disabled state (buffer is off)
It is. Since the JK flip-flops 302 and 303 are reset at power-on, the control signal 30 is "1".
Therefore, the control signal 31 becomes "0", the buffer 4 is turned on, and the master pair side sends information to the bus 6.

Here, if a failure is detected on the master pair side and the failure notification signal 110 is notified to the bus control unit 3, the JK flip-flop 302 is turned on, the control signal 30 goes to ``0'', and the control signal 31 goes to ``1'', causing the buffer 5 to turn on and the slave pair to send information to the bus 6. Can be switched. The control signal 31 is output by the AND gate 304.
It becomes "1" only when a failure occurs in the master pair and there is no failure in the slave pair. Therefore, if a failure occurs in both pairs at the same time, both pairs will be disconnected from the bus 6, making it impossible to continue processing.

FIG. 5 is a diagram showing waveforms of various parts in the embodiment of the present invention shown in FIG.

[0022]

[Effects of the Invention] As explained above, the present invention prepares two duplex microprocessor pairs, constantly monitors the bus cycle start signal between both pairs, and if the bus cycle deviates, This has the effect of correcting bus cycle deviations, and by checking the failure detection signal, it reliably detects transient sequence errors that are not just data corruption. By understanding the pairs, logically disconnecting the pairs from the system, and switching bus control so that the slave pair outputs information on the bus when the master pair fails, the microprocessor This has the advantage that the system does not go down in the event of a failure.

[Brief explanation of drawings]

FIG. 1 shows a block diagram of an embodiment of the invention.

FIG. 2 is a detailed block diagram of a bus cycle monitoring circuit used in an embodiment of the present invention.

FIG. 3 is a detailed block diagram of a bus cycle termination signal generation section used in one embodiment of the present invention.

FIG. 4 is a detailed block diagram of a bus control section used in an embodiment of the present invention.

FIG. 5 is a diagram showing waveforms of various parts in an embodiment of the present invention.

[Explanation of symbols]

1 Processor section 2 Bus cycle monitoring circuit 3 Bus control section 4,5 Buffer 6 Bus 7 Receiver 8 Decoder 9 Bus cycle end signal generation unit

Claims (3)

[Claims] Claims: 1. A bus cycle monitoring circuit monitors a bus cycle start signal output from a master pair and a slave pair each consisting of a microprocessor operating in an execution mode and a microprocessor operating in a monitoring mode; When a mismatch occurs, the bus cycle monitoring circuit outputs a bus cycle deviation detection signal, this signal is input to the bus cycle termination signal generation section, and the signal output from the bus cycle termination signal generation section is used to determine whether the master pair A highly reliable processor that corrects bus cycle misalignment between slave pairs. [Claim 2] In a master pair and a slave pair consisting of a microprocessor operating in execution mode and a microprocessor operating in monitoring mode, the master pair detects the output signals of the microprocessor operating in execution mode and the monitoring mode. If the output signals of the microprocessors operating on the A high-reliability processor that extracts an output signal from a slave pair by making a buffer provided on the output side of the slave pair non-conductive and making a buffer provided on the output side of the slave pair conductive. 3. In a master pair and a slave pair consisting of a microprocessor operating in execution mode and a microprocessor operating in monitoring mode, the slave
If the output signal of the microprocessor operating in execution mode and the output signal of the microprocessor operating in monitor mode do not match, the slave pair outputs a fault detection signal, inputs this signal to the bus controller, and controls the bus. The output signal of the master pair is taken out by making the buffer provided on the output side of the master pair conductive and making the buffer provided on the output side of the slave pair non-conductive using the signal output from the control section. Highly reliable processor.