JP2654072B2 - Fault tolerant computer equipment - Google Patents

Description

Description: Object of the Invention (Industrial application field) The present invention relates to a fault-tolerant computer device suitable for use in an attitude control system in a flying object (satellite) traveling in a space section. .

(Conventional example) In general, a computer is used as a control device of various systems. In a system requiring particularly high reliability, a plurality of central processing units are operated in exactly the same manner. Usually, the system is controlled by the main central processing unit, and the sub central processing unit monitors the operation result of the main central processing unit. As a result of monitoring, if an abnormality occurs in the main central processing unit, the power of the main central processing unit is turned off, that is, the system is shut down, and the sub central processing unit is switched to perform system control instead. .

(Problems to be Solved by the Invention) As described above, in the system including the main system and the sub-system central processing unit, when an abnormality occurs in the main system central processing unit, a human judges the abnormality. , Repair and check. However, such an approach is generally possible in terrestrial systems and is not applicable to those in space, such as satellites. Furthermore, especially in outer space, there is a case where it is unknown what causes the arithmetic error of the central processing unit.

In addition, by operating the main central processing unit and the sub-central processing unit in parallel, the operation result of the main central processing unit does not match the operation result of the sub-central processing unit.
It is not always the case that an abnormality has occurred in the main central processing unit, and it is also conceivable that an abnormality has occurred in the sub central processing unit.

Conventionally, in order to prevent a judgment error in such a case, three or more central processing units are operated in parallel to perform the same operation, compare the operation results, and determine a central processing unit that is correct by majority decision. There is a method for determining the processing device.

However, a method in which three or more central processing units are operated at the same time to take a majority decision is not preferable particularly in an apparatus such as a satellite which requires power saving.

Therefore, the present invention provides a fault-tolerant computer device for mounting on a spacecraft that can detect a central processing unit having an abnormality among a plurality of central processing units while operating with low power consumption. The purpose is to:

[Structure of the Invention] (Means for Solving the Problems) The present invention is mounted on a spacecraft and operates a plurality of central processing units in parallel to each other to increase the reliability of the arithmetic operation. In a computer device which mutually confirms the results and performs the next arithmetic processing when they agree with each other, it is determined whether or not the arithmetic results of the same contents of the first and second central processing units match, and there is no match. Means for turning off the power of the second central processing unit and turning on the power of the third central processing unit, and calculating the same result of the third central processing unit and the first central processing unit. And a means for judging that the first central processing unit is normal and operating in parallel with the third central processing unit if they match, and The same contents of the processing unit and the first central processing unit If the calculation results do not match, the power of the first central processing unit is turned off and the power of the second central processing unit is turned on, and the third central processing unit and the second central processing unit are connected. Means for operating in parallel.

(Operation) With the above-described means, the number of central processing units to be operated is always two, and it is possible to determine a central processing unit having an abnormality with the minimum required power consumption of the central processing unit.

Embodiment An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 shows an embodiment of the present invention, which is used, for example, in a satellite attitude control device. In this example, two of the three central processing units A, B, and C are operated in parallel. The central processing units A, B, and C are connected via a common bus 101 and have a common random access memory (RAM) 1.
02, also connected to read-only memory (ROM) 103.
Reference numeral 104 denotes an output device, which is a device for outputting a control signal to an actuator wheel, a gas jet thruster, or the like to be controlled, and an input device 105 is an input device for capturing external information (sensor output, etc.). It is.

The central processing units A, B, and C receive posture information from a posture sensor, for example, to obtain posture control data,
The attitude error can be calculated. Here, normally, two central processing units, for example, A and B are set to operate in parallel and perform the same arithmetic processing. Of the two operation results, the one of the main system is usually determined, and the operation result from the main system is used.

This system is characterized by a countermeasure system when the central processing units that are operated in parallel perform a mutual function check and there is a mismatch between the two.

When performing mutual monitoring, a start pulse SP1 for mutual monitoring is supplied to the selection circuit 106. The start pulse SP1 is generated from an external periodic timer, and is generated in a gap in a posture control calculation cycle. For example, now
Assuming that the central processing units A and B are selected for the function check, the central processing units A and B start a mutual check program, and the check program progresses, for example, at the timing of an internal clock. This inspection is performed until the end pulse SP2 is given from the periodic timer. Further, the selection circuit 106 sequentially obtains a selection operation so that each of the central processing units A and B can obtain a functional check equally.

Now, description will be made with reference to FIG. 2 assuming that the central processing units A and B are operating. The calculation of the attitude control data is performed in the same manner in steps S11 and S21. Then, step S1
2. In S22, check data for mutual monitoring is created. Then, for example, in the next steps S13 and S23, a check start pulse is given, and the result of calculation of each other, that is, check data is exchanged.
In S14 and S24, it is determined whether or not the own data matches the data obtained from the other party.

Here, if the data of the central processing units match each other,
The process proceeds to the next process, that is, a specific posture control operation step. However, if a mismatch result is obtained, both central processing units A and B will retry or roll back. If there is this rollback, without sending the calculated attitude control data to the control unit, for example, return to steps S11 and S21, again,
The attitude control data is calculated. Then, through the same process, mutual monitoring is performed.

The above-described rollback means can prevent erroneous diagnosis from being performed due to an accidental error. In particular, in a special atmosphere such as outer space, for example, it is assumed that one of the processing devices is irradiated with radiation, and a part of the data changes from 0 to 1 or from 1 to 0. Such a one-time or accidental error is different from a permanent failure of the processing device itself, and a mismatch does not occur if the calculation is performed again.

Further, in the present invention, the system is designed to be as small and lightweight as possible. That is, it is configured such that mutual data communication can be performed including the interrupt lines connected to each other. For example, the central processing units A and B will be described as follows.

Now, assuming that the central processing unit A checks the function (for example, the calculation result) of the central processing unit B, the central processing unit A sends its own calculation result to the central processing unit B via the bus 101.
Transmitted via. The central processing unit B compares the received calculation result with its own calculation result, and if they match, enables the interrupt line a. By judging the enable state, the central processing unit A recognizes that the calculation result was normal. However, if the interrupt line a does not become enabled within a certain period, the above-described rollback means operates. Similar processing is performed on the central processing unit B side. As described above, the data communication using the interrupt line is the same between other central processing units.

Although the above description has been made on behalf of the function of checking whether or not the calculation results match, the mutual monitoring items are further increased. For example, a check of power supply voltage data, a check of reception level data, and the like. When checking each other's data in this way, it is not necessary to equip another bus line or input / output port for mutual monitoring by using the interrupt line connected between them as a part of the data communication. Absent. This is advantageous as a control system requiring small and lightweight components, such as a satellite in particular.

Further, when the calculation results between the central processing units do not match, the computer device determines which device is causing the error, and a reconfiguration circuit 107 for determining two normal devices is provided. It is connected to the bus 101. The reconfiguration circuit 107 is designed to determine the majority of the operation results while shifting the time in order to minimize the power consumption of the system. Hereinafter, description will be made while also using FIG.

Assuming that the central processing units A and B are now in operation, and as a result of monitoring both functions, the rollback has been performed several times,
This is detected, for example, in step S41. Then, the process proceeds to step S42, where the power of the central processing unit B is turned off,
Next, in step S43, the power of the central processing unit C is turned on.
With this process, the three central processing units do not use the power supply at the same time. In the next step S44, the central processing units A and C are operated in parallel to perform a mutual function check. This inspection program is a routine similar to that executed by the central processing units A and B first, and the routines of steps S11 to S14 and steps S31 to S34 are used.

As a result of the above function check, if the result of the calculation is identical between the central processing units A and C, it is determined that the central processing unit B has an abnormality. The parallel operation of C is continued. But step S45
If the calculation results do not match, the power of the central processing unit A is turned off in step S47, and the power of the central processing unit B is turned on in step S48. Then, a mutual function check is performed between the central processing units B and C. If the calculation results of the central processing units B and C coincide with each other in step S50, it is determined that an abnormality has occurred in the central processing unit A, and thereafter, the processing shifts to the parallel operation state of the central processing units B and C. . If the calculation results of the central processing units B and C do not match in step S50, for example, a warning signal is generated.

Therefore, the reconfiguration circuit 107 takes the majority decision of the operation results of the three central processing units. However, the simultaneous operation is always limited to two without simultaneously operating the three units, The power consumption is reduced by suppressing the peak value of use.

[Effect of the Invention] As described above, the present invention provides a fault-tolerance computer that can detect a central processing unit having an abnormality among a plurality of central processing units while operating with low power consumption. An apparatus can be provided.

[Brief description of the drawings]

FIG. 1 is an explanatory view of the configuration showing an embodiment of the present invention, and FIG. 2 is a flowchart shown for explaining the operation of the apparatus of FIG. A, B, C: Central processing unit, 101: Data bus, 102
... RAM, 103 ROM, 104 output device, 105 input device, 106 selection circuit, 107 reconfiguration circuit.

 ──────────────────────────────────────────────────続 き Continuation of the front page (56) References JP-A-59-123056 (JP, A) JP-A-60-229145 (JP, A) JP-A-62-242215 (JP, A) 55699 (JP, B2)

Claims (1)

(57) [Claims] 1. A plurality of central processing units mounted on a spacecraft are operated in parallel, and the same operation results are mutually confirmed and mutually matched in order to enhance the reliability of the operation operation. In a computer device for performing arithmetic processing, it is determined whether or not arithmetic results of the same contents of the first and second central processing units match, and if they do not match, the power of the second central processing unit is turned off. Means for turning on the power of the third central processing unit, and the third central processing unit and the first central processing unit.
It is determined whether the calculation results of the same contents of the central processing unit match, and if they match, it is determined that the first central processing unit is normal, and the central processing unit is paralleled with the third central processing unit. If the operation results of the third central processing unit and the first central processing unit are not the same, the power of the first central processing unit is turned off and the second central processing unit is turned off. A fault-tolerant computer device, comprising: means for turning on the power of the processing device and operating the third central processing device and the second central processing device in parallel.