JPS6029415B2 - Failure repair method - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a fault recovery method for a data processing device having a majority voting configuration.

Data processing devices that require high reliability, availability, and maintainability, such as devices mounted on spacecraft, employ a majority voting configuration.

In the case of a majority voting configuration with N modules, “(N-1
)/2 "Even if a fault occurs in up to one module, the system can be prevented from stopping by shielding the fault. However, if one or more remaining modules have a fault, the system will stop. If the faulty module is repaired in advance before a fault occurs in the module, the operating rate of the device can be further improved. , a resynchronization method is used in which the internal states of each module are made the same and synchronization is restarted, and in the past, resynchronization was performed periodically.

FIG. 1 is a diagram for explaining a conventional fault recovery method. For ease of explanation, a triple redundant configuration, which is the basis of the majority voting configuration, will be described here. In Figure 1, the triplex module with triple redundancy configuration is 111,1
12, 113, and modules 111, 112, 11
3 are the signal lines 101, 102, 103, and the output of the majority circuit 120 that outputs the majority result of the outputs of the modules 111, 112, 113, that is, the signal line 10
0 is the output of this triple redundant configuration. A timing control circuit 16 with a built-in timer 170 periodically sends a resynchronization signal to the modules 111 and 112 through a signal line 163.
, 113, and the modules 111, 112, 113
When it receives this signal, it makes its internal state the same and resumes synchronous operation. However, in this method, the trigger for resynchronization is unrelated to the occurrence of a failure, so in an operating environment where the probability of failure occurring is high, resynchronization cannot catch up with the occurrence of a failure, resulting in a system shutdown. Furthermore, in an operating environment where the probability of failure occurring is low, resynchronization is performed even if no failure has occurred, and the system has the disadvantage that the processing capacity of the system is reduced due to unnecessary resynchronization. In order to solve these drawbacks, the present invention detects a failure in each module by comparing the output of each module in the majority voting configuration with the output of the majority voting circuit, and determines the trigger for resynchronization based on the number of failures. The purpose is to provide a resynchronization method that maintains high availability and prevents processing capacity from decreasing.

The present invention will be explained in detail below using examples. FIG. 2 is a block diagram of an embodiment of the present invention, and shows a triple redundant configuration corresponding to the conventional system shown in FIG.

In FIG. 2, the inputs to each module 211, 212, 213 in the triple redundant configuration during normal processing operation are signal lines 201, 202, 203, and the module 211
, 212 and 213, the output of the majority circuit 220, that is, the signal line 200, is the output of this triple redundant configuration. Modules 211, 212, 213
Exclusive OR circuits 231 and 23 that compare the output of the majority circuit 220, that is, the signal that passed through the signal lines 214, 215, and 216, and the output of the majority circuit 220, that is, the signal that passed through the signal line 221.
2, 233 are provided, the comparison result is also output to the control circuit 260, and the start of the resynchronization operation is instructed based on the output 263 of the processing result in the control circuit 260. As a result, the internal state of the module that outputs a result different from the output of the majority circuit 220 is made the same as the internal state of the module that outputs a result that matches the output of the majority circuit 220. FIG. 3 is a more detailed block diagram of an embodiment of the present invention, in which signals from signal lines 301 to 303 are connected to AND gates 304 to 306 and OR gates 307 to modules 311 to 313.
~309, and input via modules 311~313
The output is sent to the majority circuit 32 via signal lines 314 to 316.
0 and is input to exclusive OR circuits 331 to 333.

Further, the output of the majority circuit 320 is sent via a signal line 321 to exclusive OR circuits 331 to 333 and an AND gate 310.
322 and output line 300 of AND gate 322
1, the majority decision result of the outputs of the modules 311 to 313 is output. The exclusive OR circuits 331-333 are for detecting a mismatch between the outputs of the modules 311-313 and the output of the majority circuit 320, and their respective outputs are added to counters 341-343 for counting. The count contents of the counters 341 to 343 are set to the status register 35, and the contents of the status register 350 are transmitted to the control circuit 36 via signal lines 351 to 353.
0. Further, the timer 370 is started from the control circuit 360 via the signal line 371, and the timer 370 is activated to set the time t to 1.
A periodic counting operation is performed, and the signal line 3 is
A signal is sent to the control circuit 36 via the control circuit 72.

Also, 344-346 are AND gates, 380, 390 are comparators, 381-383, 394-396 are fault indicators,
317, 384-386 are inverters, 387-389
is a negative edge type AND gate, 391-393 is a counter, 399 is an OR gate, 354, 361-36
3,397,398 are signal lines. Control circuit 360'
Initial settings are made from this, and the timer 3 is connected via the signal line 371.
70 is activated, the modules 311 to 313 are caused to execute normal processing operations, and the number of mismatches between the outputs of the modules 311 to 313 and the output of the majority decision circuit 320, that is, the number of failure occurrences, is counted by the counters 341 to 343.

The timer 370 sends a signal indicating the passage of time t to the signal line 372.
The control circuit 36 is routed through the signal line 351 to the signal line 351 to
353 to determine the number of output discrepancies. i(i=1,2,3
, corresponding to modules 311 to 313, respectively)
The counters 341 to 343 and the status register 350 are reset via the signal line 361 to return to the initial state as i=0. Also, the number of output discrepancies n, i is a constant n
, in the above case, the control circuit 360 resets the counters 341 to 343 through the signal line 361, and
Instructs the start of the resynchronization operation through. The internal states of the modules 311 to 313 are made the same by the resynchronization operation by the AND gates 304 to 30 by the output of the inverter 317.
6 and open the AND gate 310 again to open the OR gate 3.
This is done by inputting the output of the majority circuit 320 to the modules 311-313 via 07-309.
If the modules 311 to 313 are memories, for example, writing and issuing of the same contents will be performed in accordance with the increment of the address. In addition, the modules 311 to 313 may have a logical processing configuration other than memory;
Depending on the internal configuration of modules 311 to 313, a configuration for performing processing such as data conversion in order to input the output of majority circuit 320 to modules 311 to 313 can be added. Before the timer 370 outputs a signal indicating that time t has elapsed, if the number of output mismatches n,i becomes equal to or greater than a constant no, the control circuit 3
601, and the control circuit 360 instructs the start of the resynchronization operation in the same manner as described above. Upon the start of the resynchronization operation, the counters 341 to 343 count the number of output discrepancies n2i of the modules 311 to 313 only during the resynchronization period, add the count contents to the comparator 3801 via the AND gates 344 to 346, and set the count to a constant Q. Make a comparison with

At this time, the status register 350 has a counter 341.
The count contents of ~343 are not set. If the number of output mismatches n2i is greater than or equal to a constant, it is determined that it is a permanent failure, and is displayed on the corresponding display 381 to 383, and is notified to the control circuit 360 via the signal line 398. Thereby, the control circuit 360 performs a reconfiguration operation such as switching control between the permanently failed module and a spare module (not shown). When the output mismatch count 2i is a constant value, the negative edge type AND gates 387 to 389 are opened at the fall of the resynchronization signal on the signal line 363, and the contents of the status register 350 before the resynchronization start, that is, the output The number of mismatches, n,i, is added to counters 391-393.

This addition operation reduces the number of output mismatches by 2i due to resynchronization, etc.
is performed every time it is determined that the constant n2 is satisfied, so the count contents of counters 391 to 393 are the sum of the cumulative value of n,i that was added each time it was determined that the constant n2 is less than n2 in the previous resynchronization operation, and the current resynchronization operation. The contents of the status register 350 before the start of synchronization, that is, n and i are added. The contents of these counters 391 to 393 indicate the number of interlude failures 3i, and are compared with a constant n3 from the comparator 39. If the value is greater than or equal to the constant n3, it is determined that there is a deterioration failure, and the corresponding display 39
4 to 396, and is notified to the control circuit 360 via a signal line 397. The control circuit 36 instructs the start of the reconfiguration operation, resets the counters 391 to 393 corresponding to the module determined to be a deterioration failure, and sets the counters 3i=0. Then, upon completion of the reconfiguration operation, the process returns to the initial setting. When the number of intermission failures 3i is less than the constant n3, it is determined that an intermission failure has occurred, the counters 341 to 343, the status register 350, and the comparator 380 are reset, and the process returns to when the timer 370 is activated.

The above embodiment shows the case where it is realized by hardware such as a gate circuit, but it can be realized even more easily by using a programmable control circuit.
The time t and the constants no, n, , and n3 of 70 can be arbitrarily set according to the configuration and operating environment of the device. As explained above, in the present invention, the trigger for making the internal states of each module the same through resynchronization is based on the failure detection of each module. Maintains high operating rate compared to
It becomes possible to perform fault recovery using a majority vote configuration that can prevent a decrease in processing capacity, and it is possible to achieve high reliability of the system.

[Brief explanation of the drawing]

FIG. 1 is a block diagram for explaining a fault recovery method with a conventional majority voting configuration, and FIG. 2 is a block diagram of an embodiment of the present invention.
FIG. 3 is a detailed block diagram of an embodiment of the present invention. 111, 112, 113, 211, 212, 213, 3
11, 312, 313, ... module, 120, 220
, 320...majority circuit, 231, 232, 233,
331, 332, 333...exclusive OR circuit, 16
0,260,360...control circuit, 341,342,
343, 391, 392, 393... force counter, 350...
Status Regis evening, 170, 370, ... timer, 38
0,390...Comparator, 381,382,383,394
, 395, 396, ... failure indicator, 304, 305
, 306, 311, 322, 344, 345, 346...
And gate, 307, 308, 309...or gate,
317, 384, 385, 386...Inverter, 387
, 388, 389...Negative edge type AND gate.
E18 Figure N 6 Figure 6

Claims (1)

[Scope of Claims] 1. In a data processing device having a majority voting configuration, a majority voting means for the outputs of a plurality of modules, and a comparison to determine whether or not the output of the majority voting means matches the output of each of the modules. means, a number counting means for counting the number of mismatches for each module when the comparison results do not match, a counting number determining means for determining for each module whether the number of mismatches has reached a predetermined number; and a time counting means for counting time to create a predetermined cycle, and when the number of mismatches f_1 counted by the number counting means reaches a predetermined number n_1 within the predetermined cycle created by the time counting means. If there is a module for which the number of mismatches f_4 has reached a predetermined number of times n_1, the internal state of the mismatched module is determined by the output of the majority decision means for each module. A fault recovery method characterized in that control is performed so that the internal state of the module matches the output of the majority voting means. 2. In a data processing device having a majority decision configuration, a majority decision means for outputs of a plurality of modules, a comparison means for comparing whether or not the output of the majority decision means matches the output of each of the modules, and a number counting means for counting the number of mismatches for each module when there is a mismatch; a counting number determining means for determining for each module whether the number of mismatches has reached a predetermined number; and a time counting means for creating a period of , and integrating the number of discrepancies counted by the number of times counting means within a predetermined period created by the time counting means every time a control operation is performed to make the internal states of all modules the same. and an integrated number determining means for determining whether the number of discrepancies resulting from the integration has reached a predetermined number of times, and the number of times the number of discrepancies is counted by the number of times counting means within a predetermined period created by the time counting means. The number of mismatches f_1 is the predetermined number n_1.
The counting number determining means determines for each module whether the number of discrepancies has reached a predetermined number n_1, and if there is a module for which the number of discrepancies f_1 has reached a predetermined number n_1, the output of the majority voting means determines whether the The internal state is controlled to be the same as the internal state of the module that matches the output of the majority voting means, and during the operation period of the control, the number of times of mismatch f_2 counted by the number of times counting means reaches a predetermined number of times n_2. The counting number determining means for determining whether or not the discrepancy number f
If there is a module in which _2 has reached a predetermined number of times n^2, it is determined that the first failure has occurred, and if the module does not exist, the number of mismatches Σf_1 accumulated by the number of times accumulating means reaches a predetermined number of times n_3. The cumulative number of times determining means determines whether the cumulative number of times has been reached for each module,
Fault repair characterized in that if there is a module for which the number of discrepancies Σf_1 has reached a predetermined number n^3, it is determined to be a second fault, and if the module does not exist, it is determined to be a third fault. method.