JPS6156538B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention activates the emergency control circuit when an emergency control circuit, particularly a group of multiplexed central processing units, detects an abnormality, and uses an output signal from the emergency control circuit to control the system components. This paper relates to the improvement of emergency control circuits in information processing systems that reconfigure information processing systems.

In a highly reliable information processing system that requires real-time processing, each component device has one or more backup devices, and in the event of a failure due to a hardware failure, program runaway, etc., an emergency control circuit will switch from the active device to the backup device. The system has been reconfigured to ensure continuity of processing.

FIG. 1 shows an example of an information processing system including a conventional emergency control circuit of this type. In FIG. 1, redundant central controllers CC ₀ and CC _1, main memories MM ₀ and MM ₁ , data channels DCH ₀ and
One emergency control circuit EMA is provided for DCH ₁ , file devices F ₀ and F ₁ . Now central controller CC ₀ , main memory MM ₀ , data channel
If a failure occurs while the system consisting of DCH ₀ and file device F ₀ is executing real-time processing as the active system,
The central control unit CC ₀ detects an abnormality and activates the emergency operation circuit.
Start EMA. Activated emergency control circuit EMA
initializes all the system components, selects the necessary devices from each component, and reconfigures the system. For example, when the system is reconfigured with the standby central controller CC ₁ , main memory device MM ₁ , data channel DCH ₁ , and file device F ₁ , the main memory device MM is first transferred from the file device F ₁ to the main memory device MM 1 . After initial rotation of the emergency processing program in _{step 1} , control is transferred to the program. Thereafter, when the reconfigured system starts processing normally and the so-called system startup is successful, the emergency processing program issues a recovery instruction to the emergency control circuit EMA, and the emergency control circuit EMA returns to its initial state. The emergency control operation is thereby completed and normal real-time processing continues. On the other hand, an emergency control operation monitoring timer is installed in the emergency control circuit EMA, and if the system is reconfigured within the specified time, the system startup will not succeed.
If a recovery instruction is not returned from the emergency processing program, the emergency control circuit EMA is restarted and selects another device from each component, for example the central control device CC ₀ , main memory device MM ₁ and data channel. A new system is constructed together with DCH ₁ and file device F ₁ and the above-described emergency control operation is repeated. These series of emergency control operations are repeated until the system is successfully started up and a recovery instruction is sent back from the emergency processing program to the emergency control circuit EMA. If the system is still unsuccessful in starting up even after reconfiguring the system for all combinations of each component and performing emergency control operations, it is determined that the system is down and an alarm is issued.

As is clear from the above explanation, the emergency control circuit
EMA is essential for automatically reconfiguring the system when a failure occurs in a multiplexed information processing system and maintaining continuity in real-time processing. However, in conventional information processing systems, the emergency control circuit EMA is generally not duplicated. Therefore, if a failure occurs in the system with a latent failure in the emergency control circuit EMA, the system component devices Although it was possible to construct a system that could withstand normal operation, there was a drawback that the system had no choice but to go down. Even when the emergency control circuit EMA was periodically tested as a countermeasure, it required a large amount of man-hours because it was always in use, resulting in various savings.

An object of the present invention is to solve the above-mentioned deficiencies in conventional emergency control circuits and to improve the reliability of the emergency control circuits.

The purpose of this is to activate the emergency control circuit when a group of multiplexed central processing units detects an abnormality or upon an external activation request, and reconfigure the system components using the output signal from the emergency control circuit. In an information processing system, an emergency control circuit is provided for each of a plurality of central processing units, and a means for activating all the emergency control circuits when an abnormality is detected or an external activation request is made, and a means for activating the activated emergency control circuit. This is accomplished by providing each emergency control circuit with means for defining which emergency control circuit is used for emergency control operations within the circuit.

An embodiment of the present invention will be described below with reference to FIGS. 2 and 3.

FIG. 2 is a block diagram showing a redundant information processing system according to an embodiment of the present invention;
This figure is a circuit diagram showing the emergency control circuit in FIG. 2. In Figure 2, the emergency control circuit EMA ₀ and
EMA ₁ consists of a redundant central control unit CC ₀ and
In response to CC ₁ , it is also provided in duplicate. If a failure occurs while the system consisting of the central controller CC ₀ , main memory MM ₀ , data channel DCH ₀ , and file device F ₀ is executing real-time processing as the active system, the emergency control shown in FIG. Circuit EMA ₀
The fault detection circuit D ₀ in the emergency control circuit EMA 0 and EMA 1 detects the fault and sets the start-up flip-flop circuits F ₀₀ and F ₁₀ in each emergency control circuit EMA ₀ and EMA ₁ . The set flip-flop circuits F ₀₀ and F ₁₀ respectively update the emergency control counters C ₀₀ and C ₁₀ , which are set to the same state, and at the same time activate the pulse generation circuits G ₀ and G ₁ . Each pulse generation circuit G ₀ and G ₁ is a timing generation counter C ₀₁
and C ₁₁ to output TE ₀₀ and TE ₁₀ first and then output according to a predetermined time sequence.
Let TE ₀₁ and TE ₁₁ be 1. Before that, the output 1 of the emergency control counters C ₀₀ and C ₁₀ is led to the exclusive OR circuits E ₀ and E ₁ , and the emergency control circuit number (“0” for EMA ₀ , “0” for EMA ₁ ) As a result, the exclusive OR circuit E ₀ outputs 1, and the exclusive OR circuit E ₁ outputs 0. Therefore, the output TE ₀₀ of the timing generation counter C ₀₁ mentioned above is the gate A ₀₁ .
via gate A 10 to the central control unit CC ₀ and to the central control unit CC 0 via gate A ₁₀ .
CC ₁ is placed in standby state, and then the output TE ₀₁ of the timing generation counter C ₀₁ is set to gate A _03.
The system activates the central control unit CC ₀ via the system and executes a series of emergency control operations similar to the conventional system. On the other hand, the outputs TE ₁₀ and _{TE 11 of} timing creation counter C ₁₁ started at the same time as timing creation counter C 01.
does not reach the central controllers CC ₀ and CC ₁ because the gates A ₁₁ , A ₀₀ and A ₁₃ , A ₀₂ are in the blocking state. In other words, this time, among the emergency control circuits EMA ₀ and EMA ₁ activated at the same time, the emergency control circuit EMA ₀
will be used for emergency operations. When a predetermined time has elapsed, the timing generation counters C ₀₁ and C ₁₁ in both emergency control circuits EMA ₀ and EMA ₁ issue outputs TE _0c and TE _1c , reset flip-flops F _0c and F ₁₀ , and reset themselves. do. This causes the pulse generation circuit G ₀ and
G ₁ is also restored, and emergency control counters C ₀₀ and C ₁₀ maintain their current status. If the emergency control operation succeeds in starting the system before the outputs TE _0c and TE _1c occur, the abnormality detection circuit D ₀ will also be restored, and both emergency control circuits will be activated.
Restore EMA ₀ and EMA ₁ . If the outputs of timing generation counters C ₀₁ and C ₁₁ TE _0c and
If the emergency control operation has not successfully started the system before the occurrence of TE _1c , the abnormality detection circuit D ₀ continues to operate, so that after the outputs TE _0c and TE _1c are finished, the flip-flops F ₀₀ and F start up again. ₁₀ is set, the emergency control counters _C00 and _C10 are updated, and the pulse generation circuits _G0 and _G1 are activated to start driving the timing generation counters _C01 and _C11 . This time, the outputs of the emergency control counters C ₀₀ and C ₁₀ are 0, so the output of the exclusive OR circuit E ₀ is 0, and the output of the exclusive OR circuit E ₁ is 1. Therefore, the output TE ₁₀ of the timing generation counter C ₁₁ actuates the central controller CC ₁ via the gate A ₁₁ .
state and also puts the central controller CC ₀ in standby state via gate A ₀₀ , and then the output TE ₁₁ of timing generation counter C ₁₁ is set to gate A 00.
activating the central controller CC ₁ via A ₁₃ to perform emergency control actions on behalf of the central controller CC ₀ ;
On the other hand, this time, the outputs TE ₀₀ and TE ₀₁ of the timing generation circuit C ₀₁ are output from the central controller CC ₀ and CC ₁ because the gates A ₀₁ , A ₀₀ and A ₀₃ , A ₁₂ are in the blocking state.
will not be reached. In other words, this time, among the emergency control circuits EMA ₀ and EMA ₁ activated at the same time, the emergency control circuit
EMA ₁ will be used for emergency control operations.
Each emergency control circuit EMA ₀ determines which emergency control circuit EMA ₀ or EMA ₁ is used for emergency control operation.
and the contents of emergency control counters C ₀₀ and C ₁₀ in EMA ₁ . For this purpose, the states of both emergency control counters C ₀₀ and C ₁₀ must always match. This is satisfied by resetting both emergency control counters _C00 and _C10 on power up.

Alternatively, manually set the system to the initial state, configure the system, and start the system.Initial program load CNS When starting the IPL function, both emergency control counters C ₀₀ and C ₀₁ are set to the unique values of the startup system. It is possible to make them match by setting them.

When the initial program load CNS IPL is requested from the 0 system, the IPLK ₀ signal is generated, and the activation flip-flop circuit F ₀₂ is activated via gates A ₀₀ and A ₁₁ .
and set F ₁₂ . Both flip-flop circuits set set the emergency control counters to the same state 1 and activate the pulse generation circuits _G0 and _G1 . Emergency control counter C ₀₀ and
Output 1 of C ₁₀ is led to exclusive logic circuits E ₀ and E ₁ . The following operation is the same as explained above,
Perform emergency control operations using CC ₀ as the start-up system.

On the other hand, initial program load CNSIPL from system 1
When a request is made, the IPLK ₁ signal is generated and the gate is
Start-up flip-flop circuits _F01 and _F11 are set via _A13 and _A02 . Both flip-flop circuits set the emergency control counters to the same state 0 and activate the pulse generator circuits G ₀ and G ₁ , leading the outputs 0 of the emergency control counters C ₀₀ and C ₁₀ to the exclusive logic circuit and E ₁ . He performs emergency control operations using CC ₁ as the start-up system.

The above explanation is based on the case where the central controller CC ₀ is currently in use, but if the central controller CC ₁ is currently in use, when a failure occurs, the abnormality detection circuit D ₁ detects the failure, and each emergency control circuit EMA ₀ and start EMA ₁ , and the subsequent operation is the same as described above.

Flip-flop circuits _F00 and _F10 are also set when operating in response to an emergency control circuit activation request signal _EMK0 or _EMK1 from outside the central processing unit. The following operation is the same as the operation when a failure is detected by the abnormality detection circuit described above.

Furthermore, even if either emergency control circuit EMA ₀ or EMA ₁ is in failure, the remaining emergency control circuit
Due to the aforementioned sequence of actions by EMA ₀ or EMA ₁ , the corresponding central controller CC ₀ or CC ₁ carries out emergency control actions, so that the system does not stop.

As is clear from the above description, according to this embodiment, the emergency control circuits EMA 0 and _EMA provided corresponding to the redundant central control units CC ₀ and CC ₁
EMA ₁ is activated at the same time when a fault occurs, and depending on the state of emergency control counters C ₀₀ and C ₁₀ provided in each emergency control circuit EMA ₀ and EMA ₁ , either emergency control circuit EMA ₀ or EMA ₁ is activated. It will be used for emergency control operations. Emergency control counters C ₀₀ and C ₁₀ are connected to emergency control circuits EMA ₀ and
The emergency control circuit _{EMA 0 or}
EMA ₁ is selected alternately. Therefore, even if one emergency control circuit EMA ₀ or EMA ₁ is out of service due to a failure, the remaining emergency control circuit EMA ₀ or
When the system fails, EMA ₁ activates the corresponding central controller CC ₀ or CC ₁ to perform emergency control operations, so the system does not stop.

Note that FIGS. 2 and 3 are only one embodiment of the present invention; for example, even if the central control unit has a triplex or higher configuration, an emergency control circuit may be provided for each central control unit. The effects of the present invention can be exerted as described above by providing means for activating all the emergency control circuits when an abnormality is detected and determining the emergency control circuit to be used for the emergency control operation from among them.

As described above, according to the present invention, since a plurality of emergency control circuits are provided corresponding to the multiplexed central processing unit groups, there are no normally operating circuits in the central control unit, main memory, data channel, etc. Even though the system exists, a situation where the system goes down due to a failure in the emergency control circuit can be avoided, and reliability can be significantly improved.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing an example of an information processing system including a conventional emergency control circuit, FIG. 2 is a block diagram of an information processing system including an emergency control circuit according to an embodiment of the present invention, and FIG. 3 is an example circuit diagram showing the emergency control circuit shown in the figure. FIG. In the figure, CC ₀ , CC ₁ ... central control unit,
MM ₀ , MM ₁ ... Main memory, DCH ₀ , DCH ₁ ...
Data channel, F ₀ F ₁ ...File device,
EMA, EMA ₀ , EMA ₁ ...Emergency control circuit, D ₀ , D ₁
...Abnormality detection circuit, F ₀₀ , F ₁₀ ... Flip-flop circuit, C ₀₀ , C ₁₀ ... Emergency control counter, G ₀ ,
G ₁ ... Pulse generation circuit, C ₀₁ , C ₁₁ ... Timing generation counter, E ₀ , E ₁ ... Exclusive OR circuit,
A ₀₀ , A ₀₁ , A ₀₂ , A ₀₃ , A ₁₀ , A ₁₁ , A ₁₂ , A ₁₃ ...
Gate.

Claims (1)

[Scope of Claims] 1. When a group of multiplexed central processing units detects an abnormality or upon an external activation request, an emergency control circuit is activated, and an output signal from the emergency control circuit activates the system configuration devices. In an information processing system that reconfigures a computer, each emergency control circuit is provided corresponding to a plurality of central processing units, and a means for activating all emergency control circuits when an abnormality is detected or an external activation request is made; An emergency control circuit characterized in that each emergency control circuit is provided with a means for determining an emergency control circuit to be used for an emergency control operation among the emergency control circuits. 2. Due to the operation of the emergency control circuit used for emergency control operations, the system that detects the abnormality
The emergency control circuit according to claim 1, wherein the emergency control circuit reconfigures a system that attempts normal processing.