Failsafe computer system

Abstract

The invention provides a fail-safe computer system. The purpose of the present invention is to improve reliability while maintaining security of a fail-safe computer system provided with a plurality of fail-safe CPUs. In a fail-safe computer system (1), a main CPU (12) determines and allocates, for each allocated program, a priority processing CPU and a pre-processing CPU that are responsible for arithmetic processing of the allocated program, and transmits predetermined input data for the allocated program to the priority processing CPU and the pre-processing CPU. The priority processing CPU and the pre-processing CPU are caused to execute a calculation process based on the input data following the previous calculation process to obtain calculation result data. The priority processing CPU executes computation processing based on input data, and transmits computation result data to the main CPU (12) and the preliminary processing CPU. The pre-processing CPU executes a calculation process based on input data, and transmits calculation result data to the main CPU (12).

Description

Technical Field

[0001] This invention relates to a fail-safe computer system. Background Technology

[0002] For example, in systems requiring high security and high reliability, such as the logic processing unit of a safety protection device like a railway signaling system, a fail-safe CPU (fail-safe computer) is used to construct and implement the computer system (e.g., Patent Documents 1 and 2).

[0003] Existing technical documents

[0004] Patent documents

[0005] Patent Document 1: Japanese Patent Application Publication No. 2019-147532

[0006] Patent Document 2: Japanese Patent Application Publication No. 2018-118595 Summary of the Invention

[0007] The problem the invention aims to solve

[0008] With increasing system complexity and the need for high-speed computation, there is a demand to further improve the processing capabilities of fail-safe CPUs. Therefore, a system architecture using multiple fail-safe CPUs to implement parallel processing is considered. In this case, the stability of data transmission and reception between fail-safe CPUs must also be ensured to achieve high overall system security and reliability.

[0009] The problem this invention aims to solve is to maintain the security of a fail-safe computer system with multiple fail-safe CPUs and to improve its reliability.

[0010] Solution for solving the problem

[0011] The first invention for solving the above problems is a fail-safe computer system comprising a main central processing unit (CPU) and multiple processing CPUs, wherein the main CPU and the multiple processing CPUs are all fail-safe CPUs.

[0012] The main central processing unit has:

[0013] The allocation control unit, for each allocation program, determines and allocates, among the plurality of processing central processing units, a priority processing central processing unit and a preparatory processing central processing unit responsible for the computational processing of that allocation program; and

[0014] The process control unit sends the given input data for the allocation program to the priority processing central processing unit and the pre-processing central processing unit that were assigned the allocation program, causing the priority processing central processing unit and the pre-processing central processing unit to perform calculations based on the input data following the previous calculations, and obtain the calculation result data.

[0015] When the processing CPU is the priority processing CPU, the processing CPU performs arithmetic processing based on the input data, stores the result data as prerequisite data for the next arithmetic processing, and sends the result data to the main CPU and the pre-processing CPU.

[0016] When the processing central processing unit is the pre-processing central processing unit, the processing central processing unit performs arithmetic processing based on the input data, sends the arithmetic result data to the main central processing unit, and stores either the arithmetic result data or the arithmetic result data received from the priority processing central processing unit as the premise data for the next arithmetic processing.

[0017] According to the first invention, the security of a fail-safe computer system with multiple fail-safe CPUs can be maintained, and its reliability can be improved. Specifically, the main CPU sends the input data corresponding to the allocation program to a priority processing CPU and a pre-processing CPU, which are the processing CPUs responsible for the allocation program's computational processing. The priority processing CPU and the pre-processing CPU then perform computational processing based on the input data and obtain the computational result data. Thus, the computational processing of the allocation program is dualized. As long as the data transmission and reception between the fail-safe CPUs are performed correctly, the same computational result data based on this dualized computational processing can be obtained. Therefore, the stability of data transmission and reception can be ensured, and the overall security of the system can be maintained and its reliability improved even with multiple fail-safe CPUs.

[0018] Furthermore, the priority processing CPU stores the computation result data as the prerequisite data for the next computation, and sends this computation result data to the pre-processing CPU. The pre-processing CPU stores either the computation result data it obtained or the computation result data received from the priority processing CPU as the prerequisite data for the next computation. Thus, for each computation based on the input data, the computation result can be kept consistent between the priority processing CPU and the pre-processing CPU, thereby maintaining security and further improving reliability.

[0019] The second invention is a fail-safe computer system, in which, the above-mentioned invention,

[0020] When the processing central processing unit is the pre-processing central processing unit, the processing central processing unit checks the operation result data of the executed operation processing against the operation result data received from the priority processing central processing unit.

[0021] According to the second invention, the pre-processing CPU verifies the result of the operation obtained from the execution with the result of the operation received from the priority processing CPU. Therefore, for example, even if the input data sent from the main CPU to the pre-processing CPU is corrupted due to a transmission error, the prerequisite data stored in the pre-processing CPU can be made consistent with the prerequisite data stored in the priority processing CPU, thus not affecting the next operation and maintaining security while improving reliability.

[0022] The third invention is a fail-safe computer system, in which, the above-mentioned invention,

[0023] The fail-safe central processing units operate asynchronously.

[0024] The execution cycle of the main central processing unit is shorter than that of the processing central processing unit.

[0025] According to the third invention, the time required for data transmission and reception between the main CPU, the priority processing CPU, and the preparatory processing CPU can be shortened, thereby improving the processing speed.

[0026] The fourth invention is a fail-safe computer system, in which, the invention described above,

[0027] The process control unit receives the input data from the outside, causing the priority processing central processing unit and the pre-processing central processing unit to perform calculations based on the input data, and to use the calculation result data obtained earlier from either the priority processing central processing unit or the pre-processing central processing unit and output the calculation result data to the outside.

[0028] In the case of asynchronous processing between fail-safe CPUs, the times at which the computation result data is obtained from the priority processing CPU and the preparatory processing CPU may differ. However, since both the priority processing CPU and the preparatory processing CPU are fail-safe CPUs, the reliability of the computation processing itself is guaranteed. Therefore, as in the fourth invention, by using the computation result data obtained earlier from either the priority processing CPU or the preparatory processing CPU, the time from the external input of input data to the external output of the computation result can be shortened, thereby improving the processing speed.

[0029] The fifth invention is a fail-safe computer system, in which, the invention described above,

[0030] The main central processing unit has an allocation switching control unit. When the non-received state of not receiving the calculation result data from the priority processing central processing unit after sending the input data meets a predetermined long-term condition, the allocation switching control unit performs allocation switching to set the pre-processing central processing unit as the new priority processing central processing unit and set the priority processing central processing unit as the new pre-processing central processing unit.

[0031] In the case of asynchronous processing between fail-safe CPUs, the timing at which the main CPU receives the computation result data from the priority processing CPU and the standby processing CPU may differ, but it is assumed that the difference in timing is within a specified time corresponding to the execution cycle. Therefore, as in the fifth invention, when the non-received state of not receiving computation result data from the priority processing CPU after sending input data meets a specified long duration condition, the allocation of the processing CPU is switched to that of the priority processing CPU and the standby processing CPU, thereby maintaining security and improving reliability. For example, in the case of a transmission error between the main CPU and the priority processing CPU, the non-received state of not receiving computation result data from the priority processing CPU continues, so in such a case, the allocation of the processing CPU can be switched to that of the priority processing CPU and the standby processing CPU.

[0032] The sixth invention is a fail-safe computer system, in which, the aforementioned invention,

[0033] The allocation switching control unit determines whether the long time condition is met based on the elapsed time after receiving the calculation result data from the pre-processing central processor.

[0034] According to the sixth invention, it is possible to determine whether a long time condition is met based on the elapsed time after receiving the computation result data from the preparatory processing CPU. Therefore, for example, in the event of a transmission error between the main CPU and the priority processing CPU, the allocation of the processing CPU as either the priority processing CPU or the preparatory processing CPU can be quickly switched. Attached Figure Description

[0035] Figure 1 This is an example of the application of fail-safe computer systems.

[0036] Figure 2 This is an illustration of the distributed processing of the program.

[0037] Figure 3 This is an illustration of the program's execution control.

[0038] Figure 4 This is an illustration of the program's execution control.

[0039] Figure 5This is an illustration of the program's execution control.

[0040] Figure 6 This is an illustration of the program's execution control.

[0041] Figure 7 This is an illustration of the program's execution control.

[0042] Figure 8 This is an illustration of the program's execution control.

[0043] Figure 9 This is an illustration of the program's execution control.

[0044] Figure 10 This is an example of the functional structure of the main CPU.

[0045] Figure 11 This is an example of the functional structure of the CPU. Detailed Implementation

[0046] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. However, the methods by which the present invention can be applied are not limited to the embodiments described below. Furthermore, in the accompanying drawings, the same elements are labeled with the same reference numerals.

[0047] Figure 1 This is a diagram illustrating an application example of the fail-safe computer system in this embodiment. For example... Figure 1 As shown, the fail-safe computer system 1 of this embodiment is configured by connecting multiple fail-safe CPUs 10 via an internal bus 20 in a manner that enables data transmission and reception.

[0048] The fail-safe CPU 10, also known as a fail-safe computer, is a computer with a redundant internal structure that ensures high security and reliability. Specifically, within a single fail-safe CPU 10, two or more systems are configured via software or hardware. This fail-safe CPU 10 possesses self-diagnostic capabilities: it executes the same processing in each system, outputting a normal processing result only if the processing results are identical across all systems; otherwise, it is considered a fault. Furthermore, the fail-safe CPU 10 is implemented as a blade computer (or CPU motherboard, etc.) with electronic components such as the CPU and memory mounted on an electronic substrate. Moreover, the fail-safe computer system 1 is implemented as a blade computer system comprising multiple blade computers composed of these fail-safe CPUs 10 housed within a casing.

[0049] In this embodiment, one of the multiple fail-safe CPUs 10 constituting the fail-safe computer system 1 is configured as the main CPU 12, and the other fail-safe CPUs 10 are configured as processing CPUs 14. Furthermore, for ease of understanding, the accompanying drawings illustrate that the main CPU 12 is composed of one fail-safe CPU 10, but it is preferable that the main CPU 12 is implemented using a redundant structure (e.g., a dual structure) based on multiple fail-safe CPUs 10. Additionally, an internal bus 20 is also shown in the drawings, but it is preferable to implement it using a redundant (dual) bus structure. The main CPU 12 performs data input / output control with the outside of the system, causing the processing CPUs 14 to perform computational processing based on the input data and output the computational results to the outside. Furthermore, the fail-safe CPUs 10 execute processing at predetermined execution cycles, but the fail-safe CPUs 10 execute computational processing asynchronously. Additionally, the execution cycle of the main CPU 12 is designed to be shorter than the execution cycle of the processing CPUs 14.

[0050] In the fail-safe computer system 1 of this embodiment, the processing is configured as follows to ensure the stability of data transmitted and received between fail-safe CPUs 10.

[0051] Figure 2 This diagram illustrates the program allocation in fail-safe computer system 1. In fail-safe computer system 1, the programs to be executed are processed by multiple processing CPUs 14. That is, there are multiple programs to be executed, but these programs are allocated to the processing CPUs 14 in units of one or more independent programs (the processing result of one is unrelated to the processing of another).

[0052] Furthermore, redundancy is achieved by configuring the program as a pair, with one program as the main program and the other as a backup program, and assigning them to two processing CPUs 14 respectively. Figure 2 In the example, the programs to be executed by the fail-safe computer system 1 are three programs: "Program A" to "Program C". These programs are independent and can be executed independently. Furthermore, these three programs are assigned to two processing CPUs 14 as a main program and a backup program, respectively. Additionally, each program is assigned a different combination of processing CPUs 14. These programs are managed and identified based on identification information (program ID).

[0053] Figure 3 It is a diagram that focuses on the data flow to illustrate the execution control of a program. For example... Figure 3As shown, a program (assignment program) is allocated to two processing CPUs 14 (14a, 14b), with one processing CPU 14 assigned to the main program and the other processing CPU 14 assigned to the backup program. That is, in Figure 3 In the example, CPU 14a is assigned to the main program, and CPU 14b is assigned to the backup program. The CPU 14b assigned to the main program (in...) Figure 3 The CPU 14a, which is responsible for processing the main program, is called the main program processing CPU (the priority processing CPU). The CPU 14a, which is assigned to the backup program, will then be used for processing other programs. Figure 3 The CPU14b is called the backup CPU (preparatory CPU).

[0054] The main CPU 12 sends the input data for the allocation program from the data input from outside the system to the main program processing CPU and the backup program processing CPU respectively. The main program processing CPU and the backup program processing CPU perform the allocation program calculation based on the input data received from the main CPU 12 and the premise data as the result of the previous calculation, and send the calculation result back to the main CPU 12.

[0055] The main CPU 12 outputs the calculation results received from the main program processing CPU and / or the backup program processing CPU as the calculation result for the input data to the outside of the system. At this time, the main CPU 12 uses the earlier (first) calculation result received from both the main program processing CPU and the backup program processing CPU and outputs that result to the outside. If the results are received simultaneously (processed within the same execution cycle), the calculation result from the main program processing CPU is used first. Alternatively, if the calculation result from the backup program processing CPU is received first, the system waits for the calculation result from the main program processing CPU. If the failure to receive a calculation result from the main program processing CPU for a specified long time condition is met, the allocation between the main program and the backup program is switched, as will be described in detail later.

[0056] The main program CPU sends the calculation result back to the backup program CPU. The backup program CPU checks its own calculation result against the result received from the main program CPU. Specifically, it stores its own calculation result as the prerequisite data for the next operation. When it receives the calculation result from the main program CPU, it determines whether the received result matches its stored result. If they do not match, the received result overwrites the stored result, and the received result is used as the prerequisite data for the next operation.

[0057] Figures 4-9It is a graph that illustrates the execution control of a program according to a time sequence. Figures 4-9 In the diagram, the vertical (downward) direction is used to represent the time interval, indicating the processing of the main CPU 12 and the two processing CPUs 14 (the first processing CPU and the second processing CPU) assigned the program. Thick arrows represent the data sent and received between the CPUs. The first processing CPU is the main program processing CPU assigned the main program, and the second processing CPU is the backup program processing CPU assigned the backup program.

[0058] A rectangle (block) is drawn along the time direction of each of the main CPU 12 and the processing CPU 14 to represent one execution cycle. The execution cycle of the main CPU 12 is set to be 1 / 4 of the execution cycle of the processing CPU 14. The execution content recorded within the rectangle is the content executed in the corresponding execution cycle. In each execution cycle, the fail-safe CPU 10 (main CPU 12 and processing CPU 14) first performs self-diagnosis processing, then performs data transmission and reception processing with other fail-safe CPUs 10, and then performs other processing such as allocation program calculation processing. In addition, input data for the allocation program is intermittently input from outside the fail-safe computer system 1. This input data is the data used as the initial value in the allocation program. The calculation result is obtained by performing calculation processing on the allocation program based on the input data (more precisely, by performing calculation processing on the allocation program based on the input data and the calculation result obtained from the previous calculation processing, which will be described in detail later), and the calculation result is output to the outside of the fail-safe computer system 1. Therefore, in the accompanying drawings, the input or input data is labeled with circled numbers, and the same circled numbers are used to label the operations, results, and outputs based on the input data.

[0059] Figure 4 This is an example of operation under normal transmission and reception conditions between the fail-safe CPUs 10. When the main CPU 12 receives the first input data for the allocation program from outside the system, it sends the input data (first time) to the main program processing CPU and the backup program processing CPU in the next execution cycle.

[0060] The main program processing CPU receives input data from the main CPU 12 (first time) and performs calculations based on the received input data (first time) according to the allocation program (first time). Then, in the next execution cycle, it outputs the calculation result (first time) to the main CPU 12 and the backup program processing CPU. The backup program processing CPU also receives input data from the main CPU 12 (first time) and performs calculations based on the received input data (first time) according to the allocation program (first time), and outputs the calculation result (first time) to the main CPU 12 in the next execution cycle.

[0061] The main CPU 12 receives the calculation results (first time) from both the main program processing CPU and the backup program processing CPU, but due to... Figure 4 The receiving and processing occur within the same execution cycle, so the calculation result received from the main program's CPU is output to the outside of the system as the calculation result for the first input data. Additionally, when the backup program's CPU receives the calculation result (first time) from the main program's CPU, it checks its own calculation result (first time) against the calculation result received from the main program's CPU (first time) and determines that they are consistent.

[0062] Next, after the main CPU 12 outputs the result of the calculation on the first input data to the outside of the system, the second input data for the allocation program is input from outside the system. The processing based on this second input data is also performed in the same way.

[0063] Figure 5 This is an example of an action taken when the result of the main program processing CPU's calculation is inconsistent with the result of the backup program processing CPU's calculation. Including the main CPU 12, both the main program processing CPU and the backup program processing CPU are also fail-safe CPUs 10. Therefore, if the main program processing CPU and the backup program processing CPU perform calculations on the same input data, the results should be the same. Figure 5 The example illustrates a scenario where a bit error occurs during transmission between fail-safe CPUs 10, resulting in data errors and ultimately inconsistent computation results. Specifically, an example is shown where a bit error occurs during the transmission of a second set of input data from the main CPU 12 to the backup program processing CPU, resulting in data errors in that second set of input data.

[0064] to and Figure 4 To explain the difference in the illustrated action example, when the backup program processing CPU receives the result of its computation based on the second input data from the main program processing CPU, it checks its own computation result (second time) against the result received from the main program processing CPU (second time), but determines that they are inconsistent. This is because a data error occurred in the second input data. In this case, the stored result of its own computation (second time) is overwritten with the result received from the main program processing CPU (second time). Therefore, the premise data used by both the main program processing CPU and the backup program processing CPU in the subsequent computation based on the third input data is consistent, resulting in consistent computation results (third time).

[0065] Figure 6This is an example of the main program's action when the CPU fails to receive input data from the main CPU 12.

[0066] to and Figure 4 The differences between the action examples shown will be explained. Figure 6 An example of this action is as follows: The main CPU 12 sends initial input data to both the main program processing CPU and the backup program processing CPU. However, a communication failure occurs between the main CPU 12 and the main program processing CPU, and the main program processing CPU does not receive the initial input data from the main CPU 12. In this case, the main program processing CPU does not perform the allocation process based on the initial input data, nor does it send the initial calculation results (from the main program processing CPU to the main CPU 12 and the backup program processing CPU).

[0067] On the other hand, the backup program processing CPU receives input data from the main CPU 12 (first time), performs calculations based on the received input data (first time) and sends the calculation results to the main CPU 12 (first time). However, since it does not receive the calculation results from the main program processing CPU (first time), it does not check its own calculation results (first time).

[0068] The main CPU 12 outputs the calculation result (first time) received from the backup program processing CPU as the calculation result for the first input data to the outside of the system. Then, the main CPU 12 waits to receive the calculation result (first time) from the main program processing CPU. When the state of not receiving a calculation result from the main program processing CPU (not received state) meets a specified long time condition, it sends a switching instruction between the main program and the backup program processing CPU. That is, it sends a switching instruction to the main program processing CPU to set it as the backup program, and sends a switching instruction to the backup program processing CPU to set it as the main program.

[0069] A long-duration condition is considered a time condition in which no computation result is normally received from the main program's processing CPU. Specifically, it is defined as a period equivalent to a predetermined number of execution cycles based on receiving computation results from the backup program's processing CPU. Figure 6 (The interval is 5 cycles). For example, considering the asynchronous processing between fail-safe CPUs 10, the execution cycle of processing CPU 14 is specified to be longer than the execution cycle of processing CPU 14.

[0070] When the first processing CPU, which acts as the main program processing CPU, receives a switch instruction from the main CPU 12 to the backup program, it then acts as the backup program processing CPU, executing the allocation program as the backup program. When the second processing CPU, which acts as the backup program processing CPU, receives a switch instruction from the main CPU 12 to the main program, it then acts as the main program processing CPU, executing the allocation program as the main program.

[0071] Therefore, the second processing CPU, which is the new main program processing CPU, performs calculations based on the allocation program of the second input data received from the main CPU 12, and sends the calculation results to the main CPU 12 and the first processing CPU, which is the new backup program processing CPU.

[0072] The first processing CPU, acting as the new backup program CPU, performs calculations based on the allocation procedure received from the main CPU 12, and sends the calculation result to the main CPU 12. Then, it compares the calculation result received from the second processing CPU, acting as the new main program CPU, with its own calculation result. However, since the first processing CPU, acting as the new backup program CPU, did not perform calculations based on the allocation procedure received from the first input data, it determines that the two are inconsistent. Then, it overwrites its stored calculation result (second time) with the calculation result received from the second processing CPU, acting as the new main program CPU.

[0073] Therefore, the premise data used by the new main program processing CPU (second processing CPU) and the new backup program processing CPU (first processing CPU) in the operation and processing based on the next (third) input data is consistent.

[0074] exist Figure 6 In this process, the main CPU 12 receives the second calculation result from the new backup program processing CPU (first processing CPU) before receiving the second calculation result from the new main program processing CPU (second processing CPU). However, the state of not receiving a calculation result from the main program processing CPU (second processing CPU) (not receiving state), based on receiving the second calculation result from the new backup program processing CPU (first processing CPU), does not meet the long-term condition. Therefore, the main CPU 12 outputs the second calculation result from the new main program processing CPU (second processing CPU) as the calculation result for the second input data to the outside of the system.

[0075] Figure 7 This is an example of an action taken when the main CPU fails to receive the calculation result from the main program CPU.

[0076] to and Figure 4 The differences between the action examples shown will be explained. Figure 7 In the example operation, the main program processing CPU sends the calculation result based on the initial input data to the main CPU 12 and the backup program processing CPU. However, in the following example, a communication failure occurs between the main program processing CPU and the main CPU, resulting in the main CPU 12 not receiving the calculation result (initial) from the main program processing CPU.

[0077] If the main CPU 12 does not receive the calculation result (first time) from the main program processing CPU, it will output the calculation result (first time) received from the backup program processing CPU as the calculation result for the input data of the first time to the outside of the system.

[0078] Moreover, compared with the reference Figure 6 Similarly, when the specified long-term condition is met based on the state that no calculation result has been received from the main program processing CPU (not received state) but the calculation result has not been received from the main program processing CPU, a switching instruction between the main program and the backup program is sent to both the main program processing CPU and the backup program processing CPU.

[0079] On the other hand, when the backup program processing CPU receives the calculation result (first time) from the main program processing CPU, it checks its own calculation result (first time) against the calculation result (first time) from the main program processing CPU and determines that the two are consistent.

[0080] Figure 8 This is an example of the backup program's action when the CPU fails to receive input data from the main CPU 12.

[0081] to and Figure 4 The differences between the action examples shown will be explained. Figure 8 An example of the action is as follows: The main CPU 12 sends the first input data to the main program processing CPU and the backup program processing CPU respectively, but a communication failure occurs between the main CPU 12 and the backup program processing CPU, so the backup program processing CPU does not receive the input data from the main CPU 12.

[0082] In the backup program processing CPU, since no input data was received (first time), the allocation program based on the input data (first time) was not processed (first time), and therefore the calculation result (first time) was not sent to the main CPU 12. The main CPU 12 outputs the calculation result (first time) received from the main program processing CPU as the calculation result based on the input data of the first time to the outside of the system.

[0083] When the backup program's CPU receives the calculation result (first time) from the main program's CPU, it compares its own calculation result (first time) with the calculation result (first time) received from the main program's CPU. However, since no calculation processing based on the input data (first time) was performed, the two are determined to be inconsistent. Furthermore, the backup program overwrites its stored calculation result with the calculation result (first time) received from the main program's CPU.

[0084] Therefore, the premise data used by the main program (CPU) and the backup program (CPU) in their respective operations based on the next (second) input data is consistent.

[0085] Figure 9 This is an example of an action taken when the main CPU 12 fails to receive the calculation results from the backup program processing CPU.

[0086] to and Figure 4 The differences between the action examples shown will be explained. Figure 9 In the example operation, the backup program processing CPU sends the calculation result based on the first input data to the main CPU 12. However, in the following example: a communication failure occurs between the backup program processing CPU and the main CPU 12, and the main CPU 12 does not receive the calculation result (first time) from the backup program processing CPU. The main CPU 12 then outputs the calculation result (first time) from the backup program processing CPU as the calculation result based on the input data (first time) to the outside.

[0087] In addition, when the backup program processing CPU receives the calculation result (first time) from the main program processing CPU, it checks its own calculation result (first time) against the calculation result (first time) received from the main program processing CPU and determines that the two are consistent.

[0088] Figure 10 This is a block diagram illustrating an example of the functional architecture of the main CPU 12. For example... Figure 10 As shown, the main CPU 12 includes a processing unit 200 and a storage unit 300.

[0089] The processing unit 200 includes a distribution control unit 202, a process control unit 204, a distribution switching control unit 206, an input / output control unit 208, and a transmit / receive control unit 210.

[0090] For each allocation program, the allocation control unit 202 determines and allocates the priority processing CPU and the backup processing CPU (see reference) among multiple processing CPUs. Figure 2That is, the CPU that is to be allocated the computational processing of the allocation program determines the main program CPU that is to be processed first and the backup program CPU that is to be processed second.

[0091] The allocation of processing CPUs is managed through allocation management data 310. In allocation management data 310, according to the program to be executed, corresponding to the program ID which serves as the program's identification information, allocation data, externally input data (data corresponding to the program input from outside the system), and received calculation results (received calculation result data) are stored, respectively, from the main program processing CPU and the backup program processing CPU. The allocation data includes the main program processing CPU ID, which serves as the identification information for the main program processing CPU performing the calculations for that program, and the backup program processing CPU ID, which serves as the identification information for the backup program processing CPU performing the calculations for that program.

[0092] The process control unit 204 sends the given input data for the allocation program to the main program processing CPU and the backup program processing CPU associated with the allocation program, causing the main program processing CPU and the backup program processing CPU to perform calculations based on the input data following the previous calculation, and obtain the calculation result data (see reference). Figures 4-9 ).

[0093] In addition, the process control unit 204 outputs the calculation result data obtained from either the main program processing CPU (preferred processing CPU) or the backup program processing CPU (preparatory processing CPU) to the outside. At this time, it is possible to prioritize the calculation result data obtained from the main program processing CPU and output it to the outside, or it is possible to prioritize the calculation result data obtained earlier from either the main program processing CPU or the backup program processing CPU and output it to the outside.

[0094] If the non-received state, where no calculation result data is received from the main program processing CPU after sending input data, meets the specified long-term condition, the allocation switching control unit 206 performs an allocation switch, setting the backup program processing CPU as the new main program processing CPU and the main program processing CPU as the new backup program processing CPU. For example, it determines whether the long-term condition is met based on the elapsed time after receiving the calculation result data from the backup program processing CPU (see...). Figure 6 , Figure 7 ).

[0095] The input / output control unit 208 controls the data input and output between the external system 1 and the control and fail-safe computer system 1.

[0096] The transceiver control unit 210 controls the transmission and reception of data with other processing CPUs 14 via the internal bus 20.

[0097] The storage unit 300 stores a main control program 302 for enabling the fail-safe CPU 10 to function as the main CPU 12, as well as allocation management data 310.

[0098] Figure 11 This is a block diagram illustrating an example of the functional architecture of CPU 14. For example... Figure 11 As shown, the processing CPU 14 includes a processing unit 400 and a storage unit 500.

[0099] The processing unit 400 includes an arithmetic processing unit 402, an inspection unit 404, and a transceiver control unit 406.

[0100] The arithmetic processing unit 402 performs arithmetic processing based on the input data, stores the result data as prerequisite data for the next arithmetic processing, and sends the result data to the main CPU 12. Additionally, when it is the main program processing CPU, it also sends the result data to the backup program processing CPU. Furthermore, when it is the backup program processing CPU, it stores either the result data or the result data received from the main program processing CPU as prerequisite data for the next arithmetic processing (see reference). Figures 4-9 ).

[0101] When the CPU is acting as a backup program, the verification unit 404 verifies the result data of the executed operation with the result data received from the main program CPU. For example, it determines whether the two are consistent. If they are inconsistent, the result data received from the main program CPU overwrites the result data stored as the prerequisite data for the next operation.

[0102] The storage unit 500 stores a processing control program 502 for enabling the fail-safe CPU 10 to function as a processing CPU 14, and allocation data 510.

[0103] The allocation data 510 manages the data allocated to its own program. According to the allocation program, corresponding to the allocation program ID (which serves as the identification information of the allocation program), the allocation program itself is stored; the allocation category indicating whether it is assigned to the main program or the backup program; the received input data as input data received from the main CPU 12 corresponding to the allocation program; the calculation result data as the calculation result of the allocation program; and the received calculation result data as the calculation result received from the main program processing CPU when it is the processing CPU of the backup program.

[0104] [Effects]

[0105] According to this embodiment, the security of the fail-safe computer system 1 equipped with multiple fail-safe CPUs 10 can be maintained, and its reliability can be improved. Specifically, the main CPU 12 sends input data corresponding to the allocation program to the main program processing CPU (priority processing CPU) and the backup program processing CPU (preparatory processing CPU), which are the processing CPUs responsible for the allocation program's computational processing. The main program processing CPU and the backup program processing CPU then perform computational processing based on the input data to obtain the computational result. Thus, the computational processing of the allocation program is dualized. As long as the data transmission and reception between the fail-safe CPUs are performed correctly, the same computational result data based on this dualized computational processing can be obtained. Therefore, the stability of data transmission and reception can be ensured, and the overall security of the system can be maintained and its reliability improved even when multiple fail-safe CPUs are present.

[0106] Furthermore, the main program processing CPU stores the calculation result as the prerequisite data for the next calculation and sends the calculation result to the backup program processing CPU. The backup program processing CPU stores either its own calculation result or the calculation result received from the main program processing CPU as the prerequisite data for the next calculation. Thus, for each calculation based on input data, the calculation result can be kept consistent between the main program processing CPU and the backup program processing CPU, thereby maintaining security and further improving reliability.

[0107] Furthermore, the embodiments to which this invention can be applied are not limited to the embodiments described above, and appropriate modifications can be made without departing from the spirit of this invention.

[0108] Explanation of reference numerals in the attached figures

[0109] 1: Fail-safe computer system; 10: Fail-safe CPU; 12: Main CPU; 200: Processing unit; 202: Distribution control unit; 204: Process control unit; 206: Distribution switching control unit; 208: Input / output control unit; 210: Transmit / receive control unit; 300: Storage unit; 302: Main control program; 310: Distribution management data; 14: Processing CPU; 400: Processing unit; 402: Arithmetic processing unit; 404: Verification unit; 406: Transmit / receive control unit; 500: Storage unit; 502: Processing control program; 510: Distribution data; 20: Internal bus.

Claims

1. A fail-safe computer system comprising a main central processing unit (CPU) and multiple processing CPUs, wherein the main CPU and the multiple processing CPUs are all fail-safe CPUs, wherein, The main central processing unit has: The allocation control unit, for each allocation program, determines and allocates the priority processing central processor and the preparatory processing central processor among the plurality of processing central processors to be responsible for the computational processing of that allocation program. as well as The process control unit sends the given input data for the allocation program to the priority processing central processing unit and the pre-processing central processing unit that were assigned the allocation program, causing the priority processing central processing unit and the pre-processing central processing unit to perform calculations based on the input data following the previous calculations, and obtain the calculation result data. When the processing CPU is the priority processing CPU, the processing CPU performs arithmetic processing based on the input data, stores the result data as prerequisite data for the next arithmetic processing, and sends the result data to the main CPU and the pre-processing CPU. When the processing central processing unit is the pre-processing central processing unit, the processing central processing unit performs arithmetic processing based on the input data, sends the arithmetic result data to the main central processing unit, and stores either the arithmetic result data or the arithmetic result data received from the priority processing central processing unit as the premise data for the next arithmetic processing.

2. The fail-safe computer system according to claim 1, wherein, When the processing central processing unit is the pre-processing central processing unit, the processing central processing unit checks the operation result data of the executed operation processing against the operation result data received from the priority processing central processing unit.

3. The fail-safe computer system according to claim 1, wherein, The fail-safe central processing units operate asynchronously. The execution cycle of the main central processing unit is shorter than that of the processing central processing unit.

4. The fail-safe computer system according to any one of claims 1 to 3, wherein, The process control unit receives the input data from the outside, causing the priority processing central processing unit and the pre-processing central processing unit to perform calculations based on the input data, and to use the calculation result data obtained earlier from either the priority processing central processing unit or the pre-processing central processing unit and output the calculation result data to the outside.

5. The fail-safe computer system according to any one of claims 1 to 3, wherein, The main central processing unit has an allocation switching control unit. When the non-received state of not receiving calculation result data from the priority processing central processing unit after sending the input data meets a predetermined long-term condition, the allocation switching control unit performs an allocation switching to set the preparatory processing central processing unit as the new priority processing central processing unit and the priority processing central processing unit as the new preparatory processing central processing unit.

6. The fail-safe computer system according to claim 5, wherein, The allocation switching control unit determines whether the long time condition is met based on the elapsed time after receiving the calculation result data from the pre-processing central processor.

Images