Redundant system control device and memory unification method for redundant system control device

Abstract

To enable the generation of equivalent data for transmission to the sub-system, including access information such as data and destination addresses during memory accesses from the CPU, for the purpose of building a redundant system.SOLUTION: A redundant system control device according to the present invention comprises a main system control device and a sub-system control device, and is a redundant system control device that performs synchronization of memory data between data necessary for control stored in a memory of the main system control device and data necessary for control stored in a memory of the sub-system control device. In the memories of both the main system control device and the sub-system control device, memory spaces in which memory data requiring synchronization is stored and memory spaces in which memory data not requiring synchronization is stored are defined.. Furthermore, in the main system control device 100, the CPU 11 accesses the memory via different paths depending on whether it is accessing a memory space in which memory data requiring synchronization is stored or a memory space in which memory data not requiring synchronization is stored.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a redundant control device and a method for achieving memory consistency in the redundant control device. [Background technology]

[0002] Control devices used in infrastructure facilities, industrial plants, etc. are configured with a redundant system consisting of a primary control device and a secondary control device, and in the event of a failure in the primary control device, control is switched over to the secondary control device to continue.In order for the secondary control device to take over the control that the primary control device had been performing until just before, the data in the memory of the primary control device and the secondary control device must always be consistent.

[0003] As a technique for matching memory data between a master control unit and a slave control unit, a technique disclosed in Patent Document 1 has been proposed. Patent Document 1 states that "equivalent data to be sent to the slave system is created in parallel with memory access of the master calculation unit, and memory reading during transmission is omitted, thereby speeding up the equivalent processing." [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent Publication No. 2021-152855 Summary of the Invention [Problem to be solved by the invention]

[0005] Incidentally, with the spread of SoCs (System-on-a-Chip), which integrate a CPU (Central Processing Unit), memory, a memory controller, and other peripheral circuits on a single chip, the application of SoC design is increasing in the development of embedded systems.

[0006] In control devices, the use of SoC designs is expected to increase in the future in order to improve performance and reduce development costs. In order to build a redundant system, the master control device must obtain access information, including data when the CPU accesses memory and the address of the access destination, and generate equivalent data to send to the slave control device.

[0007] The prior art described in Patent Document 1 is based on the premise that memory access from the CPU can be monitored from the functional logic. Therefore, in a control device configured to use an SoC or a CPU and memory implemented inside the SoC, it is not possible to obtain information at the time of memory access, and therefore it is not possible to generate equivalent data.

[0008] The present invention aims to provide a redundant system control device and a memory matching method for the redundant system control device that can obtain access information including data at the time of memory access from the CPU and the address of the access destination in order to construct a redundant system, and generate equivalent data to be sent to the slave control device. [Means for solving the problem]

[0009] The redundant control device of the present invention, which solves the above problems, is constructed using multiple control devices each having an SoC in which a CPU, memory, and memory controller are implemented as a single integrated circuit, and an integrated circuit in which functional logic is implemented, and includes a master control device that normally performs control, and a slave control device that continues control when a failure occurs in the master control device. Data required for control stored in the memory of the master control device is matched with data required for control stored in the memory of the slave control device. Memory spaces for data requiring matching between the master and slave control devices and memory spaces for data not requiring matching are defined in each memory of the master and slave control devices. The CPU in the master control device accesses the memory via different paths for accessing the memory space requiring matching and for accessing the memory space not requiring matching.

[0010] In addition, a memory consistency method for a redundant control device of the present invention for solving the above problems is constructed using multiple control devices each having an SoC in which a CPU, memory, and memory controller are implemented as a single integrated circuit, and an integrated circuit in which functional logic is implemented, and the redundant control device includes a master control device that performs control under normal conditions and a slave control device that continues control when a failure occurs in the master control device, and the method matches memory data stored in the memory of the master control device with data stored in the memory of the slave control device. Then, in each of the memories of the master control device and the slave control device, a memory space is defined in which data requiring memory data consistency between the master and slave control devices is stored, and a memory space is defined in which data not requiring memory data consistency is stored, and the CPU of the master control device accesses the memory via different paths for accessing the memory space requiring memory data consistency and for accessing the memory space not requiring memory data consistency. [Effects of the Invention]

[0011] According to the present invention, the memory spaces of the master and slave systems are separated into a space required for matching memory data and a space not required for matching, and when the master CPU accesses the memory, it accesses via a different route depending on the address space of the memory, thereby generating equivalent data to be sent to the slave control device. Problems, configurations, and effects other than those described above will become apparent from the following description of the mode for carrying out the invention (hereinafter referred to as the embodiment). [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a block diagram showing an example of the configuration of a redundant control device to which the present invention is applied; [Figure 2] 1 is a block diagram showing an example of the configuration of a master control device in a redundant control device according to an embodiment of the present invention; [Figure 3]FIG. 10 is a diagram showing a memory access path when accessing a memory space that does not require matching of memory data between the primary and secondary systems. [Figure 4] FIG. 10 is a diagram showing a memory access path when accessing a memory space that requires matching of memory data between the primary and secondary systems. [Figure 5] FIG. 2 is a diagram illustrating an example of the configuration of an address map as viewed from a CPU. [Figure 6] 10 is a timing chart showing an example of timing of access control in a memory access control unit. [Figure 7] FIG. 2 illustrates an example of the configuration of a data matching control unit. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the following embodiments, when referring to the number of elements, unless otherwise specified or when the number is clearly limited to a specific number in principle, the number is not limited to the specific number and may be more or less than the specific number.

[0014] Furthermore, in the following embodiments, when referring to the shape, positional relationship, etc. of components, etc., it is intended to include those that are substantially similar or approximate to the shape, etc., unless otherwise specified, or unless it is considered in principle that this is not the case. The same applies to the above-mentioned numerical values ​​and ranges. Furthermore, in all drawings used to explain the embodiments, components having substantially the same function or configuration are generally designated by the same reference numerals, and redundant explanations are omitted.

[0015] <Redundant control device to which the present invention is applied> Fig. 1 is a block diagram showing an example of the configuration of a redundant control device to which the present invention is applied. As shown in Fig. 1, the redundant control device 10 to which the present invention is applied is constructed by a primary control device 100 and a secondary control device 200. The primary control device 100 and the secondary control device 200 basically have the same configuration. In the case where a failure occurs in the primary control device 100, the redundant control device 10 switches over to the secondary control device 200 and continues control. In order for the secondary control device 200 to take over the control that the primary control device 100 was performing until just before, it is necessary to keep the data in the memories of the primary control device 100 and the secondary control device 200 consistent at all times.

[0016] With the spread of SoCs, which integrate a CPU, memory, memory controller, and other peripheral circuits on a single chip, the application of SoC design in the development of embedded systems is increasing. The application of SoC design in control devices is also expected to increase in the future in order to improve performance and reduce development costs.

[0017] However, the architecture of an SoC is built by each vendor, and the user of the SoC cannot grasp the design information or the internal operating state of the SoC. In order to build a redundant system, the master control device 100 needs to acquire access information including data at the time of memory access from the CPU and the address of the access destination, and generate equivalent data to be sent to the slave control device 200.

[0018] In an SoC, the CPU typically accesses memory through a closed path within the SoC. This means that the user cannot obtain access information. Therefore, when designing and applying an SoC to a redundant control device 10, a method for obtaining memory access information from the CPU within the SoC is essential.

[0019] 1 illustrates the redundant control device 10 configured by two control devices, the master control device 100 and the slave control device 200, but the number of control devices configuring the redundant control device 10 can be three or more. The greater the number of control devices configuring the redundant control device 10, the more the diversity of the redundant control device 10 can be improved.

[0020] Below, we will explain a redundant system control device and its memory matching method according to one embodiment of the present invention, which aims to match memory data between the primary and secondary systems by obtaining access information when the primary CPU accesses memory in order to build a redundant system and generating equivalent data to be sent to the secondary system.

[0021] <Redundant control device according to one embodiment of the present invention> 2 is a block diagram showing an example of the configuration of a master control device in a redundant control device according to one embodiment of the present invention. Master control device 100, which is the main component of the configuration of the present invention, is composed of an SoC 110 and a functional logic board 120 on which functional logic is implemented. Functional logic board 120 is an example of an integrated circuit, such as an LSI (Large-Scale Integration) or an FPGA (Field Programmable Gate Array).

[0022] [SoC configuration example] The SoC 110 includes at least a CPU 111, a memory controller 112, a memory 113, a bus switch 114, and a bus interface 115. The SoC 110 is a one-chip implementation of the CPU 111, the memory controller 112, the memory 113, and other peripheral circuits as a single integrated circuit.

[0023] The memory 113 stores programs and control data implemented by the main control device 100. The bus switch 114 switches the connection (access path) depending on the access destination requested by the CPU 111. The bus interface 115 controls the interface with the functional logic board 120.

[0024] [Example of functional logic board configuration] The functional logic board 120 includes at least a memory address conversion unit 121 , a memory access control unit 122 , and a data matching control unit 123 .

[0025] The memory address conversion unit 121 converts an access from the CPU 111 to an address on the functional logic board 120 side into a corresponding address in the memory 113 .

[0026] The memory access control unit 122 arbitrates memory access from the CPU 111, user logic 124 that performs memory access and is implemented on the functional logic board 120, and an external interface 125 connected to the user logic 124. The external interface 125 is a PCIe (Peripheral Component Interconnect-Express) or a GPIO (General-Purpose input / output). Furthermore, when the memory access control unit 122 receives a memory access request from the CPU 111, it performs post-write response control without waiting for the completion of actual data writing to the memory 113.

[0027] In parallel with access from CPU 111 to the memory space required for matching memory data, data matching control unit 123 collects the address of the memory to be accessed and the data to be written, and generates shared data to be sent to the slave system.

[0028] [Access path for each memory space] Next, an access path for each memory space accessed when the CPU 111 accesses the memory 113 in the main control device 100 configured as described above will be explained.

[0029] (Memory access path when accessing memory space that does not require matching of memory data) 3 is a diagram showing memory access paths when accessing a memory space that does not require matching of memory data between the primary and secondary systems. When accessing a memory space that is not related to matching of memory data, memory access is performed via a memory access path 201 that is closed inside the SoC 110 and accesses the memory 113 from the CPU 111 via the memory controller 112. The memory access path 201 is an access path to a memory space that does not require matching of memory data.

[0030] Generally, high-speed access is possible inside the one-chip SoC 110. Therefore, high-speed access is possible via the shortest closed path within the SoC 110, that is, the memory access path 201 where the CPU 111 accesses the memory 113 via the memory controller 112, improving the memory access performance of the CPU 111 and the master control device 100.

[0031] (Memory access path when accessing memory space that requires memory data matching) 4 is a diagram showing a memory access path when accessing a memory space that requires matching of memory data between the primary and secondary systems. CPU 111 accesses the memory space that requires matching of memory data via functional logic board 120. At this time, CPU 111 accesses an address assigned to functional logic board 120, and memory address conversion unit 121 converts the access destination to an address where the actual CPU 111 exists.

[0032] The memory access control unit 122 accepts memory access from the CPU 111 through a memory access path 202 based on information such as data other than addresses passed from the CPU 111 and the addresses converted by the memory address conversion unit 121. The memory access path 202 is an access path to a memory space where memory data matching is required. The memory access control unit 122 arbitrates memory access from the CPU 111 and access from other user logic 124 or from an external interface 125 via the user logic 124.

[0033] When the memory access control unit 122 selects a memory access request from the CPU 111, it performs memory access to the CPU 111 on the SoC 110 side via the bus interface 115. At this time, if the CPU 111 has requested a write access to the memory 113, the memory access control unit 122 performs post-write control to return a memory access completion response to the CPU 111 once it has secured bus right to the memory controller 112 via the bus interface 115, without waiting for the actual access to the CPU 111 to be completed.

[0034] In addition, while the memory access control unit 122 accesses the memory controller 112 via the bus interface 115, the data matching control unit 123 collects access information such as addresses and data on the bus, and generates and transmits equivalent data to be shared with the slave system.

[0035] (Example of address map configuration from the CPU's perspective) 5 is a diagram showing an example of the configuration of an address map as seen from the CPU. Address map 301 is made up of at least memory entity space 302 where the entity of memory 113 exists, and functional logic board space 303 allocated to the functional logic board.

[0036] At least two memory spaces are predefined in the memory entity space 302, specifically a data matching valid space 304 and a data matching invalid space 305. The data matching valid space 304 stores data that requires matching of memory data between the primary and secondary systems. The data matching invalid space 305 stores data that does not require matching of memory data between the primary and secondary systems.

[0037] Furthermore, the functional logic board space 303 has at least a memory access space 306 and a functional logic space 307. The memory access space 306 is a space for converting addresses and accessing the memory 113 from the functional logic board 120 side. The functional logic space 307 is a space allocated to the user logic 124 and the external interface 125 via the user logic 124.

[0038] When the CPU 111 accesses the memory 113, if the access destination is the data matching invalid space 305 in which data that does not require matching is stored, the CPU 111 directly accesses an address in the data matching invalid space 305. The access path in this case is the shortest, fastest path closed within the SoC 110.

[0039] When the access destination of CPU 111 is data matching valid space 304 in which data requiring memory data matching is stored, CPU 111 does not directly access an address in data matching valid space 304, but rather accesses memory access space 306 in functional logic board space 303. The access to memory access space 306 is converted into an address in the corresponding data matching valid space 304 by memory address conversion unit 121 mounted on functional logic board 120, and an access to the address in data matching valid space 304 is executed from the functional logic board 120 side to memory 113.

[0040] (Example of access control timing) FIG. 6 is a timing chart showing an example of the timing of access control in memory access control unit 122. In FIG.

[0041] When the memory access control unit 122 receives a memory access request from the CPU 111, it asserts an access request 401 to the bus interface 115. Upon receiving the access request 401, the bus interface 115 asserts an access request 404 to the memory controller 112, similar to the memory access control unit 122.

[0042] Upon receiving the access request 404, the memory controller 112 hands over the bus right to the bus interface 115 and starts actually accessing the memory 113. Then, the status 406 of the memory controller 112 changes to data write. Once the bus interface 115 has secured the bus right to the memory controller 112, it asserts access acceptance 403.

[0043] The memory access control unit 122 monitors the access acceptance 403, and upon detecting that it has been asserted, returns a completion response 402 to the CPU 111 without waiting for the completion of writing data to the memory 113. The bus interface 115 returns a completion response 405 from the memory access control unit 122 to the CPU 111 at the timing when it secures bus rights to the memory controller 112. This makes it possible to send a post write response to the CPU 111 at the fastest possible timing while avoiding overtaking by memory accesses from other requesters.

[0044] When the memory controller 112 completes writing the data to the memory 113, it asserts a completion response 407 to the bus interface 115. The bus interface 115 receives the completion response 407 and similarly asserts a completion response 405 to the memory access control unit 122.

[0045] Upon receiving the completion response 407, the memory access control unit 122 negates its own access request 401, thereby completing the series of access control steps in the memory access control unit 122.

[0046] (Example of the configuration of the data matching control unit) 7 is a diagram showing an example of the configuration of data matching control unit 123. Data matching control unit 123 is made up of matching request control unit 501 and equivalent data storage unit 502 that stores equivalent data.

[0047] When the memory access control unit 122 accesses the bus interface 115, the data matching control unit 123 receives a matching request signal 503 from the memory access control unit 122, which indicates whether the access is necessary for matching memory data. If the received matching request signal is asserted, the matching request control unit 501 asserts a data storage request 504 to the equivalent data storage unit 502.

[0048] When the equivalent data storage unit 502 receives the data storage request 504, it acquires access information 506 including write data, addresses, etc. from a data bus 505 connecting the memory access control unit 122 and the bus interface 115. Then, the equivalent data storage unit 502 generates equivalent data 507 by combining the access data and address information, stores the data in an equivalent data storage buffer memory 508, and outputs the equivalent data 507 stored in the equivalent data storage buffer memory 508 to the slave system in order, starting with the equivalent data 507 that was stored first.

[0049] The matching request control unit 501 monitors the buffer memory status 509 received from the equivalent data storage unit 502. When the matching request control unit 501 determines that the buffer memory 508 for storing equivalent data is not empty and that equivalent data 507 is stored therein, it asserts a transmission request 510 for the equivalent data 507 to the slave system, thereby transferring the equivalent data to the slave system.

[0050] (Actions and Effects of This Embodiment) As described above, in the redundant control device 10 according to this embodiment, a memory space in which control data that needs to be matched between the master control device 100 and the slave control device 200 is stored is defined in advance in the memory 113. Then, when the CPU 111 of the master control device 100 accesses the memory, the access is performed via a different route depending on the address space of the memory 113.

[0051] Specifically, the access paths from the CPU 111 to the memory 113 are separated into access to the memory space (data matching valid space 304) necessary for matching the memory data and access to the memory space (data matching valid space 304) not necessary for matching the memory data. The memory space storing the control data necessary for matching the memory data is accessed via the functional logic board 120, and in parallel with this memory access, the data matching control unit 123 mounted on the functional logic board 120 generates equivalent data to be sent to the slave control device 200.

[0052] In this way, the memory spaces of the master control device 100 and the slave control device 200 are separated into a space required for matching memory data and a space not required for matching, and when the CPU 111 accesses the memory, access is performed via a different path depending on the address space of the memory 113, thereby making it possible to generate equivalent data to be sent to the slave control device 200. Furthermore, in the master control device 100 using the SoC 110, efficient matching of memory data between the master control device 100 and the slave control device 200 becomes possible.

[0053] Furthermore, in memory access via the functional logic board 120, the memory access control unit 122 performs post-write response control, returning an access completion response to the CPU 111 at the point in time when bus rights to the memory controller 112 are obtained, before the memory 113 on the SoC 110 side is actually accessed and data writing is completed. This eliminates the increase in access time due to access via the functional logic board 120, and simultaneously matches memory data and shortens the access time seen from the CPU 111, thereby improving the memory access performance of the master control device 100.

[0054] Furthermore, when accessing a memory area (data matching invalid space 305) that does not require matching of memory data between the master control device 100 and the slave control device 200, the CPU 111 accesses the memory 113 via the memory controller 112 via the shortest route closed within the SoC 110. This enables high-speed access via the shortest route, thereby improving the memory access performance of the master control device 100.

[0055] (Modification of this embodiment) In the redundant control device according to this embodiment, an example has been described in which the access paths are separated according to the address space of the memory 113. However, the access paths may also be separated according to the access type. Examples of the access type include a write access to the memory 113 and a read access.

[0056] When the access paths are separated according to the type of access, equivalent data can be generated in the data matching control unit 123 by performing only write access from the CPU 111 to a memory area that requires memory data matching via a path that passes through the functional logic board 120. For read access from the CPU 111 to a memory area that requires memory data matching, performing memory access via the shortest path that is closed within the SoC 110 makes it possible to further improve memory access performance.

[0057] <<Variations>> It should be noted that the present invention is not limited to the above-described embodiment and includes various modifications. For example, the above-described embodiment has been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to an embodiment having all of the described configurations. [Explanation of symbols]

[0058] 10...Redundant system control device, 100...Main system control device, 110...SoC, 111...CPU, 112...Memory controller, 113...Memory, 114...Bus switch, 115...Bus interface, 120...Functional logic board, 121...Memory address conversion unit, 122...Memory access control unit, 123...Data matching control unit, 200...Slave system control device, 201...Access path to memory space not requiring memory data matching, 202...Access path to memory space requiring memory data matching, 301...CPU address map, 302...Memory entity space, 303...Functional logic board space, 304...Data matching valid space, 305...Data matching invalid space, 306...Space for memory access, 307...Functional logic space, 401...Memory access control unit access request, 402...Memory access control unit completion response, 403...Bus interface access reception, 404... Bus interface access request, 405... Bus interface completion response, 406... Memory controller status, 407... Memory controller completion response, 501... Matching request control unit, 502... Equivalent data storage unit, 503... Matching request, 504... Data storage request, 505... Data bus, 506... Access information, 507... Equivalent data, 508... Equivalent data storage buffer memory, 509... Buffer memory status, 510... Equivalent data transmission request

Claims

1. The system is constructed using a plurality of control devices each having an SoC in which a CPU, a memory, and a memory controller are implemented as a single integrated circuit, and an integrated circuit in which functional logic is implemented; A master control device that normally performs control and a slave control device that continues control when a failure occurs in the master control device are provided, A redundant control device that matches memory data between data required for control stored in a memory of the master control device and data required for control stored in a memory of the slave control device, In each memory of the master control device and the slave control device, a memory space is defined in which data requiring matching of memory data between the master control device and the slave control device is stored, and a memory space is defined in which data not requiring matching of memory data is stored, In the main control device, the CPU accesses the memory via different routes for accessing a memory space that requires matching of the memory data and for accessing a memory space that does not require matching of the memory data. Redundant control system.

2. In the main control device, the CPU accesses a memory space where the memory data needs to be matched via a path that goes through the integrated circuit, and also accesses an address space of the integrated circuit; The integrated circuit comprises: a memory address conversion unit that receives an access from the CPU and converts the access destination address of the access into an address in a memory space that requires matching of the memory data; a data matching control unit that generates equivalent data to be transmitted to the slave control device in parallel with access to the memory space that requires matching of the memory data; The redundant control device according to claim 1 .

3. The integrated circuit further includes a memory access control unit that, upon receiving a write access from the CPU to a memory space that requires matching of the memory data, executes access to the memory and returns a response of completion of the access to the CPU without waiting for completion of actual data writing to the memory. The redundant control device according to claim 2 .

4. The system is constructed using a plurality of control devices each having an SoC in which a CPU, a memory, and a memory controller are implemented as a single integrated circuit, and an integrated circuit in which functional logic is implemented; A redundant control device includes a master control device that normally performs control and a slave control device that continues control when a failure occurs in the master control device, A memory matching method for matching memory data between data necessary for control stored in a memory of the master control device and data necessary for control stored in a memory of the slave control device, comprising: In each memory of the master control device and the slave control device, a memory space is defined in which data that requires matching of memory data between the master control device and the slave control device is stored, and a memory space is defined in which data that does not require matching of memory data is stored, In the main control device, access to the memory by the CPU is performed via different paths depending on whether the access is to a memory space that requires matching of the memory data or a memory space that does not require matching of the memory data. A method for matching memories in a redundant control device.

Images