Fail-Safe Computer System

Abstract

To maintain the safety of a fail-safe computer system equipped with multiple fail-safe CPUs and improve its reliability. [Solution] In a fail-safe computer system (1), a master CPU (12) determines and assigns, for each assigned program, a priority processing CPU and a backup processing CPU to handle the arithmetic processing of the assigned program, sends given input data for the assigned program to the priority processing CPU and the backup processing CPU, causes them to execute arithmetic processing based on the input data following the previous arithmetic processing, and obtains arithmetic result data. The priority processing CPU executes arithmetic processing based on the input data and sends the arithmetic result data to the master CPU (14) and the backup processing CPU. The backup processing CPU executes arithmetic processing based on the input data and sends the arithmetic result data to the master CPU (12).

Description

[Technical Field]

[0001] The present invention relates to a fail-safe computer system. [Background technology]

[0002] For example, in systems that require high safety and reliability, such as the logical processing units of safety devices in railway signaling systems, computer systems are configured and realized using fail-safe CPUs (fail-safe computers) (e.g., Patent Documents 1 and 2). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2019-147532 [Patent Document 2] Japanese Patent Application Publication No. 2018-118595 Summary of the Invention [Problem to be solved by the invention]

[0004] As systems become more complex and higher speed calculations are required, there is a demand for further improvements in the processing power of fail-safe CPUs. Therefore, a system configuration that uses multiple fail-safe CPUs to perform parallel calculations is being considered. In this case, to achieve high safety and reliability for the entire system, it is necessary to ensure the integrity of data transmission and reception between the fail-safe CPUs.

[0005] The problem to be solved by the present invention is to maintain the safety and improve the reliability of a fail-safe computer system having multiple fail-safe CPUs. [Means for solving the problem]

[0006] The first invention to solve the above problem is: 1. A fail-safe computer system comprising a master CPU and a plurality of processing CPUs, each of which is a fail-safe CPU, The master CPU: an allocation control unit that determines and allocates, for each allocated program, a priority processing CPU and a backup processing CPU from among the plurality of processing CPUs that will be in charge of processing the allocated program; a process control unit that transmits given input data for the assigned program to the priority processing CPU and the backup processing CPU to which the assigned program is assigned, causes the CPU to execute a calculation process based on the input data subsequent to the previous calculation process, and obtains calculation result data; and The processing CPU In the case of the priority processing CPU, the priority processing CPU executes a calculation process based on the input data, stores the calculation result data as premise data for the next calculation process, and transmits the calculation result data to the master CPU and the backup processing CPU; In the case of the spare processing CPU, the spare processing CPU executes a calculation process based on the input data, transmits calculation result data to the master CPU, and stores either the calculation result data or the calculation result data received from the priority processing CPU as premise data for the next calculation process. It is a fail-safe computer system.

[0007] According to the first aspect of the present invention, it is possible to maintain the safety of a fail-safe computer system equipped with multiple fail-safe CPUs and improve its reliability. That is, a master CPU transmits input data corresponding to an assignment program to each of a priority processing CPU and a backup processing CPU, which are processing CPUs in charge of arithmetic processing of the assignment program, and causes the CPUs to execute arithmetic processing based on the input data and obtain arithmetic result data. This duplicates the arithmetic processing of the assignment program, and if data transmission and reception between the fail-safe CPUs is performed correctly, the duplicated arithmetic processing can obtain the same arithmetic result data, thereby ensuring the integrity of data transmission and reception, and making it possible to maintain the safety of the entire system and improve its reliability even when equipped with multiple fail-safe CPUs.

[0008] The priority processing CPU stores the calculation result data as premise data for the next calculation result and transmits it to the backup processing CPU, and the backup processing CPU stores either the executed calculation result data or the calculation result data received from the priority processing CPU as premise data for the next calculation result. This makes it possible to match the calculation result data between the priority processing CPU and the backup processing CPU for each calculation process based on input data, thereby maintaining safety and further improving reliability.

[0009] The second invention is the above-mentioned invention, the processing CPU, when it is the backup processing CPU, verifies the calculation result data of the executed calculation process against the calculation result data received from the priority processing CPU; It is a fail-safe computer system.

[0010] According to the second aspect of the present invention, the backup processing CPU verifies the result of the operation it has executed with the result of the operation received from the priority processing CPU. As a result, even if, for example, input data transmitted from the master CPU to the backup processing CPU is corrupted due to a transmission / reception error, the prerequisite data stored in the backup processing CPU is made to match the prerequisite data stored in the priority processing CPU, so that the next operation will not be affected, and safety can be maintained and reliability can be improved.

[0011] The third invention is the above-mentioned invention, The fail-safe CPUs are asynchronous processes, The execution period of the master CPU is shorter than the execution period of the processing CPU. It is a fail-safe computer system.

[0012] According to the third aspect of the present invention, the time required for data transmission and reception between the master CPU and the priority CPU and the backup CPU can be shortened, thereby improving the processing speed.

[0013] A fourth aspect of the present invention is the above-mentioned invention, the process control unit receives the input data from an external device, causes the priority processing CPU and the backup processing CPU to execute arithmetic processing based on the input data, and adopts the arithmetic result data obtained earlier from either the priority processing CPU or the backup processing CPU and outputs it to the outside. It is a fail-safe computer system.

[0014] When the fail-safe CPUs are asynchronous, the timing at which the operation result data is obtained from the priority processing CPU and the backup processing CPU may differ, but the reliability of the operation process itself is guaranteed because the priority processing CPU and the backup processing CPU are fail-safe CPUs. Therefore, by adopting the operation result data obtained earlier from either the priority processing CPU or the backup processing CPU, as in the fourth invention, the time from external input of input data to external output of the operation result can be shortened, and the processing speed can be improved.

[0015] The fifth invention is the above-mentioned invention, The master CPU: an allocation switching control unit that performs allocation switching such that the backup processing CPU becomes the new backup processing CPU and the priority processing CPU becomes the new backup processing CPU when a state in which no calculation result data has been received from the priority processing CPU satisfies a predetermined long-term condition after the transmission of the input data; having It is a fail-safe computer system.

[0016] When the fail-safe CPUs are asynchronous, the timing at which the master CPU receives the operation result data from the priority processing CPU and the backup processing CPU may differ, but the difference is expected to be within a predetermined time according to the execution cycle. Therefore, as in the fifth invention, if the state in which operation result data has not been received from the priority processing CPU satisfies a predetermined long-term condition after transmission of input data, it is possible to maintain safety and improve reliability by switching the allocation of the processing CPUs as the priority processing CPU and the backup processing CPU. For example, if a transmission / reception error occurs between the master CPU and the priority processing CPU, the state in which operation result data has not been received from the priority processing CPU will continue, so in such a case, it is possible to switch the allocation of the processing CPUs as the priority processing CPU and the backup processing CPU.

[0017] The sixth invention is the above-mentioned invention, the allocation switching control unit determines whether the long-time condition is satisfied based on the elapsed time after receiving the calculation result data from the backup processing CPU. It is a fail-safe computer system.

[0018] According to the sixth aspect of the present invention, it is possible to determine whether the long-time condition is satisfied based on the elapsed time after receiving the calculation result data from the backup processing CPU. This makes it possible to quickly switch the allocation of the processing CPUs to the priority processing and backup processing CPUs when, for example, a transmission / reception error occurs between the master CPU and the priority processing CPU. [Brief explanation of the drawings]

[0019] [Figure 1] An example of the application of a fail-safe computer system. [Figure 2] FIG. 1 is an explanatory diagram of distributed processing of a program. [Figure 3] FIG. 2 is an explanatory diagram of program execution control. [Figure 4] FIG. 2 is an explanatory diagram of program execution control. [Figure 5] FIG. 2 is an explanatory diagram of program execution control. [Figure 6] FIG. 2 is an explanatory diagram of program execution control. [Figure 7] FIG. 2 is an explanatory diagram of program execution control. [Figure 8] FIG. 2 is an explanatory diagram of program execution control. [Figure 9] FIG. 2 is an explanatory diagram of program execution control. [Figure 10] Example of master CPU functional configuration. [Figure 11] Example of functional configuration of processing CPU. DETAILED DESCRIPTION OF THE INVENTION

[0020] Hereinafter, preferred embodiments of the present invention will be described with reference to the drawings. Note that the forms to which the present invention can be applied are not limited to the following embodiments. In addition, in the description of the drawings, the same elements are given the same reference numerals.

[0021] 1 is a diagram showing an application example of a fail-safe computer system according to this embodiment. As shown in Fig. 1, the fail-safe computer system 1 according to this embodiment is configured by connecting multiple fail-safe CPUs 10 via an internal bus 20 so that they can send and receive data.

[0022] The fail-safe CPU 10, also known as a fail-safe computer, is a computer that has a redundant internal configuration and ensures high safety and reliability. Specifically, a single fail-safe CPU 10 is internally configured with two or more systems, either software or hardware, each of which executes the same process. Only when the processing results of each system are identical is a normal processing result output. If the results do not match, a self-diagnostic function is provided to indicate a failure. The fail-safe CPU 10 is implemented as a blade computer (also referred to as a CPU board, etc.) in which electronic elements such as a CPU and memory are mounted on a single electronic circuit board. The fail-safe computer system 1 is implemented as a blade computer system in which multiple blade computers, each consisting of these fail-safe CPUs 10, are mounted within a housing.

[0023] In this embodiment, of the multiple fail-safe CPUs 10 constituting the fail-safe computer system 1, one is configured as a master CPU 12, and the others are configured as processing CPUs 14. For ease of understanding, the master CPU 12 is illustrated in the drawings as if it were a single fail-safe CPU 10, but it is preferable to implement it in a redundant configuration (e.g., a duplex configuration) using multiple fail-safe CPUs 10. Although the internal bus 20 is illustrated as a single bus in the drawings, it is preferable to implement it in a redundant (dual) bus configuration. The master CPU 12 controls data input / output with the outside of the system, causes the processing CPU 14 to execute arithmetic processing based on input data, and outputs the arithmetic results to the outside. Furthermore, the fail-safe CPU 10 executes processing at a predetermined execution cycle, but the arithmetic processing is executed asynchronously between the fail-safe CPUs 10. Furthermore, the execution cycle of the master CPU 12 is designed to be shorter than the execution cycle of the processing CPU 14.

[0024] In the fail-safe computer system 1 of this embodiment, in order to ensure the integrity of data transmitted and received between the fail-safe CPUs 10, the following processing is performed.

[0025] 2 is a diagram illustrating the allocation of programs in the fail-safe computer system 1. In the fail-safe computer system 1, programs to be executed are distributed among a plurality of processing CPUs 14. That is, although there are a plurality of programs to be executed, these programs are allocated to the processing CPUs 14 in units of one or a plurality of programs that are not related to each other (the processing result of one is not related to the processing of the other programs).

[0026] Furthermore, programs are made redundant by being assigned to two processing CPUs 14 as a pair, one as a primary and the other as a backup. In the example of Fig. 2, there are three "programs A to C" that the fail-safe computer system 1 should execute, which are unrelated programs that can be executed independently. Each of the three "programs A to C" is assigned to two processing CPUs 14 as a pair of a primary and a backup. Furthermore, the combination of processing CPUs 14 assigned varies for each program. These programs are managed and identified by identification information (program ID).

[0027] Fig. 3 is a diagram illustrating execution control of one program, focusing on the flow of data. As shown in Fig. 3, one program (assigned program) is assigned to two processing CPUs 14 (14a, 14b), and one processing CPU 14 is assigned as the primary, and the other processing CPU 14 is assigned as the backup. That is, in the example of Fig. 3, the processing CPU 14a is assigned as the primary, and the processing CPU 14b is assigned as the backup. The processing CPU 14 assigned as the primary (processing CPU 14a in Fig. 3) is called the primary processing CPU (priority processing CPU), and the processing CPU 14 assigned as the backup (processing CPU 14b in Fig. 3) is called the backup processing CPU (standby processing CPU).

[0028] The master CPU 12 transmits input data for the allocation program, among data input from outside the system, to the primary processing CPU and the backup processing CPU. The primary processing CPU and the backup processing CPU perform calculation processing of the allocation program based on the input data received from the master CPU 12 and premise data, which is the result of the previous calculation, and transmit the calculation result to the master CPU 12.

[0029] The master CPU 12 outputs the calculation result received from the primary processing CPU and / or the backup processing CPU to the outside of the system as the calculation result for the input data. At this time, the master CPU 12 adopts the calculation result received earlier (first) from the calculation results received from the primary processing CPU and the backup processing CPU, and outputs it to the outside. If the calculation results are received simultaneously (reception processing at the same execution cycle), the calculation result from the primary processing CPU is adopted preferentially. Furthermore, as will be described in detail later, if the calculation result from the backup processing CPU is received first, the master CPU 12 waits for the calculation result from the primary processing CPU, and if the state in which the calculation result cannot be received from the primary processing CPU satisfies a predetermined long-term condition, the master CPU 12 switches the allocation between primary and backup.

[0030] The primary processing CPU also transmits the calculation results to the backup processing CPU. The backup processing CPU compares its own calculation results with those received from the primary processing CPU. Specifically, it stores its own calculation results as prerequisite data for the next calculation, and when it receives a calculation result from the master CPU, it checks whether the received calculation result matches its own stored calculation result. If they do not match, it overwrites its own stored calculation result with the received calculation result, and the received calculation result becomes the prerequisite data to be used for the next calculation process.

[0031] 4 to 9 are diagrams for explaining the execution control of one program in chronological order. In Fig. 4 to 9, the vertical direction (downward) represents time, and the processes of the master CPU 12 and the two processing CPUs 14 (first processing CPU and second processing CPU) to which the program is assigned are shown, with thick arrows indicating data transmitted and received between them. The first processing CPU is the primary processing CPU to which the primary program is assigned, and the second processing CPU is the backup processing CPU to which the backup program is assigned.

[0032] Each rectangle (square) divided along the time axis of the master CPU 12 and the processing CPU 14 represents one execution cycle. The execution cycle of the master CPU 12 is 1 / 4 of the execution cycle of the processing CPU 14. The execution content written within the rectangle is the content executed in the corresponding execution cycle. For each execution cycle, the fail-safe CPU 10 (master CPU 12 and processing CPU 14) first performs self-diagnosis processing, then performs data transmission / reception processing with other fail-safe CPUs 10, and then performs other processing such as arithmetic processing of the allocation program. In addition, input data for the allocation program is intermittently input from outside the fail-safe computer system 1. This input data is data that becomes the initial value of the allocation program. The allocation program is arithmetically processed based on the input data (details will be described later, but more precisely, the allocation program is arithmetically processed based on the input data and the result of the immediately previous arithmetic processing), and the arithmetic result is obtained and output to the outside of the fail-safe computer system 1. Therefore, in the drawings, inputs or input data are indicated by circled numbers, and the same circled numbers are used for calculation processes based on this input data, calculation results, and outputs.

[0033] 4 shows an example of operation when transmission and reception between the fail-safe CPUs 10 are normal. When the master CPU 12 receives the first input data for the assigned program from outside the system, it transmits the input data (first time) to the primary processing CPU and the backup processing CPU in the next execution cycle.

[0034] The primary processing CPU receives input data (first time) from the master CPU 12, and performs arithmetic processing (first time) of the allocation program based on the received input data (first time). Then, in the next execution cycle, it outputs the arithmetic result (first time) to the master CPU 12 and the backup processing CPU. Similarly, the backup processing CPU receives input data (first time) from the master CPU 12, performs arithmetic processing (first time) of the allocation program based on the received input data (first time), and outputs the arithmetic result (first time) to the master CPU 12 in the next execution cycle.

[0035] The master CPU 12 receives the calculation result (first time) from each of the primary processing CPU and the backup processing CPU, but since the reception processing is performed in the same execution cycle in Fig. 4, the calculation result received from the primary processing CPU is output to the outside of the system as the calculation result for the first input data. Furthermore, when the backup processing CPU receives the calculation result (first time) from the primary processing CPU, it verifies its own calculation result (first time) with the calculation result (first time) received from the primary processing CPU and determines whether they match.

[0036] Subsequently, after the master CPU 12 outputs the calculation result for the first input data to the outside of the system, the second input data for the allocation program is input from the outside of the system. Processing based on this second input data is also performed in the same manner.

[0037] 5 shows an example of operation when the calculation results of the primary processing CPU and the backup processing CPU do not match. The primary processing CPU and the backup processing CPU, including the master CPU 12, are also fail-safe CPUs 10. Therefore, when the primary processing CPU and the backup processing CPU perform calculation processing on the same input data, the calculation results should be the same. The example in FIG. 5 shows an example of operation when some kind of bit error occurs during transmission and reception between the fail-safe CPUs 10, causing a data error and ultimately resulting in a mismatch in the calculation results. Specifically, this shows an example in which a bit error occurs during the process of transmitting input data from the master CPU 12 to the backup processing CPU, causing a data error in this second input data.

[0038] To explain the differences from the operation example shown in Figure 4, when the backup processing CPU receives the calculation result of the calculation process based on the second input data from the primary processing CPU, it compares its own calculation result (second time) with the calculation result (second time) received from the primary processing CPU, and determines that they do not match. This is because a data error occurred in the second input data. In this case, it overwrites its own stored calculation result (second time) with the calculation result (second time) received from the primary processing CPU. As a result, the premise data used by the primary processing CPU and the backup processing CPU in the calculation process based on the next third input data will match, and the calculation results (third time) of the calculation process will match.

[0039] FIG. 6 shows an example of operation when the primary processing CPU cannot receive input data from the master CPU 12. In FIG.

[0040] To explain the differences from the operation example shown in Fig. 4, the operation example in Fig. 6 is an example in which input data is transmitted from the master CPU 12 to each of the primary processing CPU and the backup processing CPU for the first time, but a communication failure occurs between the master CPU 12 and the primary processing CPU, and the primary processing CPU does not receive the input data (for the first time) from the master CPU 12. In this case, the primary processing CPU does not perform arithmetic processing of the assignment program based on the first input data, and the primary processing CPU does not transmit the arithmetic result (for the first time) to the master CPU 12 and the backup processing CPU.

[0041] On the other hand, the backup processing CPU receives input data (first time) from the master CPU 12, performs arithmetic processing (first time) of the assignment program based on the received input data (first time), and transmits the arithmetic result (first time) to the master CPU 12. However, since the arithmetic result (first time) from the primary processing CPU is not received, the backup processing CPU does not verify its own arithmetic result (first time).

[0042] The master CPU 12 outputs the calculation result (first time) received from the backup processing CPU to the outside of the system as the calculation result for the first input data.Then, the master CPU 12 waits to receive the calculation result (first time) from the primary processing CPU, but when a state in which the calculation result from the primary processing CPU is not received (non-received state) satisfies a predetermined long-term condition, it transmits a primary / backup switching instruction to the primary processing CPU and the backup processing CPU.That is, it transmits a switching instruction to change the allocation to backup to the primary processing CPU, and a switching instruction to change the allocation to primary to the backup processing CPU.

[0043] The long-term condition is a time condition under which it is assumed that the calculation result is not received normally from the primary processing CPU. Specifically, it is defined as a period equivalent to a predetermined number of execution cycles (five cycles in FIG. 6) based on the reception of the calculation result from the backup processing CPU. For example, it is defined as a time longer than the execution cycle of the processing CPU 14, taking into account that the fail-safe CPU 10 is an asynchronous process and the execution cycle of the processing CPU 14.

[0044] When the first processing CPU, which is the primary processing CPU, receives a switch instruction to switch to backup from the master CPU 12, it operates thereafter as a backup processing CPU that executes the assigned program as a backup. When the second processing CPU, which is the backup processing CPU, receives a switch instruction to switch to primary from the master CPU 12, it operates thereafter as a primary processing CPU that executes the assigned program as a primary.

[0045] Therefore, the second processing CPU, which is the new primary processing CPU, performs calculation processing of the assignment program based on the second input data received from the master CPU 12, and transmits the calculation results to the master CPU 12 and the first processing CPU, which is the new backup processing CPU.

[0046] The first processing CPU, which is the new backup processing CPU, performs arithmetic processing of the allocation program based on the second input data received from the master CPU 12, and transmits the arithmetic result to the master CPU 12. Then, it verifies the arithmetic result received from the second processing CPU, which is the new primary processing CPU, with its own arithmetic result, but because the first processing CPU, which is the new backup processing CPU, did not perform arithmetic processing of the allocation program based on the first input data, it determines that the two do not match. Then, it overwrites its own stored arithmetic result (second time) with the arithmetic result (second time) received from the second processing CPU, which is the new primary processing CPU.

[0047] As a result, the new primary processing CPU (second processing CPU) and the new backup processing CPU (first processing CPU) will have the same premise data used in the next (third) calculation process based on the input data.

[0048] 6, the master CPU 12 receives the calculation result (second time) from the new backup processing CPU (first processing CPU) before the calculation result (second time) from the new primary processing CPU (second processing CPU). However, a state (non-received state) in which the calculation result from the primary processing CPU (second processing CPU) is not received based on the reception of the calculation result (second time) from the new backup processing CPU (first processing CPU) does not satisfy the long-term condition. Therefore, the master CPU 12 outputs the calculation result (second time) from the new primary processing CPU (second processing CPU) to the outside of the system as the calculation result for the second input data.

[0049] FIG. 7 shows an example of the operation when the master CPU cannot receive the calculation result from the primary CPU.

[0050] 7, the primary processing CPU transmits the calculation result of the calculation process based on the first input data to the master CPU 12 and the backup processing CPU. However, a communication failure occurs between the primary processing CPU and the master CPU, and the master CPU 12 does not receive the calculation result (first time) from the primary processing CPU.

[0051] The master CPU 12 that has not received the calculation result (first time) from the primary processing CPU outputs the calculation result (first time) received from the backup processing CPU to the outside of the system as the calculation result for the first time input data.

[0052] Then, similar to the switching instruction described with reference to Figure 6, when the state in which the calculation result is not received from the primary processing CPU (non-received state) satisfies a predetermined long-term condition, based on the reception of the calculation result (first time) from the backup processing CPU, a primary-backup switching instruction is sent to the primary processing CPU and the backup processing CPU.

[0053] On the other hand, when the backup processing CPU receives the calculation result (first time) from the primary processing CPU, it verifies its own calculation result (first time) with the calculation result (first time) from the primary processing CPU and determines whether they match.

[0054] FIG. 8 shows an example of operation when the backup processing CPU is unable to receive input data from the master CPU 12. In FIG.

[0055] To explain the differences from the operation example shown in Figure 4, the operation example in Figure 8 is an example in which the master CPU 12 sends input data for the first time to each of the primary processing CPU and the backup processing CPU, but a communication failure occurs between the master CPU 12 and the backup processing CPU, and the backup processing CPU does not receive the input data from the master CPU 12.

[0056] Since the backup processing CPU does not receive the input data (first time), it does not perform the arithmetic processing (first time) of the assignment program based on the input data (first time), and the arithmetic result (first time) is not transmitted to the master CPU 12. The master CPU 12 outputs the arithmetic result (first time) received from the primary processing CPU to the outside of the system as the arithmetic result for the first input data.

[0057] When the backup processing CPU receives the calculation result (first time) from the primary processing CPU, it compares its own calculation result (first time) with the calculation result (first time) received from the primary processing CPU, but determines that they do not match because it has not performed calculation processing based on the input data (first time).The backup processing CPU then overwrites its own stored calculation result with the calculation result (first time) received from the primary processing CPU.

[0058] As a result, the primary processing CPU and the backup processing CPU will have the same premise data to use in the next (second) calculation process based on the input data.

[0059] FIG. 9 shows an example of the operation when the master CPU 12 cannot receive the calculation result from the backup CPU.

[0060] 9. The difference from the operation example shown in Fig. 4 is that in the operation example of Fig. 9, the backup processing CPU transmits the calculation result of the calculation process based on the input data for the first time to the master CPU 12. However, a communication failure occurs between the backup processing CPU and the master CPU 12, and the calculation result (first time) from the backup processing CPU is not received by the master CPU 12. The master CPU 12 outputs the calculation result (first time) from the primary processing CPU to the outside as the calculation result for the input data (first time).

[0061] In addition, when the backup processing CPU receives the calculation result (first time) from the primary processing CPU, it verifies its own calculation result (first time) with the calculation result (first time) received from the primary processing CPU and determines that the two match.

[0062] 10 is a block diagram showing an example of the functional configuration of master CPU 12. As shown in FIG.

[0063] The processing unit 200 includes an allocation control unit 202 , a process control unit 204 , an allocation switching control unit 206 , an input / output control unit 208 , and a transmission / reception control unit 210 .

[0064] The allocation control unit 202 determines and allocates, for each allocation program, a priority processing CPU and a backup processing CPU from among a plurality of processing CPUs that will be in charge of the arithmetic processing of the allocation program (see FIG. 2). That is, the allocation control unit 202 determines a primary processing CPU that is a priority processing CPU and a backup processing CPU that is a backup processing CPU as the processing CPUs to which the arithmetic processing of the allocation program will be allocated.

[0065] The allocation of the processing CPUs is managed by allocation management data 310. The allocation management data 310 stores, for each program to be executed, allocation data associated with a program ID that is identification information for the program, external input data that is data that corresponds to the program and is input from outside the system, and received calculation result data that is the calculation result received from each of the primary processing CPU and the backup processing CPU. The allocation data includes a primary processing CPU ID that is identification information for the primary processing CPU that processes the program, and a backup processing CPU ID that is identification information for the backup processing CPU that processes the program.

[0066] The process control unit 204 transmits given input data for the allocation program to the primary processing CPU and backup processing CPU associated with the allocation program, executes calculation processing based on the input data following the previous calculation processing, and obtains calculation result data (see Figures 4 to 9).

[0067] Furthermore, the process control unit 204 outputs the computation result data obtained from either the primary processing CPU (priority processing CPU) or the backup processing CPU (standby processing CPU) to the outside. At this time, the computation result data obtained from the primary processing CPU may be preferentially adopted and output to the outside, or the computation result data obtained earlier from either the primary processing CPU or the backup processing CPU may be preferentially adopted and output to the outside.

[0068] If the state in which the operation result data has not been received from the primary processing CPU satisfies a predetermined long-term condition after the transmission of the input data, the allocation switching control unit 206 performs allocation switching so that the backup processing CPU becomes the new primary processing CPU and the primary processing CPU becomes the new backup processing CPU. For example, whether the long-term condition is satisfied is determined based on the elapsed time after the operation result data has been received from the backup processing CPU (see FIGS. 6 and 7).

[0069] The input / output control unit 208 controls the input and output of data to and from the outside of the fail-safe computer system 1 .

[0070] The transmission / reception control unit 210 controls data transmission and reception with other processing CPUs 14 via the internal bus 20 .

[0071] The storage unit 300 stores a master control program 302 for causing the fail-safe CPU 10 to function as the master CPU 12, and allocation management data 310.

[0072] 11 is a block diagram showing an example of the functional configuration of the processing CPU 14. As shown in FIG.

[0073] The processing unit 400 includes an arithmetic processing unit 402 , a testing unit 404 , and a transmission / reception control unit 406 .

[0074] The arithmetic processing unit 402 executes arithmetic processing based on input data, stores the arithmetic result data as premise data for the next arithmetic processing, and transmits the arithmetic result data to the master CPU 12. If it is the primary processing CPU, it also transmits the arithmetic result data to the backup processing CPU. If it is the backup processing CPU, it stores either the arithmetic result data or the arithmetic result data received from the primary processing CPU as premise data for the next arithmetic processing (see FIGS. 4 to 9).

[0075] When the verification unit 404 is the backup processing CPU, it verifies the computation result data of the executed computation process with the computation result data received from the primary processing CPU. For example, it determines whether the two match, and if they do not match, it overwrites the computation result data stored as premise data for the next computation process with the computation result data received from the primary processing CPU.

[0076] The storage unit 500 stores a processing control program 502 for causing the fail-safe CPU 10 to function as the processing CPU 14, and allocation data 510.

[0077] The allocation data 510 is data for managing the allocation of programs to itself. For each allocated program, the allocation data 510 stores, in association with an allocated program ID that is identification information of the allocated program, the allocated program itself, an allocation type indicating whether the allocated program is allocated as a primary or backup, received input data that is input data corresponding to the allocated program received from the master CPU 12, calculation result data that is the calculation result of the allocated program, and received calculation result data that is the calculation result received from the primary processing CPU when the allocated program is a backup processing CPU.

[0078] [Action and effect] According to this embodiment, it is possible to maintain the safety of a fail-safe computer system 1 equipped with multiple fail-safe CPUs 10 and improve its reliability. That is, the master CPU 12 transmits input data corresponding to an allocation program to each of the processing CPUs 14 in charge of arithmetic processing of the allocation program, that is, a primary processing CPU (priority processing CPU) and a backup processing CPU (standby processing CPU), and causes them to execute arithmetic processing based on the input data to obtain an arithmetic result. This duplicates the arithmetic processing of the allocation program, and if data transmission and reception between the fail-safe CPUs is performed correctly, the same arithmetic result data can be obtained by the duplicated arithmetic processing. This ensures the integrity of data transmission and reception, and it is possible to maintain the safety of the entire system and improve its reliability even when equipped with multiple fail-safe CPUs.

[0079] Furthermore, the primary processing CPU stores the calculation result as premise data for the next calculation result and transmits it to the backup processing CPU, and the backup processing CPU stores either the executed calculation result or the calculation result received from the primary processing CPU as premise data for the next calculation result. This makes it possible to match the calculation results between the primary processing CPU and the backup processing CPU for each calculation process based on input data, thereby maintaining safety and further improving reliability.

[0080] It should be noted that the applicable embodiments of the present invention are not limited to the above-described embodiments, and can be modified as appropriate without departing from the spirit of the present invention. [Explanation of symbols]

[0081] 1. Fail-safe computer system 10...Fail-safe CPU 12...Master CPU 200...Processing section 202... Allocation control unit 204...Process control section 206... Allocation switching control unit 208... Input / output control unit 210...Transmission and reception control unit 300...Storage section 302...Master control program 310...Allocation management data 14...Processing CPU 400...Processing section 402...arithmetic processing unit 404…Certification Department 406...Transmission and reception control unit 500...Storage section 502...Processing control program 510...Allocation data 20...Internal bus

Claims

1. 1. A fail-safe computer system comprising a master CPU and a plurality of processing CPUs, each of which is a fail-safe CPU, The master CPU an allocation control unit that determines and allocates, for each allocated program, a priority processing CPU and a backup processing CPU that are in charge of processing the allocated program from among the plurality of processing CPUs; a process control unit that transmits given input data for the assigned program to the priority processing CPU and the backup processing CPU to which the assigned program is assigned, causes the CPU to execute a calculation process based on the input data subsequent to the previous calculation process, and obtains calculation result data; and The processing CPU In the case of the priority processing CPU, the priority processing CPU executes a calculation process based on the input data, stores the calculation result data as premise data for the next calculation process, and transmits the calculation result data to the master CPU and the backup processing CPU; In the case of the backup processing CPU, the backup processing CPU executes a calculation process based on the input data, transmits calculation result data to the master CPU, and stores either the calculation result data or the calculation result data received from the priority processing CPU as premise data for the next calculation process. Fail-safe computer system.

2. the processing CPU, when it is the backup processing CPU, verifies the calculation result data of the executed calculation process against the calculation result data received from the priority processing CPU; 10. The fail-safe computer system of claim 1.

3. The fail-safe CPUs are asynchronous processes, The execution period of the master CPU is shorter than the execution period of the processing CPU.

10. The fail-safe computer system of claim 1.

4. the process control unit receives the input data from an external device, causes the priority processing CPU and the backup processing CPU to execute arithmetic processing based on the input data, and adopts the arithmetic result data obtained earlier from either the priority processing CPU or the backup processing CPU and outputs the result data to the outside.

4. The fail-safe computer system of claim 3.

5. The master CPU an allocation switching control unit that performs allocation switching such that the backup processing CPU becomes the new priority processing CPU and the priority processing CPU becomes the new backup processing CPU when a state in which no calculation result data has been received from the priority processing CPU satisfies a predetermined long-term condition after the transmission of the input data; having 10. The fail-safe computer system of claim 1.

6. the allocation switching control unit determines whether the long-time condition is satisfied based on the elapsed time after receiving the calculation result data from the backup processing CPU.

6. The fail-safe computer system of claim 5.

Images