JPH08202588A - Failure tolerant computer device - Google Patents

Abstract

(57) [Summary] [Object] The present invention is to enable accurate diagnosis of a runaway state of a central processing unit. [Structure] Arithmetic processing period (operating) and vacant period (stopped)
To the central processing units 101 and 102 which are set so as to execute the calculation processing in a constant cycle including alternately, and which outputs an identification signal for identifying the arithmetic processing period (operating) and the idle period (stopped). , The central processing units 101, 10
2 is provided with a counter that is synchronized with the fixed cycle of 2 and generates a stop check pulse independently in the idle period, the stop check pulse and the identification signal are supplied, and the central processing unit 101, 102 runs out of control. When the identification signal indicates the operating state of the device at the time of generation of the stop check pulse, the central processing units 101, 102
By turning off the power, the intended purpose is achieved.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a fault-tolerant computer apparatus suitable for a system requiring high reliability such as an attitude control system in a flying body (satellite) that travels in outer space.

[0002]

2. Description of the Related Art Generally, a computer is used as a control device for various systems, but in a system that requires particularly high reliability, two central processing units operate in exactly the same manner. Then, usually, the system is controlled by the main system central processing unit, and when an abnormality occurs in the main system central processing unit, it is switched to the sub system central processing unit to operate. In this case, the main system central processing unit is switched off to shut down the system, and the sub system central processing unit switches to perform system control instead.

As a method for realizing this, a diagnostic device using a watchdog counter has been conventionally used.
As shown in FIG. 3, the above-mentioned diagnostic device monitors a pulse output from a central processing unit that operates by alternately repeating an operation period and a stop period at a constant cycle. The central processing unit outputs this pulse in synchronization with the stop period, and this pulse is used as a clear pulse for the counter. When the central processing unit stops supplying a clear pulse of a certain period, the counter judges that the central processing unit is in a runaway state and the central processing unit is turned off, and turns off the power of the central processing unit. It is configured.

[0004]

However, in the above-mentioned abnormality judging means, when the central processing unit is in a runaway state (shown by a broken line in FIG. 3) such that the clear pulse is continuously output, this is detected. Impossible to do. This is because the counter is always cleared and its count content does not increase. Therefore, an object of the present invention is to provide a fault-tolerant computer system capable of more accurately diagnosing the runaway state of the central processing unit.

[0005]

[Means for Solving the Problem] Calculation processing period (during operation)
A central processing that is set to perform calculation processing in a constant cycle that alternately includes a free period and a free period (stopped), and outputs an identification signal that identifies the arithmetic processing period (operating) and the free period (stopped). The apparatus is provided with a counter that is synchronized with the fixed cycle of the central processing unit and that independently generates a stop check pulse during the idle period. Then, the stop check pulse and the identification signal are supplied,
A detection means is provided for turning off the power of the central processing unit when the identification signal indicates the operating state of the device when the stop check pulse is generated due to the runaway of the central processing unit.

[0006]

When the central processing unit runs out of control by the above means, the logical product of the stop check pulse and the identification signal indicating the stopped state cannot be obtained, so that the runaway state of the central processing unit can be accurately detected. is there.

[0007]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 shows an embodiment of the present invention, which is used, for example, in a satellite attitude control device. Central processing unit 10
1, 102 are connected to a common random access memory (RAM) 104 and a read only memory (ROM) 105 via a common bus 103. Further, the central processing units 101 and 102 are external devices (actuator wheels to be controlled, gas jet thrusters, etc.) 10
6. Connected to an input device 107 for collecting various data.

Each of the central processing units 101 and 102 is a device for executing a calculation process in a constant cycle including an arithmetic processing period (operating) and an idle period (stopped) alternately.
An identification signal A for identifying the arithmetic processing period (operating) and the free period (stopped) is output. This identification signal is supplied to the abnormality monitoring circuits 11 and 12 provided corresponding to the central processing units 101 and 102, respectively.

The monitoring operation on the side of the central processing unit 101 will be described as a representative. The abnormality monitoring circuit 11 has a stop check pulse generating means for independently generating a stop check pulse in synchronization with a period in which the identification signal A indicates that the operation is stopped. further,
The stop check pulse from the stop check pulse generating means is supplied to the check means. This checking means calculates the logical product of the identification signal and the stop check pulse, and obtains the power supply control signal B of the central processing unit according to the result of the logical operation. If the check means confirms the stopped state, the check means continues the operation of the central processing unit 101. On the contrary, if the operation state is confirmed, it is determined that the central processing unit 101 is out of control, and this central processing unit The power of the processing device 101 is turned off. When the power of the central processing unit 101 is turned off, the central processing unit 102, which performs the same calculation, operates the system instead.

FIG. 2 is a time chart showing an operation example of the apparatus of the present invention. If the central processing unit is operating normally, a stop check pulse is generated when the identification signal A is at a level (for example, 0) indicating that the central processing unit stops operating. At this time, for example, a counter clear pulse is obtained. Further, if the stop check pulse occurs when the central processing unit is in a runaway state and the identification signal is at a level (for example, 1) indicating the operating state, the counter clear pulse is not obtained and the count value of the counter increases. When the count value of this counter increases, a power control signal B for turning off the power of the central processing unit is obtained.

In FIG. 2, the central processing unit is shown to be turned off in the second cycle after it has gone into a runaway state. However, this is set so that the power is turned off after a few more cycles. Good. In particular, in a special atmosphere such as outer space, for example, it is assumed that one of the processing devices is irradiated with radiation, and a part of the data changes from 0 to 1 or from 1 to 0. Such a sporadic or accidental error may return to a normal state when the processing device itself is reset, and thus a period for resetting the power without turning off the power supply may be provided immediately. In the above description, the abnormality monitoring circuit 11 has been described, but the abnormality monitoring circuit 12 also performs similar monitoring on the central processing unit 102.

[0012]

As described above, the present invention can provide a fault tolerant computer system capable of more accurately diagnosing the runaway state of the central processing unit.

[Brief description of drawings]

FIG. 1 is a structural explanatory view showing an embodiment of the present invention.

FIG. 2 is a time chart shown for explaining the operation of the apparatus of FIG.

FIG. 3 is a time chart shown for explaining the operation of the conventional device.

[Explanation of symbols]

 101, 102 ... Central processing unit. 103 ... Data bus. 104 ... RAM. 105 ... ROM. 106 ... Output device. 107 ... Input device. 11, 12 ... Abnormality monitoring device.

Claims (1)

[Claims] 1. An arithmetic processing period (operating) and an idle period (stopped) are set so as to perform calculation processing in a fixed cycle alternately, and the arithmetic processing period (operating) and idle period (stop) are set. A central processing unit that outputs an identification signal that identifies (medium), a counter that is synchronized with the fixed cycle of the central processing unit, and that generates a unique stop check pulse during the empty period; An identification signal is supplied, and detection means is provided for turning off the power of the central processing unit when the identification signal indicates the operation period at the time of generation of the stop check pulse due to runaway of the central processing unit. A fault-tolerant computer device.