JPH11265321A - Fault restoring method central processing unit and central processing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To execute various fault restoring processing by judging a fault generation source in a central processing system having double redundant constitution. SOLUTION: In a method arranging a 1st central processing unit(CPU) 11 of an action system to be functioned as a CPU and a 2nd CPU 12 of a stand-by system not functioned as a CPU and having the same constitution as the 1st CPU 11 in parallel and capable of restoring a fault generated at the time of writing the same information in main memories respectively included in the 1st and 2nd CPUs 11, 12 at the same cycle, the 1st CPU 11 judges which CPU generates a fault during the writing operation, the 1st CPU 11 or the 2nd CPU 12, and restoring processing different in accordance with the judged result is executed.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a central processing system, and more particularly to a system backup function when a failure occurs in a RAM (random access memory) storing a program of a private branch exchange (PBX) and system data. It can be applied to the central processing system provided.

The present invention also relates to a central processing unit as a component of such a central processing system.

[0003] Further, the present invention relates to a failure recovery method used in such a central processing system.

[0004]

2. Description of the Related Art Conventionally, in a switching system or an information processing system, a double redundant configuration is often adopted in order to prevent the system from being stopped or to improve the reliability of the system.

In this double redundant configuration, an act-based (operating) central processing unit currently operating as a central processing unit of the system, and a central processing unit having the same configuration as the central processing unit, And a central processing unit of a standby system (waiting) that is not operating is juxtaposed.

The same programs and data are written (double-written) in the same cycle in the main memory (RAM) incorporated in these two central processing units. When writing is completed, a response signal is sent from each main memory and supplied to the wired OR response notification line.

The write access time-out period is defined as a single optimal time for the system.
At that time, if at least one of the two response signals that should be sent from each main memory is not sent,
A time-out failure has occurred, an interrupt has been performed in the act-based central processing unit, and failure recovery processing has been executed.

[0008]

However, in the above-mentioned method, when a response signal is not sent from one main memory due to a time-out failure in the double write access, it is determined which main memory is the response signal. There is no means, and with the interrupt processing defined in advance,
The same failure recovery processing was performed for both the act system and the standby system.

[0009]

According to a first aspect of the present invention, there is provided an act-type first central processing unit functioning as a central processing unit and a standby unit not functioning as a central processing unit. In this system, the first central processing unit and a second central processing unit having the same configuration are juxtaposed, and the same information is written to the main memories of the first and second central processing units in the same cycle. In the recovery method for the failure that occurs sometimes, the first central processing unit of the act system determines whether the failure that occurred during the write operation has occurred in the first or the second central processing unit, A different recovery process is performed according to the result of this determination.

A central processing unit which writes the same information in the same cycle to the built-in self-system memory and the external another-system memory in the same cycle is characterized as follows.

That is, in the second invention, (1) own system response means for notifying the built-in central processing unit control circuit that one cycle of information writing to the own system memory has been completed; And (3) another system response means for notifying the central processing unit control circuit that the writing of information for one cycle to the other system memory has been completed. (3) The self-response means is provided by a predetermined timing corresponding to the cycle. When the notification is not received from the response unit of the system or the other system, the central processing unit performs a different recovery process depending on which response unit does not receive the notification.

Further, a central processing system according to a third aspect of the present invention is characterized in that the central processing system is configured by connecting a plurality of central processing devices according to any one of the third and fourth aspects.

[0013]

DESCRIPTION OF THE PREFERRED EMBODIMENTS (A) Embodiment An embodiment will be described below, taking as an example a case where a failure recovery method, a central processing unit and a central processing system according to the present invention are applied to a PBX exchange.

(A-1) Configuration of the Embodiment FIG. 1 shows a central processing system 10 according to the embodiment.

Referring to FIG. 1, a central processing system 10 includes two packages of central processing units 11 and 12.

The timeout monitoring circuit 13 in the central processing unit 11 is a timer that starts counting from an initial value upon receiving a start signal sent from the MPU 14 every time a double write access cycle starts. This circuit notifies the MPU control circuit 17 of the elapse of a preset timeout time (timing) for each access cycle to the other system memory 16. The input terminal of the timeout monitoring circuit 13 is connected to a control bus in the composite bus 18 and the output terminal is connected to the MPU control circuit 17 to receive the start signal.

The composite bus 18 includes an address bus and a data bus from the MPU 14 to the own system memory 15 and the other system memory 16 in addition to a control bus between the MPU 14 and the timeout monitoring circuit 13.

The MPU 14 writes (duplicately writes) data and programs necessary for the execution of the basic PBX exchange program (including the double write) into the own system memory 15 and the other system memory 16 (double write). Composite bus 18
To the memories 15 and 16 of the own system and the other system.

In order to notify the completion of the writing to itself by an access response signal (the central processing unit 1
1 is a main memory).
And is connected to the own system receiving circuit 19. Own system receiving circuit 1
Reference numeral 9 is connected to the MPU control circuit 17 to notify the reception of the response signal.

Similarly, the other system memory 16 (which is the main memory of the central processing unit 12) is connected to the control bus 22 to notify the completion of the writing to itself by an access response signal. Is connected to the other-system receiving circuit 23. The other-system receiving circuit 23 is connected to the MPU control circuit 17 to notify the reception of the response signal.

On the other hand, the MPU control circuit 17 includes a failure cause register 24 for the own system and a failure cause register 25 for the other system.
The cause of the failure that occurred during the access to the
4 and the failure factor generated by accessing the other-system memory 16 is stored in the failure factor register 25.

The MPU control circuit 17 transmits a response notification signal indicating that the reception circuits 19 and 23 of the own system and the other systems have notified the reception of the response signal by the timing described later in the one cycle. Are connected to the MPU 14.

The interrupt circuit 26 connected to the fault cause register 24 transmits at least a signal indicating the fault cause of the own system stored in the fault cause register 24,
It is connected to the interrupt control circuit 27.

Similarly, the interrupt circuit 28 connected to the fault cause register 25 includes at least the fault cause register 25
Is connected to the interrupt control circuit 27 in order to send out a signal indicating a cause of failure of another system stored in the interrupt control circuit 27.

In accordance with an output signal from the interrupt circuit 26 or 28, an interrupt control circuit 27 is provided on the internal bus 20 to interrupt the MPU 14 executing the basic PBX exchange program by hardware. MPU14
It is connected to the.

The internal bus 20 for interrupts is, for example, an internal bus composed of three signal lines for transmitting 3-bit information, and has a level of 0 to 0 depending on the cause of the failure and whether the location of the failure is its own system or another system. 7 different interrupt signals are transmitted to the MPU 14. In accordance with the level of the interrupt signal, that is, the interrupt level, the MPU 14 recognizes whether a fault has occurred in the memory of the own system or the other system, and executes different interrupt processing (interrupt program).

Since the configuration of the central processing unit 12 is exactly the same as that of the central processing unit 11, the components other than the other system memory 16, which is the main memory of the central processing unit 12, are omitted.

Hereinafter, the operation of the present embodiment having such a configuration will be described.

(A-2) Operation of the Embodiment The timeout monitoring circuit 13
5, and information on the access timeout time TO for the other-system memory 16 is obtained. Here, it is assumed that TS is longer than TO, for example, TS = 10 μS and TO = 5 μS. However, if necessary, TS may be set to be shorter than TO, and the time may be shorter or longer than 5 μS and 10 μS. In short, the timing of the system is allowed and the MPU control circuit 17 can recognize the TS and TO
There should be a time difference between them. Act-based central processing unit 11 operating as a central processing unit of a PBX exchange
When the MPU 14 is normal, it accesses the own memory 15 and the other memory 16 simultaneously, writes the same data or program, and sends a start signal to the timeout monitoring circuit 13 when the access starts.

Upon receipt of the start signal, the timeout monitoring circuit 13 starts counting time from an initial value.

When the writing by the access is completed, each of the memories 15 and 16 sends a response signal to the receiving circuits 19 and 23 via the control buses 21 and 22. In a normal state, the receiving circuits 19 and 23 respectively receive the response signals before the timings TS and TO, and upon detecting these, the MPU control circuit 17 sends one response notification indicating the reception of both response signals to the MPS.
Send to U14.

At this time, the MPU control circuit 17
Does not receive the TO progress notification or the TS progress notification sent by the timeout monitoring circuit 13. Normally, during the period from when the response notification is sent to when the MPU 14 starts the next cycle, the MPU control circuit 17 sends the TO progress notification and the T
S progress notifications will be received one after another. Of course, a response signal is received from the other system memory 22, TO = 5 μS progress notification is received, a response signal is received from the own system memory 15, TS = 1.
The order may be 0 μS progress notification reception.

In any case, in a normal state, the MPU control circuit 17 has finished sending the response notification at least by the time TS = 10 μS has elapsed, and does not perform any particular operation by receiving the progress notification of TO and TS.

After receiving the response notification, the MPU 14
The next one cycle of write access to the own system memory 15 and the other system memory 16 is started, and the timeout monitoring circuit 13 starts counting from the initial value again at this start timing. While the normal state continues, such a double write cycle is repeated.

While this cycle is repeated,
Standby central processing unit 12 is in standby (standby)
The state is maintained.

In one cycle, the response signal from the own system memory 15 is received by the own system receiving circuit 19 before the timeout time TS, but the other system memory 16
The response signal that should have been output from the
It was not received by now.

In this case, in this cycle, TO = 5 μS
The MPU control circuit 17 that has detected that the other-system receiving circuit 23 has not received the response signal from the other-system memory 16 until the notification of the progress of the “TO” progress, immediately after the notification of the TO progress, causes the other-system fault cause register 25 to fail. A time-out error is stored as a cause, and the cycle of the double writing is terminated.
The MPU control circuit 17 detects the reception of the response signal sent from the local memory 15 before or after this.

The interruption circuit 2 stores the time-out error.
When 8 is detected, the interrupt control circuit 27 sends an interrupt signal to the MPU 14. The level of this interrupt signal is
The failure location is the other system memory 16 or the other system memory 16
And indicates that the cause of the failure is a time-out error, which is selected from the eight levels 0 to 7 described above.

By receiving the interrupt signal, the MPU
14 performs a failure recovery process without performing a write access to the other system memory 16 of the standby system,
Data and the like are written to the local memory 15 as before. Therefore, the function of the central processing unit 11 as the central processing unit of the PBX exchange is not affected at all by the occurrence of the failure.

Then, the other memory 1
If the fault in the sixth part is repaired, the double writing is started again. It is to be noted that the MPU 14 executes the failure repair processing, but the M
A PU (corresponding to the MPU 14) may execute the program. In this case, when an interrupt signal is received, MP
U14 executes processing such as disconnecting the standby system central processing unit 12 and performing re-installation after repairing the failure.

On the other hand, in one cycle when the dual writing is normally performed, the response signal from the other system memory 16 is received by the other system receiving circuit 2 before the timeout time TO.
It is assumed that a response signal, which was received in step 3 but should be output from the local memory 15, was not received before the timeout time TS.

In this case, in this cycle, TS = 10 μm
By the time the S progress notification, the own system receiving circuit 19
MPU that has not received a response signal from
Immediately after the notification of the progress of the TS, the control circuit 17 stores a timeout error as a failure factor in the failure factor register 24 for the own system, and terminates the double writing cycle. In this case, the reception of the response signal from the other-system memory 16 has already been detected by the MPU control circuit 17 at this time.

As in the case of the timeout error of the other system, when the storage of the timeout error is detected by the interrupt circuit 26 for the own system, the interrupt control circuit 27
14 to send an interrupt signal. However, the level of this interrupt signal is different from the above-mentioned interrupt signal. This is the same as the case described above in that the failure factor is a timeout error, except that the failure location is the local memory 15 or a peripheral part of the composite bus 18 that affects the local memory 15.

The MPU 14 recognizing from the interrupt signal that a failure has occurred in its own memory 15, temporarily ends the double write cycle and performs an interrupt process different from the above.

The contents of the interrupt processing can be changed depending on the relationship between the timeout time and the time of one cycle. If the longer timeout period, that is, the remaining one cycle time after the elapse of the local system timeout time TS = 10 μS in this embodiment, cannot afford to execute the failure repair processing, the double write cycle At the same time, the central processing unit 1 which has been the standby system
2 as the act system, the own system stops the operation as the central processing unit of the PBX exchange, and exclusively uses the failure recovery processing. After the failure is repaired, the own central processing unit 11 may become the standby system, or may become the act system again, and the other central processing unit 12 may become the standby system.

If there is enough time, the dual write cycle is started again at the time when the next one cycle should start if the fault repair processing is executed during that time and the repair can be performed. The other system central processing unit 12 may be an act system, and the MPU 14 may be dedicated to the failure repair processing. This has no effect on the operation of the PBX exchange.

If the failure cannot be repaired by the failure repair processing program stored in advance, the central processing unit is replaced for each package.

(A-3) Effects of the Embodiment As described above, according to the present embodiment, even for the same cause of failure, different interrupt processing is performed depending on the location of the failure, and the failure recovery and the act system and the standby system can be performed. It can execute failure recovery processing including various processing such as system switching, and does not affect the operation as the central processing unit even when a failure occurs,
The reliability of the system can be improved.

(B) Other Embodiments In the above embodiment, the own system timeout time TS
Is longer than the other system timeout time TO. However, in practice, the control bus 21,
In 22 as well, the transmission delay of the other system is usually larger, so setting the TS to be shorter than the TO is advantageous in terms of system timing design.

If necessary, three or more central processing units may be connected to form a system with three or more redundancy levels. In this case, the "central processing unit" in the claims
Does not necessarily mean one central processing unit,
One or more central processing units.

Further, in the above embodiment, PB
Although the case where the present invention is applied to the X exchange has been described as an example, the scope of application of the present invention is not limited to this, and a redundant configuration is required among devices that are required to continue operating without stopping for at least a certain period of time. It can be widely applied to central processing units and enhances its reliability.

[0052]

As described above, in the failure recovery method according to the first aspect of the present invention, it is determined whether the failure that occurred during the write operation has occurred in the act-system or the standby-system central processing unit. Since different recovery processes are performed according to the result of the determination, various failure recovery processes can be executed by various interrupt processes, and the reliability of the failure recovery method can be improved.

In the central processing unit according to the second invention, the self-system response means for notifying the built-in central processing unit control circuit that one cycle of information writing to the self-system memory has been completed, A response unit for notifying the central processing unit control circuit that the writing of information for one cycle to the other memory has been completed, and performing a different recovery process depending on which response unit has not received the notification. Therefore, various recovery processes can be flexibly prepared according to the assumed failure situation, and the reliability is high.

Further, in the central processing system according to the third aspect of the present invention constituted by connecting a plurality of such central processing units, the central processing unit has a redundant configuration.
The reliability of the entire system can be improved.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration of a central processing system according to an embodiment.

[Explanation of symbols]

10 central processing system, 11, 12 central processing unit,
13: timeout monitoring circuit, 14: MPU, 15: own system memory, 16: other system memory, 17: MPU control circuit,
18: Composite bus, 19, 23 ... Receiving circuit, 20: Internal bus, 21, 22 ... Control bus, 24, 25 ... Failure factor register, 26, 28 ... Interrupt circuit.

──────────────────────────────────────────────────続 き Continued on front page (51) Int.Cl. ⁶ Identification code FI H04Q 3/58 101 H04Q 3/58 101

Claims (5)

[Claims] 1. An act-type first central processing unit functioning as a central processing unit and a standby system not functioning as a central processing unit, the second unit having the same configuration as that of the first central processing unit. In the main memory of the first and second central processing units and writing the same information in the same cycle in the same cycle. Whether the failure has occurred in the first or the second central processing unit is determined by the first action system.
A failure recovery method characterized in that the central processing unit of (1) makes a determination and performs a different recovery process according to the result of the determination. 2. The fault recovery method according to claim 1, wherein the first central processing unit of the act system stores a fault factor of a fault occurring in the first central processing unit in a first fault factor storage unit. The failure factor of the failure that has occurred in the second central processing unit is stored in the second failure factor storage unit, and the central processing unit built in the first central processing unit of the act system is configured to store the failure The central processing unit receives the interrupt at the interrupt level corresponding to the factor, and the central processing unit that has received the interrupt has at least the standby system when the fault factor storage means storing the fault factor is the first fault factor storage means. A recovery process including switching of the act system is performed, and when the failure factor storage unit storing the failure factor is the second failure factor storage unit, at least a recovery not including the switching between the standby system and the act system. A failure recovery method characterized by performing processing. 3. A central processing unit for writing the same information in the same cycle to a built-in self-system memory and an external another-system memory in one cycle. Self-response means for notifying the central processing unit control circuit that is performing the operation, and other-system response means for notifying the central processing unit control circuit that one cycle of information writing to the other system memory has been completed, By the predetermined timing corresponding to the cycle, when the notification is not received from the response unit of the own system or the other system, the central processing unit performs different recovery processing depending on which notification unit does not receive the notification. A central processing unit. 4. The central processing unit according to claim 3, wherein the recovery processing is performed at least by the central processing unit of the local system if there is no notification from the local system response unit by a first timing in one cycle. If the central processing unit which incorporates the standby system and the other system memory is set as the active system, and there is no notification from the other system response means by the second timing in the one cycle, at least the central system of the own system is used. Means for maintaining the processing apparatus as an act system as it is, executing the above-mentioned restoration processing within the one cycle, and then normally executing information writing in at least the next one cycle to the main memory of the act system. A central processing unit comprising: 5. A central processing system comprising a plurality of central processing units according to claim 3 connected to each other.