JPS592943B2 - Multiprocessor system failure handling method - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a multiprocessor system failure handling scheme, particularly in a multiprocessor system in a system such as an electronic switching system that performs real-time processing.
A fault control unit FCU having a so-called wired logic configuration is provided, which receives a fault signal when a fault occurs in at least one of the processors CP, and instructs other healthy processors to handle the fault. The present invention relates to a multiprocessor system failure handling method in which failure handling is executed via a multiprocessor system.

In conventional multiprocessor systems, when at least one processor CP fails, the failed processor is either left as failed or disconnected from the system. However, in systems that require real-time processing and systems that perform on-line processing, it is desirable that after a fault occurs, another healthy processor promptly handles the fault. Failure handling here refers to (:) abnormally terminating the job being processed by the failed processor or handing it over to a healthy processor, and (1) freeing the memory area used by the failed processor. (111) Performing processing to release the input/output device that was being used by the faulty processor. In order to have the above-mentioned healthy processors perform fault processing, a device is required to monitor the faults in each processor and instruct the fault processing, but on the other hand, if a fault occurs in the device itself, This could lead to system failure.

For this purpose, a wired
It is desirable to provide this type of device with a logic configuration, and to simplify the configuration to further reduce the possibility of failure. The multiprocessor system fault handling method of the present invention is aimed at solving the above problems.In a multiprocessor system configured by combining a plurality of processors, each processor detects the occurrence of a fault in itself. The processor is equipped with a fault detection function to detect the occurrence of a fault, and also has a fault control device that receives fault signals from each processor and instructs other processors to handle the fault.
Each of the processors is provided with means for transmitting a fault signal indicating the occurrence of a fault in itself to the fault control device, and
When the fault control device receives a fault signal from the processor, it selects at least one processor other than the processor that sent the fault signal, and sends an interrupt signal instructing the selected processor to handle the fault. It is characterized by

This will be explained below with reference to the drawings.

FIG. 1 shows an embodiment of a multiprocessor type electronic switching system to which the present invention is applied, FIG. 2 is a connection diagram showing the connection between each processor and the fault control unit FCU referred to in the present invention, and FIG. 3 4 is a detailed diagram of the signal contents of the fault information transmission line FSL sent from the fault control device FCU to each processor CP, FIG. 4 is a flowchart showing an example of the operation of the fault control device FCU according to the present invention, and FIG. B and C are flowcharts showing an example of the operation on the processor side in fault handling according to the present invention; FIG. 6 is a configuration of an embodiment of the fault control device FCU; FIG. 8 shows the configuration of an embodiment of the individual fault control circuit 1FC shown in FIG. 7, and FIGS. 9-1 to 9-7 show the structure of the fault control device F shown in FIG. 6.
An example configuration of each part of the CU, FIG. 10 shows an example configuration of the SP bus controller shown in FIG. 1, and FIG. 11 shows an example configuration of the communication path device SPU and abnormality monitoring device ESE shown in FIG. An example configuration is shown.

In FIG. 1, 1-1 to 1-n are processors CP, 2-1 to 2-n are central controllers CC, 3-1 to 3-n are individual memories, and 4
are the fault control units FCU, 5-1 to 5- according to the present invention.
j is a channel device SPU, 6 is a channel bus, 7 is a channel bus controller SPBC, 8 is a common memory device CM,
9 is a common memory bus, 10 is a common memory bus controller CMBC, 11 is a channel device CH, 12 is a channel bus, 13 is a channel bus controller CHBC, 14
is an input/output device bus, 15 is a magnetic drum device 1) R, l6
is a magnetic tape device MT, l7 is a typewriter device TYP
, l8 represents the abnormality monitoring device ESE.

Each processor 1-1 executes processing while accessing the common memory device 8 and each individual memory 3-1,
Controls the communication path device 5. Each processor 1-1 is connected to a failure control device 4 and provides failure notification. FIG. 2 shows the relationship between the failure control unit FCU and each connected device.

Reference numerals 1-1 to 1-N, 4, 7, 1O, 13 and 18 in the figure correspond to those in FIG. Further, 20-1 to 201n are failure signal lines CPD, 2l-1 to 21-n are offline display lines 0FL, and 22-1 to 22-n are interrupt signal lines FIL, 23-1 to 23
-n is the initial setting activation line 1SL, 24 is the failure processing completion notification line FPE, and 25-1 to 25-n are failure recovery notification lines F.
RST, 26 is a failure information transmission line FSL, 2r is a clear signal line CLR, 28 is a system down detection signal line SYD,
29l to 29-n represent fault processor indicator lines FID. Figure 3 shows the failure information transmission line FS in Figure 2.
The FSL is composed of n+m signal lines including m FSTT information lines indicating fault indications FCPN to FCPNn and fault state numbers of each processor.

FIG. 4 is a flowchart illustrating an example of the operation of the fault control unit FCU according to the present invention, and FIG. 5 is a flowchart illustrating an example of the operation on the processor side in trouble handling according to the present invention.

An example of the failure handling operation of the present invention will be described with reference to FIGS. 1, 2, and 3 in accordance with FIGS. 4 and 5.

If a failure such as a power cut occurs on +ICPl-1, the corresponding C
Pl-1 prevents failure from occurring due to ≠ICPD2O-1
Notify CU4.

FCU4 displays faulty CP indication F due to ≠1CPD20-1.
Set CPNi and ≠IFID29-1. Subsequently, the failure CP number is compared with the master CP display described later using ≠1CPD20-1. If ◆ICP has been the master CP until now, it will become the new master CP≠JC
Re-select P, and if the master CP display is not ΦICP but ≠JCP, do not change the master CP display, ◆
An interrupt signal FIL22-j is sent to the JCP, and a timer is activated at the same time. ◆When the JCP receives FIL, if this CP is a processor controlled by a microprogram, it generates a microprogram address for interrupt processing and executes the interrupt processing (see FIG. 5B). In interrupt processing, the operation currently being processed is interrupted, the processing status is temporarily stored in 1M,
Starts the failure handling program after analyzing the cause of the interrupt. The fault processing program performs fault processing based on the information of the FSL 26, and after the processing is completed, the fault processing completion notification line FP
Return E24 to FCU4. FCU4 is FPE24
When detected, the timer is reset and control ends.
If +JCP cannot normally complete failure processing, the timer will overflow.

When the timer overflows, FCU4 determines that +JCP is a failure, and displays failure CP indication FCPN of +JCP.
” and ≠JFID29-j, select a new CP as the master CP again, and repeat the above control. Further, when all CPs send fault signals or all CPs' fault indications are set, the FCU 4 updates the fault state number FSTT and changes the state of the fault state from the number of FSTT.
P, for example, selects ≠KCP, sends a CLR signal 27 instructing all CPs to initialize, and then sends an ISL signal 261k instructing +KCP to start initializing, and starts a timer.

When ΦKCP receives the ISL signal 26-k, the
As shown in the figure, a microprogram address for initial setting startup processing is generated, a system setup program is read from the magnetic tape device 16 under microprogram control,
The program is stored in the IM3-k, and after reading is completed, the program starts from the first address. The system establishment program performs the initial settings of the entire system based on the FSTT of the FSL information 26 and reconfigures the system to enable normal processing, and upon completion of the processing, notifies the FPE 24 and ≠KCP of failure recovery. The signal 25-k is sent back to the FCU4. F.C.
When U4 detects the FPE 24, it resets the timer and ends the control. If +KCP cannot normally complete the system startup process, the timer overflows, the FSTT is updated, and the above operation is repeated. Also FC
U4 is the system down detection signal SYD from ESEl8.
28 is also received, the same control as when a failure indication of all CPs is detected is performed. FIG. 6 shows an example of the configuration of the fault control device FCU4 according to the present invention.

In addition, in the figure, for ease of understanding, CPl-1~
1-n are shown in duplicate. Codes 1-1 to 1 in the diagram
-N, 4, 7, lO, l3, l8, 2O-1 to 20
-N, 2ll to 21-N, 22-1 to 22-N
, 23-1 to 23-N, 24, 25-1 to 25
-N, 26, 27, 28, 29-1 to 29-n correspond to FIG. 1 and FIG. 2, respectively. FCU4 is CP
Faulty CP detection circuit FCPDETlOO, which detects CPD signals 20-1 to 20-n and 0FL signals 211 to 21-n from l-1 to 1-n and displays a CP-compatible fault.
System down detection circuit SYDDETlOl detects detection of SYD signal 28 from ESEl8 and all CP failures
, a master CP selection circuit MCPSEL1O2,F that determines the CP that instructs failure handling and system startup processing.
Timing circuit TM that creates control timing for CU4
GlO3, clock circuit TIMERlO4, failure state counter circuit FSTClO that counts the number of system down times
5. Activation signal sending circuit 1DV106 that sends FIL signals 22-1 to 22-n, ISL signals 23-1 to 23n, and CLR signal 27 to each CP;
Fault information sending circuit FDVl that sends out signals 9-1 to 29-n
It is composed of each circuit of O7. Details of each circuit of the FCU 4 and content signal lines will be described later in FIGS. 9-1 to 9-7.

FIG. 7 shows a processor applied to the present invention≠ICPl-
1 shows the configuration of a microprogram-controlled processor.

In the figure, symbols 1-1, 2-I, 3-1, 6, 7, 10, 1
2, 13, and 19 correspond to those in FIG. 1, respectively. The central control unit CC includes, as components, an instruction register R2OO that stores instructions read from L8-1, a microprogram address generation circuit MPAGN2Ol that generates a microprogram address, a microprogram address register MPAR2O2 that stores a microprogram address, and a microprogram address register MPAR2O2 that stores a microprogram address. Microinstruction registers MIR2O4 and MIR2O4, M which store the microphone instruction which is one step of the microprogram read from the microprogram memories MPM2O3 and MPM2O3 which store the program.
A decoder DEC2O5 that decodes the IR information and creates and sends a control signal for the entire CC, a microprogram execution control circuit MPC2O6 that controls microprogram execution based on the MIR information, and an instruction that stores the address information of the instructions stored in the IM. Address register IAR2O7, IAR
Adder circuit +1ADDER208 that increments by +1, general-purpose register REG2O9 used in the program, arithmetic circuit ALU21O, SPBUF2ll that exchanges information with SPU5-1 to SPU5-j, and SP for accessing SPBUS6.
Sending the SP bus use request signal SPRQ2l2 and the SP bus use 0K signal SP with the bus controller SPBC7.
The SP bus access controller SPAC2l4 controls the reception of AOK2l3, and the sending of the CM bus use request signal CMRQ2l5 and the CM bus use 0K between the CM bus controller CMBClO and the CM bus controller CMBClO for CMBUSl9 access.
CM bus access controller CMAC2l7, which controls reception of signal CMAOK2l6, CMBUF2l8, which exchanges information with CM8, CHBUF2l9, which exchanges information with CHll, and CH for CHBUSl2 access
Sending CH bus use request signal CHRQ22O and CH bus use 0K signal C between bus controller CHBCl3
The CH bus access controllers CHAC222 and IM3-1, which control the reception of HAOK22l, the processor bus PRB223, which connects each buffer register and ALU in the CC, and the processor bus PRB223, which displays various interrupt causes, and the MPAGN2O
It consists of an interrupt cause display circuit 1SF224 that notifies interrupts to CPli, and an individual fault control circuit IFC3OO that sends and receives signals to and from FCU4 and detects faults in CPli.

Details of the internal operation of CC2-1 are omitted because they are not directly related to the present invention.

FIG. 8 shows details of the individual failure control circuit 1FC300, which constitutes a part of the present invention, in the internal configuration of the CC.

In Figure 8, the numbers 4, 20-1, 21-1, 22-1 in the diagram
,23-1,24,25-1,26,27,201,2
04, 223, 224, 300 are shown in Fig. 1 and Fig. 2, respectively.
This corresponds to FIG.

The IFC3OO receives part of the control information of the microphone command from the MIR2O4 via the microcontrol line 301, and decodes this control line using the decoder DEC3O2. Then, the FSL information 26 from the FCU 4 received by the receiver 310 is
A signal FSIR3O3 that controls the opening and closing of the gate 311 is sent to the RB223, an SFPE signal 304 that instructs to send the FPE signal 24 to the FCU4 via the driver 312,
Similarly, the SFRST signal 305 and driver 314 instruct the transmission of the FRST signal 25-1 via the driver 313.
0FLS signal 306, 0FLR signal 307, which instructs to set/reset the transmission of 0FL signal 21-1 via
A TF counter TF3O8 that counts a certain period of time and a reset signal TFRST3O9 are created. Also IFC3O
O has a clock oscillator CPG3l5, +ICPl
-1.

CDD3l6 is a clock stop detection circuit that detects oscillation interruption of CPG3l5, and this detection signal 318 is
Log the logical sum with the overflow signal 317 of O8.3
19 and sent to FCU4 via driver 320.
It is notified via the fault signal CPD2Ol. On the other hand, 1FC
In response to signals from the FCU 4, the receiver 321 receives the CLR signal 27 and instructs the CP to perform initial settings, and the receiver 322 receives the FIL signal 22-1 and sends the FIL signal 22-1 to the receiver 322 via the fault interrupt line FIR 323. to set the ISF 224, receive the ISL signal 23-1 at the receiver 324, and
Instruct PAGN2Ol to start initialization via IPL signal 325. Note that TF3O8 is used to confirm the normality of the program operation of the CP. Under normal conditions, the program resets TF3O8 at regular intervals, and in the event of an abnormality such as a program runaway, resetting is not performed and TF3O8 is reset.
8 overflows and detects an abnormality in the CP. 9th-
1 to 9-7 are detailed diagrams of the FCU 4, and will be collectively described below.

Figure 9-1 shows the failure CP detection circuit FCPDET of FCU4.
The details of lOO are shown, and the circuit is connected to the receiver 40.
1-1 to 401-n receive the CP fault signals 20-1 to 20-n.

The output of 401-1 is the output of each hole or gate 402-1.
CP failure indication FF4O3- through 402-n
Set from 1 to 403-n.

The output of 403-1 to 403-n is the failure indication of each CP≠1FCP to≠NFCPI4O4-1 to 40
4-n to other circuits of the FCU 4.

In addition, the output of 401-1 becomes a pulse output from the edge trigger pulse generators ETG4O5-1 to 405-n, which detect the rising of the 401-1 signal and output a pulse, and pass through OR gate 406 to the CP failure detection signal CPFD.
Emits 4O7. The CP failure indication FF4O3-1 to 403-n transmit the FRST signals 251 to 25-n from the corresponding CP to the receivers 408-1 to 408-1 to 403-n, respectively.
It is set when received at 8-n.

Also, the off-line display signals 0FL21-1 to 21-n from each CP are sent to the receivers 409-1 to 409-1, respectively.
Received at 09-n and corresponding CP failure indication FF4O3
-1 to 403-n. Furthermore, the CP failure indication FF4O3 outputs the master CP indication signal MCP1565.
-1 to 565-n and the overflow signal 0VF501 of the timer circuit TIMERlO4 are logically ANDed by AND gates 408-1 to 408-n, respectively, and the outputs are also set through OR gates 402-1 to 402-n, If a CP that has been instructed to handle a fault cannot normally handle the fault, the CP is displayed as faulty. FIG. 9-2 shows the system down detection circuit 101, and the receiver 450 receives the SYD signal 28 from the ESEl8.
When this signal is received, the edge trigger pulse generator ETG45l generates a system down detection signal SYDD452 pulse.

In addition, a CP failure indication signal 40 is sent from FCPDETlOO.
41 to 404-n are received, and they are ANDed by an AND gate 453 to detect failure indications of all CPs.

The outputs of receiver 450 and gate 453 send a system down indication SYDI 455 through OR gate 454. FIG. 9-3 shows the timing circuit TMGlO3 that creates the control timing of the FCU4, and the OR gate 500 is the CP failure detection signal CPFD4O7, the system down detection signal SYDD452, or the timing circuit TIM.
Timing generator TGN5O2 is activated by one of the time-up signals 0VF501 from ERIO4.

TGN5O2 is the control timing Tl, T2, T3, T
4 occur sequentially over time, and MCPS occurs at T1.
Master CP selection timing signal MSL5 to ELIO2
O3 is emitted and system down indication SYDI455
AND gate 504 performs a logical product and issues a state update timing signal CHG5O5 to FSTClO5,
At T3, the AND gate 506 performs an AND with SYDI455 and issues a clear signal sending timing signal SCLR5O7.
The AND gate 510 performs an AND with the negative signal of 5 to generate a CP interrupt signal sending timing signal SFI5O9, and AND gate 510 performs an AND with SYDI to generate an initial setting activation signal sending timing signal SIS5ll to the CP. Signal TS5 instructing to start timing
emits l2. Figure 9-4 shows the master CP selection circuit M
It shows the details of CPSEL1O2.

MCPSEL1O2 is used to select and display a CP to perform fault processing when a fault is detected. Flip Flop (F
F) MCPFl55O-1 to MCPFn55O-
n is a master CP display F that displays the CP that should perform failure processing when a CP failure is detected (this is called a master CP)
Fl NAND gates 551-1 to 551-n are CP
Represents a gate that receives and inverts fault indication signals FCPl4O4-1 to 404-n. Furthermore, the circuit surrounded by a broken line is the priority selection circuit PSL552, and the input 551
-1 to 551-n with signal 1〉2〉
...> It functions to select only one signal in the order of n. That is, when the output of the gate 551-1 is "'1", it is inverted by the gate 553, and the AND gate 55
4-1 to block output from gate 551-2, and connected to NOR gate 555 to make the output of gate 555 SOI and connected to AND gate 554-2 to block output from gate 551-3. In this way, the AND gates 554-n and 55-n except the gates 551-n
It will open only when all the gates of 1-1 are '0I', select one of the CPs with no fault indication and open gate 554.
One output of 11 to 554-n is 1''. AND gates 556-1 to 556-n output each CP fault indication signal FCPI4-1 to 404-n and master CP indication FF output MCPF1 to N55O. -1 to 550-n.C of current master CP display
OR gate 557 that detects whether P is displayed as a fault.
When any one of 556-1 to 556n becomes ``1'', it outputs ``1'', and the AND gate 558 performs an AND with the master CP selection timing signal MSL5O3 to select a new master CP. emit a signal. The output of gate 558 is the output of PSL 554-1 through 554.
-n and AND gates 559-1 to 559-n to set one of the FFs 55O-1 to 550-n and reset the others through OR gates 560-1 to 560-n. In addition, FF55O-1 to 550
-n is an FF that is set when SET and SET are input at the same time. ORGATE 560-1 to 560
One input of −n is the system down detection signal SYDD.
452, force MCP when system down is detected.
Only Fl55O-1 is set and the others are reset. The decoder DEC56l decodes the state display STI562 indicating the number of system down times, and
The signal S1'' is output only to the output corresponding to the number of system downs among the 6l outputs 563-1 to 563-n.

The AND-OR gates 564-1 to 564-n select the master CP display FF outputs 550-1 to 550-n or the outputs 563-1 to 563-n of the DEC 56l in response to the system down display signal SYDI, that is, the system down display is When set, DEC56l
If the output is not set, select the master CP display 550 output and send the selected signal to the master CP.
+1MCPI5651 or +NMC as P display signal
Output PI565-n. Figure 9-5 shows a failure state counter circuit FSTC that counts the number of times the system goes down.
Fault state registers FSTR6OO and FSTR6O which are details of lO5 and store m bits of state information.
+1ADDER601 which adds +1 to the output of TMGlO3, and updates the state by setting the output of +1ADDER601 to FSTR6OO at the timing of generation of output CHG5O5 from TMGlO3. The state is output to other circuits as STIO to STIm signals 602-1 to 602-m. FIG. 9-6 shows details of the activation signal sending circuit 1DV106 that sends the activation signal to the CP,
Clear signal sending timing signal SC from TMGlO3
Clear signal 27 for LR5O7 to each CP using driver 650
and set the CP interrupt signal sending timing SFI5O9 from TMGlO3 to drivers 651-1 to 651-.
Master CP indication signal M from MCPSELIO2 at n
Interrupt signals 22-1 to 22-n are sent to each CP by logically ANDing them with CPIs 565-1 to 565-n, respectively.

Similarly, the initial setting start signal sending timing signal SIS5ll from TMGlO3 is transmitted to the drivers 652-1 to 652-1.
At 2-n, logical AND is performed with each of the MCPIs 565-1 to 565-n, and initialization activation signals 23-1 to 23-n are sent to each CP. Figure 9-7 shows details of the fault information sending circuit FDVlO7, and FSTClO5.
State information from STl6O2-1 to STl602-m
The drivers 700-1 to 700-m send fault state numbers FSTTO to FSTTm to each CP as part of the fault information transmission line FSL26. Further, the drivers 701-1 to 701-n are FCPDETlOO
FCPI4O4-1 to 404-n and MCPS from
MCPl565-1 to 565-n from ELlO2
For those with failure CP indications whose master CP indication is not set, calculate the CP failure indications FCPNl to FCPNn for each CP.
It is sent to P as part of the fault information sending line FSL26.
Furthermore, the outputs of the drivers 701-1 to 701n are S as fault processor display lines FID29l to FID29-n.
It is sent to PBC7, CMBClO, and CHBCl3.
The clock circuit TlMERlO4 (Fig. 6) is TMGlO3
This circuit outputs an overflow signal αT5Ol after a certain period of time when it receives a signal TS5l2 instructing the start of timekeeping from the circuit, and if there is a RESET input before overflow, it clears the timekeeping.

The RESET input of the clock circuit TIMERlO4 is connected to the fault processing end signal FPE24 from the CP, and when the FPE signal is detected, TIMERlO4 is cleared and the fault control device F
Control of CU4 ends. FIG. 10 explains one of the features of the present invention, which is means for preventing a faulty processor from accessing a controlled device that can be accessed by each processor.

Although FIG. 10 uses the SP bus controller SPBC7 as an example, CMBClO and CHBCl3 also have similar means. SPBC 7 receives SP bus use request signals SPRQ2l2-1 to 212-n from each CP through AND gate 8.
00-1 to 800-n, a circuit PSL'801 having the same configuration as the priority selection circuit PSL522 in FIG. Bus use 0K signal SPAOK
2l3-1 to 213-n are sent. Here FCU
4 to fault processor display lines FID29-1 to 29
n is received by the receivers 803-1 through 803-n, the FID signal is inverted and connected to the other input of the AND gates 800-1 through 800-n, respectively, and the SPRQ2l2-1 from the CP with the faulty processor indication is
The signal is suppressed to prevent bus access from the faulty processor. FIG. 11 shows an embodiment of the configuration of the communication path device SPU and the abnormality monitoring device ESE, and explains another feature of the present invention. 900-1 and 900-2 indicate lines LINE connecting to other stations.

The communication path device SPU≠I5-1 is connected to the network NW9Ol, which connects LINE9OO-1 to LINE900-2.
Network controller NWC9O2 that controls the connection of NW9Ol, trunks TRK9O3-1 to 903-P, TRK9O that send and receive various signals such as dial signals
Trunk controller TRKC9O4, which controls 3, receives control signals from ≠ICPl-1 via SPBUS6 and distributes them to NWC9O2 and TRKC9O4, and also receives response information from NWC9O2 and TRKC9O4 from ≠I
It is composed of a signal reception distribution circuit SRD9O5 that returns the signal to CPl-1. The abnormality monitoring device ESEl8 includes an interval timer ITM9O6 that generates a SEND pulse 912 at regular intervals, a supervisory signal transmitter SST9O8 that transmits a supervisory signal SS9O7, and a response signal receiver 911 that receives a response signal SR9O9 and emits a set signal RST91O.
, starts with the SEND pulse 911 from TM906, counts a certain period of time, and outputs the system down signal SYD after the certain period of time has elapsed.
The error detection timer EDTM 913 is configured to emit an error detection timer 28 and, upon receiving an RST signal 910 before a predetermined period of time has elapsed, stop clocking and initialize.

The ITM9O6 issues a SEND signal 912 at regular intervals, and the SST9O8 thereby sends a signal to the SS line 907.

SS line 907 connects to TRK9O3- via NW9Ol.
connected to j. At the same time, the SEND pulse 912 causes the EDTM 9l3 to start measuring time. On the other hand≠ICPl
-i is sent to TRKC via SRD9O5 at regular intervals.
It sends control information to 9O4 and checks the signal reception status of TRK9O3. ◆TRK9O3 if ICPl-1 is normal
-j detects a signal change and sends control information to TRKC9O4 to send a response signal, and from TRK9O3-k to NW
A response signal is sent to the SR line 909 via 9Ol.
When SRT9ll receives a response signal, RST9lO
is sent to EDTM to stop timing. If all CPs fail and no CP failure signal is issued, this case is caused by a program bug, but the previous TF
When resetting correctly no longer performs substantial processing, there is no response to the SS line signal 907 from the SST9O8, and the EIyI'M913 overflows and sends a system down signal SYD28 to the FCU4.

In other words, the ESEl8 is the final means of detecting whether this system is functioning normally, and even if a failure is detected in this device, the FCU4 is activated to recover from the failure and maintain system availability. It is something to do. As explained above, according to the present invention, there is provided a fault control unit FCU which is configured with wired logic and has a minimally simplified configuration to minimize the occurrence of faults in itself, so that when a fault occurs in at least one processor, other An interrupt is issued to each processor to handle the failure, and when all processors fail, initial settings are made, the processor is selected repeatedly, and the initial settings are started to recover from the failure and start the system as much as possible. can be measured and the effectiveness of the system can be improved.

[Brief explanation of the drawing]

FIG. 1 shows an embodiment of a multi-processor type electronic switching system to which the present invention is applied, FIG. The figure shows a link from the fault control unit FCU to each processor C.
4 is a flowchart showing an example of the operation of the fault control device FCU according to the present invention, and FIG. 5 is a detailed diagram of the signal contents of the fault information sending line FSL sent to P. FIG. 6 is a flowchart showing an example of the operation of the fault control device FCU, FIG. 7 is an embodiment of the structure of the processor CP, and FIG. 8 is an example of the individual fault control circuit 1FC shown in FIG. Example configuration, FIGS. 9-1 to 9-7 are examples of the configuration of each part of the fault control unit FCU shown in FIG. 6, and FIG. 10 is an example of the SP bus controller shown in FIG. 1. Configuration: FIG. 11 shows an embodiment of the configuration of the communication path device SPU and the abnormality monitoring device ESE shown in FIG. In the figure, 1-1 is a processor, 4 is a fault control device, 5 is a communication path device, 8 is a common memory, 18 is an abnormality monitoring device, and 10
0 is a fault CP detection circuit, 101 is a system down detection circuit, 102 is a master CP selection circuit, 103 is a timing circuit, 104 is a clock circuit, 105 is a fault state counter circuit, 106 is a start signal sending circuit, and 107 is a fault information sending circuit. Represents a circuit.

Claims (1)

[Scope of Claims] 1. In a multiprocessor system configured by combining a plurality of processors, each of the processors has a failure detection function for detecting the occurrence of a failure in itself, and receives a failure signal from each processor. A fault control device is provided for instructing other processors to handle the fault, and each of the processors is provided with means for transmitting a fault signal indicating the occurrence of a fault in itself to the fault control device; When the device receives a fault signal from the processor, the device selects at least one processor other than the processor that sent the fault signal, and sends an interrupt signal instructing the selected processor to handle the fault. Features multiprocessor system failure handling method. 2. Each of the processors includes offline signal sending means for notifying the fault control device that it is offline, and when the fault control device receives a fault signal from the processor, the fault control device receives the fault signal and the offline signal. 2. The multiprocessor system failure handling method according to claim 1, wherein one of the processors that is not activated is selected and an interrupt signal is sent to that processor. 3. Claims characterized in that, when the fault control device sends an interrupt signal to the selected processor, it notifies the selected processor of the faulty processor machine number that sent the fault signal. 2. The multiprocessor system failure handling method according to claim 1. 4. If the fault control device has previously selected one master processor as the processor to send the interrupt signal, and the faulty processor is the master processor when receiving the fault signal from the faulty processor; , reselects the master processor, and sends the reselected master processor the interrupt signal or the interrupt signal and faulty processor machine number information to the master processor. 2. The multiprocessor system failure handling method according to claim 1, wherein: 5. The fault control device includes a counter that measures when the interrupt signal is issued to the processor, and when the counter times out, reselects a new processor and sends the interrupt signal again. A multiprocessor system failure handling method according to claim 1, characterized in that: 6 The fault control device is equipped with a circuit that detects that all the processors are sending fault signals, and upon detection, sends an initial setting start signal to one processor, and the processor executes the initial setting program. 3. A multiprocessor system failure handling method according to claim 1 or 2, further comprising means for: 7. The fault control device includes means for reselecting the processor to which the initialization activation signal should be sent each time the circuit for detecting that all the processors are sending fault signals detects a fault in all the processors. 7. A multiprocessor system failure handling method according to claim 6. 8. The fault control device includes means for counting the number of times the circuit detects that all of the processors are sending a fault signal every time a fault is detected in all of the processors, and the number of times is determined by the initial setting activation signal. 8. The multiprocessor system failure handling method according to claim 7, further comprising means for notifying the processor at the time of sending. 9. The failure control device includes means for considering an offline signal sent by a part of the processors when executing an offline job as a failure signal, and when all the processors issue the failure signal, the failure control device according to claim 6 7. A multiprocessor system failure handling method according to claim 6, characterized in that the multiprocessor system failure handling method performs the following operations. 10 The multiprocessor system has a controlled device that can be accessed from each processor, and the faulty control device includes means for sending the faulty processor machine number information to the controlled device, Claim 3 is characterized in that it comprises means for inhibiting access from the processor corresponding to the faulty processor machine number.
Multiprocessor System Failure Handling Methods Described in Section. 11 The multiprocessor system described above is equipped with an abnormality monitoring device that issues a processing request at regular intervals, and the abnormality monitoring device monitors the response from the system after issuing the processing request, and if no response is detected, the abnormality monitoring device issues a processing request to the fault control device. 7. The multifunction device according to claim 6, further comprising means for issuing a system down signal when the fault control device receives the system down signal, and sends the initialization activation signal to one processor. Processor system failure handling method.