RU2527191C1 - Backed-up multichannel computer system - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: backed-up dual-processor computer system comprises: three identical channels connected to an OR element and a channel selection signal generator. Each of said channels includes an initial setting circuit, a system generator, a processor, an OR element, a pulse generator, a time operability analyser, an emergency actuation device, switches and a storage device.

EFFECT: high reliability, fault-tolerance and reliability of the computation result.

4 dwg

Description

The present invention relates to computer technology and can be used to build reliable computing and control systems.

Known fault tolerant computing system [1] (analogue). A computing system consists of two processors (channels), an initial installation circuit connected to the processor input of each channel, a system generator whose output is connected to the processor input of each channel, and a control circuit. Each processor can operate in the main processor mode and in the slave processor mode, which controls the operation of another processor. In slave mode, the processor executes the same instructions as the main processor, only all lines through which data is output are turned off. In addition, in the slave mode, a comparison circuit built into the processor checks the output of both processors. The control circuit at certain time intervals switches the operating modes of the processors to control each other's processors. If a mismatch occurs, the slave processor signals an error to the control circuit. The control circuit tries to restore the synchronism of the processors, causing an external interrupt in both processors. If the processor crashed and at that time was a slave processor, then in this case the circuit will work without a slave processor for a time equal to the period of switching the processor operating modes. Then, the failed processor will be transferred to the master mode, and the healthy processor will be transferred to the slave mode, where a malfunction of the main processor will already be detected.

The disadvantage of the system is that when a system generator, which is common to two processors, fails, the entire system fails. In the case of using separate generators, there will be a lack of synchronism in the operation of the processors, which can also occur when the input data from the receiving devices is not received simultaneously.

In addition, the main disadvantage of the system is that the slave processor only controls the operability of the main one and does not perform its functions in the event of a failure.

Known computing device mixed reservation [2] (analogue). The mixed backup device consists of two switched on computing channels and one turned off, which is in cold reserve. In the event of a failure in one of the working channels, the third channel that was in the cold reserve is automatically switched on, and the signals of the three channels are majorized. In case of failure of two working channels, the third channel is turned on, which is in the cold reserve, which forms the output signal.

The disadvantage of the mixed redundancy device is that under unauthorized influences (electromagnetic interference, electrical discharge, radiation), a failure can occur simultaneously in two working channels and as a result of majorization, an unauthorized signal can form. In the event of a failure of two working channels and the connection of a third, which was in a cold reserve, the formation of the output signal occurs without majorization.

Known redundant dual-processor computing system [3] (prototype), containing two identical channels, in each of which the first output of the processor is connected to the first input of the first switch; a system generator whose output is connected to the first input of the processor; a trigger whose output is connected to the first input of the OR-NOT element, the output of which is connected to the second input of the first switch; a pulse generator connected through a temporary health analyzer to the first input of the trigger and the first input of the failure counter, the first output of which is connected to the second input of the OR-NOT element; the initial setup circuit, the output of which is connected to the second input of the processor, the second input of the failure counter, the first input of the OR element, and the outputs of the OR element are connected to the second input of the temporary health analyzer and the second trigger input; comparison circuit, the first input of which is connected to the second output of the failure counter of the first channel, the second input is to the second output of the failure counter of the second channel, the first output of the comparison circuit is connected to the third input of the OR-element of the first channel, and the second - to the third input of the OR- NOT the second channel; emergency start device, the first input of which is connected to the output of the initial installation circuit, the second input is connected to the second output of the processor, and the outputs to the second input of the pulse generator and the second input of the OR element; the second and third switches and a memory device, wherein the first input of the second switch of the first channel is connected to the third output of the processor of the first channel, the fourth output of which is connected to the first input of the third switch of the second channel, the output of the first switch of the first channel is connected to the second input of the third switch of the second channel, the second input of the second switch of the first channel and is the output of the first channel of the system; the output of the second switch of the first channel is connected to the output of the third switch of the first channel and the input of the memory device of the first channel; the first input of the second switch of the second channel is connected to the third output of the processor of the second channel, the fourth output of which is connected to the first input of the third switch of the first channel; the output of the first switch of the second channel is connected to the second input of the second switch of the second channel, the second input of the third switch of the first channel and is the output of the second channel of the system; the output of the second switch of the second channel is connected to the output of the third switch of the second channel and the input of the memory device of the second channel.

In the well-known redundant dual-processor computing system [3], after the arrival of the RES signal from the initial installation circuit, all the system devices are initialized and the processor of the first channel is connected to the output, and the second channel is turned off by the switch. In each channel, together with the main task, the diagnostic task is periodically resolved periodically at fixed intervals of time (the self-diagnosis of the operability of system devices is carried out). In the case of successful diagnostics, short TestOK health pulses are generated, which reset (reset) the temporary health analyzer. In this case, signals from the pulse generator to the failure counter will not be received. In the absence of TestOK signals (channel failure), the failure counter will be filled with signals from the pulse generator. The comparison circuit, analyzing the codes of the failure counters, generates the signals that enter the switches. In this case, a workable processor (channel) is connected to the output, and a failed one is disabled. Intermediate results of calculations are periodically written to the memory devices of both channels. The second channel, which is the backup one, in case of failure of the main one, starts the task using the information recorded in the memory device of the backup channel. This allows you to continue solving the problem without losing information. With operable channels, in case of repeated failures, switching is carried out to that channel in which there are fewer failures. The decision to switch is assigned to the backup device, which is implemented on the logic elements in the base matrix crystal, which has high reliability, and occurs after receipt of a pulse generator to the time analyzer serviceability of at least two pulses.

The well-known redundant dual-processor computing system [3] has increased reliability, minimum switching time to the backup channel and maintains operability in the event of a short circuit at the output of one of the channels.

The disadvantage of the system [3] is that in the system, in the event of a failure of one channel, it is not possible to reduce the likelihood of a false output of a calculation result (command), since the output of the result is based on calculations of only one channel.

The technical result is an increase in reliability, fault tolerance and reliability of the calculation result due to the introduction of the third channel and additional devices and communications into the system.

The technical result is achieved by the fact that a third channel, an OR element, and a device for generating channel sample signals are introduced into a redundant dual-processor computing system containing two identical channels. In each channel, the first output of the processor is connected to the first input of the first switch. A system generator is connected to the first input of the processor. The pulse generator is connected to a temporary health analyzer. The output of the initial installation circuit is connected to the first input of the pulse generator, the first input of the emergency start device, to the second input of the processor and the first input of the OR element. The output of the OR element is connected to the second input of a temporary health analyzer. The second output of the processor is connected to the second input of the emergency start device. The first output of the emergency start device is connected to the second input of the pulse generator, and the second output is connected to the second input of the OR element. The first input of the second switch is connected to the third output of the processor. The output of the first switch is connected to the second input of the second switch and is the output of the corresponding channel. The outputs of the second and third switches are connected and connected to the input of the memory device. The fourth output of the processor of the first channel is connected to the first input of the third switch of the second channel, and the fourth output of the processor of the second channel is connected to the first input of the third switch of the first channel. The output of the first switch of the first channel is connected to the second input of the third switch of the second channel, and the output of the first switch of the second channel is connected to the second input of the third switch of the first channel. Additionally, a fourth switch is introduced into each channel, the output of which is connected to the outputs of the second and third switches and to the input of the memory device of the corresponding channel. The output of the temporary analyzer of serviceability of the first, second and third channels are connected respectively to the first, second and third inputs of the input OR element, the output of which is connected to the first input of the channel sampling signal generation device. The second outputs of the processors of the first, second and third channels are connected respectively to the second, third and fourth inputs of the device for generating the sampling signals. The first, second and third outputs of the channel sampling signal generation device are connected to the second inputs of the first switches of the corresponding channels and are control outputs for connecting the supply voltage to the corresponding channels from the secondary power sources. The fifth output of the processor of the first channel is connected to the first input of the fourth switch of the third channel. The fifth processor output of the second channel is connected to the first input of the third switch of the third channel. The third output of the processor of the third channel is connected to the first input of the second switch of the third channel. The fourth output of the processor of the third channel is connected to the first input of the fourth switch of the first channel. The fifth output of the processor of the third channel is connected to the first input of the fourth switch of the second channel. The output of the first switch of the first channel is additionally connected to the second input of the fourth switch of the third channel. The output of the first switch of the second channel is additionally connected to the second input of the third switch of the third channel. The output of the first switch of the third channel is additionally connected to the second input of the fourth switch of the second channel, the second input of the fourth switch of the first channel and is the output of the third channel.

Figure 1 shows the structural diagram of the proposed multi-channel system.

Figure 2 shows an embodiment of a device for generating signals for channel sampling.

Figure 3 shows the timing diagram of the operation of the device for generating signals for channel sampling.

Figure 4 shows the timing diagram of the multi-channel system.

The redundant multi-channel computing system shown in Fig. 1 contains three identical channels 1, an OR element 2, a device for generating signal samples of channel 3. Each channel contains an initial setup 4, a system generator 5, processor 6, an OR element 7, a pulse generator 8 , temporary health analyzer 9, emergency start device 10, first switch 11, second switch 12, third switch 13, fourth switch 14, memory device 15. The outputs of the switches 12, 13, 14 are connected and connected to the memory device ty 15. Pulse generator 8 is connected to the initial setup 4, temporary health analyzer 9, emergency start device 10, which is connected to the initial setup 4, processor 6, OR element 7 connected to the initial setup 4, processor 6 and time analyzer health 9. The processor 6 is connected to the system generator 5, the first switch 11, the second switch 12. In the system, in addition, the processor 6 of the first channel is connected to the third switch 13 of the second channel and the fourth switch 14 of the third to Nala; the processor 6 of the second channel is connected to the second switch 12 of the second channel and to the third switches 13 of the first and third channels; the processor 6 of the third channel is connected to the second switch 12 of the third channel and the fourth switches 14 of the first and second channels; temporary analyzers 9 of each channel are connected to an OR element 2, which is connected to a channel 3 sampling signal generating device, which is connected to the first switches 11 of the first, second, and third channels and control outputs for connecting the supply voltage to each channel from the secondary power sources of each channel . In addition, the device for generating the sampling signals of channel 3 is connected to the processors 6 of each channel. The output of the first switch 11 of each channel is connected to the second switch 12 and is the output of the corresponding channel. The output of the first switch 11 of the first channel is connected to the third switch 13 of the second channel and to the fourth switch 14 of the third channel. The output of the first switch 11 of the second channel is connected to the third switches 13 of the first and third channels. The output of the first switch 11 of the third channel is connected to the fourth switches 14 of the first and second channels.

The power source of each channel contains controlled and uncontrolled voltage converters. Controlled converters allow using OE signals from the channel 3 sampling signal generation device to disconnect or connect channel power voltages (system generator 5, processor 6, switch 11, initial installation circuit 4, emergency start device 10, pulse generator 8, OR element 7, temporary health analyzer 9). Uncontrolled converters are necessary for supplying voltage to devices that do not allow for their functional purpose to remove voltage during operation (OR element 2, channel 3 sampling signal generation device, switches 12-14, memory 15). The uncontrolled converters of each channel are combined at the outputs through decoupling diodes.

At the time of supplying voltage to the system, the initial setup circuit 4 generates a Res # signal (change of state from a logical zero to a logical unit). At the same time, the processors 6, emergency start devices 10, pulse generators 8, temporary analyzers of serviceability 9 are allowed to work, and the device for generating the sampling signals of channel 3 sets the OE signals in a state in which power is supplied to all channels from secondary sources. The time to exit to the channel processor mode due to the delay selection is spaced. In this case, the processor that first enters the mode and generates a test signal TestOK, using the channel 3 sampling signal generation device, will leave the supply voltage on its channel and disconnect the removed supply voltages from the other two (Fig. 3). Thus, this channel will go into working mode, and the other two will be in cold reserve. In case of a failure in the working channel (absence of TestOK pulses), the time analyzer 9 will generate an Fsd pulse, which will be sent to the channel 3 signal generation device. In this case, device 3 will connect power to the next channel and disconnect power from the other two (Fig. 4). It should be noted that in the event of a failure of the channel to which the switching occurred, the next channel will be similarly connected and the other two will be disconnected. A feature of the proposed system is that TestOK pulses can be interrupted programmatically, which allows selecting the working channels with the required frequency. The number of switching between channels is not limited.

Intermediate results of calculations are periodically written to the memory devices of all channels. This allows you to continue solving the problem on the backup channel without losing information.

It should be noted that if three-port RAM is used as channel memory in a redundant multi-channel computing system, then the system can be simplified by eliminating the connections of memory devices with processors. If you use non-volatile memory and connect it on command from the processor, you can reduce power consumption and further improve system reliability.

The fundamental difference between the proposed redundant multi-channel processor system shown in Fig. 1 from the prototype is the introduction of the third channel 1, the OR element 2, the device for generating the sampling signals of channel 3, the introduction of additional switches 14 into each channel and the introduction of additional connections, which made it possible to increase reliability and system fault tolerance and reduce the likelihood of issuing a false calculation result (false commands). To obtain a reliable result in the system, one can programmatically switch over the channels, and the results of solving the problems of each channel stored in the channel memory can be compared, analyzed, and output on any of three independent channels.

The proposed system may not have drawbacks for critical applications. The restriction can only be the time to reach the operating mode of the connected channel. When using high-speed processors, for example, type 1892ВМ8Я (АЕЯР.431280.767 ТУ), the switching time can be minimized.

Newly introduced switches can be implemented on 5584AP7T transceiver microcircuits with an input information retention scheme. Newly introduced memory devices can be implemented on random-access memory (RAM) type 1658RU1U, with the required amount of memory, speed. The OR logic element and the channel sampling signal generation circuit can be implemented on 1594T series microcircuits (1594L3T, 1594LE4T, 1594TL2T, 1594TM2T), or on logic elements in the base matrix crystal.

List of sources

1. Patent 94296302, USA, MKI G06F 11/00, 1994 (analogue).

3. Patent No. 2339994, RF, MKI G06F 11/18, 2006 (analogue).

3. Patent No. 2460121, RF, MKI G06F 11/20, 2012 (prototype).

Claims (1)

A redundant multi-channel computing system containing two identical channels, in each of which the first output of the processor is connected to the first input of the first switch; a system generator whose output is connected to the first input of the processor; a pulse generator connected to a temporary health analyzer; initial installation circuit, the output of which is connected to the first input of the pulse generator, the first input of the emergency start device, to the second input of the processor, the first input of the OR element, the output of which is connected to the second input of the temporary health analyzer; the second output of the processor is connected to the second input of the emergency start device, the first output of which is connected to the second input of the pulse generator, and the second output is connected to the second input of the OR element; the first input of the second switch is connected to the third output of the processor, the output of the first switch is connected to the second input of the second switch and is the output of the corresponding channel; the outputs of the second and third switches are connected and connected to the input of the memory device; the fourth processor output of the first channel is connected to the first input of the third switch of the second channel, the fourth processor output of the second channel is connected to the first input of the third switch of the first channel; the output of the first switch of the first channel is connected to the second input of the third switch of the second channel, the output of the first switch of the second channel is connected to the second input of the third switch of the first channel; characterized in that a third channel, an OR element, and a channel sampling signal generating device are introduced into the system, and a fourth switch is inserted into each channel, the output of which is connected to the outputs of the second and third switches and to the input of the memory device of the corresponding channel; the output of the temporary analyzer of serviceability of the first, second and third channels are connected respectively to the first, second and third inputs of the input OR element, the output of which is connected to the first input of the channel sampling signal generation device; the second outputs of the processors of the first, second and third channels are connected respectively to the second, third and fourth inputs of the device for generating sampling signals; the first, second and third outputs of the channel sampling signal generation device are connected to the second inputs of the first switches of the corresponding channels and are control outputs for connecting the supply voltage to the corresponding channels from the secondary power sources; the fifth output of the processor of the first channel is connected to the first input of the fourth switch of the third channel, the fifth output of the processor of the second channel is connected to the first input of the third switch of the third channel, the third output of the processor of the third channel is connected to the first input of the second switch of the third channel; the fourth output of the processor of the third channel is connected to the first input of the fourth switch of the first channel; the fifth output of the processor of the third channel is connected to the first input of the fourth switch of the second channel; the output of the first switch of the first channel is additionally connected to the second input of the fourth switch of the third channel; the output of the first switch of the second channel is additionally connected to the second input of the third switch of the third channel; the output of the first switch of the third channel is additionally connected to the second input of the fourth switch of the second channel, the second input of the fourth switch of the first channel and is the output of the third channel.

Images