Method for isolating a defective computer in a fault-tolerant multiprocessor system

The invention relates to a method for isolating an identified as defective Computer in a fault tolerant multiprocessor system according to the preamble of claim 1. The invention further relates to a fault-tolerant Multicomputer system according to the preamble of claim 3rd

Fault-tolerant multiprocessor systems - mostly 2-of-3 computer systems- especially such processes are used for control, in which particularly high demands in terms of security and availability the controller are provided. Examples of such processes include the Assurance of railway infrastructure for railway or monitoring Nuclear power plants. A computer system is called fault tolerant if even in the presence of a limited number of hardware and / or Software errors, the system still works. From such Data processing equipment can also request that they rest with the required for process control devices according to the "fail-safe" principle cooperate. This means that even with a total loss the data processing system of the process under any circumstances in a dangerous condition may pass.

A method according to the preamble of claim 1 is known from EP-B1-0 246 218 known. There, however, is not isolation but rather the necessary before an isolation identification of a faulty computer in a redundant data processing system described. The known data processing system consists of several Computer nodes, in turn, as a multi-computer systems - preferably as a 2-of-3 computer systems - Are executed. The nodes are over serial point-to-point connections interconnected. The computers within a each node are also fully meshed with each other. The a Majority decision required reconciliation of each of the computers within a node supplied results ( "Voting") is not central performed, but is distributed over the individual computers.

Furthermore, from DE-A1-41 35 640 a 2-from-3-computer system known in the computer also has its own control bus to each other can exchange data. The computers communicate with the process on one of them independent I / O data bus. If a computer is defective is identified, cause there the two non-defective computers that the Data port is blocked to the I / O bus. Depending on the nature of the defect, however, it may happen that the non-defective computers such an intervention in the Data port of the defective computer fails. It is then possible that the defective computer continues to output erroneous data to the I / O bus. If another computer is broken and also errored data output to the I / O bus, so these data could match by chance. A receiver could these two results then because of their maintain compliance for properly, so they accept and pursue tax acts that result in a non-safe state could.

Finally, from DE-C2-32 08 573 a selection device for a Three computer system is known in which an identified as defective computer via a relay switch from I / O channel is irreversibly separated. Of the defective computer can not there again after a restart without any intervention an operator will be integrated into the system. This solution is comparatively expensive since the relay switch dedicated to each Computer system needs to be developed. Further, control lines for provide control of Reloisschalters.

It is therefore an object of the invention to provide a method by means of which a identif ed as broken computers effectively in a multi-computer system not defective considering the ,, failsafe "principle of the computers can be isolated. The process should not under any circumstances unsafe process conditions lead. Moreover, the method is not intended to the use of additional hardware such as relay switches require.

The invention solves this problem by the teaching specified in claim. 1 Since the invention of the defective computer is prompted shut down, a subsequent re-integration of the computer - unless a reboot is successful - even without the intervention of an operator possible. The security of the system is ensured by the fact that the non- Shutdown defective computer even if the defective computer the Shutdown command has not complied with successfully. namely, if the defective computer to spite shutdown commands further results outputs the input / output channel, then only by a shutdown of the non-defective computers are reliably prevented it up to the aforementioned random match results from two defective computers and thereby comes to an unsafe condition.

In an advantageous embodiment of claim 2 is the Task, the defective computer to send a shutdown command, taken from the non-defective computers. The non-defective computers Check also whether the defective computer results common to the I / O channel outputs. Further, the non-defective computer boots up itself down if the defective computer after a predetermined period after the shutdown command still results to the common I / O channel outputs. Thus, the computer system is in a safe state, because it is - as in secure computer systems usual - provided that a safe output always two computers must participate. A single computer alone can not under any circumstances effectively engage the consumers to due process. Additional hardware devices are not necessary in this embodiment.

filters In a further advantageous embodiment according to claim 3 the non-defective computers to exchange data with the defective Computer on after it has received the shutdown command. This is the defective computer signaled again that he all output Set to the common I / O channel and Shutdown should.

The invention is described with reference to embodiments and the Drawings in detail. Show it:<sl><li>Fig. 1: A representation of the method according to claim 1 in the form of a flow chart,</li><li>Fig. 2: A representation of the method according to claim 3 in the form of a flow chart,</li><li>Fig. 3: A schematic representation of one embodiment of a Multicomputer system according to the invention of claim 4,</li><li>Fig. 4: A schematic representation of another embodiment a multi-computer system according to the invention of claim 4.</li></sl>

Fig. Figure 1 illustrates the inventive method 100 according to claim 1 in the form of of a flow chart. A multi-computer system in which the method 100 may be advantageously applied, Fig. 4. This multi-computer system consists in this example of three computers R1, R2, R3, via a system internal communication network are intermeshed, ie each Computer can have its own communication link with each Replacing other computer data. Thus, between the computers R1 and R2 communication connection KV12, between the computers R2 and R3 communication connection KV23 and between the computers R1 and R3 communication connection KV13. The exchange of data between the multicomputer system, and the process to be controlled via a common, independent of the system-internal communication network I / O channel EAK.

In a first step 101, by the inventive method 100 a defective computer identified. In general, this identification is performed characterized in that the three computers R1, R2, R3 via the intrinsic Communication network, the calculated results of them with each other change. If all the results agree with each other, so it goes System assumes that no host is defective. however soft the result a computer of the results of the other two computers from, so is this result as flawed and therefore the corresponding computer as defective viewed. Because of the complete meshing of the computer each other is always a clear allocation of results ensured so that the defective computer can be clearly identified. A particularly advantageous method for error identification is already in the cited patent EP-B1-0 246 218 describes, on to this Reference is made.

In a second step 102, in accordance with the invention to be defective identified computer a shutdown command received. This Command can, for example, by external command means are, as in the description of the invention Multicomputer system is described in detail below. Especially then However, if the error ID decentralized, ie distributed to all computers, is performed, it is advisable, broken this command not to Computers or start from one of the non-defective computers allow. Under shutdown is understood here that the computer be concerned Application program, as well as its operating system with all Interface drivers properly terminated. Such proper Termination includes, for example conducting diagnostics and Storing data on a non-volatile carriers. After this Shutdown, the computer will not back more, either through the I / O channel still on the system internal communication network. If no errors were detected and it allows the security concept, will the computer then rebooted. This typically includes extensive hardware testing a with.

In a next step 103 it is checked whether the detected as defective computer continue outputting results to the common I / O channel. This amounts to a review of whether the defective computer the Shutdown command is actually complied with. As already mentioned, a computer can after shutdown no issues to the common I / O channel make more. yet Can such demonstrate expenditures, then it can be assumed that the defect such is severe, that a shutdown was no longer possible. If he makes computer output to the input / output channel, can the I / O channel be even detected. Again, it is again possible, this task by external test equipment or defective of not the carry computers even allow.

If it is found during this check that the broken computer to a predetermined period still issues to the common I / O channel makes, so go the non-defective computers in one step 104 down to. This shutdown will of external test equipment are caused or of the non-defective computers themselves. By Shutdown is, as explained above, the system to a safe state over because the defective computer can alone make any expenditure on the side of expenditure receiving recipient an effect could unfold. That task must always - in the case of a 2-of-3 computer system - Correspond at least two results.

If on the other hand found in this test 103 that the defective computer after a predetermined period of time no issues to the common makes I / O channel more, so go the non-defective computers in the of conventional 2-of-3 computer systems known manner with their Computing activity continued. The predetermined time period should be at least as long as be like a broken computer needs to shut down. Otherwise could shut down the non-defective computers, although the defective Computer is shutting down successfully and thus a dangerous condition not may occur.

Another embodiment of the method according to Claim 3 is shown in Fig. 2. Steps 201 and 202 correspond to the Steps 101 to 102. In addition to the steps shown in Fig. 1 is here However, provided that, in a step 204, the non-defective computers of from the data exchange with the defective computer via the Setting the internal system communications network. This is the defective Computer again signaled that it is no longer as an equal calculator is recognized in the system and should therefore shut down. The non defective computers can exchange data in each case after the Setting the transmission of the shutdown commands 202 or, as in shown Fig. 2, in step 203, do this depends on whether the defective Calculator adjusts on its own data exchange. The additional Step 204 reduces the likelihood that the defective computer not shutting down and therefore to a shutdown and the not defective computer in step 207 comes.

An embodiment of an inventive multi-computer system is in shown FIG. 3. The multiprocessor system includes three computer R1, R2, R3, the via input / output ports EA1, EA2, EA3 with a common I / O channel EAK are connected. According to the invention are further provided Identification means IM for identifying defective computers and Command means KM to issue shutdown commands. This means are connected to the computer via a system internal communication network, comprising the compounds V1, V2 and V3. In this way, the Identification means IM and the command means KM with the computers R1, R2, R3 communicate. In addition, test equipment PM are present, both with the I / O channel EWC as well as with the three computers R1, R2, R3 are connected. These agents have the task of reviewing whether the of the identification means as defective recognized calculator results to the common I / O channel outputs. If the test equipment to determine that the defective computer after a predetermined period still cause outputting results to the common input / output channel, the test means that the non-defective computers shut down and thus a safe state is achieved.

In the embodiment shown in Fig. 4, the Identification means IM, the command means KM and test equipment not PM externally arranged, but divided among the three computers. Preferably is it in this means Im1 ... IM3, KM1 KM3 ... and PM1 PM3 to ... Software modules, which take over the corresponding functions.