RU2455681C1 - Fault-tolerant computing system with hardware-programmed function of fault-tolerance and dynamic reconfiguration - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: fault-tolerant computing system with hardware-programmed function of fault-tolerance and dynamic reconfiguration has first, second, third and fourth computing machines connected by first, second, third and fourth serial data buses, first, second, third and fourth secondary power sources, first, second, third and fourth intermachine exchange controllers, first, second, third and fourth configuration management controllers.

EFFECT: faster operation and automation of the reconfiguration process in fault-tolerant systems.

Description

The invention relates to the field of computer technology and can be used in the construction of highly reliable computing and control systems designed to solve the problems of controlling the onboard systems of a transport ship.

A known computer system [1], correcting a single error, which contains a first system module with a first processor, with a bus of the first processor and the first I / O bus (input / output), a second system module with a second processor, with a bus of the second processor and a second bus I / O, a third system module with a third processor, with a third processor bus and a third I / O bus, the first system module comprising a first memory, a first processor, a first I / O control unit, a first bridge comparing data of the first processor bus with data second second and third processor buses, the first output of the first module connected to the first inputs of the second and third module, the first output of which is connected to the first input of the first module and the second input of the second module, the first output of which is connected to the second inputs of the first and third module, each the memory module is connected to the processor, the processor is connected to the bridge, the bridge is connected to the I / O control unit, the output of which is the second output of the module, the second module of the system including the second memory, the second processor, the second unit I / O equations, a second bridge comparing the data of the second processor bus with the data of the first and third processor buses, the third module of the system including the third memory, the third processor, the third I / O control unit, the third bridge comparing the data of the third processor bus with the data of the first and a second processor bus.

The disadvantage of this system is the low reliability due to the failure of its functioning when a second failure occurs.

Known fault-tolerant computing system for controlling the flight of an aircraft [2], consisting of data processing modules including processors and their storage devices, and a bus controller connected by a conventional broadband communication channel.

The system performs a series of tasks, each of which is a sequence of iterations. The input for the next iteration of a task is the output obtained at the previous iteration of a set of tasks (including the task in question). The input and output signals of the entire system are formed when tasks are performed by input / output processors. The reliability of the system is ensured by the independent execution of each iteration of any task by several modules. After the next iteration, the processor sends the results to its own storage device (memory). A processor using the results of this iteration determines their correct values by comparing the output generated by each processor that performed this iteration. Usually, the correct values are selected by the “two out of three” method. If not all output options are identical, then an error is recorded. Such errors are recorded in the processor memory and then used by the control program to detect faulty blocks.

The disadvantage of this system is its low speed, synchronization according to the system-wide time, and not according to program events, the absence of fault tolerance and the inability to automatically carry out the process of restoration or reconstruction of the structure (reconfiguration).

Known fault-tolerant computing system for controlling the flight of an aircraft [3], consisting of five identical general-purpose computers (GPCs) connected by a digital data bus, each GPC includes a central processing unit (CPU), which provides central computing power, and an input / output processor (IOP), which performs I / O control operations for the CPU, four of the computers are designed to solve problems and work as a redundant compatible set. The calculations of each computer in this set are checked by other computers. Thus, the complex of computers supports the fault tolerance of the operational and safe operation of the system; the fifth computer is designed for functional control of the system.

Twenty-four computer data buses are used, organized in seven groups. Data transmission is time division multiplexed using pulse code modulation. Each bus runs on the strobe of one megabit per second.

The described device as the closest to the proposed adopted for the prototype and is presented in Fig.34.

The disadvantage of this system is its low speed, synchronization according to the system-wide time (according to the slowest VM), and not according to program events, the absence of fault tolerance and recovery mechanisms for VMs in a state of software failure, and the inability to automatically carry out the process of restoration or reconstruction of the structure (reconfiguration).

The objective of the invention is to increase the speed and automation of the reconfiguration process in fault-tolerant systems.

The essence of the claimed invention, the possibility of its implementation and industrial use are illustrated by the drawings, presented in figure 2-33, where:

- figure 2 presents the structural diagram of a fault-tolerant computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration;

- figure 3 presents the functional diagram of the configuration management controller;

- figure 4 presents the functional diagram of the block receiving command parcels;

- figure 5 presents the functional diagram of the block selection commands;

- figure 6 presents the functional diagram of the block execution of commands;

- Fig.7 shows a functional diagram of a watchdog timer unit and a frequency divider;

- Fig. 8 is a functional diagram of an inter-machine exchange controller;

- figure 9 presents the functional diagram of the block receiving parcels IMO;

- figure 10 presents the functional diagram of the block issuing parcels IMO;

- figure 11 presents a functional diagram of a direct access control unit;

- Fig.12 presents a functional diagram of the node reference time intervals;

- Fig.13 shows a functional diagram of a single command mode node;

- on Fig presents a functional diagram of a single pulse generator;

- on Fig presents a diagram of states and transitions;

- in Fig.16 shows the format of the command sending line MMO;

- on Fig presents the format of the command configuration management VM;

- on Fig presents the format of the command control watchdog timer;

- Fig.19 shows the format of the MCO control commands;

- Fig.20 shows the correspondence of the values of the KO code to the operations performed;

- in Fig.21, 21a presents the algorithm of the MS unit BVK;

- on Fig presents the algorithm of the MS unit execution of the commands (BIC);

- Fig.23 shows the format of the generated packages;

- on Fig presents the format of the control register RUSP block receiving parcels IMO;

- on Fig presents the format of the control register RUSV block issuing parcels IMO;

- Fig.26 shows the algorithm of operation of the MS of the block receiving packages of channels IMO;

- on Fig presents the algorithm of operation of the MS block issuing parcels IMO;

- on Fig presents a timing diagram of the operations of writing and reading in RAM;

- Fig.29, 29a presents the algorithm of the MS of the direct access control unit;

- on Fig, 30a presents the algorithm of the MS shaper sign synchronization;

- in Fig.31 shows the format of the control register and the status of the RUSS unit block shaper sign synchronization FPS;

- on Fig presents the format of the register duration of the waiting synchronization (RPOS) block FPS;

- on Fig presents the format of the register duration of synchronization (RPS) block FPS.

The indicated advantages of the claimed system over the prototype are achieved due to the fact that in a fault-tolerant computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration, containing the first 1, second 2, third 3 and fourth 4 computers (VMs) connected to the first 5, second 6, third 7 and fourth 8 serial data buses, additionally introduced the first 9, second 10, third 11 and fourth 12 secondary power supplies (VIP), first 13, second 14, third 15 and fourth 16 controllers inter-machine exchange (CMMO), the first 17, second 18, third 19 and fourth 20 configuration management controllers (CCC), the first 21 groups of outputs of which are connected to the first groups of inputs of the first, second, third and fourth VMs, the second 22 groups of inputs of which are connected to the first group of system inputs, the second 23, third 24, fourth 25, fifth 26 groups of inputs which are connected to the first groups of inputs KMMO1 (13) and KUK1 (17), KMMO2 (14) and KUK2 (18), KMMO3 (15) and KUK3 (19), KMMO4 (16) and KUK4 (20), respectively, the second 27 groups of inputs of which are connected to the first groups of outputs VM (1, 2, 3, 4), the local bi-directional highway 28 of which is connected to the local bi-directional highways of KMMO (13, 14, 15, 16), the first 29 outputs of which are connected to the first inputs of the KUK controllers (17, 18, 19, 20 ), the second 30 groups of outputs of which are connected to the first groups of inputs of the VIP (9, 10, 11, 12), respectively, the groups of outputs 31 of which are connected to the third groups of inputs of the VM (1, 2, 3, 4), and the first 32 group of outputs of the first 13 KMMO is connected to the third groups of inputs of the second 14, third 15 and fourth 16 KMMO and the first 17, second 18, third 19 and four addition of KUK 20, the first 33 group of outputs of the second 14 KMMO is connected to the fourth groups of inputs of the first 13, third 15 and fourth KMMO 16 and the first 17, second 18, third 19 and fourth 20 KUK, the first 34 group of outputs of the third 15 KMMO the inputs of the first 13, second 14 and fourth 16 KMMO and the first 17, second 18, third 19 and fourth 20 KUK, the first 35 group of outputs of the fourth 16 KMMO is connected to six groups of inputs of the first 13, second 14 and third 15 KMMO and the first 17, second 18, third 19 and fourth 20 KUK, and the sixth 36 group the system is connected to the second groups of inputs of the first 9, second 10, third 11 and fourth 12 VIPs, the first inputs of which are connected to the seventh 37 group of system inputs, the eighth 38 group of inputs of which is connected to the second inputs of the first 9, second 10, third 11 and fourth 12 VIP, and the second 39 output groups of CMMOs (13, 14, 15, 16) are connected to the fourth groups of VM inputs (1, 2, 3, 4).

The configuration control controller (17, 18, 19, 20, 20) comprises a first 40 command parcel reception unit, a second 41 command parcel reception unit, a third 42 command parcel reception unit, a fourth 43 command parcel reception unit, an instruction allocation unit 44, an instruction execution unit 45 , a watchdog timer and frequency divider block 46, the first 47 output group of which is connected to the first group of inputs of the command execution unit 45, the first 48 output group of which is connected to the first group of inputs of the watchdog timer block and frequency divider 46, the first 49 output of which the second is connected to the first input of the command allocation unit 44, the output group 50 of which is connected to the second group of inputs of the command execution unit 45, the second output group of which is the first 21 output group of the configuration control controller 17, the second 30 output group of which is the third output group of the command execution unit 45, the first 51 output of which is connected to the first input of the watchdog timer unit and frequency divider 46, the second 52 output of which is connected to the first inputs of the first command receiving unit 40, the second block ka receiving command parcels 41, the third block receiving command parcels 42, the fourth block receiving command parcels 43, the block executing commands 45 and with the second input of the block selection commands 44, the first 53 output of which is connected to the second input of the block command execution 45, the second 54 output of which connected to the third input of the command allocation unit 44, the first 55, the second 56, the third 57 and the fourth 58 of the input group are connected to the first output groups of the first 40, second 41, third 42 and fourth 43 of the command receiving blocks respectively e outputs of which are connected to the fourth 59, fifth 60, sixth 61, seventh 62 inputs of the command allocation unit 44, the eighth 63 input of which is connected to the second inputs of the first 40, second 41, third 42 and fourth 43 of the command receiving unit and watchdog block, and frequency divider 46, the third input of the command execution unit 45 and is the first signal of the second 27 group of inputs of the configuration management controller 17, the first 23 group of inputs of which is connected to the third group of inputs of the command execution unit 45, the fourth input of which is connected to the ninth input of the command allocation block 44 and is the first 29 input of the configuration control controller 17, third 32, fourth 33, fifth 34 and sixth 35 of the input group of which are connected to the first input group of the first 40, second 41, third 42 and fourth 43 command receiving unit accordingly, the second 64 signal of the second 27 group of inputs connected to the third input of the watchdog block and frequency divider 46.

The command package receiving unit 40 contains a shift register 65, a counter 66, a decoder 67, a first 68 trigger, a second 69 trigger, a third 70 trigger, a fourth 71 trigger, a fifth 72 trigger, exclusive OR 73, the first 74 AND element, the second 75 AND element, the third 76 AND element, the fourth 77 AND element, the OR element 78, the output of which is connected to the reset inputs of the counter 66 and the third trigger 70, the output of which is connected to the first inputs of the exclusive OR 73 and the second 75 AND element, the output of which is connected to the information input of the fifth 72 trigger whose output is connected the first inverse input of the fourth 77 AND element, the output of which is the output 59 of the command package receiving unit 40, the group of outputs 55 of which is connected to the group of outputs of the shift register 65, the information input of which is connected to the second input of the exclusive OR 73 and is the first signal of the group of inputs 32 of the receiving unit command packages 40, the second signal of which is connected to the clock inputs of the shift register 65, the counter 66 and the third trigger 70, the information input of which is connected to the output of the exclusive OR 73, the first 52 input the command parcel receiving unit 40 is connected to the clock inputs of the first 68, second 69, and fourth 71 triggers, the output of the fourth 71 triggers is connected to the first input of the third 76 AND element, the output of which is connected to the first input of the fourth 77 AND element, the second and third inputs of which are the second and the third signals of the group of outputs 55 of the command package receiving unit 40, the first signal of which is connected to the second inverse input of the fourth 77 AND element, the second 63 input of the command package receiving unit 40 being connected to the shift inputs register 65, first 68, second 69, fourth 71 and fifth 72 triggers and the first input of the OR element 78, the second input of which is connected to the output of the first 74 element And, the first input of which is connected to the second input of the third 76 element And and the inverse output of the second 69 the trigger, the direct output of which is connected to the information input of the fourth trigger 71, the direct output of the first 68 trigger is connected to the information input of the second 69 trigger, and the inverse output is connected to the second input of the first 74 element And, the third signal of the group of inputs 32 of the receiving unit to command-chip 40 is connected to the data input of the first flip-flop 68 and the clock input of the fifth flip-flop 72, the group counter output 66 is connected to a group of inputs of the decoder 67, whose output is connected to a second input of the second member 75 I.

The block selection commands 44 contains the switch 79 transmitting the command code (CPPC), the register 80 signs of readiness (RPG), the switch 81 signs of readiness of the command code (CPCC), the comparison circuit 82, the node counting time intervals (UOVI) 83, the node mode single command ( LESSON) 84, a state machine (MS) 85, the group of outputs of which is connected to the group of inputs of the RPG 80 and to the first group of inputs of the CPPC 79, the first group of outputs of which is connected to the first group of inputs of the comparison circuit 82 and is the group of outputs 50 of the block 44 commands, output 53 of which is connected to the first output of the MS 85, the second output of which 86 is connected to the first input of the UOVI 83, the first output of which 87 is connected to the first input of the MS 85, the second input of which is connected to the output of the comparison circuit 82, the second group of inputs of which is connected to the second group of outputs of the PDA 79, the second the group of inputs 55 of which is connected to the first group of inputs of the unit for allocating commands 44, the second 56, third 57, and fourth 58 of the group of inputs of which are connected to the third, fourth, and fifth groups of inputs of KPKK 79, respectively, the first 49 and second 52 inputs of the unit for allocating commands 44 dinene with the second input UOVI 83 and with the third inputs MS 85 and UOVI 83 and the first input LESSON 84, respectively, the first 88 and second 89 outputs of which are connected to the fourth and fifth inputs of the MS 85, the third output of which is connected to the first input of the RPG 80, the second, the third, fourth and fifth inputs of which are the fourth 59, fifth 60, sixth 61 and seventh 62 inputs of the command extraction unit 44, respectively, the eighth 63 input of which is connected to the second input of the LESSON 84, with the fourth input of the AOI 83 and with the sixth input of the MC 85, the first the input group of which is connected to the group of outputs PGKK 81, the group of inputs of which is connected to the group of 90 outputs of RPG 80, with the group of inputs of LESSON 84 and with the second group of inputs of MC 85, the seventh input of which is the ninth 29 input of block 44, the third 54 input of which is connected to the third input of LESSON 84, third 91 the output of which is connected to the eighth input of the MS 85, the ninth input of which is connected to the second 92 output of the UOVI 83.

The command execution unit (BIC) 45 contains a command register (RGC) 93, a comparison circuit (SS) 94, a single pulse generator (GOI) 95 and a state machine (MS) 96, the first group of outputs of which is the first 48 group of outputs of BIC 45, the second 21 group of outputs of which is connected to the second group of outputs of MC 96, the third group of outputs of which is the third 30 group of outputs of BIC 45, the first 51 and second 54 outputs of which are connected to the first and second outputs of MC 96, the first and second groups of inputs of which are connected to the first and the second groups of outputs of Prg 93, the third group the outputs of which are connected to the first group of inputs of SS 94, the output of which is connected to the first input of MS 96, the third 97 output of which is connected to the first input of GOI 95, the output of which 98 is connected to the second input of MS 96, the third input of which is connected to the input of PrgK 93 and is the second 53 input of BIC 45, the first 47 group of inputs of which is connected to the second input of the GOI 95 (first signal) and the fourth input (second signal) of the MS 96, the fifth input of which is connected to the third input of the GOI 95 and is the first 51 input of the BIC 45, the third 63 the input of which is connected to the fourth input of GOI 95 and th input of the MS 96, the seventh input of which is the fourth input 29 BIC 45, second 50 and third 23 of which input group connected to a group of inputs 93 RGCs and a second group of inputs 94 SS.

The watchdog timer and frequency divider (BSTDCH) block 46 contains a watchdog timer (ST) 99 and a frequency divider (DF) 100, the first and second outputs of which are the first 49 and second 52 outputs of the BSTDCH 46, the first 47 group of outputs of which are connected to the output of CT 99 (first signal) and the third output of the PM (second signal) 100, the fourth output of which is connected to the first input of CT 99, the group of inputs of which is the first 48 group of inputs of the BSTDCH 46, the second 27 group of inputs of which (first signal) 63 is connected to the first input of the PM 100 and the second input of CT 99, and the second 64 signal is connected inen with the second input of the PM 100, and the first 51 input BSTDCH 46 is connected to the third input of CT 99.

The inter-machine exchange controller (13, 14, 15, 16) contains the first 101, second 102, and third 103 blocks for receiving parcels from inter-machine exchange channels (B1PP, B2PP, B3PP), a parcel delivery unit (BWP) 104, a direct access control unit (BDP) ) 105, a synchronization flag generator (FPS) 106, the first 107 and second 108 I / O buffers (B1VV, B2VV), the first 109 and second 110 groups of OR elements, the first group of outputs of the second group of OR elements is the second 39 output group of CMMO 13, the first 32 group of outputs of which is connected to the first group of outputs of the BVP 104, the second 111 group exits which is connected to the first 112 output groups B1PP 101, B2PP 102, B3PP 103 and FPS 106 and input groups of the second 110 group of OR elements, the FPS 106 output being output 29 KMMO 13, the local highway 28 of which consists of address buses, information buses and control buses and is connected to the input-output groups of the first 107 B1VV and the second 108 B2VV and BPD 105, with the first group of outputs 113, with the first output 114 and with the first group of inputs 115 of the air supply unit 105, the second 116 output group of which is connected to the first group of inputs B1VV 107, the group of outputs 117 of which is connected to in first groups of inputs B1PP 101, B2PP 102, B3PP 103, BVP 104 and FPS 106 and with a second group of inputs BPD 105, the third group of inputs of which is connected to the second groups of inputs B1PP 101, B2PP 102, B3PP 103, BVP 104, FPS 106 and s the output group 118 of the second 108 B2BV buffer, the first input of which is connected to the output of the first 109 group of OR elements, the input group of which is connected to the third group of outputs of the BVP 104 and the second 119 output groups of the B1PP 101, B2PP 102, B3PP 103 and FPS 106, the third group the inputs of which are connected to the first 120 outputs B1PP 101, B2PP 102, B3PP 103 and BVP 104, the third group of inputs which is connected to the third groups of inputs B1PP 101, B2PP 102, B3PP 103 and is the first 23 group of inputs KMMO 13, the second 27 group of inputs which is connected to the fourth groups of inputs BPD 105, B1PP 101, B2PP 102, B3PP 103, BVP 104 and FPS 106 , the fifth group of inputs of which is connected with the fifth groups of inputs B1PP 101, B2PP 102, B3PP 103. BVP 104, with the input B1VV 107, with the second input of B2BV 108 and with the third group of outputs 121 of the BJP 105, with the fourth 33, fifth 34 and sixth 35 input groups KMMO 13 are connected to the sixth, seventh and eighth groups of inputs B1PP 101, B2PP 102, B3PP 103, ninth groups inputs are connected with the first group 32 outputs BVP 104, a second output 122 which is connected to the second output B1PP 101 B2PP 102 B3PP 103 and the fifth group TU 105 inputs.

The IMO package receiving unit contains the first 123, second 124, third 125, fourth 126 multiplexers (MP), shift register (SDW WG) 127, command word register (RCS) 128, data buffer register (BRD) 129, control register and reception status (RUSP) 130, state machine 131, counter 132, decoder 133, trigger 134, AND 135 element exclusive OR 136, the output of which is connected to the information input of trigger 134, the output of which is connected to the first inputs of the exclusive OR 136 element and AND 135 whose output is connected to the first input of MC 131, the first output of which the first is connected to the input of the RKS 128, the group of inputs of which is connected to the group of inputs of the BRD 129 and the group of outputs of the SDV RG 127, whose information input is connected to the second input of the element exclusive OR 136 and the output of the first multiplexer 123, the first input of which is the first signal of the ninth 32 group of inputs block 101, the second and third signals of which are connected to the first inputs of the second 124 and third 125 multiplexers, the second inputs of which are connected to the second input of the first multiplexer 123 and are signals of the sixth 33 group of inputs of the block 101, seventh the fourth 34 group of inputs is connected to the third inputs of the first 123, second 124 and third 125 multiplexers, the fourth inputs of which are signals of the eighth 35 of the group of inputs of block 101, the first 112 group of outputs of which are connected to the second and third outputs of MC 131, the fourth output of which is connected to the input of the BRD 129, the group of outputs of the RKS 128 is connected to the first group of inputs of the fourth 126 multiplexer, the group of outputs of which is the second 119 group of outputs of the block 101, the first 120 output of which is connected to the fifth output of the MC 131, the sixth output of which is the second 122 output of block 101, the first 117 group of inputs of which is connected to the first group of inputs of MC 131, the seventh and eighth outputs of which are connected to the first and second inputs of the fourth multiplexer 126, the second group of inputs of which is connected to the group of outputs of the RUSP 130, the first group of inputs of which is the second 118 group of inputs of block 101, the third 23 group of inputs of which is connected to the second group of inputs of MC 131, the group of outputs of which is connected to the fifth inputs of the first 123, second 124 and third 125 multiplexers, the output of the third multip the lexor is connected to the discharge input of the SDV RG 127, the output of which is connected to the second input of the MC 131, the ninth output of which is connected to the input of the RUPS 130, the second group of inputs of which is the fifth 121 group of inputs of the block 101 and connected to the third group of inputs of the MC 131, the fourth group of inputs which is connected to the second group of inputs of the fourth multiplexer 126, the third group of inputs of which is connected to the group of outputs of the BRD 129, and the output of the second 124 multiplexer is connected to the clock inputs of the ADS RG 127, counter 132 and trigger 134, the reset input of which connected to the reset input of the counter 132, with the third input of the MC 131 and is the second signal of the fourth 27 group of inputs of the block 101, the first signal of which is connected to the fourth input of the MC 131, the fifth input of which is connected to the second input of the And element 135 and the output of the decoder 133, group the inputs of which are connected to the group of outputs of the counter 132.

Block issuing parcels MMO 104 contains the register command word issuing (RKSV) 137, the buffer register issuing parcels (BVP) 138, the control register and the status of issuing (RUSV) 139, the first 140 and second 141 multiplexers (MP), shift register (SDV RG) 142, counter 143, descrambler 144, first 145 and second 146 triggers, an exclusive element OR 147 and a state machine 148, the first group of outputs of which is the first 32 group of outputs of the block issuing parcels IMO 104, the second 112 group of outputs of which are connected to the first and second outputs MS 148, the second group of outputs of which is connected and with the third 119 group of outputs of the block of delivery of parcels MMO 104, the first 120 and second 122 outputs of which are connected to the third and fourth outputs of MC 148, the first and second groups of inputs of which are the first 117 and third 23 groups of inputs of the block of the issuance of parcels IMO 104, second 118 the group of inputs of which is connected to the first groups of inputs of RKSV 137, BVP 138, RUSV 139, the clock inputs of which are connected to the fifth, sixth and seventh outputs of the MS 148, respectively, the eighth output of which is connected to the boot and inverse enable inputs of the SDV RG 142, the output of which is connected n with the first input of the second 141 multiplexer and connected to the first input of the MS 148, the third group of outputs of which is connected to the second group of inputs of the RUSV 139, the group of outputs of which is connected to the third group of inputs of the MS 148, the ninth output of which is connected to the clock inputs of the first 145 and second 146 flip-flops, SDV RG 142 and counter 143, the group of outputs of which is connected to the group of inputs of the decoder 144, the inverse output of which is connected to the second input of the second 141 multiplexer, the output of which is connected to the information input of the second trigger 146 and the first the input of the element is exclusive OR 147, the output of which is connected to the information input of the first 145 trigger, the output of which is connected to the second input of the element exclusive OR 147, the first signal of the fourth 27 group of inputs of block 104 connected to the second input of the MS 148, the third input of which is the second signal of the fourth 27 of the group of inputs of block 104 and is connected to the emergency inputs of the SDV RG 142, counter 143 and the first 145 of the trigger, with the installation input of the second 146 trigger, the output of which is connected to the fourth input of the MS 148, the fourth group of inputs of which is is the fifth 121 group of inputs of block 104, and the output groups of the RKSV 137 and BVP 138 are connected to the first and second groups of inputs of the first 140 MP, the group of outputs of which is connected to the information inputs of the SDV RG 142, the inverse output of the first 145 trigger is connected to the second input of the second 141 MP , the input of the first multiplexer 140 is connected to the fifth output of the MS 148.

Direct access control unit 105 contains a first register of the current receive address (RTAP1) 149, a second register of the current receive address (RTAP2) 150, a third register of the current receive address (RTAP3) 151, a first register of the final receive address (RCAP1) 152, a second register of the final address reception (RCAP2) 153, the third register of the final receiving address (RCAP3) 154, the register of the current issuing address (PTAB) 155, the register of the final issuing address (RCAB) 156, the first counter of the current address of the first parcel receiving block (CTA B1PP) 157, the second counter the current address of the second receiving unit at the link (STA B2PP) 158, the third counter of the current address of the third parcel reception unit (STA B3PP) 159, the counter of the current address of the parcel delivery unit (STA BVP) 160, the first 161, the second 162, the third 163, the fourth 164 comparison schemes, the state machine ( MS) 165, multiplexer (MP) 166, the first and second groups of outputs of which are the first 28 and second 116 groups of outputs of the local trunk (LM) of block 105, the group of inputs and outputs 28 of which are connected to the group of inputs and outputs of the MS 165, the first group of outputs which is the third 121 group of block outputs, the first output of LM block 28 connected to the first output of MS 165, the second group of outputs of which is connected to the first inputs of the registers RTAP1 149, RTAP2 150, RTAP3 151, RTAV 155, RCAP 152, RCAP 153, RCAP 154, RCAB 156 and current address counters STA B1PP 157, STA B2PP 158 , STA B3PP 159, STA BVP 160, the first group of outputs of which is connected to the first group of inputs MP 166, the second, third and fourth groups of inputs of which are connected to the first groups of outputs of counters STA B1PP 157, STA B2P 158, STA B3PP 159, the second inputs of which connected to the second, third and fourth outputs of MS 165, the fifth output of which is connected about the second input of the STA counter BVP 160, the second group of outputs of which is connected to the first group of inputs of the fourth SS 164, the second group of inputs of which is connected to the group of outputs of the register РКАВ 156, the group of inputs of which is connected to the groups of inputs of the registers РТАП1 149, РТАП2 150, РТАП3 151, РТАВ 155, РКАП1 152, РКАП2 153, РКАП3 154 and is the third 118 group of inputs of block 105, the first (LM) 28 and second 117 of the group of inputs of which are connected to the first and second groups of inputs of MS 165, the third group of outputs of which is connected to the fifth group of inputs MP 166, and the group of outputs p of RTAG 155, RTAP1 149, RTAP2 150, RTAP3 151 registers are connected to groups of inputs of the counters STA BVP 160, STA B1PP 157, STA B2PP 158, STA B3PP 159, the third inputs of which are interconnected and connected to the first input of MS 165 and are the first signal the fourth 27 groups of inputs of block 105, the second signal of which is connected to the second input of MS 165, the third, fourth, fifth and sixth inputs of which are connected to the outputs of the first 161, second 162, third 163 and fourth 164 comparison circuits, the first groups of inputs of which are connected to groups outputs of counters STA B1PP 157, STA B2PP 158, STA B3PP 159, moreover, the groups of outputs of the registers RKAP1 152, RKAP2 153, RKAP3 154 are connected to the second groups of inputs of the first 161, second 162 and third 163 SS, the fifth 122 group of inputs of block 105 is connected to the third group of inputs of MS 165.

The time interval reference unit (SIA) 83 contains the first 167, second 168, third 169 and fourth 170 triggers, a counter 171, a decoder 172 and an OR element 173, the output of which is connected to the dump inputs of the second 168 and third 169 triggers, the direct output of which is the second 92 by the output of the UOVI 83, the first 87 output of which is connected to the output of the fourth 170 trigger and the first input of the OR element 173, the second input of which is the fourth 63 input of the UOVI 83 and connected to the reset inputs of the first 167 and fourth 170 triggers, the clock inputs of which are connected to the second input 168 of the trigger and is the third 52 input UOVI 83, the first 86 input of which is connected to the information input of the second 168 trigger, the output of which is connected to the clock input of the third 169 trigger, the inverse output of which is connected to the reset input of the counter 171, the clock input of which is connected to the output of the first 167 trigger, the information input of which is the second 48 input of the UOVI 83, and the group of outputs of the counter 171 is connected to the group of inputs of the decoder 172, the output of which is connected to the information input of the fourth 170 trigger RA, the information input of the third 169 trigger is connected to 3.3V.

The single command mode node (LESSON) 84 contains the first 174, second 175 and third 176 triggers, the first 177 and second 178 OR elements, the first 179 and second 180 AND elements, the outputs of which are the third 91 and second 89 outputs of the LESSON 84, the first 88 output which is connected to the output of the first 174 trigger, the inverse output of which is connected to the first input of the second 178 OR element, the output of which is connected to the discharge inputs of the second 175 and third 176 triggers, the direct and inverse outputs of which are connected to the first inputs of the first 179 and second 180 AND elements, second entrances which are connected to the information input of the third 176 trigger and the output of the second 175 trigger, the clock input of which is connected to the clock inputs of the first 174 and third 176 triggers and is the first 52 input of the LESSON 84, the second 63 input of which is connected to the second input of the second OR element 178 and the reset the input of the first 174 trigger, the information input of which is the third 54 input of LESSON 84, the group of inputs 90 of which is connected to the first, second, third and fourth inputs of the first 177 OR element, the output of which is connected to the information input in there are 175 triggers.

The single pulse generator (GOI) 95 contains a counter 181, a decoder 182, the first 183 and second 184 triggers and the element And 185, the output of which is the output 98 of the GOI, the first 97 and second 47 inputs of which are connected to the reset and clock inputs of the counter 181, respectively, group the outputs of which are connected to the group of inputs of the decoder 182, the output of which is connected to the information input of the first 183 trigger, the output of which is connected to the information input of the second 184 trigger and the first input of AND element 185, the second input of which is connected to the inverse output to there is a 184 trigger, the clock input of which is connected to the clock input of the first 183 trigger and is the third 52 input of the GOI, the fourth 63 input of which is connected to the reset inputs of the first 183 and second 184 triggers.

The synchronization flag generator (FPS) 106 comprises a control and synchronization status register (РУСС) 186, a synchronization waiting duration register (RPOS) 187, a synchronization duration register (RPS) 188, a multiplexer (MP) 189, a synchronization waiting duration counter (FPIC) 190, and a state machine (MS) 191, the first group of outputs of which is the first 112 group of outputs of the FPS, the second 119 group of outputs of which is connected to the group of outputs of the MP 189, the first group of inputs of which is connected to the group of outputs of the RPOS 187 and the input group SPOS 190, the output of which is connected to the first input of MS 191, the second group of outputs of which is connected to the first group of inputs of RUSS 186, the group of outputs of which is connected to the first group of inputs of MS 191 and the second group of inputs of MP 189, the third group of inputs of which is connected to the group of outputs RPS 188 and the second group of inputs MS 191, the third group of outputs and the first output of which are connected to the fourth group of inputs MP 189 and the output 29 of the FPS 106, respectively, the first 117 group of inputs of which is connected to the third group of inputs MS 191, the fourth, fifth and sixth groups the inputs of which are connected to the third 120, fourth 27 and fifth 121 groups of inputs of FPS 106, respectively, the second 118 group of inputs of which is connected to the first groups of inputs of RPOS 187 and RPS 188 and to the second group of inputs of RUSS 186, the first and second inputs of which are connected to the second and the third outputs of the MS 191, the fourth and fifth outputs of which are connected to the first inputs of the RPOS 187 and the AEC 190 and the second input of the RPS 187, the sixth, seventh and eighth outputs of the MS 191 connected to the second input of the AEC 190, with the first and second inputs of the RPS 188, respectively.

Failsafe computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration works as follows.

A fault-tolerant computing system includes three VMs of a working configuration and one VM in a cold reserve, the general scheme for countering failures and failures is as follows. The structural diagram of a fault-tolerant computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration is presented in figure 2. Each VM of the working configuration solves the same target task of special software (STR), using the fault tolerance software (VET), the decision results are transferred to other VMs of the working configuration and receives from them their copies of the results of the decision, and then according to their own and received copies of the solution determines the correct result. In a two-machine operating configuration, the correct solution is determined on the basis of two results and, if such a determination is not possible (there is no possibility of identifying a faulty VM using the results of the solution), then, depending on the available time resources, either a second solution of the STR problem is performed, or transition to intermediate testing of channels followed by a second decision with a positive test result or a transition to a single-channel configuration based on a working channel of the system. If it is not possible to identify a faulty VM, a transition is made to a safe shutdown of the system.

In the process of all actions performed by the system through VET, continuous and end-to-end functional diagnostics is carried out, which detects the occurrence of malfunctions and identifies them by the place of occurrence and by type: failure, software failure or failure. When identifying a failure, its accounting and analysis of the consequences is carried out. If the consequences of the failure do not require the intervention of the STR program, then they are eliminated automatically. If support from the STR is necessary, then diagnostic information is generated, on the basis of which the STR makes the required decision. Failures that do not require the intervention of STRs include, for example, a failure in the inter-machine transmission of information, which is parried due to the input of information redundancy. A malfunction requiring support of the software application is, for example, a malfunction in the issuance of information to the subscriber.

Identification of a software failure of a certain VM indicates the need for the process of its recovery on the part of other VMs of the working configuration, which consists in restoring information in the failed VM and coordinating its retraction into joint work. The volumes and location of the information being restored, the sequence and periods of its transmission, as well as the moment of retraction into joint work are determined by the conditions of application of the system and the tasks of the STR. Therefore, diagnostic information about a software failure is transmitted to the STR program, which controls the further course of the recovery process carried out using special recovery process operators performed by the software.

When identifying a failure, a system reconfiguration is performed. The failed VM is exited from the working configuration and shuts down. The solution of the problems of open source software also continues with further degradation of the system until the possibility of such a solution remains. If the continuation of the tasks of the STR is impossible, then the VET switches to the safe shutdown mode of the system, which is implemented by the special task of the STR, in which the on-board systems are transferred to safe operation modes while maintaining communication and controllability from the external environment.

In the process of operation of a fault-tolerant computing system, the following stages can be distinguished:

- the stage of turning on the system, its initial verification and initialization of mechanisms for ensuring failure and fault tolerance (initial verification stage);

- stage functional (target) work while maintaining a given level of redundancy;

- the stage of controlled degradation, which occurs when it is impossible to maintain a given level of redundancy;

- safe shutdown of the system.

At the initial verification stage, VET determines the operable elements of the system, selects and sets the initial working configuration of the system.

At the second stage, the target tasks of the system software are implemented with the help of VET. VET accompanies all performed actions with continuous and end-to-end functional diagnostics, periodic and background test diagnoses. In the event of malfunctions and software failures, open source software through VET restores the computing process. In the case of failure identification, VET performs reconfiguration of the system, ensuring the preservation of a given level of redundancy, and, on instructions from the STR, restores the computational process of the STR.

The stage of controlled degradation occurs when the exhaustion of redundancy and the inability to maintain its required level are exhausted. When failures are detected, VET reconfigures the system. At this stage, it is possible to reduce the functional characteristics of the system.

The system, with the help of VET, proceeds to a safe shutdown if it is impossible to continue the target work due to unacceptable malfunctions (for example, simultaneous failures in all VMs of the working configuration) or due to complete degradation of the system. In the process of safe shutdown, the system performs the actions defined by the special program of STRs for safe shutdown and aimed, firstly, at setting safe operating modes of on-board systems and, secondly, at ensuring the possibility of communication and control from the external environment.

The fault-tolerant and fault-tolerant operation of a fault-tolerant computing system, which is a multi-machine computing system, is based on two principles: the synchronized operation of all VMs of the working configuration and the consistency of decisions made by different VMs, based on the consistency of the source data.

These two principles are implemented in the VET system using the basic synchronization mechanism and the mechanism of mutual information coordination (VIS).

Two types of synchronization are provided:

- by internal programmable events generated in each VM working configuration;

- based on a single system time.

For open source tasks, the second synchronization method is preferable, in which the same system time is displayed on a specific timer in each working VM configuration.

In the process of synchronizing both types of VET, it carries out functional diagnostics with the detection and, if possible, identification of the occurrence of malfunctions.

The objectives of the VIS mechanisms used in VET are:

- ensuring data consistency in all operational VMs of the working configuration;

- parry of possible failures of a given multiplicity;

- detection and identification of manifestations of permissible malfunctions that occurred during the VIS.

At the stage of detailed design, it is planned to develop and evaluate VIS mechanisms of various designs in order to select mechanisms that are optimal in terms of reliability and expended resources.

From the state diagram and transitions in figure 1 shows that the system operates in computational modes of two types:

- solutions to the target in 3-, 2- and 1-machine working configurations (states 1, 4, and 6, respectively);

- restoration of the computational process in 3-, 2- and 1-machine working configurations (states 2, 5, and 7, respectively).

The hardware of the system and VET allow, when issuing information to subscribers via external communication channels, to provide the following possible options for sub-modes of exchange:

1) for preliminary control actions before issuing:

- with preliminary interchange of copies of the issued information or their convolutions;

- without prior interchange;

2) by the method of forming the information issued:

- issuing a copy of the output information belonging to one of the VMs;

- issuing a copy of the output information that belongs to one of the VMs and which is the result of preliminary hardware majorization of copies of various VMs;

3) to conduct the process of issuing information:

- without eavesdropping on the exchange being performed;

- with eavesdropping on the exchange being carried out and subsequent analysis of its results;

4) if necessary, a separate confirmation of the correctness of the information issued:

- without confirmation;

- with confirmation in the form of issuing a confirmation command to the subscriber via an external communication channel.

In total, a significant number of options for acceptable modes are formed, each of which is a variant of the combination of the given submodes. Each of the modes is characterized by certain values of the reliability of the issued information, the ability to detect and identify the manifestations of malfunctions, the required time, software and information resources. In the process of executing the algorithm of the diagram in FIG. 15, during the degradation of the VET system, it will sequentially change such modes. Moreover, the trajectory of regime changes should be determined by the conditions of application of the system and the requirements of the ACT software.

The main mechanisms for ensuring fault-tolerance and fault tolerance implemented in VET include mechanisms to counter the manifestations of faults, functional diagnostics, test diagnostics, reconfiguring the system, and restoring the computing process after failures, software failures, and failures.

Various mechanisms to counter the manifestations of malfunctions are based on the use of acceptable combinations of different types of redundancy (hardware, time, information and software). Thus, a reliable result of solving the ACT problem in a multi-machine working configuration can be determined on the basis of a majority sample of several copies of the results obtained by combining the available hardware, time and information redundancy or by combining software, time and information redundancy (for example, the excess number of copies can be obtained using various programs with possible intermediate testing of the system).

The mechanisms of functional diagnostics used are based on various methods of monitoring the operability of computer tools and their combinations: time control (maintaining the synchronism of actions of various VMs of the working configuration, performing actions for certain time periods, etc.), information control (difference between copies of the result from its reliable value, various types of information coding by codes detecting errors, etc.), hardware control (hardware built-in control circuits I'm in various elements of the system).

Functional diagnostics include a watchdog timer that also provides some protection against software design errors.

The reconfiguration and recovery mechanisms of the computational process after failures and failures are designed to isolate faulty elements of the working configuration and the computational processes they perform in order to avoid spreading errors and distortions to other elements and computational processes of the system, restore interrupted computational processes, reconfigure computing tools to isolate failed elements and replace their spare, checking the operability of the connected spare elements, ensuring their necessary my information and involvement in working together in a working configuration. Isolation of faulty system elements is carried out by logical and physical methods. With logical isolation, the actions of a faulty element are ignored by serviceable elements. With physical isolation, the effects of faulty system elements on serviceable ones are blocked by hardware or faulty elements are turned off. The proposed project uses both insulation methods.

All elements of the system, as necessary to install a failed item in the initial state of recovery, are divided into two types: requiring such installation and not requiring. In the designed system there are elements of both types. So a failed VM is forcibly transferred to the initial recovery state when it is blocked by two other VMs of the working configuration.

When performing recovery processes in the working configuration, a recovery complex (VK) is formed, which includes serviceable elements of the working configuration, which carries out all the necessary recovery actions according to the tasks from the STR with the help of VET.

The hardware and software of the recovery mechanisms ensure the exchange of information between the VC and the restored VM, initialization of the required computing processes in the restored VM, retraction of the restored VM into the coordinated joint work of the newly created working complex.

The occurrence of latent (latent) failures not detected by the functional diagnostics, a significant accumulation and subsequent joint manifestation of which can lead to a system failure even if there is a sufficient margin, significantly affects reliability indicators, fault and fault tolerance. Protection against such malfunctions is achieved through periodic testing of all means of a computer system with the aim of timely detection and elimination of consequences. Testing is carried out by executing test programs (TP), each of which is designed to test the health of a particular system element.

In the designed system, it is supposed to implement two types of testing implemented in VET:

- full testing of all elements of the system;

- limited testing of specified elements, taking into account certain restrictions on the conditions of verification (by runtime, by interaction with other elements, by the required safety of certain operating modes or information).

Full testing is performed during initial testing. Limited testing can be carried out either in specially allocated test pauses, or in the background. In addition, the function of limited testing is to periodically check spare and backup elements.

A separate recovery mechanism, functional and test diagnosis is the mechanism of regeneration of a given area of RAM. This mechanism is launched from the target program and provides restoration or control (depending on the number of VMs in the working configuration) of the uniformity of the contents of this memory area in all VMs of the working configuration.

To ensure these functions, the system provides for inter-machine exchange controllers (KMMO) (13, 14, 15, 16) and configuration control controllers (KUK) (17, 18, 19, 20).

KUK (17, 18, 19, 20) is intended for use as part of the same type of VM, which are the backup channels of the redundant system, and performs the following functions:

- control of the inclusion of the main and standby secondary supply voltages in the VM, turning off these voltages;

- the appointment of a VM leading relatively multiplex communication channels (MCO) system;

- restart the VM in order to carry out the procedure for restoring its normal operation after a failure;

- organization of work of the watchdog timer 99 VM.

The functional diagram of the configuration management controller (17, 18, 19, 20) is shown in FIG.

The composition of the CUC includes:

- four blocks of the same type receiving command packages (BPKP0-BPKP3) (40-43);

- block allocation teams (BVK) 44;

- command execution unit (BIC) 45;

- block watchdog timer and frequency divider (BSTDCH) 46.

The third 32, fourth 33, fifth 34, sixth 35 groups of inputs (RX, SY, SL), BPKPO-BPKP3 (40-43) blocks receive signals corresponding to four sequential synchronous transmission channels of the transmission lines of the MMO system.

The functional diagram of the block receiving command parcels is presented in figure 4.

Each channel is formed by three signal lines. The information bits of the packet are sent to the input Rxi, the transmission synchronization pulses to the input SYi, and the signal reflecting the presence / absence of the transmission of the packet through the channel to the input SLi.

In each of the BPKP0-BPKP3 (40-43) blocks, the incoming packet is converted from a sequential to parallel representation (shift register 65), the reliability of the received packet is checked (modulo adder (73) and trigger (70)). If the parcel is a command and reliable, then its content part is “latched” and the command code (CC) 55 is issued from the BPKi block. The end of the parcel reception, determined with the help of counter 66 and decoder 67, is accompanied by a single generation of a warning pulse signal (ISO) 59 ( triggers 68, 69, 71 and elements And 76 and 77). The time interval between two adjacent command sends is at least 500 μs.

Functional block diagram of the allocation of commands (BVK) is presented in figure 5.

Codes KK1-KK4 (55-58) and signals ISO1-ISO4 (59-62) from the outputs of the BPKP0-BPKP3 (40-43) blocks are fed to the inputs of the BVK 44. Each of the pulses ISO1-ISO4 (59-62) installs the corresponding trigger from the RPG register 80, which forms a single state of the readiness indicator 90 of the corresponding command code. At the output of the BVK block 44, the KIK code 50 of the command is transmitted, which is transmitted for execution to the BIK block 45. The code is written to the input instruction register 93 of the BIK block 45 by the pulse ZK 53.

There are two operating modes of the BVK 44 unit, set by the value of the VMZHR signal 54:

- Majorization mode of command codes (WMR = 1);

- mode of absence of majorization of command codes (WMR = 0).

In the majorization mode in BVK 44, 82 codes of teams from the set of KK1-KK4 (55-58) are compared in pairs, for which the signs of readiness have a single value. Switching command codes and signs of readiness is performed by generating control signals of the MS 85 in accordance with the algorithm presented in Fig.21, 21A. If a pair of codes has the same value, then it is entered once, using the pulse ЗК 53, formed by the MC 85, and is entered into the input instruction register of the BIC block 45, where, under appropriate conditions, it is executed once. At the same time, the reference node of the time interval 83 with a duration of 240-310 μs is launched, after which all the signs of the readiness of the command code in the BVK 44 are reset to zero (SBRRP).

In the absence of majorization mode in BVK 44, a single entry is made in the input command register 93 of the BIC block 45 of that value of the command code from the set KK1-KK4 (55-58) for which a single state of the readiness flag is established. Upon completion of recording, the sign of readiness of the command code is reset to zero.

Switching the BVK block 44 from the majorization mode to the mode of absence of majorization is carried out only after the reset to zero signs of readiness of the block.

Due to initialization, the mode of majorizing command codes is set.

The switching of the BVK block 44 from the majorization mode to the absence of majorization mode is controlled using a special command to turn off majorization.

The allocation procedure for this command in BVK 44 is determined by the value of the signal ZPRMZHR 29:

- at a single signal value, the command is transmitted for execution if its code is generated at the output of at least one of the BPKP0-BPKP3 (40-43) blocks;

- when the signal value is zero, the command is transmitted for execution if its code is generated at the outputs of two blocks BPKP0-BPKP3 (40-43).

Functional block diagram of the command execution (BIC) is presented in Fig.6.

Code KIK 50 command block BIK 45 is recorded in the input register of commands 93 by the signal ZK 53. The format of the configuration management commands is presented in Fig.17. The correspondence of the KO code values to the performed operations is given in table 1 in Fig. 20.

The third 23 group of inputs of the BIC block 45 receives a two-bit specified code of the VM number, and if the specified code matches the command code of the VM number, the comparison circuit 94 generates a signal by which the MS 96 generates an output signal in accordance with the specified operation code.

The formation of the output signals is performed by the MS 96 in accordance with the algorithm presented in Fig.22.

On the third 30 group of outputs, the following signals are generated:

- the first signal VKLDP0 - at a single signal value, the 0th reserve line of the duplicated VM standby power line is activated. The signal VKLDP0 is set to one if the following conditions are jointly fulfilled:

- bits 7, 8 of the command have a state of "0";

- <KO> = "10010";

- <HBM> = ZNVM.

The ONLDP0 signal is reset to zero if one of the following conditions is true:

- signal <NU> 63 = "0";

- conditions are jointly fulfilled:

bits 7, 8 of the command have a state of "0";

<CO> = "00010";

- conditions are jointly fulfilled:

bits 7, 8 of the command have a state of "0";

<CO> = "10010";

<NVM> is not equal to the ZNVM;

- the second signal VKLDP1 - at a single signal value, the 1st backup line of the duplicated VM standby power line is activated. The signal VKLDP1 is set to unity if the following conditions are met together:

- bits 7, 8 of the command have a state of "0";

- <KO> = "10011";

- <HBM> = ZNVM.

Signal VKLDP1 is reset to zero if one of the following conditions is true:

- signal <NU> 63 = "0";

- conditions are jointly fulfilled:

bits 7, 8 of the command have a state of "0";

<CO> = "00011";

- conditions are jointly fulfilled:

bits 7, 8 of the command have a state of "0";

<CO> = "10011";

<NVM> is not equal to the ZNVM.

- the third signal VKLBLK - with a single value of the signal is prohibited the issuance of the second 21 and third 30 groups of outputs.

The VKLBLK signal is set to unity if the following conditions are met together:

- bits 7, 8 of the command have a state of "0";

- <KO> = "10100";

- <HBM> = ZNVM.

The ONLBL signal is reset to zero if one of the following conditions is true:

- signal <NU> 63 = "0";

- conditions are jointly fulfilled:

bits 7, 8 of the command have a state of "0";

<CO> = "00100";

<NVM> is not equal to the ZNVM;

- at the second output of the BIC 45, a VMZH signal 54 is generated, with a single value of the signal, majorization of the parcels received by the CMC of the VM module is allowed.

The WMR signal 54 is reset to zero if the following conditions are met together:

- bits 7, 8 of the command have a state of "0";

- <KO> = "00101";

- <HBM> = ZNVM.

The signal VMZHR 54 is set to one if one of the following conditions is true:

- signal <NU> 63 = "0";

- conditions are jointly fulfilled:

bits 7, 8 of the command have a state of "0";

<CO> = "10101";

<HBM> = ZNVM;

ZPRMZHR = "0".

On the second 21 group of outputs, VDSHi signals are formed that determine the number of the MCO, on which the VM module must be active.

The output signal of the VDShCi is set to unity if the following conditions are met together:

- bits 7, 8 of the command have the state "0", "1", respectively;

- <HBM> = ZNVM;

- the value i corresponds to the decimal representation of <KO>.

The pulse signal ZKU, once generated at the first output 51 of the BIC block 45, is set if the following conditions are met together:

- bits 7, 8 of the command have a state of "1";

- <HBM> = ZNVM.

When this is done, the binary code of the time interval (the first group of outputs 48) is written to the CO field of the command in the counter 99 of the watchdog timer of the BSTDCH block 46.

Block BSTDCH 46 for the second group of inputs of the SNU 27 receives the first signal TI 64 with a frequency of 24 MHz, based on which the pulse sequences are generated 23 kHz (second output 52), TI1 (first output 49) and 92 Hz (second signal of the first group of outputs 47 ) coming into other blocks and ensuring their work.

The functional block diagram of the watchdog timer and frequency divider (BSTDCH) is presented in Fig.7.

Watchdog 99 is based on a five-digit binary counter. When the timer 99 is activated, a pulse signal IST is generated (the first signal of the first group of outputs 47), which enters the BIK block 45. The code KU (the first group of inputs 48) of the setpoint is written to the timer counter 99 by the ZKU signal (first input 51) when the corresponding command is executed in the block BIC.

The inter-machine exchange controller (KMMO) (13, 14, 15, 16) is intended for use as part of the same type of VM, on the basis of which highly reliable four-machine computing systems are built.

KMMO performs the following functions:

- organizes high-speed information exchange between computers of a computer complex using serial channels of inter-machine exchange;

- provides mutual synchronization of computing processes implemented by the machines of the complex;

- provides a record in an external operational memory of data received via the inter-machine exchange channels, reading codes from the memory, issued to the corresponding inter-machine communication channel;

- performs write and read operations, in relation to the addressable KMMO registers, from the processor side of the calculator.

Functional diagram of the machine-to-machine exchange controller (KMMO) (13, 14, 15, 16) is presented in Fig. 8.

KMMO includes the first B1PP 101, the second B2PP 102, the third B3PP 103 parcel receiving units, the BVP parcel issuing unit 104, the direct memory access control unit BJP 105, the synchronization sign generator FPS 106, the first B1VV 107 I / O buffer, the second buffer B2BB I / O 108, the first group of OR elements 109, the second group of OR elements 110.

Inter-machine exchange (IMO) is organized using packages that are transmitted through inter-machine exchange channels. Each channel (fourth 33 group of inputs, fifth 34 group of inputs, sixth 35 group of inputs) corresponds to three signals:

- SL - signal activation package;

- RX - information signal;

- SY- synchronization signal.

The format of the generated packages is presented in Fig.23.

The transmission of the package takes place at a zero value of the signal SL. The SY pulse train generated in this case is used to change the value of the transmitted information signal on the transmitting side of the channel when the signal SY goes into a low state, and to receive the values of the information signal (IS) on the receiving side of the channel when the signal SY goes into a high state. The first bit of the IC is a sign of the type of transmitted information (PTI): a zero value of the sign indicates the transmission of the control word, a single - the transmission of the data word. Bits of information are followed by bits of the information word, starting with the oldest. The sending ends with a control bit (BC) having a unit value if the previous sending bits contain an even number of units. An MMO channel is considered to be switched off if its SL and SY signals simultaneously have a low level state for a time interval exceeding 0.7 μs.

The inputs of each of the blocks B1PP 101, B2PP 102, B3PP 103 receive the received signals corresponding to the four channels of the IMO. In this case, the signals of the three channels come directly from the inputs of the CMMO (fourth group of inputs 33, fifth group Error! Communication error).

Functional diagram of the block receiving parcels IMO (101-103) is presented in Fig.9.

At the current time, the B1PP unit receives signals from only one of the four MMO channels. The control of the reception unit is carried out through the programmatically accessible control register RUSP 130. The selected channel is set by the code contained in the control register RUSP 130.

The format of the control register of the IMO package receiving unit (101-103) is shown in FIG.

The line number of the MMO trunk from which reception is performed is selected using multiplexers MP1 123, MP2 124, and MP3 125 under the control of the state machine MS 131. The algorithm of operation of the MS 131 of the block for receiving parcels from the channels of the IMO is shown in Fig. 26. In the block, the received serial code is converted to parallel on the shift register 127, the reliability of the received information on the exclusive XOR 136 elements, the trigger 134, the counter 132, the decoder 133, the I element 135 and the MS 131. If an error is not detected during the control, the attribute value is analyzed PTI, which determines the subsequent operation of block 101. In case of receiving a control word (PTI = 0), it is recorded in the command word register RKS 128, and this fact is recorded in the control register RUSP 130. It is possible to generate an interrupt request flag upon receipt of a control word by issuing interrupt flags 112 from the block of the corresponding value of the code KFP1 112. Through the group of elements OR2 110 this code is transmitted to the second group of outputs 39 KMMO 13. Writing the command word in RKS 128 causes the unit to be set to a single state sign of the control panel receiving the command received by the FPS unit 106. In the case of receiving a data word (PTI = 1), it is recorded in a special buffer register BRD 129 and activation of the signal ZPD 122 direct access request, which enters the BJP block 105. This block organizes the recording of the contents of the buffer register in the RAM cell at the address contained in the current address register. If the cell address matches the contents of the register of the final address, the fact of filling the buffer area of RAM designed to receive an array of data words is recorded in the control register of the RUPS 130. The data code recorded in the memory, as the code KDP1 119 at the output of B1PP, is transmitted to the terminals D of the local highway 28 through the group of elements OR1 109 and the second input / output buffer B2BV 108. Using the control feature that is part of the RUSP 130 register, it can be receipt of parcels to B1PP is prohibited (the unit is disconnected from the exchange channels). The addresses of the control and status registers in the B1PP-B3PP blocks have the following meanings: RUSP1 - 00100, RUSP2 - 01000, RUSP3 - 01100.

The operation of the control register RUSP 130:

• zero and first digits control the operation of multiplexers MP1 123, MP2 124, MP3 125. They specify the number of the computer;

• the third bit SL determines the “state of the MMO line” - it is set to “1” if at the input SLi and at the input SYi of the input channel selected by the multiplexer, at the same time, a low level of the input signal is located for at least 4 periods of TI1 frequency. Thus, “0” in this category is set if the given MMO line is turned on, and “1” - if the line is turned off;

• fourth discharge Off - “the receiving unit is disconnected from the MMO line”, it is installed and reset programmatically, “0” in the discharge - the operation of the MC 131 is allowed, “1” in the discharge - the operation of the MS 131 is prohibited. The Off discharge does not affect the setting of the SL discharge;

• seventh digit FEr - “format error”, is set to “1” upon detection of MS 131 by one of the following situations:

- if during the active (low) SLi level, the number of transitions received from the “1” to “0” received at the SYi input differs from 18;

- received an incorrect parity bit;

• the eighth digit of Eri - “information reception error”, is set to “1” upon detection of MS 131 by one of the following situations:

- MS 131 recognized the informational package when the Qi bit “receive buffer is full” is set;

- when the Qi discharge is cleared, new information is recorded in the register of the BRD 129, while the RAP mechanism did not ensure that the previous information from the BRD 129 was entered into the external RAM;

• the ninth bit Ni switches the output of the signal Qi to the output FL0 (first signal of the second group of outputs 39) (with Ni = "0") or FL1 (second signal of the second group of outputs 39) (with Ni = "1");

• tenth rank Mi - “interrupt mask” - sign of masking the interrupt request based on Qi: the request is generated if Qi = "1" and Mi = "0";

• eleventh bit Qi - “the receive buffer is full”, is set to “1” upon completion of the reception of the information package corresponding to the final address of the external RAM. Logical "1" in the Qi category prohibits the reception of a sequence of information packets;

• twelfth bit Erc - “error receiving command”, set to “1” if the command code was written in the RUSP 130 register when the Qc bit was set;

• thirteenth digit Nc - “interrupt line number” interrupt request line number according to the Qc criterion: when the bit value is zero, the request is issued via FL0 (the first signal of the second group of outputs 39), with a single - through FL1 (the second signal of the second group of outputs 39);

• fourteenth bit Mc - “command interrupt mask” - sign of masking the interrupt request on the basis of Qc: the request is generated if Qc = 1 and Mc = 0;

• the fifteenth digit Qc - “command received”, is set to “1” by writing to the register of the command word RKS 128 the command code from the received command sending. The presence of "1" in the discharge Qc with the mask removed in the discharge MS is indicated by the active (low) signal level at the output FL0 (the first signal of the second group of outputs 39) (with Nc = "0") or FL1 (the second signal of the second group of outputs 39) ( at Nc = "1").

From the block issuing parcels MMO BVP 104 on the first group of outputs 32 are issued parcels containing both command words and data words.

The functional diagram of the block issuing parcels IMO (104) is presented in figure 10.

When a command word is issued, its code is pre-recorded in the addressable register RKSV 137, and then, as a result of writing a single value to the corresponding bit of the RUSV 139 register, the operation of sending a message from the BVP 104 is performed. During the issuing process, TX, SY, SL signals are generated in accordance with with the format of the generated parcels in Fig.23 and the conversion of the contents of the register RKSV 137 into a serial code on the shift register 142, which together with the control bit generated on the elements of the counter 143, the decoder 144, the element exclude The current OR 147 and trigger 145 are issued as the first signal of the first group of outputs. The fact of completion of the issuance of the control word is recorded in the register RUSV 139.

The algorithm of operation of the MS 148 block issuing parcels IMO (104) is presented in Fig.27.

It is possible to generate, according to this fact, the corresponding value of the CWF code of the interrupt flags on the second group of outputs 112 of the BWP 104. The completion of the command word results in the setting of the sign of PVC 120 (first output) of the issuance of the command transmitted to the FPS to a single state.

The addresses of the control and status registers and the control word in the BVP block 104 have the following meanings: RUSV - 00000, RKSV - 00001.

The functioning of the control register issuing RUSV 139:

- zero and first digits set the number of the computer;

- fourth discharge Off - “the issuing unit is disconnected from the MMO line”, it is installed and reset programmatically, “0” in the discharge - operation of the MS 148 is enabled, “1” in the discharge - operation of the MS 148 is prohibited. During normal operation, information from the buffer register BWP 138 under the control of MS 148 is fed to the first group of outputs 32;

- the eighth digit Exe - “issuing information packages”, is set to “1”, initiating the issuance of a sequence of information packages, the data for which are taken through the DAP mechanism from sequentially located external RAM cells and the BVP buffer register 138, the bit is reset to hardware due to the issuance from the sending block with the last word of the array data;

- the ninth bit Ni switches the output of the signal Qi to the first output FL0 (first signal of the second group of outputs 112) (with Ni = "0") or the second output FL1 (second signal of the second group of outputs 112) (when Ni = "1");

- tenth rank Mi - “interrupt mask” - sign of masking the interrupt request by the Qi attribute: the request is generated if Qi = "1" and Mi = "0";

- eleventh bit Qi - “the receive buffer is full”, is set to “1” upon completion of the reception of the information package corresponding to the final address of the external RAM. Logical "1" in the Qi category prohibits the reception of a sequence of information packets;

- twelfth digit Start - “issue a command”, is set to “1” if it is necessary to issue from the block of the parcel containing the command word (contents of the register РКСВ 137);

- thirteenth digit Nc - “interrupt line number” interrupt request line number according to Qc: when the value is zero, the request is issued via FL0 (first signal of the second group of outputs 112) or second output FL1 (second signal of the second group of outputs 112);

- fourteenth bit Mc - “interrupt mask on command” flag to mask the interrupt request on the basis of Qc: the request is generated if Qc = 1 and Mc = 0;

- the fifteenth bit Qc - “command issued”, is set to “1” due to the issuance of a parcel containing the control word from the block.

Work when performing direct access operations is carried out in accordance with the functional diagram of the direct access control unit (BAP) 105, presented in Fig.11. The activation of the signals ZPD1-ZPD3 of the direct memory access request (fifth group of inputs 122) from the direct access blocks B1PP-B3PP (101-103) entails the performance of one or more operations of writing data codes to RAM. On Fig presents a timing diagram of the write (and read) operation in RAM, which corresponds to the case of the presence of requests from two blocks simultaneously. The operation begins with the formation of a low signal level at the first output of HOLD (local highway 28). The transition to zero of the signal at the HLDA input (the first signal of the first group of inputs of the local highway 28) indicates the permission of the access operation, as a result of which the address code corresponding to one is set at the outputs A1-A12 (second group of outputs 116, the first group of outputs of the local highway 28) from reception units. The issuance of signals to the inputs and outputs A1-A5 (local highway 28) is carried out by the buffer B1VV 107 under the control of the UVA signal (third group of outputs 121). In the receiving unit from the BAP 105, a permission signal is issued for issuing a recordable data code, which is transmitted through a group of OR1 109 elements and a buffer 108 to a bi-directional data bus D of the local highway 28. Using the ATC signal, the data code is transmitted from the output of the OR1 109 element group via B2B 108. The output signal nWR (local highway 28) provides a record of the data code in a given memory location.

After a certain time interval, the write operation is repeated for the data code transmitted from the second receiving unit to the memory.

On Fig presents a timing diagram of the operation of reading the data code from RAM into the buffer register of the block BWP 104. The operation is a consequence of the filing in the block BJP 105 signal ZPD0 and begins the same way as the write operation, in terms of changing the status of the signals HOLD, HLDA and issuing the code addresses on the first 28 and second 116 groups of outputs A1-A12. The transition to the low level signal nRD (input-output of the local highway 28) generates a data code on the D bus (local highway 28), which is transmitted through the B2BB 108 buffer to the broadband bus of the received data, and then to the BVP unit 104.

Block BPD 105 contains the registers of the current address when accessing RAM in direct access mode:

- РТАВ 155 - is used for calls from the BVP 104;

- RTAP1 149 - is used for calls from the block B1PP 101;

- RTAP2 150 - used for calls from the side of the B2PP block 102;

- RTAP3 151 - used for calls from the B3PP 103 block.

Register Addresses:

- PTAB 155 - 00010;

- RTAP1 149 - 00110;

- RTAP2 150 - 01010;

- RTAP3 151 - 01110.

The values of the codes of the current addresses stored on the counters STA BVP 160, STA B1PP 157, STA B2PP 158, STA B3PP 159 increase by one after each use to access RAM. Bits 2–13 of the register are read and write programmable.

Block BPD 105 contains the registers of the end address when accessing RAM in direct access mode:

- РКАВ 156 - used for calls from the BVP 104;

- RKAP1 152 - is used for calls from the block B1PP 101;

- RKAP2 153 - used for calls from the side of the B2PP block 102;

- RKAP3 154 - is used for calls from the block B3PP 103.

Register Addresses:

- RKAV 156 - 00011;

- RKAP1 152 - 00111;

- RKAP2 153 - 01011;

- RCAP3 154-01111.

Bits 0, 1, 14, 15 of the register are not used.

The algorithm of operation of the MS 165 block BAP (105) is presented in Fig.29.

Mutual synchronization of computational processes implemented by the VM is carried out using the FPS unit 106 based on the attributes of the PVC, PPK1-PPK3, which reflect the facts of the perception of command messages and their corresponding control signs Off0-Off3, which are part of the address register RUSS 186.

Functional diagram of the generator sign synchronization is presented in Fig.

In the synchronization process, only those attributes from the number of PVCs, PPK1-PPK3, to which correspond to zero values of the control signs, are involved. The modes of single-machine synchronization, two-machine synchronization, three-machine synchronization are allowed. To register the result of the synchronization, the RUSS 186 register provides a generalized synchronization indicator (OPS) and a synchronization error indicator.

The operation algorithm of the MS 190 of the FPS unit 106 is shown in FIG.

In single-machine synchronization, the OPS reflects the state of a feature participating in synchronization. With two-machine synchronization, the OPS is set to one if the time interval between setting the single state of the features participating in the synchronization does not exceed the duration of the synchronization wait specified in RPOS register 187. Otherwise, when the synchronization wait is completed, the OPS unit is set and a synchronization error is recorded. In the case of three-machine synchronization, the OPS is set to one if the time interval between fixing the installation of the unit state of the two signs participating in synchronization and setting the unit state of the third does not exceed the duration of the synchronization wait. Otherwise, upon completion of the synchronization wait, it is set to the OPS unit and a synchronization error is recorded. The OPS transition to a single state provides the start of the timing of the synchronization using a time counter, which is accessed through the addressable register of the RPS 188. It is possible to generate, upon the installation of the OPS, the corresponding value of the KFS code 112 (the first group of outputs) of the interrupt flags. If a synchronization error is detected, then a high signal level is set at the output of OShC 29.

The format of the control register and state RUSS 186 of the FPS block (106) is shown in Fig. 31. The address of RUSS 186 is 10010.

The operation of the control register and state RUSS 186:

- zero discharge F10 (PVC) - a sign that displays the status of the sign Qc, which is part of the register RUSV 139;

- the first bit Off0 is a control feature, with the help of which the participation of the characteristic F10 (PVC) in the formation of the OPS (Q) is set;

- the second bit F11 (PPK1) is a sign that displays the status of the sign Qc, which is part of the register RUSP1;

- the third bit Off1 is a control feature, with the help of which the participation of the characteristic F11 (PPK1) in the formation of the OPS (Q) is set;

- the fourth bit F12 (PPK2) - a sign that displays the status of the sign Qc, which is part of the register RUSP2;

- the fifth digit Off2 is a control feature, with the help of which the participation of the characteristic F12 (PPK2) in the formation of the OPS (Q) is set;

- the sixth digit F13 (PPK3) - a sign that displays the status of the sign Qc, which is part of the register RUSPZ;

- the seventh digit Off3 is a control feature, with the help of which the participation of the feature F13 (PPK3) in the formation of the OPS (Q) is set;

- the eleventh bit MEr is a sign of masking the transmission of the status of the sign of Er to the OshC 29 output 29: a high signal level at this output occurs if Er = 1 and MEr = 0;

- the twelfth bit Er is a sign of a synchronization error;

- the thirteenth digit N is the number of the interrupt request line according to the sign of Q: when the bit value is zero, the request is issued as the first signal of the first group of outputs 112 or the second signal of the first group of outputs 112;

- the fourteenth bit M is the sign of masking the interrupt request on the basis of Q: the request is formed if Q = 1 and M = 0;

- the fifteenth digit Q (OPS) is a generalized sign of synchronization.

The format of the register of the duration of the synchronization wait RPOS 187 block FPS (106) is presented in Fig. 32. The address of RPOS 187 is 10001.

Using the binary code of the waiting time (KPO), an integer value of the waiting time is set to One that is a multiple of Tic and is in the range from Tic to 256 Tic. The encoded value of the waiting time Current is determined in accordance with the expression

Current = To / Tic-1.

The format of the synchronization duration register of the RPS 188 of the FPS block 106 is shown in FIG. The address of the RPS 188 is 10,000.

The time counter starts working due to the transition to the single state of the OPS, its operation stops after the transition of the senior bit from the single state to zero, which is accompanied by setting 15 bits of the register to unity.

The synchronization of the software (software) of individual VMs and the necessary data coordination is carried out by the on-board operating system (BOS) at key points in the computing process, called synchronization points.

BOS provides:

- Coordinated management of system time in different VMs;

- coordinated task launch (the same task is performed in each VM at the current moment of time);

- coordinated exchange of MCOs;

- Consistent masking and masking of interrupts from on-board equipment.

In the coordination of the listed data, special software programs (STR) are not involved.

If it is necessary to coordinate any other (proprietary) data, the STR program can use the biofeedback function synchlnf (), which synchronizes the operation of the VM at the given synchronization point and matches the given information array.

Synchronization points are uniquely determined by their identifiers, which for STR programs can take values from 0 to 63. Different identifiers must be assigned to different synchronization points. To obtain the result of synchronization, a descriptor of the synchronization state is used, a pointer to which must be set when using the synchlnf () function.

Upon successful synchronization and data matching, the synchlnf () function returns the value of the initial state "OK".

If an error is detected in the function parameters, "ERROR" is returned. An array of control information (MCI) with the corresponding type of error is formed. If synchronization errors are detected, the vector of synchronization errors is returned.

The result of synchronization and data matching is generated in the synchronization state descriptor, a pointer to which was specified in the synchlnf () function call. The task of the STR, after analyzing the return code generated by the MCI and the descriptor of the synchronization state, makes a decision on possible further actions.

For all synchronization points, the actual synchronization is performed first, i.e. establishing the fact that all VMs are at the same point. If so, then the necessary data are negotiated. Otherwise, several synchronization attempts are made, as due to incomplete synchronization of the VM operation, a situation may arise when different VMs come to different synchronization points.

Coordination of system time is carried out periodically every second. Separate coordination is made according to different algorithms of the second time component (Ts) and the microsecond component (Tmks).

Matching Ts in a three-machine configuration is majorized by the Ts values received from different VMs.

In the two-machine configuration, the Ts value from the VM with the minimum or maximum number is selected as the correct one (in accordance with a predefined agreement). Matching Tmks of the three-machine configuration is done by choosing the average median value: of the three values t0 <t1 <t2, t1 is selected.

In the two-machine configuration, the arithmetic mean of the two values of Tmks is selected as the agreed one.

After coordination, the same values Ts and Tmks are set in all VMs.

Coordination of the time value is also carried out when reading and changing the time value at the request of the STR.

When reading time, the software program produces a consistent (identical) time value in all VMs.

When the time changes, a new value is negotiated, and then the agreed time value is set in all VMs. The synchronous execution of tasks in all VMs is ensured by matching the start vector and identifier when creating the task and matching the identifier at each start and each task suspension.

To do this, synchronize the VM when performing all functions:

- creating a task;

- suspensions;

- renewal and restart;

- delete and complete the task.

When creating a task, the values of the launch vector and the identifier of the created task are coordinated. In the remaining functions listed, the value of the identifier of the corresponding task is coordinated.

When a task is launched for execution, the value of the identifier of the task being launched is also agreed.

When working out the request of the open source software program for an exchange on MCOs, information is prepared for VMs in MCOs in all VMs equally. Direct transfer to the MCO is carried out only in one VM (VM_vdsh). Before starting the transfer, the information prepared for the transfer is agreed upon, and then after the exchange is completed in VM_vdsh, the exchange results and information received from the MCO are sent from VM_vdsh to the other VMs.

The ACT task that initiated the exchange will get the same results in all VMs. The assignment of VM_vdsh to the MCO is performed by the BF at initialization: VM with the minimum number is selected as VM_vdsh. Open source software programs can change the number BM_vdsch.

Information sources

1. USA patent No. 6141769 714/10, 714/11, 714 / E11.061, G06F 11/00, 1997

2. TIIER, Vol. 66, 10, No. 10, October 1978. Design and Analysis of a Fault - Tolerant Computer for Aircraft Control. JOHN H. WENSLEY, LESLIE LAMPORT.

3. IBM J. RES. DEVELOP. Redundancy Management Technique for Space Shuttle Computers J.R. Sklaroff.

4. Automation and telemechanics. 2003. No. 6, pp. 175-186. Mutual information coordination with the detection and identification of hostile faults in non-connected multi-machine systems. Lobanov A.V.

Claims (14)

1. Fault-tolerant computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration, containing the first, second, third and fourth computers (VMs) connected by the first, second, third and fourth serial data buses, characterized in that, in order to increase speed and automation of the reconfiguration process, the first, second, third and fourth secondary power sources (VIP), the first, second, third and fourth intermash controllers are additionally introduced into it of another exchange (CMMO), the first, second, third and fourth configuration controllers (CCC), the first output groups of which are connected to the first input groups of the first, second, third and fourth VMs, the second input groups of which are connected to the first group of system inputs, the second , the third, fourth, fifth groups of inputs which are connected to the first groups of inputs KMMO1 and KUK1, KMM02 and KUK2, KMMO3 and KUK3, KMMO4 and KUK4, respectively, the second groups of inputs of which are connected to the first groups of outputs of the VM, a local bi-directional highway rykh is connected to local bi-directional KMMO highways, the first outputs of which are connected to the first inputs of the KUK controllers, the second output groups of which are connected to the first groups of VIP inputs, respectively, the output groups of which are connected to the third groups of VM inputs, the first group of outputs of the first KMMO connected to third groups the inputs of the second, third and fourth CMMOs and the first, second, third and fourth CMCs, the first group of outputs of the second CMMO is connected to the fourth groups of inputs of the first, third and even grated CMMO and the first, second, third and fourth CMC, the first group of outputs of the third CMMO is connected to the fifth groups of inputs of the first, second and fourth CMMO and the first, second, third and fourth CMC, the first group of outputs of the fourth CMMO is connected with the sixth groups of inputs of the first, the second and third CMMOs and the first, second, third and fourth KUK, and the sixth group of inputs of the system is connected to the second groups of inputs of the first, second, third and fourth VIPs, the first inputs of which are connected to the seventh group of inputs of the system we, the eighth group of inputs of which are connected to the second inputs of the first, second, third and fourth VIPs, and the second groups of outputs of the CMMO are connected to the fourth groups of inputs of the VM. 2. Fault-tolerant computing system with hardware-software implementation of fault-tolerance and dynamic reconfiguration functions according to claim 1, characterized in that the configuration control controller comprises a first block for receiving command messages, a second block for receiving command messages, a third block for receiving command messages, a fourth block for receiving command parcels, block for allocating commands, block for executing commands, block for watchdog timer and frequency divider, the first group of outputs of which is connected to the first group of inputs of the block of execution commands, the first group of outputs of which is connected to the first group of inputs of the watchdog timer unit and the frequency divider, the first output of which is connected to the first input of the unit of allocation of commands, the group of outputs of which is connected to the second group of inputs of the command execution unit, the second group of outputs of which is the first group of controller outputs configuration management, the second group of outputs of which is the third group of outputs of the command execution unit, the first output of which is connected to the first input of the watchdog block and a frequency divider, the second output of which is connected to the first inputs of the first block for receiving command packets, the second block for receiving command parcels, the third block for receiving command parcels, the fourth block for receiving command parcels, the block for executing commands and with the second input of the block for selecting commands, the first output of which is connected with the second input of the command execution unit, the second output of which is connected to the third input of the command allocation unit, the first, second, third and fourth groups of inputs of which are connected to the first, second, third them and the fourth groups of outputs of the first, second, third and fourth blocks of the reception of command packages, respectively, the first outputs of which are connected to the fourth, fifth, sixth, seventh inputs of the block selection commands, the eighth input of which is connected to the second inputs of the first, second, third and fourth blocks receiving command parcels and a watchdog block and a frequency divider, the third input of the command execution block is the first signal of the second group of inputs of the configuration control controller, the first group of inputs to the second is connected to the third group of inputs of the command execution unit, the fourth input of which is connected to the ninth input of the command allocation unit and is the first input of the configuration control controller, the third, fourth, fifth and sixth groups of inputs of which are connected to the first groups of inputs of the first, second, third and fourth blocks receiving command parcels, respectively, with the second signal of the second group of inputs connected to the third input of the watchdog timer and frequency divider. 3. Fault-tolerant computing system with hardware-software implementation of fault tolerance and dynamic reconfiguration functions according to claim 1, characterized in that the command package receiving unit comprises a shift register, counter, decoder, first trigger, second trigger, third trigger, fourth trigger, fifth trigger exclusive OR, the first element AND, the second element AND, the third element AND, the fourth element AND, the OR element, the output of which is connected to the reset inputs of the counter and the third trigger, the output of which is connected to the first inputs given an exclusive OR and a second AND element, the output of which is connected to the information input of the fifth trigger, the output of which is connected to the first inverse input of the fourth AND element, the output of which is the output of the command package receiving unit, the group of outputs of which is connected to the group of outputs of the shift register, the information input of which connected to the second input of the exclusive OR and is the first signal of the group of inputs of the block receiving commands, the second signal of which is connected to the clock inputs of the shift register, a sensor and a third trigger, the information input of which is connected to the exclusive OR output, the first input of the command package receiving unit being connected to the clock inputs of the first, second and fourth triggers, the output of the fourth trigger connected to the first input of the third AND element, the output of which is connected to the first input of the fourth element And, the second and third inputs of which are the second and third signals of the group of outputs of the block receiving commands, the first signal of which is connected to the second inverse input of the fourth element And, the second input of the command package receiving unit is connected to the reset inputs of the shift register, the first, second, fourth and fifth triggers and the first input of the OR element, the second input of which is connected to the output of the first element And, the first input of which is connected to the second input of the third element And and the inverse output of the second trigger, the direct output of which is connected to the information input of the fourth trigger of the first, the direct output of the first trigger is connected to the information input of the second trigger, and the inverse output is connected with the second input of the first element And, the third signal of the group of inputs of the block receiving the command packages is connected to the information input of the first trigger and the clock input of the fifth trigger, and the group of outputs of the counter is connected to the group of inputs of the decoder, the output of which is connected to the second input of the second element I. 4. Fault-tolerant computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration according to claim 1, characterized in that the command allocation unit contains a command code switch (CPPC), a sign of readiness signs (RPG), a switch of signs of readiness of a command code (CPCK ), a comparison scheme, a node for counting time intervals (UOVI), a node for a single command mode (LESSON), a state machine (MS), the group of outputs of which is connected to a group of RPG inputs and to the first group of CPCK inputs, the first group you the moves of which are connected to the first group of inputs of the comparison circuit and is the group of outputs of the command extraction unit, the output of which is connected to the first output of the MS, the second output of which is connected to the first input of the SIA, the first output of which is connected to the first input of the MS, the second input of which is connected to the output of the circuit comparisons, the second group of inputs of which is connected to the second group of outputs of the CPPC, the second group of inputs of which is connected to the first group of inputs of the unit for selecting commands, the second, third and fourth groups of inputs of which are connected to network, the fourth and fifth groups of inputs KPKK, respectively, with the first and second inputs of the block selection commands are connected to the second input of the SIA and the third inputs of the MCU and the SEC and the first input of the Lesson, respectively, the first and second outputs of which are connected to the fourth and fifth inputs of the MC, the third the output of which is connected to the first input of the RPG, the second, third, fourth, and fifth inputs of which are the fourth, fifth, sixth, and seventh inputs of the instruction block, respectively, the eighth input of which is connected to the second input of the LESSON, with the fourth UOVI and with the sixth input of the MC, the first group of inputs of which is connected to the group of outputs of the CPCHC, the group of inputs of which is connected to the group of outputs of the RPG, with the group of inputs of the Lesson and the second group of inputs of the MC, the seventh input of which is the ninth input of the unit, the third input of which is connected with the third input of the LESSON, the third output of which is connected to the eighth input of the MS, the ninth input of which is connected to the second output of the SIA. 5. Failsafe computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration according to claim 1, characterized in that the command execution unit (BIC) contains a command register (RGK), a comparison circuit (SS), a single pulse generator (GOI), and a state machine (MS), the first group of outputs of which is the first group of outputs of the NIR, the second group of outputs of which is connected to the second group of outputs of the MS, the third group of outputs of which is the third group of outputs of the NIR, the first and second outputs of which connected to the first and second outputs of the MS, the first and second groups of inputs of which are connected to the first and second groups of outputs of the Prc, the third group of outputs of which is connected to the first group of inputs of the SS, the output of which is connected to the first input of the MS, the third output of which is connected to the first input of the GOI the output of which is connected to the second input of the MS, the third input of which is connected to the input of the PrC and is the second input of the NIR, the first group of inputs of which is connected to the second input of the GOI (first signal) and the fourth input (second signal) of the MS, the fifth input of which union of the third input of the GOI and the first input of the BIC, the third input coupled to a fourth input of the GOI and the sixth input of the MS, the seventh input of which is the fourth input NIR, second and third AND input group are connected to a group of inputs and a second group of RGCs SS inputs. 6. Fault tolerant computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration according to claim 1, characterized in that the watchdog timer and frequency divider (BSTDCH) block contains a watchdog timer (ST) and a frequency divider (DC), the first and second outputs which are the first and second outputs of the BSTDCH, the first group of outputs of which is connected to the output of CT (the first signal) and the third output of the PM (second signal), the fourth output of which is connected to the first input of CT, the group of inputs of which is the first the second group of inputs BSTDCH, the second group of inputs of which (the first signal) is connected to the first input of the PM and the second input of the CT, and the second signal is connected to the second input of the PM, and the first input of the BSTDC is connected to the third input of the ST. 7. Fault-tolerant computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration according to claim 1, characterized in that the inter-machine exchange controller contains the first, second and third blocks for receiving parcels from the channels of the inter-machine exchange (B1PP, B2PP, B3PP), the issuing unit parcels (BVP), direct access control unit (BDU), synchronization flag generator (FPS), first and second input-output buffers (B1VV, B2VV), the first and second groups of OR elements, the first group of outputs of the second group of OR elements is the second group of outputs of the CMMO, the first group of outputs of which is connected to the first group of outputs of the BVP, the second group of outputs of which is connected to the first groups of outputs of B1PP, B2PP, B3PP and FPS and the groups of inputs of the second group of OR elements, the output of the FPS being the output of KMMO, local highway which consists of address buses, information buses and control buses and is connected to the input-output groups of the first and second B1VV and B2VV and BPD, with the first group of outputs, with the first output and with the first group of input BPD, the second group of outputs which is connected to the first group of inputs B1VV, the group of outputs of which is connected to the first groups of inputs B1PP, B2PP, B3PP, BVP and FPS and to the second group of inputs of the BJP, the third group of inputs of which is connected to the second groups of inputs B1PP, B2PP, B3PP, BVP, FPS and with the group of outputs of the second B2BV buffer, the first input of which is connected to the output of the first group of OR elements, the group of inputs of which are connected to the third group of outputs of the BVP and the second groups of outputs B1PP, B2PP, B3PP and FPS, the third group of inputs of which is connected to the first outputs of B1PP B2P P, B3PP and BVP, the third group of inputs of which is connected to the third groups of inputs B1PP, B2PP, B3PP and is the first group of inputs of KMMO, the second group of inputs of which is connected to the fourth groups of inputs of BPP, B1PP, B2PP, B3PP, BVP, and FPS, fifth the group of inputs of which is connected to the fifth groups of inputs B1PP, B2PP, B3PP, BVP, with the input B1VV, with the second input B2VV and with the third group of outputs of the BJP, the fourth, fifth and sixth groups of inputs of the CMMO connected to the sixth, seventh and eighth groups of inputs of B1PP , B2PP, B3PP, the ninth input groups of which are connected They are connected with the first group of BVP outputs, the second output of which is connected to the second outputs B1PP, B2PP, B3PP and with the fifth group of BTP inputs. 8. A fault-tolerant computing system with hardware-software implementation of the fault tolerance and dynamic reconfiguration functions according to claim 1, characterized in that the IMO package receiving unit contains a first, second, third, fourth multiplexer (MP), a shift register (WDW), a command register words (RKS), buffer data register (DBD), control and reception status register (RUSP), state machine, counter, decoder, trigger, AND element, exclusive OR element, the output of which is connected to the trigger information input, the output of which connected to the first inputs of the exclusive OR element and the And element, the output of which is connected to the first input of the MS, the first output of which is connected to the input of the RCC, the group of inputs of which is connected to the group of inputs of the BRD and the group of outputs of the ADD of the WG, the information input of which is connected to the second input of the element OR and the output of the first multiplexer, the first input of which is the first signal of the ninth group of inputs of the block, the second and third signals of which are connected to the first inputs of the second and third multiplexer, the second inputs of which the second input of the first multiplexer is the signals of the sixth group of inputs of the block, the seventh group of inputs of which is connected to the third inputs of the first, second and third multiplexers, the fourth inputs of which are signals of the eighth group of inputs of the block, the first group of outputs of which is connected to the second and third outputs of the MC, the fourth output which is connected to the input of the BRD, the group of outputs of the RKS is connected to the first group of inputs of the fourth multiplexer, the group of outputs of which is the second group of outputs of the block, the first output is The second one is connected to the fifth output of the MS, the sixth output of which is the second output of the block, the first group of inputs of which is connected to the first group of inputs of the MS, the seventh and eighth outputs of which are connected to the first and second inputs of the fourth multiplexer, the second group of inputs of which is connected to the group of outputs of the RCSP, the first group of inputs of which is the second group of inputs of the block, the third group of inputs of which is connected to the second group of inputs of the MS, the group of outputs of which is connected to the fifth inputs of the first, second and third multiplex ditch, the output of the third multiplexer is connected to the discharge input of the SDV RG, the output of which is connected to the second input of the MS, the ninth output of which is connected to the input of the RCSP, the second group of inputs of which is the fifth group of inputs of the unit and connected to the third group of inputs of the MS, the fourth group of inputs of which is connected with the second group of inputs of the fourth multiplexer, the third group of inputs of which is connected to the group of outputs of the BRD, and the output of the second multiplexer is connected to the clock inputs of the ADS RG, counter and trigger, the reset input is the second is connected to the fourth input of the unit, the first signal of which is connected to the second input of the element And and the output of the decoder, the group of inputs of which is connected to the group of outputs of the counter . 9. Fault-tolerant computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration according to claim 1, characterized in that the IMO parcel delivery unit contains an issuing command word register (RKSV), a buffer parcel issuing register (BVP), a control register and issuing status (RUSV), the first and second multiplexers (MP), shift register (SDV RG), counter, decoder, first and second triggers, an exclusive OR element and a state machine, the first group of outputs of which is the first group of outputs of the block IMO parcel delivery, the second group of outputs of which is connected to the first and second outputs of the MS, the second group of outputs of which is connected to the third group of outputs of the IMO parcel delivery unit, the first and second outputs of which are connected to the third and fourth outputs of the MS, the first and second groups of inputs of which are the first and third groups of inputs of the IMO package issuing block, the second group of inputs of which is connected to the first groups of inputs of RCSB, BVP, RUSV, the clock inputs of which are connected to the fifth, sixth and seventh outputs of the MS, respectively, eight the output of which is connected to the boot and inverse enable inputs of the SDV RG, the output of which is connected to the first input of the second multiplexer and connected to the first input of the MS, the third group of outputs of which is connected to the second group of inputs of the RUSV, the group of outputs of which is connected to the third group of inputs of the MS, the ninth output which is connected to the clock inputs of the first and second triggers, SDW RG and counter, the group of outputs of which is connected to the group of inputs of the decoder, the inverse output of which is connected to the second input of the second multiplexer a, whose output is connected to the information input of the second trigger and the first input of the element exclusive OR, the output of which is connected to the information input of the first trigger, the output of which is connected to the second input of the element exclusive OR, the first signal of the fourth group of inputs of the unit connected to the second input of the MS, the third the input of which is the second signal of the fourth group of inputs of the block and is connected to the reset inputs of the SDV RG, counter and the first trigger, with the installation input of the second trigger, the output of which is connected to the quad the first input of the MC, the fourth group of inputs of which is the fifth group of inputs of the block, and the groups of outputs of the RCCB and BVP are connected to the first and second groups of inputs of the first MP, the group of outputs of which is connected to the information inputs of the ADC RG, the inverse output of the first trigger is connected to the second input of the second MP , the input of the first multiplexer is connected to the fifth output of the MS. 10. A fault-tolerant computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration according to claim 1, characterized in that the direct access control unit comprises a first register of the current receive address (RTAP1), a second register of the current receive address (RTAP2), and a third register of the current receive address (RTAP3), first register of the final receive address (RCAP1), second register of the final receive address (RCAP2), third register of the final receive address (RCAP3), register of the current issuing address (RTAP), register of the final issuing address (RCAW), the first counter of the current address of the first parcel receiving unit (CTA B1PP), the second counter of the current address of the second parcel receiving unit (CTA B2PP), the third counter of the current address of the third parcel receiving unit (CTA B1PP), the counter of the current address of the issuing unit parcels (STA BVP), the first, second, third, fourth comparison schemes, a state machine (MS), a multiplexer (MP), the first and second groups of outputs of which are the first and second groups of outputs of the local trunk (LM) of the unit, a group of inputs and outputs which is connected to groups th input-output MC, the first group of outputs of which is the third group of outputs of the block, the first output of the LM block is connected to the first output of the MS, the second group of outputs of which is connected to the first inputs of the registers RTAP1, RTAP2, RTAP3, RTAV, RKAP1, RKAP2, RKAP3, RKAV and counters of the current address STA B1PP, STA B2PP, STA B3PP, STA BVP, the first group of outputs of which is connected to the first group of MP inputs, the second, third and fourth groups of inputs of which are connected to the first groups of outputs of the counters STA B1PP, STA B2PP, STA B3PP, the second inputs of which are connected with the second, third and fourth outputs of the MC, the fifth output of which is connected to the second input of the STA BVP counter, the second group of outputs of which is connected to the first group of inputs of the fourth SS, the second group of inputs of which is connected to the group of outputs of the RCA register, the group of inputs of which is connected to the groups of inputs registers RTAP1, RTAP2, RTAP3, RTAV, RKAP1, RKAP2, RKAP3 and is the third group of inputs of the block, the first (LM) and second groups of inputs of which are connected to the first and second groups of inputs of the MS, the third group of outputs of which is connected to the fifth UPPA of MP inputs, moreover, the groups of outputs of the registers РТАВ, РТАП1, РТАП2, РТАП3 are connected to the groups of inputs of the counters СТА БВП, СТА Б1ПП, СТА Б2ПП, СТА Б3ПП, the third inputs of which are interconnected and connected to the first input of the MC and are the first signal of the fourth group block inputs, the second signal of which is connected to the second input of the MS, the third, fourth, fifth and sixth inputs of which are connected to the outputs of the first, second, third and fourth comparison circuits, the first groups of inputs of which are connected to the output groups of the counters STA B1PP, STA B2PP, STA B3PP, p When in use, the outputs of registers RKAP1 group, RKAP2, RKAP3 groups connected to the second inputs of the first, second and third SS, a fifth block input group is connected to the third group of MS inputs. 11. Fault-tolerant computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration according to claim 1, characterized in that the time interval reference unit (UOVI) contains the first, second, third and fourth triggers, counter, decoder and OR element, the output of which connected to the dump inputs of the second and third flip-flops, the direct output of which is the second output of the FIA, the first output of which is connected to the output of the fourth trigger and the first input of the OR element, the second input of which is It is connected with the fourth inputs of the first trigger and the second input of which is connected to the information input of the second trigger, the output of which is connected to the clock input of the third trigger, the inverse output which is connected to the reset input of the counter, the clock input of which is connected to the output of the first trigger, the information input of which is the second input of the UOVI, and the group of outputs of the counter with dinena the group decoder inputs, the output of which is connected to the data input of the fourth flip-flop, an information input of the third flip-flop is connected to 3.3V. 12. Fault-tolerant computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration according to claim 1, characterized in that the node of the single command mode (LESSON) contains the first, second and third triggers, the first and second elements of OR, the first and second elements of AND , the outputs of which are the third and second outputs of the lesson, the first output of which is connected to the output of the first trigger, the inverse output of which is connected to the first input of the second OR element, the output of which is connected to the reset inputs of the second o and the third trigger, the direct and inverse outputs of which are connected to the first inputs of the first and second elements AND, the second inputs of which are connected to the output of the second trigger, the clock input of which is connected to the clock inputs of the first and third triggers and is the first input of the LESSON, the second input of which is connected with the second input of the second OR element and the dump input of the first trigger, the information input of which is the third input of the LESSON, the group of inputs of which is connected to the first, second, third and fourth inputs of the first electronic cop OR, whose output is connected to the data input of second flip-flop, the data input of the third flip-flop connected to the output of the second flip-flop. 13. Fault-tolerant computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration according to claim 1, characterized in that the single pulse generator (GOI) contains a counter, a decoder, the first and second triggers and the element And whose output is the output of the GOI, the first and the second inputs of which are connected to the reset and clock inputs of the counter, respectively, the group of outputs of which is connected to the group of inputs of the decoder, the output of which is connected to the information input of the first trigger, the output which is connected to the information input of the second trigger and the first input of the And element, the second input of which is connected to the inverse output of the second trigger, the clock input of which is connected to the clock input of the first trigger and is the third input of the GOI, the fourth input of which is connected to the reset inputs of the first and second triggers. 14. Fault-tolerant computing system with hardware-software implementation of the functions of fault tolerance and dynamic reconfiguration according to claim 1, characterized in that the synchronization sign generator (FPS) contains a control and synchronization state register (RUSS), a synchronization waiting time register (RPOS), a duration register synchronization (RPS), a multiplexer (MP), a counter for the duration of waiting for synchronization (FPIC) and a state machine (MS), the first group of outputs of which is the first group of outputs of the FP the second group of outputs of which is connected to the group of outputs of MP, the first group of inputs of which is connected to the group of outputs of RPOS and the group of inputs of SPOS, the output of which is connected to the first input of MS, the second group of outputs of which is connected to the first group of inputs of RUSS, the group of outputs of which is connected to the first a group of MS inputs and with a second group of MP inputs, a third group of inputs of which is connected to a group of RPS outputs and a second group of MS inputs, a third group of outputs and a first output of which are connected to a fourth group of MP inputs and a FPS output respectively, the first group of inputs of which is connected to the third group of inputs of the MS, the fourth, fifth and sixth groups of inputs of which are connected to the third, fourth and fifth groups of inputs of the FPS, respectively, the second group of inputs of which is connected to the first groups of inputs of the RPOS and RPS and the second group of inputs RUSS, the first and second inputs of which are connected to the second and third outputs of the MS, the fourth and fifth outputs of which are connected to the first inputs of the RPOS and AEC and the second input of the RPOS, the sixth, seventh and eighth outputs of the MS connected to the second FPIC th input and the first and second inputs respectively RPM.

Images