Abstract:
A method includes: causing at least three processors to perform a same process; extracting, when one of the at least three processors outputs different operational information generated by performing the same process, majority processors with which outputted operational information are the same and a minority processor with which different operational information is outputted; and controlling one of the two redundant processors to output a result of the same process.

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
       [0001]    This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2015-048630, filed on Mar, 11, 2015, the entire contents of which are incorporated herein by reference. 
       FIELD 
       [0002]    The embodiments discussed herein are related to a redundancy technology. 
       BACKGROUND 
       [0003]    Availability means resistance to failure. In particular, in computer systems in which instantaneous interruption is not permitted, such as computer systems used in plant control and aircraft control, various measures are taken in order to improve the availability of the computer systems for continuous operation. 
         [0004]    Technologies to make processors or servers redundant are known as the technologies to improve the availability of the computer systems. For example, the following technology is disclosed in a certain document. Specifically, each arithmetic processing unit determines the state of the own arithmetic processing unit using arithmetic operations and transmits state data indicating the state of the own arithmetic processing unit to multiple determination units on a certain cycle. Each of the determination units selects normal arithmetic processing units based on the state data and notifies a control unit of the result of the selection. The control unit extracts a normal arithmetic processing unit from the result of the selection received from each determination unit based on a majority rule. 
         [0005]    In this technology, each arithmetic processing unit determines the state of the own arithmetic processing unit, each determination unit selects the normal arithmetic processing units, and the control unit extracts the normal arithmetic processing unit based on the majority rule. Accordingly, it may take a time to finally extract the normal arithmetic processing unit and no consideration is taken for the time. 
         [0006]    For example, an example of the related art is disclosed in Japanese Laid-open Patent Publication No. 2013-239034. 
       SUMMARY 
       [0007]    According to an aspect of the invention, a method includes: causing, by a control circuitry, at least three processors to perform a same process; extracting, by the control circuitry, when one of the at least three processors outputs different operational information generated by performing the same process, majority processors with which outputted operational information are the same and a minority processor with which different operational information is outputted; and controlling, by the control circuitry, one of the two redundant processors to output a result of the same process. 
         [0008]    The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims. 
         [0009]    It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, as claimed. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0010]      FIG. 1  illustrates an exemplary configuration of an information processing apparatus according to a first embodiment; 
           [0011]      FIG. 2  is a diagram for describing an operation of working CPUs and how to switch an operation CPU; 
           [0012]      FIG. 3  is another diagram for describing the operation of the working CPUs and how to switch the operation CPU; 
           [0013]      FIG. 4  is another diagram for describing the operation of the working CPUs and how to switch the operation CPU; 
           [0014]      FIG. 5  is a flowchart illustrating a process performed by an address comparer; 
           [0015]      FIG. 6  is a flowchart illustrating a process performed by a data value comparer; 
           [0016]      FIG. 7  is a flowchart illustrating a process performed by a selection controller; 
           [0017]      FIG. 8  is a flowchart illustrating the process performed by the selection controller; 
           [0018]      FIG. 9  is a flowchart illustrating a process performed by an operation management portion; 
           [0019]      FIG. 10  illustrates exemplary data stored in a management table; 
           [0020]      FIG. 11  illustrates other exemplary data stored in the management table; 
           [0021]      FIG. 12  is a flowchart illustrating the process performed by the operation management portion; 
           [0022]      FIG. 13  is a diagram for describing a switching time of the operation CPU; and 
           [0023]      FIG. 14  is a diagram for describing another switching time of the operation CPU. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0024]    According to embodiments, a normal processor is capable of being extracted from multiple processors that are working. 
       First Embodiment 
       [0025]      FIG. 1  illustrates an exemplary configuration of an information processing apparatus  1  according to a first embodiment. Referring to  FIG. 1 , the information processing apparatus  1  includes a control unit  10 , a working data storage unit  11 , a sensor data storage unit  12 , and an operation data storage unit  13 . The control unit  10  includes a central processing unit (CPU) block  14 , a selector block  15 , a management block  16 , storages al to an (n is a natural number not smaller than three), storages b 1  to bn, and a storage c. The CPU block  14  includes multiple CPUs: CPU  1  to CPU n. The management block  16  includes a synchronization control portion  161 , an operation management portion  162 , a determination portion  163 , and a management table storage portion  164 . The determination portion  163  includes an address comparer  1631 , a data value comparer  1632 , and a selection controller  1633 . 
         [0026]    Referring to  FIG. 1 , “WD” denotes a data value to be written, “RD” denotes a data value that is read out, “D” denotes a data value, and “A” denotes an address. A bus indicated with “D” is a data bus and a bus indicated with “A” is an address bus. 
         [0027]    The working data storage unit  11  is, for example, a memory. The working data storage unit  11  is connected to the selector block  15  and the storage c. Programs executed by the CPU  1  to CPU n, data used by the CPU  1  to CPU n during the execution of the programs, and so on are stored in the working data storage unit  11 . 
         [0028]    The sensor data storage unit  12  is, for example, a memory or a register. The sensor data storage unit  12  is connected to the selector block  15  and the storage c. For example, data (hereinafter referred to as “sensor data”) measured by a temperature sensor, an altitude sensor, or the like is stored in the sensor data storage unit  12 . 
         [0029]    The operation data storage unit  13  is, for example, a memory or a register. The operation data storage unit  13  is connected to the selector block  15  and the storage c. For example, commands are stored in the operation data storage unit  13 . 
         [0030]    The selector block  15  is connected to the working data storage unit  11 , the sensor data storage unit  12 , the operation data storage unit  13 , the management block  16 , the storages al to an, and the storages bl to bn. The selector block  15  switches the CPU to be connected to the working data storage unit  11 , the sensor data storage unit  12 , and the operation data storage unit  13  in accordance with a CPU selection signal supplied from the selection controller  1633 . In the example illustrated in  FIG. 1 , the CPU selected with the CPU selection signal is the CPU  1 . The CPU selection signal is denoted by a “selection signal” in  FIG. 1  for visibility. 
         [0031]    The storages a 1  to an are, for example, registers. Each of the storages a 1  to an stores an address output from the corresponding CPU. The storages b 1  to bn are, for example, registers. Each of the storages b 1  to bn stores a data value (data value to be written) output from the corresponding CPU. The storage c is, for example, a register. The storage c stores the data value read out from the working data storage unit  11 , the data value read out from the sensor data storage unit  12 , and the data value read out from the operation data storage unit  13 . The data values stored in the storage c is read out by the CPU  1  to CPU n. As described above, since the provision of the storage c causes the CPU  1  to CPU n to perform the subsequent processes based on the same values, the reliability of majority decision is improved. 
         [0032]    The CPU  1  to CPU n are multiple CPUs that execute the same programs. Although the processes by the CPU  1  to CPU n are synchronized with each other and the processes are concurrently performed in parallel, the processes by non-operation CPUs may delayed from the processes by an operation CPU by a certain time. Part of the CPU  1  to CPU n may be stopped. The CPU that is working is referred to as a working CPU. The CPU that is not working and that is stopped is referred to as a non-working CPU. Among the working CPUs, the CPU connected to the working data storage unit  11 , the sensor data storage unit  12 , and the operation data storage unit  13  via the selector block  15  is referred to as an operation CPU. Among the working CPUs, the CPU that executes the same programs as those executed by the operation CPU but is not connected to the working data storage unit  11 , the sensor data storage unit  12 , and the operation data storage unit  13  is referred to as a non-operation CPU. In the first embodiment, among the working CPUs, one CPU is the operation CPU and the remaining CPUs are the non-operation CPUs. 
         [0033]    Since the majority decision is available with at least three working CPUs, control may be performed so as to keep the number of the working CPUs to three to achieve power saving. It is sufficient for the number of the non-working CPUs to be zero or more. 
         [0034]    The synchronization control portion  161  controls operation timing and working of the CPU  1  to CPU n in accordance with information on the operation status and information on the working status, which are received from the operation management portion  162 , using synchronization control signals. The synchronization control portion  161  supplies information on the synchronization status to the operation management portion  162 . Each of the synchronization control signal is, for example, a signal to clear resetting or a signal to delay a response of bus access. The synchronization control signals are denoted by “control signals” in  FIG. 1  for visibility. 
         [0035]    The operation management portion  162  manages data to be stored in the management table storage portion  164  based on the information on the synchronization status received from the synchronization control portion  161  and information on the selection status received from the determination portion  163 . The operation management portion  162  supplies the information on the operation status and the information on the working status to the determination portion  163  and the synchronization control portion  161 . 
         [0036]    The address comparer  1631  copies the addresses stored in the storages a 1  to an to acquire the copied addresses. The address comparer  1631  compares the acquired multiple addresses with each other and supplies the result of the comparison to the selection controller  1633 . 
         [0037]    The data value comparer  1632  copies the data values (data values to be written) stored in the storages b 1  to bn to acquire the copied data values. The data value comparer  1632  compares the acquired multiple data values with each other and supplies the result of the comparison to the selection controller  1633 . 
         [0038]    The selection controller  1633  performs a process of selecting the operation CPU based on the result of the comparison received from the address comparer  1631 , the result of the comparison received from the data value comparer  1632 , and the information on the operation status and the information on the working status, which are received from the operation management portion  162 . The selection controller  1633  changes the CPU selection signal to be supplied to the selector block  15  based on the result of the selection of the operation CPU. 
         [0039]    An exemplary operation of the working CPUs and switching of the operation CPU in the first embodiment will now be described with reference to  FIG. 2  to  FIG. 4 . 
         [0040]    In the example illustrated in  FIG. 2 , the CPU  1  to CPU n are the working CPUs. The CPU  1  is the operation CPU and the CPU  2  to CPU n are the non-operation CPUs. When the CPU  1  performs writing (bus access  1 ) in which address=a and data value=b, the CPU  2  to CPU n also perform the bus access  1 . Similarly, when the CPU  1  performs reading (bus access  2 ) in which address=c and data value=d, the CPU  2  to CPU n also perform the bus access  2 . The above operation is repeated. 
         [0041]    In a phase in which the writing access is performed, it is determined whether any failure occurs in the CPUs based on the writing addresses stored in the storages al to an and the data values stored in the storages b 1  to bn. For example, when the address of the CPU  3  is “gg” and the addresses of the other CPUs are “g” in a phase of a bus access  4 , it is determined that a failure occurs in the CPU  3  because the CPU  3  is in a minority group. When the data value of the CPU  3  is “hh” and the data values of the other CPUs are “h” even if a difference in address is not detected, it is determined that a failure occurs in the CPU  3  because the CPU  3  is in the minority group. As described above, it is determined that a failure occurs in the CPU if a difference in address is detected or a difference in data value is detected. 
         [0042]    In a phase in which the reading access is performed, no data value is output from the CPUs. Accordingly, it is determined whether any failure occurs in the CPUs based on the reading addresses stored in the storages a 1  to an. For example, when the address of the CPU  3  is “cc” and the addresses of the other CPUs are “c” in a phase of the bus access  2 , it is determined that a failure occurs in the CPU  3  because the CPU  3  is in the minority group. 
         [0043]      FIG. 3  illustrates an exemplary operation of the CPU  1  to CPU n when any failure occurs in the CPU  2  in a phase of a bus access  3 . In the example in  FIG. 3 , the CPU  1  is the operation CPU and the CPUs other than the CPU  1  are the non-operation CPUs. It is assumed that the address of the CPU  2  is not “e” but the addresses of the CPUs other than the CPU  2  are “e”. In such a case, it is determined that any failure occurs in the CPU  2  through the majority decision. However, since the CPU  2  is not the operation CPU, switching of the operation CPU is not performed and the CPU  1  is kept as the operation CPU. In the example in  FIG. 3 , the CPU  2  is stopped after the failure has occurred and is switched to the non-working CPU. The CPU  2  returns to the non-operation CPU from a phase of a bus access φ, for example, after the failure is cleared. 
         [0044]      FIG. 4  illustrates an exemplary operation when any failure occurs in the CPU  1 , which is the operation CPU, in the phase of the bus access  3 . In the example in  FIG. 4 , it is assumed that the address of the CPU  1  is not “e” but the addresses of the CPUs other than the CPU  1  are “e”. In such a case, it is determined that any failure occurs in the CPU  1  through the majority decision. Here, the CPU  1  is switched from the operation CPU to the non-working CPU and the CPU  2  is switched from the working CPU to the operation CPU. The CPU  1  returns to the non-operation CPU from the phase of the bus access φ, for example, after the failure is cleared. 
         [0045]    An exemplary operation of the information processing apparatus  1  will be described in detail with reference to  FIG. 5  to  FIG. 14 . First, a process performed by the address comparer  1631  will be described with reference to a flowchart illustrated in  FIG. 5 . This process is performed, for example, each time a certain time elapses after the operation CPU started the operation. Alternatively, this process may be continuously performed until the operation CPU stops the operation after the operation CPU started the operation. 
         [0046]    Referring to  FIG. 5 , in S 1 , the address comparer  1631  acquires the numbers of the working CPUs (that is, the CPUs to be subjected to the majority decision) from the selection controller  1633 . 
         [0047]    In S 3 , the address comparer  1631  compares the addresses supplied from the working CPUs with each other. Specifically, the address comparer  1631  compares the addresses acquired from the storages connected to the working CPUs, among the storages al to an, with each other. 
         [0048]    In S 5 , the address comparer  1631  determines whether a difference in address is detected (that is, all the addresses are not equal to each other). For example, the address comparer  1631  determines that a difference in address is detected if the addresses supplied from the working CPUs are an address “g”, an address “g”, and an address “gg”. The address comparer  1631  determines that a difference in address is not detected if the addresses supplied from the working CPUs are an address “g”, an address “g”, and an address “g”. 
         [0049]    If the address comparer  1631  determines that a difference in address is not detected (NO in S 5 ), in S 7 , the address comparer  1631  supplies the result of comparison indicating that a difference in address is not detected to the selection controller  1633 . Then, the process illustrated in  FIG. 5  is terminated. 
         [0050]    If the address comparer  1631  determines that a difference in address is detected (YES in S 5 ), in S 9 , the address comparer  1631  classifies the working CPUs into a majority group and a minority group based on the addresses of the working CPUs. For example, it is assumed that the address of the CPU  1  is “g”, the address of the CPU  2  is “g”, the address of the CPU  3  is “g”, the address of the CPU  4  is “gg”, and the address of the CPU  5  is “gg”. In such a case, the CPU  1  to the CPU  3  are the working CPUs belonging to the majority group and the CPU  4  and the CPU  5  are the working CPUs belonging to the minority group. 
         [0051]    In S 11 , the address comparer  1631  supplies the result of comparison indicating that a difference in address is detected and the numbers of the working CPUs belonging to the minority group to the selection controller  1633  and the operation management portion  162 . Then, the process illustrated in  FIG. 5  is terminated. 
         [0052]    The above process allows the CPUs having the probability of an abnormal operation (the working CPUs belonging to the minority group) to be detected. Since the addresses are output from the CPUs in both the reading and the writing, the majority decision is capable of being performed in both the reading and the writing. 
         [0053]    Next, a process performed by the data value comparer  1632  will be described with reference to a flowchart illustrated in  FIG. 6 . This process is performed, for example, each time a certain time elapses after the operation CPU started the operation. Alternatively, this process may be continuously performed until the operation CPU stops the operation after the operation CPU started the operation. 
         [0054]    Referring to  FIG. 6 , in S 21 , the data value comparer  1632  acquires the numbers of the working CPUs (that is, the CPUs to be subjected to the majority decision) from the selection controller  1633 . 
         [0055]    In S 23 , the data value comparer  1632  determines whether the bus access corresponds to writing. Whether the bus access corresponds to writing may be based on the content of the data values or the state of a writing control signal in each CPU. Since the data values in the reading are not output from the CPUs, the comparison is performed only when the bus access corresponds to writing in the first embodiment. If the data value comparer  1632  determines that the bus access corresponds to reading (NO in S 23 ), the process goes to S 25 . 
         [0056]    If the data value comparer  1632  determines that the bus access corresponds to writing (YES in S 23 ), in S 24 , the data value comparer  1632  compares the data values supplied from the working CPUs with each other. Specifically, the data value comparer  1632  compares the data values acquired from the storages connected to the working CPUs, among the storages b 1  to bn, with each other. 
         [0057]    In S 27 , the data value comparer  1632  determines whether a difference in data value is detected (that is, all the data values are not equal to each other). For example, the data value comparer  1632  determines that a difference in data value is detected if the data values supplied from the working CPUs are a data value “h”, a data value “h”, and a data value “hh”. The data value comparer  1632  determines that a difference in data value is not detected if the data values supplied from the working CPUs are a data value “h”, a data value “h”, and a data value “h”. 
         [0058]    If the data value comparer  1632  determines that a difference in data value is not detected (NO in Step  27 ), in S 25 , the data value comparer  1632  supplies the result of comparison indicating that a difference in data value is not detected to the selection controller  1633 . Then, the process illustrated in  FIG. 6  is terminated. 
         [0059]    If the data value comparer  1632  determines that a difference in data value is detected (YES in S 27 ), in S 29 , the data value comparer  1632  classifies the working CPUs into the majority group and the minority group based on the data values. For example, it is assumed that the data value of the CPU  1  is “h”, the data value of the CPU  2  is “h”, the data value of the CPU  3  is “h”, the data value of the CPU  4  is “h”, and the data value of the CPU  5  is “hh”. In such a case, the CPU  1  to the CPU  4  are the working CPUs belonging to the majority group and the CPU  5  is the working CPU belonging to the minority group. 
         [0060]    In S 31 , the data value comparer  1632  supplies the result of comparison indicating that a difference in data value is detected and the numbers of the working CPUs belonging to the minority group to the selection controller  1633  and the operation management portion  162 . Then, the process illustrated in  FIG. 6  is terminated. 
         [0061]    The above process allows the CPU having the probability of an abnormal operation (the working CPU belonging to the minority group) to be detected. 
         [0062]    Next, a process performed by the selection controller  1633  will be described with reference to flowcharts illustrated in  FIG. 7  and  FIG. 8 . This process is performed, for example, each time a certain time elapses after the operation CPU started the operation. Alternatively, this process may be continuously performed until the operation CPU stops the operation after the operation CPU started the operation. 
         [0063]    Referring to  FIG. 7 , in S 41 , the selection controller  1633  acquires the number of the operation CPU, the numbers of the working CPUs, and the priority of switching from the operation management portion  162 . 
         [0064]    In S 43 , the selection controller  1633  supplies the numbers of the working CPUs acquired in S 41  (that is, the numbers of the CPUs to be subjected to the majority decision) to the address comparer  1631  and the data value comparer  1632 . 
         [0065]    In S 45 , the selection controller  1633  acquires the result of the comparison and the numbers of the working CPUs belonging to the minority group, if a difference in address is detected in S 5 , from the address comparer  1631 . 
         [0066]    In S 47 , the selection controller  1633  determines whether the result of the comparison acquired in S 45  indicates that a difference in address is detected. If the result of the comparison acquired in S 45  does not indicate that a difference in address is detected (NO in S 47 ), the process goes to S 55  in  FIG. 8  through an arrow A. 
         [0067]    If the result of the comparison acquired in S 45  indicates that a difference in address is detected (YES in S 47 ), in S 49 , the selection controller  1633  determines whether the operation CPU is included in the minority group. The selection controller  1633  determines in S 49  whether the number of the operation CPU is included in the numbers of the working CPUs acquired in S 45 . 
         [0068]    If the operation CPU is not included in the minority group (NO in S 49 ), the process goes to S 55  in  FIG. 8  through the arrow A. If the operation CPU is included the minority group (YES in S 49 ), in S 51 , the selection controller  1633  selects the number of a new operation CPU (that is, a CPU to be switched to the operation CPU) from the non-operation CPUs belonging to the majority group (that is, the CPUs other than the CPUs belonging to the minority group, among the working CPUs) and changes the CPU selection signal. The CPU selection signal is changed so that the new operation CPU is connected to the working data storage unit  11 , the sensor data storage unit  12 , and the operation data storage unit  13  in S 51  and the selector block  15  performs the switching of the bus in accordance with the CPU selection signal. The operation CPU is selected in S 51  based on the priority of switching acquired in S 41 . 
         [0069]    In S 53 , the selection controller  1633  supplies the number of the new operation CPU to the operation management portion  162 . Then, the process illustrated in  FIG. 7  and  FIG. 8  is terminated through an arrow B. 
         [0070]    Referring to  FIG. 8 , in S 55 , the selection controller  1633  acquires the result of the comparison and the numbers of the working CPUs belonging to the minority group, if a difference in data value is detected in S 27 , from the data value comparer  1632 . 
         [0071]    In S 57 , the selection controller  1633  determines whether the result of the comparison acquired in S 55  indicates that a difference in data value is detected. If the result of the comparison acquired in S 55  does not indicate that a difference in data value is detected (NO in S 57 ), the process illustrated in  FIG. 7  and  FIG. 8  is terminated. 
         [0072]    If the result of the comparison acquired in S 55  indicates that a difference in data value is detected (YES in S 57 ), in S 59 , the selection controller  1633  determines whether the operation CPU is included in the minority group. The selection controller  1633  determines in S 59  whether the number of the operation CPU is included in the numbers of the working CPUs acquired in S 55 . 
         [0073]    If the operation CPU is not included in the minority group (NO in S 59 ), the process illustrated in  FIG. 7  and  FIG. 8  is terminated. If the operation CPU is included in the minority group (YES in S 59 ), in S 61 , the selection controller  1633  selects the number of a new operation CPU (that is, a CPU to be switched to the operation CPU) from the non-operation CPUs belonging to the majority group (that is, the CPUs other than the CPUs belonging to the minority group, among the working CPUs) and changes the CPU selection signal. The CPU selection signal is changed so that the new operation CPU is connected to the working data storage unit  11 , the sensor data storage unit  12 , and the operation data storage unit  13  in S 61  and the selector block  15  performs the switching of the bus in accordance with the CPU selection signal. The operation CPU is selected in S 61  based on the priority of switching acquired in S 41 . 
         [0074]    In S 63 , the selection controller  1633  supplies the number of the new operation CPU to the operation management portion  162 . Then, the process illustrated in  FIG. 7  and  FIG. 8  is terminated. 
         [0075]    With the above process, it is possible to suppress wrong control caused by any failure of the CPU. In addition, since the new operation CPU is selected from the non-operation CPUs, which are the working, it is possible to continue the operation while the switching time is greatly reduced. 
         [0076]    Next, a process performed by the operation management portion  162  will be described with reference to flowcharts illustrated in  FIG. 9  and  FIG. 12 . This process is performed, for example, after power-on. 
         [0077]    Referring to  FIG. 9 , in S 71 , the operation management portion  162  reads out data from a management table stored in the management table storage portion  164 . 
         [0078]      FIG. 10  illustrates an exemplary management table stored in the management table storage portion  164 . In the example illustrated in  FIG. 10 , the number of each CPU, information indicating whether the CPU is the operation CPU (hereinafter referred to as operation information), information indicating whether the CPU is the working CPU (hereinafter referred to as working information), information indicating whether a failure occurs in the CPU (hereinafter referred to as failure information), and information indicating the priority order of switching are stored in the management table. The CPU is the operation CPU when the operation information has a value of one (“1”) and the CPU is the non-operation CPU when the operation information has a value of zero (“0”). The CPU is the working CPU when the working information has a value of one “1” and the CPU is the non-working CPU when the working information has a value of zero (“0”). The CPU is in failure when the failure information has a value of one (“1”) and the CPU is not in failure when the failure information has a value of zero (“0”). The CPU is not the target of switching when the priority order of switching is zero “0”. For example, since the current operation CPU is not switched to the operation CPU next, the priority order of switching of the current operation CPU is zero (“0”). 
         [0079]      FIG. 11  illustrates an exemplary management table when the CPU  1  fails and the operation CPU is switched from the CPU  1  to the CPU  2 . In the example illustrated in  FIG. 11 , the operation information about the CPU  1  is switched from “1” to “0” and the failure information about the CPU  1  is switched from “0” to “1”. Since the CPU  1  is stopped because of the failure, the working information about the CPU  1  is switched from “1” to “0”. The operation information about the CPU  2  is switched from “0” to “1”. In addition, since the number of the working CPUs is decreased due to the failure of the CPU  1 , the CPU  4  is switched to the working CPU. Accordingly, the working information about the CPU  4  is switched from “0” to “1”. The priority order of switching is also updated. 
         [0080]    Referring back to  FIG. 9 , in S 73 , the operation management portion  162  supplies the number of the operation CPU, the numbers of the working CPUs, and the priority order of switching to the determination portion  163 . 
         [0081]    In S 75 , the operation management portion  162  determines whether the result of comparison indicating that a difference in address is detected is acquired from the address comparer  1631 . If the result of comparison indicating that a difference in address is detected is not acquired from the address comparer  1631  (NO in S 75 ), the process goes to S 87  in  FIG. 12  through an arrow C. 
         [0082]    If the result of comparison indicating that a difference in address is detected is acquired from the address comparer  1631  (YES in S 75 ), in S 77 , the operation management portion  162  reads out the numbers of the working CPUs belonging to the minority group, acquired from the address comparer  1631 , and acquires the number of the new operation CPU from the selection controller  1633 . The numbers of the working CPUs read out in S 77  are acquired with the result of the comparison and are stored in a certain storage unit (for example, a main memory or a register). 
         [0083]    In S 79 , the operation management portion  162  updates the management table so that the CPUs belonging the minority group are switched to the non-working CPUs (that is, the working information is set to “0”), the CPU to be set as the new operation CPU is switched from the non-operation CPU to the operation CPU (that is, the operation information is set to “1), and the CPU, which has been the operation CPU, is switched to the non-operation CPU (that is, the operation information is set to “0”). When the CPU, which has been the operation CPU, belongs to the minority group, the CPU is switched to the non-working CPU. The operation management portion  162  supplies the information on the operation status and the information on the working status to the synchronization control portion  161  and, in response to the received information, the synchronization control portion  161  controls the operation timing and working of the CPU  1  to CPU n. 
         [0084]    In S 81 , the operation management portion  162  updates the failure information and the priority order of switching stored in the management table. Specifically, the operation management portion  162  sets the failure information about the CPUs belonging to the minority group is set to “1” and the priority orders of the CPUs belonging to the minority group are set to “0”. Then, the process goes to S 83  in  FIG. 12  through an arrow D. 
         [0085]    Referring to  FIG. 12 , in S 83 , the operation management portion  162  reads out data from the management table stored in the management table storage portion  164 . 
         [0086]    In S 85 , the operation management portion  162  supplies the number of the operation CPU, the numbers of the working CPUs, and the priority order of switching to the determination portion  163 . 
         [0087]    In S 87 , the operation management portion  162  determines whether the result of comparison indicating that a difference in data value is detected is acquired from the data value comparer  1632 . If the result of comparison indicating that a difference in data value is detected is not acquired from the data value comparer  1632  (NO in S 87 ), the process goes to S 95 . 
         [0088]    If the result of comparison indicating that a difference in data value is detected is acquired from the data value comparer  1632  (YES in S 87 ), in S 89 , the operation management portion  162  reads out the numbers of the working CPUs belonging to the minority group, acquired from the data value comparer  1632 , and acquires the number of the new operation CPU from the selection controller  1633 . The numbers of the working CPUs read out in S 89  are acquired with the result of the comparison and are stored in a certain storage unit (for example, the main memory or the register). 
         [0089]    In S 91 , the operation management portion  162  updates the management table so that the CPUs belonging the minority group are switched to the non-working CPUs (that is, the working information is set to “0”), the CPU to be set as the new operation CPU is switched from the non-operation CPU to the operation CPU (that is, the operation information is set to “1), and the CPU, which has been the operation CPU, is switched to the non-operation CPU (that is, the operation information is set to “0”). When the CPU, which has been the operation CPU, belongs to the minority group, the CPU is switched to the non-working CPU. The operation management portion  162  supplies the information on the operation status and the information on the working status to the synchronization control portion  161  and, in response to the received information, the synchronization control portion  161  controls the operation timing and working of the CPU  1  to CPU n. 
         [0090]    In S 93 , the operation management portion  162  updates the failure information and the priority order of switching stored in the management table. Specifically, the operation management portion  162  sets the failure information about the CPUs belonging to the minority group to “1” and sets the priority orders of the CPUs belonging to the minority group to “0”. 
         [0091]    In S 95 , the operation management portion  162  determines whether the redundancy process of the CPUs is to be terminated. If the redundancy process of the CPUs is not to be terminated (NO in S 95 ), the process goes back to S 71  in  FIG. 9  through an arrow E. If the redundancy process of the CPUs is to be terminated (YES in S 95 ), the process illustrated in  FIG. 9  and  FIG. 12  is terminated. 
         [0092]    With the above process, it is possible to appropriately manage the operation status and the working status of the CPU  1  to CPU n. 
         [0093]    The switching time of the operation CPU will now be described with reference to  FIG. 13  and  FIG. 14 . Processes performed by the operation CPU, processes performed by the non-operation CPU, the timing when a failure occurs in the operation CPU, and the timing of switching between the CPUs are illustrated in  FIG. 13  and  FIG. 14 . The horizontal axis represents time in  FIG. 13  and  FIG. 14 . Referring to  FIG. 13  and  FIG. 14 , (1) indicates that the processes are related to the working data storage unit  11 , (2) indicates that the processes are related to the sensor data storage unit  12 , (3) indicates that the processes are related to the operation data storage unit  13 , and (4) indicates communication between the CPUs. Each process is performed in a time corresponding to one clock. 
         [0094]      FIG. 13  illustrates an example when a method of the first embodiment is used. In the example illustrated in  FIG. 13 , a failure of the operation CPU and switching of the CPUs occur at any timing in rectangular portions in which vertical lines are drawn. In the first embodiment, the operation CPU and the non-operation CPU concurrently perform the same processes in parallel. Specifically, a process  1  to read out an instruction to read out the sensor data from the sensor data storage unit  12  from the working data storage unit  11 , a process  2  to read out the sensor data from the sensor data storage unit  12  in response to the instruction that is read out, a process  3  to read out a data processing instruction from the working data storage unit  11 , a process  4  to process the data stored in the working data storage unit  11  in response to the data processing instruction that is read out, a process  5  to read out a writing instruction from the working data storage unit  11 , and a process  6  to perform writing into the operation data storage unit  13  in response to the writing instruction that is read out are performed in parallel. The communication between the CPUs does not occur in the example in  FIG. 13 . Accordingly, there is no time period when the operation is stopped even if the operation CPU is switched at any timing in the rectangular portions in which the vertical lines are drawn. 
         [0095]      FIG. 14  illustrates an example when the method of the first embodiment is not used. In the example illustrated in  FIG. 14 , a failure of the operation CPU occurs at any timing in rectangular portions in which vertical lines are drawn. Upon detection of the failure, equalization is performed (that is, the CPUs are set to the same state) in order to switch the CPUs. Specifically, the operation CPU performs a process U to read out an instruction to transmit equalization data for equalizing the non-operation CPUs from the working data storage unit  11  and a process V to transmit the equalization data to the non-operation CPUs. The non-operation CPU performs a process W to receive the equalization data from the operation CPU, a process X to read out an instruction to confirm the validity of the equalization data from the working data storage unit  11 , and a process Y to confirm the validity of the equalization data in accordance with the instruction that is read out. At this time, the operation CPU is switched and the new operation CPU starts the process  3  to read out the data processing instruction from the working data storage unit  11 . As described above, with the method of detecting an occurrence of a failure and then performing the equalization, the switching is not performed instantaneously. No new process is performed before the new operation CPU completes the process  6  to perform the writing into the operation data storage unit  13  since the original operation CPU has completed the process  6  to perform the writing into the operation data storage unit  13 . Accordingly, the processes are substantially delayed. Since it takes a time corresponding to several clocks normally to perform each process, the delay time is further increased practically. 
       Other Embodiments 
       [0096]    The CPUs belonging to the minority group are switched to the non-working CPUs (that is, are stopped) in the first embodiment. However, addresses or the likes different from the addresses or the likes of the majority group may be detected because of a temporary bus error caused by noise even if no failure occurs in the hardware itself of the CPUs. 
         [0097]    Accordingly, the CPU for which a difference in address or data value is detected may be switched to the non-operation CPU first without immediately being stopped. The CPU may continue the operation as the non-operation CPU when the CPU continuously belongs to the majority group a certain number of times or more before the bus access is performed for a certain time or a certain number of times. The CPU may be stopped when the CPU does not belong to the majority group before the bus access is performed for a certain time or a certain number of times. 
         [0098]    While the present disclosure is described in terms of some specific examples and embodiments, it will be clear that the present disclosure is not limited to these specific examples and embodiments. For example, the functional block configuration of the information processing apparatus  1  described above may not coincide with the practical program module configuration. 
         [0099]    The structure of each table described above is only an example and each table is not limited to the above structure. In addition, the order of the steps may be switched in the process flows as long as the results of the processes are not changed. The steps may be performed in parallel. 
         [0100]    Although the examples using the multiple CPU  1  to CPU n are described above, the embodiments are applicable to multiple CPU cores. 
         [0101]    When it is difficult for the operation CPU and the non-operation CPUs to concurrently perform the processes in parallel due to a restriction on hardware, the non-operation CPUs may perform the same processes behind the processes of the operation CPU by a time α. Here, α is a time resulting from multiplication of the time corresponding to one clock by an integer that is not smaller than zero. 
         [0102]    For example, when the number of CPUs having a data value “g” is two and the number of CPUs having a data value “f” is two, it is not possible to determine the majority group and the minority group through the majority decision. In such a case, it may be considered that the difference in data value is not detected. 
         [0103]    Although the information acquiring side actively acquire information from the information providing side in the above examples, the information providing side may provide information to the information acquiring side at certain timing. Specifically, the timing when the address comparer  1631 , the data value comparer  1632 , the selection controller  1633 , and the operation management portion  162  acquire information may be arbitrarily set and is not limited to the above ones. 
         [0104]    In selection of the operation CPU, the CPU in which no failure has occurred may be selected as the operation CPU based on the history of the majority decision. 
         [0105]    When the switching of the operation CPU has been performed, data notifying the manager of the information processing apparatus  1  of the switching of the operation CPU may be output. 
         [0106]    The summary of the above embodiments is as follows: 
         [0107]    The method of extracting the normal processor according to the embodiments includes (A) a process to cause the multiple processors to perform the same process and (B), if operational information that differs between the processors is included in the operational information in the process performed by each processor, a process to extract one or more processors for which the operational information belonging to the majority group is acquired as the normal processor. 
         [0108]    With the above method, it is possible to extract the normal processor from the multiple processors. In addition, since the multiple processors perform the same processes and the equalization process is not performed, the switching of the processors is performed at high speed. 
         [0109]    The operational information described above may include at least one of the writing address of data, the value of data to be written, the reading address of data, and the value of data that is read out in the process performed by each processor. 
         [0110]    The above extracting method may further include (C) a process to acquire the operational information by capturing data passing through the bus connected to each of the multiple processors. With this method, the operational information is easily acquired. 
         [0111]    The above extracting method may further include (D) if a predetermined first processor (for example, the operation CPU in the embodiments), among the multiple processors, is not included in the one or more processors for which the operational information belonging to the majority group is acquired, a process to select a new first processor from the one or more processors for which the operational information belonging to the majority group is acquired. With the above method, it is possible to address a case in which the first processor may fail. 
         [0112]    In (A) the process to cause the multiple processors to perform the same process, (al) the processes performed by the processors other than the first processor, among the multiple processors, may be behind the process performed by the first processor by a certain time. For example, there is a case in which it is difficult to cause the first processor and the processors other than the first processors to perform the same process due to a restriction on hardware. With the above process, it is possible to address such a case. 
         [0113]    The above extracting method may further include (E) if the operational information belonging to the majority group is not acquired for a certain time or more or a certain number of times or more for a processor other than the one or more processors for which the operational information belonging to the majority group is acquired, a process to stop the processor. When the operational information belonging to the majority group is not acquired for a certain time or more or a certain number of times or more, the processor may fail. Accordingly, with the above method, it is possible to exclude the processor that may fail from the target processors. 
         [0114]    The above extracting method may further include (F) a process to perform bus connection to switch the predetermined first processor to a new first processor. With the above method, it is possible to suppress an occurrence of a state in which the first processor fails. 
         [0115]    In (D) the process to select a new first processor, (d 1 ) a new first processor may be selected from the one or more processors for which the operational information belonging to the majority group is acquired based on priority order. With this process, it is possible to select an appropriate first processor. 
         [0116]    Programs to cause the processors to perform the processes in the above methods may be created. The programs are stored in a computer-readable storage medium or storage unit, such as a flexible disk, a compact disk-read only memory (CD-ROM), a magneto-optical disk, a semiconductor memory, or a hard disk. An intermediate processing result is temporarily stored in a storage unit, such as the main memory. 
         [0117]    All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiments of the present invention have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.