초록 ▼

A hybrid multiple redundant computer system (10) having at least three parallel operating processing units (12) including input module (14), central processor module (16), and output module (50) in each processing unit is disclosed. The central processor module (16) is connected to the associated in

A hybrid multiple redundant computer system (10) having at least three parallel operating processing units (12) including input module (14), central processor module (16), and output module (50) in each processing unit is disclosed. The central processor module (16) is connected to the associated input module (14) and connected to primary and secondary output circuits (18, 20) located in the associated output module (50) and in the neighboring output module (50) respectively. Each processing unit (12) further includes a watchdog controller (30) that monitors the associated central processor module (16) and transfers an alarm signal (44) to each output module (50) in the event that a central processor module (16) fails. Primary and secondary output circuits (18, 20) in each output module (50) control an output voter network (22) and perform selectable but different logical functions among output data of the respective central processor modules (16) and alarm signals (44) for providing no single point of failure within the output module (50). If alarm signals (44) are not activated, the system generates an output (180) using two-of-three vote among output data produced by three central processor modules (16). In the event that one or two central processor modules (16) fail, the system is reconfigured to a two-of-two and to a one-of-one vote configuration respectively. Each central processor module (16) in turn monitors the status of all of the system components and disables faulty outputs by opening a fault recovery switch (54) in the respective output module (50) allowing continued system operation in the face of as many as two faults within any system components.

대표청구항 ▼

A hybrid multiple redundant computer system (10) having at least three parallel operating processing units (12) including input module (14), central processor module (16), and output module (50) in each processing unit is disclosed. The central processor module (16) is connected to the associated in

A hybrid multiple redundant computer system (10) having at least three parallel operating processing units (12) including input module (14), central processor module (16), and output module (50) in each processing unit is disclosed. The central processor module (16) is connected to the associated input module (14) and connected to primary and secondary output circuits (18, 20) located in the associated output module (50) and in the neighboring output module (50) respectively. Each processing unit (12) further includes a watchdog controller (30) that monitors the associated central processor module (16) and transfers an alarm signal (44) to each output module (50) in the event that a central processor module (16) fails. Primary and secondary output circuits (18, 20) in each output module (50) control an output voter network (22) and perform selectable but different logical functions among output data of the respective central processor modules (16) and alarm signals (44) for providing no single point of failure within the output module (50). If alarm signals (44) are not activated, the system generates an output (180) using two-of-three vote among output data produced by three central processor modules (16). In the event that one or two central processor modules (16) fail, the system is reconfigured to a two-of-two and to a one-of-one vote configuration respectively. Each central processor module (16) in turn monitors the status of all of the system components and disables faulty outputs by opening a fault recovery switch (54) in the respective output module (50) allowing continued system operation in the face of as many as two faults within any system components. at least some responsibilities of the second protected card in response to a failure of the second protected card, the second protection I/O module operable to communicate the second data between the second protection card and the second I/O module using the protection bus, the second I/O module for the second protected card operable to communicate the second data with the network interface associated with the second protected card. 5. The device of claim 4, further comprising N-1 additional second protected cards, the second protected card and additional second protected cards forming a second protection group associated with the second protection card and having N members. 6. The device of claim 4, wherein the network interface for the protected card is of a different type than the network interface for the second protected card. 7. The device of claim 1, wherein the I/O module for the protected card comprises a multiplexer coupled to the protected card and to the protection bus, the multiplexer operable to selectively communicate the data between the protection I/O module and the network interface rather than between the protected card and the network interface in response to the failure. 8. An I/O module within a telecommunications device, comprising: a multiplexer coupled to a protected card and to a protection bus; the multiplexer operable to selectively communicate data between the protected card and an associated network interface if the protected card is capable of performing its responsibilities; and the multiplexer operable to selectively communicate data between a protection I/O module and the network interface using a protection bus if the protected card is not capable of performing its responsibilities, the protection I/O module coupled to the protection card and to the protection bus, the protection card operable to assume at least some of the responsibilities of the protected card, the module operable to receive a watchdog signal from the protected card, the module operable to detect a modification of the watchdog signal to detect a failure of the protected card. 9. The module of claim 8, wherein the protected card is one of N protected cards in a protection group associated with the protection card. 10. The module of claim 9, wherein the protection card is one of X protection cards associated with the protection group that cooperate to provide N+X redundancy for the protection group. 11. A method of protecting the operation of a telecommunications device from a failure of a protected card within the device, comprising: communicating data between the protected card and an associated network interface using an I/O module; communicating a watchdog signal from the protected card to the I/O module; detecting a modification of the watchdog signal to detect a failure of the protected card; in response to the failure, communicating data between a protection I/O module and the network interface using a protection bus and the I/O module, the protection I/O module coupled to a protection card; and assuming at least some responsibilities of the protected card using the protection card to protect the operation of the device from the failure. 12. The method of claim 11, wherein the protected card is one of N protected cards in a protection group associated with the protection card. 13. The method of claim 12, wherein the protection card is one of X protection cards associated with the protection group that cooperate to provide N+X redundancy for the protection group. 14. The method of claim 11, further comprising: communicating second data between a second protected card and an associated network interface using a second I/O module; detecting a second failure of the second protected card; in response to the second failure, communicating the second data between a second protection I/O module and the network interface associated with the second protected card using the protection bus and the second I/O module, the second protection I/O module coupled to a second protection card; and assuming at least some responsibilities of the second protected card using the second protection card. 15. The method of claim 14, wherein the second protected card is one of N second protected cards in a second protection group associated with the second protection card. 16. The method of claim 14, wherein the network interface for the protected card is of a different type than the network interface for the second protected card. 17. The method of claim 11, wherein the I/O module for the protected card comprises a multiplexer coupled to the protected card and to the protection bus, the method further comprising selectively communicating data either between the protected card and the network interface or between the protection I/O module and the network interface according to a failure status of the protected card. 18. Logic for protecting the operation of a telecommunications device from a failure of a protected card within the device, the logic encoded in medial and operable to: communicate data between the protected card and an associated network interface using an I/O module; communicate a watchdog signal from the protected card to the I/O module; detect a modification of the watchdog signal to detect a failure of the protected card; in response to the failure, communicate data between a protection I/O module and the network interface using a protection bus and the I/O module, the protection I/O module coupled to a protection card; and assume at least some responsibilities of the protected card using the protection card to protect the operation of the device from the failure. 19. The logic of claim 18, wherein the protected card is one of N protected cards in a protection group associated with the protection card. 20. The logic of claim 19, wherein the protection card is one of X protection cards associated with the protection group that cooperate to provide N+X redundancy for the protection group. 21. The logic of claim 18 further operable to: communicate second data between a second protected card and an associated network interface using a second I/O module; detect a second failure of the second protected card; in response to the second failure, communicate the second data between a second protection I/O module and the network interface associated with the second protected card using the protection bus and the second I/O module, the second protection I/O module coupled to a second protection card; and assume at least some responsibilities of the second protected card using the second protection card. 22. The logic of claim 21, wherein the second protected card is one of N second protected cards in a second protection group associated with the second protection card. 23. The logic of claim 21, wherein the network interface for the protected card is of a different type than the network interface for the second protected card. 24. The logic of claim 18, wherein the I/O module for the protected card comprises a multiplexer coupled to the protected card and to the protection bus, the logic further operable to selectively communicate data either between the protected card and the network interface or between the protection I/O module and the network interface according to a failure status of the protected card. 25. A telecommunications device, comprising: means for communicating data between a protected card and an associated network interface using an I/O module; means for communicating a watchdog signal from the protected card to the I/O module; means for detecting a modification of the watchdog signal to detect a failure of the protected card; means for, in response to the failure, communicating data between a protection I/O module and the network interface using a protection bus and the I/O module, the protection I/O module coupled to a protection card; and means for assuming at least some responsibilities of the p rotected card using the protection card to protect the operation of the device from the failure. indication for the second unit to the second channel of the bus. 13. The monitor system of claim 12, wherein each unit of each node is connected to a respective channel on the bus. 14. The monitor system of claim 13, wherein each channel is a respective bus line. 15. The monitor system of claim 12, comprising a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distributed fault tolerant system dependent upon the state of the status signals. 16. The monitor system of claim 15, wherein each unit of respective nodes is connected to a respective channel on the bus and the management subsystem is responsive to respective status signals on respective channels to determine the status of respective nodes. 17. The monitor system of claim 15, wherein the management subsystem is operable to redefine the configuration of the distributed fault tolerant system in response to detection of a change of state of a node. 18. The monitor system of claim 17, wherein the management subsystem is operable to compare system resources to system requirements following a change of state of a node to determine whether reconfiguration of the distributed fault tolerant system is required. 19. The monitor system of claim 15, wherein the management subsystem is operable to define a node as a member of the fault tolerant computer system when it is associated with an ON status signal. 20. The monitor system of claim 12, wherein the management subsystem is provided at a node of the distributed fault tolerant computer system. 21. The monitor subsystem of claim 20, wherein a said management subsystem is provided at each node of the fault tolerant computer system. 22. The monitor system of claim 12, wherein the first counter mechanism comprises a first hardware counter and the second counter mechanism comprises a second hardware counter. 23. The monitor system of claim 22, wherein the first counter mechanism comprises a first gate responsive to the first counter reaching the fault value to pass a fault signal to the first unit and the second counter mechanism comprises a second gate responsive to the second counter reaching the fault value to pass a fault signal to the second unit. 24. The monitor system of claim 12, wherein the first unit is a first power supply unit and the second unit is a second power supply unit. 25. The monitor system of claim 24, wherein each power supply unit is operable to turn off in response to a fault signal output by the respective counter mechanism. 26. A node of a distributed fault tolerant computer system comprising: a first counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; a counter reset routine implemented in software and operable repeatedly to reset the first counter mechanism to its reset value during normal operation of the counter reset routine; a first unit connectable to a first channel on a bus to supply a status signal indicative of the status of the first unit, the first unit being responsive to a fault signal output from the first counter mechanism to provide an OFF status indication for the first unit to the first channel of the bus; and a second counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; the counter reset routine being operable repeatedly to reset the second counter mechanism to its reset value during normal operation of the counter reset routine; and a second unit connectable to a first channel on the bus to supply a status signal indicative of the status of the second unit, the second unit being responsive to a fault signal output from the second counter mechanism to provide an OFF status indication for the second unit to the second channel of the bus. 27. The node of claim 26, wherein each unit is connected to a respective channel on the bus. 28. The node of claim 27, wherein each channel is a respective bus line. 29. The node of claim 26, comprising a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distributed fault tolerant system dependent upon the state of the status signals. 30. The node of claim 29, wherein each unit of respective nodes of the distributed fault tolerant computer system is connected to a respective channel on the bus and the management subsystem is responsive to respective status signals on respective channels to determine the status of respective nodes. 31. The node of claim 29, wherein the management subsystem is operable to redefine the configuration of the distributed fault tolerant system in response to detection of a change of state of a node. 32. The node of claim 31, wherein the management subsystem is operable to compare system resources to system requirements following a change of state of a node to determine whether reconfiguration of the distributed fault tolerant system is required. 33. The node of claim 29, wherein the management subsystem is operable to define a node as a member of the fault tolerant computer system when it is associated with an ON status signal. 34. The node of claim 26, wherein the first counter mechanism comprises a hardware counter. 35. The node of claim 26, wherein the first counter mechanism comprises a first hardware counter and the second counter mechanism comprises a second hardware counter. 36. The node of claim 26, wherein the first unit is a first power supply unit. 37. The node of claim 26, wherein the first unit is a first power supply unit and the second unit is a second power supply unit. 38. The node of claim 37, wherein each power supply unit is operable to turn off in response to a fault signal output by the respective counter mechanism. 39. A distributed fault tolerant computer system comprising a plurality of nodes and a bus, wherein a node of the distributed fault tolerant computer system comprises: a first counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; a counter reset routine implemented in software and operable repeatedly to reset the first counter mechanism to its reset value during normal operation of the counter reset routine; a first unit connectable to a first channel on the bus to supply a status signal indicative of the status of the first unit, the first unit being responsive to a fault signal output from the first counter mechanism and being operable to provide an OFF status indication for the first unit to the first channel of the bus; wherein a node further comprises: a second counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; the counter reset routine being operable repeatedly to reset the second counter mechanism to its reset value during normal operation of the counter reset routine; and a second unit connectable to a first channel on the bus to supply a status signal indicative of the status of the second unit, the second unit being responsive to a fault signal output from the second counter mechanism to provide an OFF status indication for the second unit to the second channel of the bus. 40. The distributed fault tolerant computer system of claim 39, comprising a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distributed fault tol erant system dependent upon the state of the status signals. 41. The distributed fault tolerant computer system of claim 40, wherein each unit of respective nodes of the distributed fault tolerant computer system is connected to a respective channel on the bus and the management subsystem is responsive to respective status signals on respective channels to determine the status of respective nodes. 42. The distributed fault tolerant computer system of claim 40, wherein management subsystem is operable to redefine the configuration of the distributed fault tolerant system in response to detection of a change of state of a given node and to define the given node as a member of the fault tolerant computer system where at least one ON status signal is provided from a unit of the given node. 43. The distributed fault tolerant computer system of claim 39, wherein the management subsystem is provided at a node of the distributed fault tolerant computer system. 44. The distributed fault tolerant computer system of claim 43, wherein a said management subsystem is provided at each node of the fault tolerant computer system. 45. The distributed fault tolerant computer system of claim 39, wherein each said unit is a power supply unit operable to turn off in response to a fault signal output by the respective counter mechanism. 46. A monitor system for a distributed fault tolerant computer system, the monitor system comprising: a counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; a counter reset routine implemented in software and operable repeatedly to reset the counter mechanism to its reset value during normal operation of the counter reset routine; a unit connectable to a bus to supply a status signal indicative of the status of the unit, the unit being responsive to a fault signal output from the counter mechanism to provide an OFF status indication to the bus; and a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distributed fault tolerant system dependent upon the state of the status signals; wherein the management subsystem is operable to redefine the configuration of the distributed fault tolerant system in response to detection of a change of state of a node; and wherein the management subsystem is operable to redefine the configuration of the distributed fault tolerant system in response to detection of a change of state of a node. 47. A monitor system for a distributed fault tolerant computer system, the monitor system comprising: a counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; a counter reset routine implemented in software and operable repeatedly to reset the counter mechanism to its reset value during normal operation of the counter reset routine; a unit connectable to a bus to supply a status signal indicative of the status of the unit, the unit being responsive to a fault signal output from the counter mechanism to provide an OFF status indication to the bus; and a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distributed fault tolerant system dependent upon the state of the status signals; wherein the management subsystem is operable to define a node as a member of the fault tolerant computer system when it is associated with an ON status signal. 48. A monitor system for a distributed fault tolerant computer system, the monitor system comprising: a counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; a counter reset routine implemented in software and operable repeatedly to reset the counter mechanism to its reset value during normal operation of the counter reset routine; and a unit connectable to a bus to supply a status signal indicative of the status of the unit, the unit being responsive to a fault signal output from the counter mechanism to provide an OFF status indication to the bus; wherein the unit is a power supply unit. 49. The monitor system of claim 48, wherein each unit of respective nodes is connected to a respective channel on the bus. 50. The monitor system of claim 49, wherein each channel is a respective bus line. 51. The monitor system of claim 48, comprising a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distributed fault tolerant system dependent upon the state of the status signals. 52. The monitor system of claim 51, wherein the management subsystem is operable to redefine the configuration of the distributed fault tolerant system in response to detection of a change of state of a node. 53. The monitor system of claim 51, wherein the management subsystem is operable to define a node as a member of the fault tolerant computer system when it is associated with an ON status signal. 54. The monitor system of claim 48, wherein the power supply unit is operable to turn off in response to a fault signal output by the counter mechanism. 55. A node of a distributed fault tolerant computer system comprising: a first counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; a counter reset routine implemented in software and operable repeatedly to reset the first counter mechanism to its reset value during normal operation of the counter reset routine; a first unit connectable to a first channel on a bus to supply a status signal indicative of the status of the first unit, the first unit being responsive to a fault signal output from the first counter mechanism to provide an OFF status indication for the first unit to the first channel of the bus; and a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distributed fault tolerant system dependent upon the state of the status signals; wherein each unit of respective nodes of the distributed fault tolerant computer system is connected to a respective channel on the bus and the management subsystem is responsive to respective status signals on respective channels to determine the status of respective nodes. 56. A node of a distributed fault tolerant computer system comprising: a first counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; a counter reset routine implemented in software and operable repeatedly to reset the first counter mechanism to its reset value during normal operation of the counter reset routine; a first unit connectable to a first channel on a bus to supply a status signal indicative of the status of the first unit, the first unit being responsive to a fault signal output from the first counter mechanism to provide an OFF status indication for the first unit to the first channel of the bus; and a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distribute d fault tolerant system dependent upon the state of the status signals; wherein the management subsystem is operable to redefine the configuration of the distributed fault tolerant system in response to detection of a change of state of a node; and wherein the management subsystem is operable to compare system resources to system requirements following a change of state of a node to determine whether reconfiguration of the distributed fault tolerant system is required. 57. A node of a distributed fault tolerant computer system comprising: a first counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; a counter reset routine implemented in software and operable repeatedly to reset the first counter mechanism to its reset value during normal operation of the counter reset routine; a first unit connectable to a first channel on a bus to supply a status signal indicative of the status of the first unit, the first unit being responsive to a fault signal output from the first counter mechanism to provide an OFF status indication for the first unit to the first channel of the bus; and a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distributed fault tolerant system dependent upon the state of the status signals; wherein the management subsystem is operable to define a node as a member of the fault tolerant computer system when it is associated with an ON status signal. 58. A node of a distributed fault tolerant computer system comprising: a first counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; a counter reset routine implemented in software and operable repeatedly to reset the first counter mechanism to its reset value during normal operation of the counter reset routine; and a first unit connectable to a first channel on a bus to supply a status signal indicative of the status of the first unit, the first unit being responsive to a fault signal output from the first counter mechanism to provide an OFF status indication for the first unit to the first channel of the bus; wherein the first unit is a first power supply unit. 59. The node of claim 58, comprising a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distributed fault tolerant system dependent upon the state of the status signals. 60. A distributed fault tolerant computer system comprising a plurality of nodes and a bus, wherein a node of the distributed fault tolerant computer system comprises: a first counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; a counter reset routine implemented in software and operable repeatedly to reset the first counter mechanism to its reset value during normal operation of the counter reset routine; a first unit connectable to a first channel on the bus to supply a status signal indicative of the status of the first unit, the first unit being responsive to a fault signal output from the first counter mechanism and being operable to provide an OFF status indication for the first unit to the first channel of the bus; and a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distributed fault tolerant system dependent upon the state of the status signals; wherein each unit of respective nodes of the distributed fault tolerant computer system is connected to a respective channel on the bus and the management subsystem is responsive to respective status signals on respective channels to determine the status of respective nodes. 61. A distributed fault tolerant computer system comprising a plurality of nodes and a bus, wherein a node of the distributed fault tolerant computer system comprises: a first counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; a counter reset routine implemented in software and operable repeatedly to reset the first counter mechanism to its reset value during normal operation of the counter reset routine; a first unit connectable to a first channel on the bus to supply a status signal indicative of the status of the first unit, the first unit being responsive to a fault signal output from the first counter mechanism and being operable to provide an OFF status indication for the first unit to the first channel of the bus; and a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distributed fault tolerant system dependent upon the state of the status signals; wherein management subsystem is operable to redefine the configuration of the distributed fault tolerant system in response to detection of a change of state of a given node and to define the given node as a member of the fault tolerant computer system where at least one ON status signal is provided from a unit of the given node. 62. A distributed fault tolerant computer system comprising a plurality of nodes and a bus, wherein a node of the distributed fault tolerant computer system comprises: a first counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; a counter reset routine implemented in software and operable repeatedly to reset the first counter mechanism to its reset value during normal operation of the counter reset routine; a first unit connectable to a first channel on the bus to supply a status signal indicative of the status of the first unit, the first unit being responsive to a fault signal output from the first counter mechanism and being operable to provide an OFF status indication for the first unit to the first channel of the bus; and a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distributed fault tolerant system dependent upon the state of the status signals; wherein the management subsystem is provided at a node of the distributed fault tolerant computer system. 63. The distributed fault tolerant computer system of claim 62, wherein a said management subsystem is provided at each node of the fault tolerant computer system. 64. A distributed fault tolerant computer system comprising a plurality of nodes and a bus, wherein a node of the distributed fault tolerant computer system comprises: a first counter mechanism operable to count from a reset value towards a fault value and operable to output a fault signal on reaching said fault value; a counter reset routine implemented in software and operable repeatedly to reset the first counter mechanism to its reset value during normal operation of the counter reset routine; and a first unit connectable to a first channel on the bus to supply a status signal indicative of the status of the first unit, the first unit being responsive to a fault signal output from the first counter mechanism and being operable to provide an OFF status indication for the first unit to the first channel of the bus; wherein each said unit is a power supply unit operable to turn off in response to a fault signal output by the respective counter mechanism. 65. The distributed fault tolerant computer system of claim 64, comprising a management subsystem, the management subsystem defining a configuration for the distributed fault tolerant computer system, the management subsystem being responsive to status signals on the bus and being operable selectively to redefine the configuration of the distributed fault tolerant system dependent upon the state of the status signals. memory and the external contents stored in said external memory, wherein the external contents stored in said external memory involve original check result information representative of a check result associated with validity of the external contents, said processing apparatus comprising: a renewal module obtaining section for obtaining a renewal module involving original module check result information representative of a check result associated with validity of the renewal module, said renewal module being to be substituted for a module to be renewed which is part of the external contents stored in said memory; a module check section for ch