JP3399398B2 - Mirror Disk Recovery Method in Fault Tolerant System - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a failure recovery processing method in a fault tolerant system for constructing a computer duplication system, and more particularly to an online data recovery method in which computers of a second system mutually back up online data.

[0002]

2. Description of the Related Art Disk mirroring in a fault-tolerant system allows hard disks of two computers to be interconnected, data to be written to both at the same time, and data processing to be continued even if one computer fails. Widely used as a method. For example, in Japanese Unexamined Patent Publication No. 9-204319, two opposing computers have opposing system operation information, and the same online data is mutually transferred by the data transfer control means to duplicate the data. ing. Then, when any of the computers recovers from the failure, all the online data of the normal computer is automatically transferred to the opposite computer so that the online data can be recovered quickly and easily.

[0003]

However, in the prior art as described above, in the fault tolerant system, the shorter the time from the occurrence of a failure to the recovery, the higher the reliability. Since the time required for the mirroring for recovery occupies most of the system recovery time, there arises a problem that the reliability of the entire system is deteriorated. In particular, the above-mentioned JP-A-9-2
The technique disclosed in Japanese Patent No. 04319 transfers all online data to the opposite computer at the time of restoration, which is a factor of prolonging the restoration time.

The present invention has been made in view of such circumstances, and an object thereof is to reduce the time required for mirroring by suppressing the amount of data transfer at the time of system recovery to a necessary minimum, and thus to recover. The goal is to significantly shorten the time and build a highly reliable fault-tolerant system.

[0005]

According to the present invention, there are two computers having the same hardware configuration, and the two computers operate in the same manner while communicating with each other by connecting cables between the computers. A fault-tolerant system that improves the performance of a fault-tolerant system that mirrors hard disks connected to each computer and mutually retains the same information, and that performs recovery processing after the computer stops due to a failure other than the hard disk. It relates to a mirror disk restoration method.

In order to solve the above problems, therefore, the mirror disk restoration method in the fault tolerant system of the present invention uses a disk that is updated while one computer is stopped due to a factor other than a disk failure. Save data information in a special area. Then, when the failed computer is repaired and returned to the system to recover the disk data, only the updated disk data information, that is, the difference information when one computer is stopped and recovered By transferring the data, it is possible to recover faster than before without stopping the original processing of the system.

That is, the mirror disk restoration method in the fault-tolerant system according to claim 1 improves reliability by allowing two opposing computers having the same hardware configuration to perform the same operation while mutually communicating. A fault-tolerant system configured to achieve the above, the disks provided in each of the computers are mirrored to mutually retain the same information, and recovery processing is performed after the computer is stopped due to a failure other than the disks. In the mirror disk restoration method in the fault tolerant system, each of the computers allocates a storage area of the disk to N disks.
(N is a natural number of 2 or more) It is composed of N elements corresponding to the storage area when it is divided, and is updated among the storage areas of the N-divided disk while the computer is stopped. A special storage area for storing the updated difference data information in the element corresponding to the storage area is provided, and when the failed computer recovers and returns to the secondary system to recover the disk data, The normal computer returns to the system of the second system by transferring only the data in the disk corresponding to the difference data information stored in the special storage area of itself to the computer which has returned to the system.
Each of the two components that make up the dual system
The computer is a CPU (central processing unit) that performs the main operations.
And the interface between the disk and other hardware.
Disk interface that provides
Disk controller for direct data access to the disk
And the disk used to store the data, and
Passing data to and from each of the computers
Data communication means for realizing the above, and the entire computer
Monitor hardware failures and detect failures
Failure that has the function of stopping the function of the entire computer
Single-system operation or restoration of the detection means and the two-system
Before to record the difference data information created during operation
The storage area of the disk provided in the special storage area
Is divided into N (N is a natural number of 2 or more)
It consists of N elements associated with each other.
Disk divided into N while the computer is stopped
Corresponding to the updated storage area of the storage area
The data access that stores the updated difference data information.
Access table and access instructions to the disk .
The data access is determined by determining whether the data is read or written.
Data monitor that creates the data to write to the process table
And the data access table is
Before it was updated while the computer was shutting down and restoring
This is to store the difference data information.
The viewing means is a storage area of the N-divided disk.
For storage areas that have already been rewritten,
Change only the checksum calculated when writing the data
Characterized in that that.

[0008]

A mirror disk restoration method in a fault tolerant system according to a second aspect is the one according to the first aspect , wherein the data access table is composed of a storage medium of a flash memory capable of retaining the contents even when the power is turned off. Is characterized by.

[0010]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described in detail below with reference to the drawings. FIG. 1 is a block diagram showing the configuration of a computer system according to an embodiment of the present invention. In the figure, a computer 1 and a computer 2 have the same hardware configuration, and CPUs 11 and 21 for performing main operations, disk interfaces 12 and 22 for providing an interface between a disk and other hardware, and a disk, respectively. Data monitoring means 1 for creating data to be written in the data access table by discriminating whether the access instruction is reading or writing of data
3, 23, disk controllers 14 and 24 for directly accessing data to the disks, disks 15 and 25 used for storing data, and a computer 1.
And failure detection having a function of monitoring the failure of the data communication means 16 and 26 for mutually exchanging data between the computer 2 and the hardware of the entire computer and stopping the function of the entire computer when a failure is found. Means 17 and 27 and a storage medium necessary for the system to record difference information of data created during one-sided operation or recovery operation, and the write position at the time of issuing a disk write command necessary for mirror copy and at that time And data access tables 18 and 28 for storing the status of the.

However, the data access tables 18 and 2
Reference numeral 8 is assumed to be composed of a device such as a flash ROM capable of retaining the contents even when the power is turned off, or a storage medium such as a disk which replaces the device. It is also possible to use the unused areas of the disks 15 and 25 to have the functions of the data access tables 18 and 28.
The computer 1 and the computer 2 are connected by a link cable 3 and are used for mutual processing information, data transfer between computers, and status confirmation.

Next, the operation of the embodiment having such a configuration will be described. In a fault tolerant system with two computers 1 and 2, one computer stops due to a failure other than the disks 15 and 25, and the remaining one computer (1 or 2) must continue to operate. When the data disappears, the update information of the disk (15 or 25) generated during the operation of one unit is stored in the data access table (18 or 28) which is a specially prepared storage area.

When the fault is removed and the stopped computer (1 or 2) is restarted, the updated information of the data access table (18 or 28) stored during the stop is used to update the computer during the stop. The mirror copy can be completed in a shorter time than before by adding hardware or software that can transfer only the contents of the disk (15 or 25). To do. Also, by devising the data structure of the data access tables 18 and 28, the data access table can be updated even during the mirror copy, so that it is possible to operate normal operations while the mirror copy is being performed. is there.

Next, as an example of the operation, the method of system recovery will be described in detail by using the system and algorithm as shown in FIGS. 1, 2, 3 and 4 as an example. still,
FIG. 2 is an algorithm of the process performed by the data access table in FIG. FIG. 3 is a state transition diagram which can be taken by the fault tolerant system including the two computers in FIG. Furthermore, FIG.
2 is a flowchart showing a flow of processing from failure to recovery of one computer in the configuration of FIG. 1.

First, the normal operation will be described. C
The checksum of the calculation result in the PU 11 and the CPU 21 is transferred to the data communication means 16 and 26, and the mutual data is transferred using the link cable 3 to confirm the consistency of the data. Then, at the time of disk access, the data monitoring means 13 and 23 generate checksums of read and write data to perform read / write, and when read and write are completed, the disk interface 1
2, 22 and the data communication means 16, 26 are used to transfer the generated checksums from the link cable 3 to each other to check whether the data match, and if they do match, perform the next processing. Move.

Now, the operation of the data access tables 18 and 28 will be described in detail using the algorithm of FIG. One element of the data access tables 18 and 28 corresponds to an area when the total capacity of the disks 15 and 25 is divided into N, holds disk update information of the area, and its address is 0, 1 in order from the upper left. After waving it up to 2, and moving to the upper right, move one step down to the left and assign the address until the address N-1 is assigned. One element of the data access tables 18 and 28 has the format of the data format 1, and the failure occurrence information 211 indicating that the data is written when the failure occurs, and the calculation when writing the data. The checksum 212 and the next address pointer 213 storing the addresses of the data access tables 18 and 28 to which data is written next.

Further, the data access tables 18 and 28
Is assigned a data address register 2 that holds an address necessary for failure recovery. The data address register 2 stores the last address 221 indicating the address of the data access tables 18 and 28 corresponding to the last updated data area and the address of the data access table corresponding to the last updated data area. The pre-last address 222, the failure address 223 that records the address of the data access table corresponding to the area where the data was updated first after the failure occurred, and the data corresponding to the area when the write access occurred. It comprises a current access address 224, which indicates the addresses of the access tables 18 and 28.

When the writing to the disks 15, 25 occurs, the data monitoring means 13, 23 cause the disks 15,
It is determined in which area of 25 the data is to be written, the area is converted into the address of the data access tables 18 and 28, and the address is stored in the current access address 224 in the data address register 2. Then, the checksum calculated during the write access is written in the checksum 212 in the data access tables 18 and 28 indicated by the current access address 224.

Since the write access that has occurred at present is the access next to the last write access, the data access table 18 indicated by the last address 221
The next address pointer 213 in 28 is updated to the current access address. That is, the current access address 224 is stored in the next address pointer 213. Then, since the data access tables 18 and 28 of the currently write-accessed area indicate the last accessed area, the contents of the last address 221 are saved in the pre-last address 222 and the contents of the current access address 224 are stored. Save to last address 221. In this way, the update history of the disks 15 and 25 is stored by connecting the pointers to the data access tables 18 and 28 of the areas that have been write-accessed.

Next, the state transitions that the fault tolerant system having the two computers 1 and 2 can take will be described with reference to the state transition diagram of FIG. When the computer 1 and the computer 2 are running, there is no difference in the data contents of the disks 15 and 25, and the same operation is performed. Normal operation 311, the computer (1 or 2) is operating only one. One-side operation 312,
Stop the system when it cannot operate as a system 31
By setting the state in which the difference between the disk 3 and the disks 15 and 25 is being transferred to the recovery operation 314, the state can be represented by four states.

Further, the state transition occurs in the direction of the arrow, and the respective conditions are one stop 301 under the condition that the computer detects the abnormality and stop, and another stop while one is stopped. Another condition is to stop 302, a computer to be restarted during the recovery operation is stopped, the transfer destination of the condition is to stop 303, and a condition to restart the computer that was stopped in the single operation condition is to be restarted 304. Transfer source restart 305 under the condition that a computer that has been operating for a long time from the system stop state is restarted, transfer source is stopped under the condition that a computer that has been operating for a long time during recovery operation stops due to an error 306, disk difference The transition is made according to the seven conditions of the disk copy end 307, which is the condition that all information is transferred.

Next, referring to the flowchart of FIG. 4, one-sided operation 312 is performed with the computer 2 stopped due to a failure.
The flow of the processing performed from to return to the normal operation 311 will be described. First, when the failure detecting means 27 detects a hardware failure of a device inside the computer 2, the operation of the computer 2 is stopped (Step 1). As a result, the computer 1 shifts to the failure avoidance mode. That is,
The data communication means 16 of the computer 1 is the computer 2
Since it cannot communicate with the data communication means 26, the stop of the computer 2 is detected and the information is transmitted to the disk interface 12. Then, the disk interface 12
Recognizes that it is running only on computer 1,
The information is notified to the data monitoring means 13. Upon receiving this information, the data monitoring means 13 receives the pre-last address 22.
2 is written in the failure occurrence address 223, and the failure occurrence information 211 of the data access table 18 indicated by the addresses written in the pre-last address 222 and the last address 221 is turned ON. By doing so, the failure occurrence flag indicating that a failure has occurred is raised, and when the information is written in the data access table 18, the failure occurrence information 211 is turned on and the mode shifts to the data write mode (Step 2).

Next, the disk access requested by the CPU 11 is controlled (Step 3). This control method will be described with reference to Setp20 to Step26 of another flow. That is, the CPU
When 11 requests access to the disk 15, an instruction is transferred to the data monitoring means 13 via the disk interface 12 (Step 20). Next, the instruction is analyzed (St
ep21), if it is a read command, the disk controller 14
To read data from the disk 15 (Step
26) and end the access request to the desk (Step 25).
On the other hand, if the analysis result in Step 21 is a write command, the disk controller 14 is controlled to write data on the disk 15 (Step 22). At that time, the data monitoring means 13 generates a checksum. Further, the address of the data access table 18 corresponding to the write address is determined and written in the current access address 224.

Next, the data access table 18 is created. That is, the current access address 224 is set to the next address pointer 213 in the data access table 18 at the address indicated by the last address 221.
Of the error occurrence information 21 in the data access table 18 indicated by the current access address 224.
1 is set to ON to indicate that the write access is in the one-way operation 312. In addition, the checksum 212 includes St
The checksum generated in ep22 is written, and the nonexistent address (N) is written in the next address pointer 213 to indicate the end of the list (Step 2).
3).

In step 23, when the data access table 18 is updated, the failure occurrence information 211 has already been set to O.
If it is N, it indicates that the write access to the area has already occurred during the one-sided operation 312 state. In this case, only the checksum 212 is rewritten and the St
Continue to ep25. That is, only the update data information for the same address is rewritten, and the access request to the disk is ended (Step 25). On the other hand, in step 23, when the failure occurrence information 211 is OFF when updating the data access table, the last address 221 is written to the pre-last address 222, the current access address 224 is written to the last address 221, and the data address register is updated. (Step 24), the end of instruction execution is notified to the disk interface 12, and the access to the disk is ended (Step 25).

When the disk access is completed in this way, the process proceeds from Step 3 to Step 4 described above. That is, the data communication unit 16 confirms whether or not the computer 2 is restarted (Step 4), and if NO, returns to Step 3 and executes the above Steps 20 to 26 to execute the failure occurrence information 211 of the data access table. By updating the record while turning on, the data update history in the state of the one-way operation 312 is saved.

On the other hand, in Step 4, the data communication means 1
If the confirmation of whether the computer 2 is restarted by 6 is YES, the process proceeds to Step 5. That is, when the computer 2 is restarted, each of the last address 221 and the pre-last address 222 recorded in the data access table 28 is checked in order to confirm whether the disk data of the disk 25 has the same contents as before the stop. Checksum 21 of the data access table 28 pointed to by
2 is taken out, the actually recorded disk data is read out to generate a checksum, and it is confirmed whether the checksum is the same as before the stop. That is, the data communication means 16 of the computer 1 confirms whether or not they match, and informs the data monitoring means 13 via the disk interface 12 (Step 5).

The data in the disk 25 is not updated during the one-way operation 312 in which the computer 2 was stopped and becomes old data, so the CPU 21
Cannot use the data of the disk 25, the disk interface 22 is not used and the data communication means 26,
The disk interface 12 is used by using the link cable 3 and the data communication means 16.

Then, in Step 6, the mirror copy mode is entered and the recovery operation 314 in FIG. 3 is entered. That is, if the comparison results of the checksums transferred to the data monitoring means 13 are the same, the disk 2
Since it can be determined that the data 5 is the same as before the computer 2 was stopped, the mode is switched to the mode in which only the data difference is transferred. If even one checksum comparison result does not match, it can be determined that the data on the disk 25 is different from that before the computer 2 was stopped due to disk replacement or the like. Switch to transfer mode (step6).

Here, in Step 6, if only the data difference is transferred, the data of the disk 15 corresponding to the address indicated by the failure occurrence address 223 stored in the data address register 2 is transferred, In order to sequentially transfer the disk data corresponding to the address written in the next address pointer 213 of the data access table indicated by the failure occurrence address 223, the process moves to the disk access of Step 7.

In Step 6, if all the data is in the transfer mode, it is necessary to transfer all the data in the disk 15 to the disk 25. Therefore, the difference information in the data access table 18 is discarded and The following processing is performed so that the data can be transferred. That is, the failure occurrence information 211 of a certain address (i) is turned on.
The address (i +
Work such as writing 1) is performed at address (0)
To address (N-1) for all data. After updating the data access table 18,
(N-1) is written in the last address 221, (N-2) is written in the pre-last address 222, and (0) is written in the failure occurrence address 223, and the disk access in Step 7 is started.

At Step 7, CPU 11 or CPU 21
In the step of processing the write access from to, the same processing as Step 3 is performed. That is, the data of the disk 15 can be updated even during the mirror copy. Also, CPU1
If there is no 1 or a write access request from the CPU 21, the disk access in Step 7 is not executed and the process proceeds to the disk copy execution in Step 8.

That is, in Step 8, the computer 1 causes the failure address 223 of the data access table 18 to occur.
Disk 15 corresponding to the data access table indicated by
Data is transferred to the disk 25. In the computer 2, since the data monitoring means 23 performs the same processing as in the normal operation, the checksum is generated and the current access address 224 is updated at the time of write access, and the data access table pointed to by the current access address 224 of the data access table 28. Address checksum 21
2 and the current access address 224 is written to the next address pointer 213 of the address of the data access table pointed to by the last address 221, and the contents of the last address 221 are stored in the pre-last address 222 and the contents of the current access address 224 are stored in the last address 2
21 (Step 8).

Next, in Step 9, the data address register is updated. That is, when the write access to the disk 25 of the computer 2 ends normally, the data monitoring means 23 causes the disk interface 22, the data communication means 26, the link cable 3, and the data communication means 16 to operate.
And, via the disk interface 12, the data monitoring means 13 of the computer 1 is notified of the end confirmation. When the computer 1 can confirm the information of normal termination, it turns off the failure occurrence information 211 written in the data access table 18 indicated by the failure occurrence address 223 of the data access table 18. Also, the fault address 2
23 to the next address pointer 113 written in the data access table 18
Write in 23 (Step 9).

Then, in Step 10, it is judged whether or not the mirroring is completed. That is, if the failure occurrence address 223 of the data access table 18 is not N (that is, NO), the process returns to the disk access of Step 7. If N (that is, if YES), there are no more lists, and the two-system computer is restored to the normal system (Step 11). That is, Step7 to Step9
By repeating the processing up to the above until the next address pointer of the data access table 18 reaches the end address (N), the updated data can be transferred during the one-way operation 312.

At Step 11, the data monitoring means 13 is shifted to the normal operation mode. That is, the disk interface 12, data communication means 16,
C via the link cable 3 and the data communication means 26
Notify PU21. The CPU 21 of the computer 2 recovers the data in the disk 25 by completing the transfer of the differential data between the disk 15 and the disk 25, and uses the disk interface 22 when accessing the disk, thereby returning to the normal system.

The embodiment described above is an example for explaining the present invention, and the present invention is not limited to the above-mentioned embodiment, and various modifications can be made within the scope of the invention. is there. It goes without saying that the present invention can be applied to a redundant network server system in which the same file is stored in a plurality of computers.

[0038]

As described above, in a fault tolerant system by duplicating a computer, there is a situation where a defective part cannot be replaced unless the computer is stopped when a hardware failure is detected. In particular, when the hard disks are mirrored in both systems, it is necessary to make the information of each hard disk the same in both systems in order to restore the stable system from the one-system operating state.
However, in the conventional method, when one computer is restored from the down state and the hard disk information of the restored computer is restored, all the information in the disk of the computer that was continuously operating is copied to the restored computer disk. Therefore, it takes a considerable amount of time to complete disk mirroring, and most of the time until failure recovery is occupied by the mirror copy time for disk data recovery, which leads to a decrease in system reliability. Was there. However, by applying the present invention, it is only necessary to transfer the minimum necessary data when recovering the disk data, so the recovery time is greatly shortened, and a fault-tolerant system with higher reliability than before is constructed. You can do it.

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration of a computer system according to an embodiment of the present invention.

FIG. 2 is an algorithm of processing performed by the data access table in FIG.

FIG. 3 is a state transition diagram which can be taken by a fault tolerant system having a configuration of two computers in FIG.

FIG. 4 is a flowchart showing a processing flow from failure to recovery of one computer in the configuration of FIG.

[Explanation of symbols]

1, 2 ... Computer, 11, 21 ... CPU, 12, 2
2 ... Disk interface, 13, 23 ... Data monitoring means, 14, 24 ... Disk controller, 15, 2
5 ... Disk, 16, 26 ... Data communication means, 17, 2
7 ... Failure detection means, 18, 28 ... Data access table

Claims (2)

(57) [Claims] 1. A fault tolerant system configured to improve reliability by allowing two opposing computers having the same hardware configuration to perform the same operation while mutually communicating. In the mirror disk restoration method in a fault tolerant system, in which the disks provided in the computer are mirrored to mutually retain the same information, and the restoration processing is performed after the computer is stopped due to a failure other than the disks, , A disk which is composed of N elements corresponding to the storage area when the storage area of the disk is divided into N (N is a natural number of 2 or more), and which is divided into N while the computer is stopped In the element corresponding to the updated storage area of the storage area of A special storage area for storing the updated differential data information is provided, and when the failed computer recovers and returns to the secondary system to recover the disk data, the normal computer returns to the system. against the computer, by transferring only the data in the disk corresponding to the differential data information stored in the special storage area of the self, but to return to the two systems of
So, each computer that makes up the dual system
A CPU (central processing unit) that performs the main calculations and a disk
Interface to other hardware
Disk interface and data access to the disc.
Disk controller for direct access and save data
Discs used to
Data that enables the exchange of data between computers
Data communication means and the hardware of the entire computer.
Monitor the failure and if you find a failure,
Failure detecting means having a function of stopping the function of the body, and
The dual system is created during single operation or recovery operation.
In the special storage area for recording the difference data information
And the storage area of the disk is N (N is 2 or more).
Natural number) N associated with the storage area when divided
The computer is shut down
Of the storage area of the disk divided into N while
The element corresponding to the updated storage area is updated
A data access table for storing difference data information,
The disk access command is a data read or write command.
It is determined whether it has been imprinted and it is written in the data access table.
Data monitoring means for creating data to be imbedded, and the data access table is stopped by another computer.
And the difference data that was updated during the recovery work
Information is stored, and the data monitoring means stores the N divided disks.
Memory area that has already been rewritten
Of the checksum calculated when writing the data
A mirror disk restoration method in a fault-tolerant system characterized by changing only the settings. 2. The mirror disk restoration method in a fault tolerant system according to claim 2, wherein the data access table is composed of a storage medium of a flash memory that can retain the contents even when the power is turned off.