JP3420919B2 - Information processing device - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an information processing apparatus that operates as an active machine or a standby machine of a hot standby system in which a standby machine for backup of the active machine is in a hot state and stands by, and more particularly to a hot standby system. The present invention relates to an information processing device suitable for speeding up backup switching and improving system operation rate.

[0002]

2. Description of the Related Art As a backup switching method for a hot standby system, a health check of an active machine is periodically performed on the standby machine side, and when the down of the active machine is detected, the active machine is disconnected by control from the standby machine. Later, a method has been widely adopted in which a spare machine takes over the work of the current machine.

Further, in a duplex system including an active processing system and a standby processing system, an interrupt signal is sent to the standby processing system when a failure of its own system is detected by the active processing system, and an acceptance signal from the standby processing system is sent to the standby signal. When received, the interrupt signal sending flag information is set, the standby processing system sends the forced stop signal to the active processing system after accepting the interrupt signal, and the active processing system sends the interrupt signal when the forced stop signal is received. A system switching control method is known in which the processing execution of the own system is stopped on condition that the flag information is set, and the standby processing system takes over the processing of the active processing system (for example, Japanese Patent Publication No. 63-43771). .

[0004]

The method of detecting the down of the active machine and switching the backup by the health check by the above-mentioned standby machine has a certain lack of certainty. That is, in general, the health check is performed by the "Are y" from the standby machine through the communication path between the standby machine and the active machine.
ou alive? Since a simple return communication is performed by sending a telegram that means such as "to the active machine, and confirming a response telegram that means such as" I am alive. " There is a risk of falsely detecting the down of the current machine or overlooking it, and as a result, unnecessary backup switching may be activated or necessary backup switching may not be performed.

Further, in the hot standby system, the backup switching time from the down of the active machine to the operation of the standby machine is a non-operation time, so the system operation rate largely depends on the backup switching time. The backup switching time cannot be shorter than the health check time interval. However, the health check has the possibility of communication errors and missing telegrams as described above, and it is not reliable to judge whether the active machine is down with one confirmation response. It is necessary to give redundancy to the contents of the confirmation, and as a result of the health check, the time required to judge that it has gone down with sufficient accuracy is generally quite long, from several tens of seconds to several minutes. Therefore, it is difficult to shorten the backup switching time.

If the health check time interval is forcibly shortened to shorten the backup switching time,
As described above, in addition to the deterioration of reliability, there is another problem that the computer time is largely devoted to health check, which leads to a decrease in system throughput.

The system switching control method disclosed in Japanese Examined Patent Publication No. 63-43771 does not apply to all hot working systems when it is applied to a hot standby system having a large number of working machines (working system) and standby machines (standby system). There is a problem that the backup switching mechanism becomes large-scale and expensive, because the signal line for transmitting the interrupt signal, its acceptance signal, the forced stop instruction signal, etc. must be connected between the machine and the standby machine. is there.

An object of the present invention is to provide an information processing apparatus which operates as an active machine or a standby machine of a hot stun bus system without causing a decrease in system throughput.
An object of the present invention is to provide an information processing device capable of more reliable backup switching and shortening the backup switching time.

Another object of the present invention is to provide a hot standby system with a large number of active and standby machines.
An object of the present invention is to provide an information processing apparatus that does not require connection of a huge number of signal lines for backup switching and can realize a backup switching mechanism at low cost.

[0010]

In order to achieve the above object, according to the information processing apparatus which operates as the active machine or the standby machine of the hot standby system of the present invention, the down of the active machine is detected when the active machine operates. Then, both means for activating the backup switching for the current machine and means for activating the backup switching for the current machine by detecting the down of the current machine side during operation as a standby machine are provided.

Since the down state can be directly detected when operating as the active machine, a quick backup switching process can be performed by activating the backup switch from the downed active machine. Even if the backup switching process fails (for example, the disconnection of the down working machine cannot be normally transmitted to the standby machine, and the standby machine does not perform the backup process), the down operation of the active machine still occurs. If detected by the standby machine, backup switching is activated from the standby machine when operating as a standby machine, and the backup switching process is likely to succeed. That is, in the hot standby system using the information processing apparatus of the present invention, the backup switching time can be shortened as a whole by using the backup switching activation from the active machine and the backup switching activation from the standby machine, and the fail safe effect can be obtained. Therefore, the certainty of backup switching increases. Further, even when the standby machine detects the down status of the active machine by the same health check as in the conventional case, it is not necessary to unreasonably shorten the health check time interval which causes a decrease in system throughput.

Then, according to the present invention, the current working is down.
From the device, the down notification message containing the device address of the current device.
The sentence is broadcast. This is all information processing
It is only necessary to use one communication channel common to the devices. Spare machine
When the active machine side broadcasts
When receiving the notification message of the down notification, the received notification message of the down message
Based on the device address in the
Being a standby target for machine business processes
On the condition that the current business process is
Execute it continuously.

By the way, it may be inconvenient if backup switching is activated redundantly from the active machine and the standby machine for the active machine that has gone down, and the disconnecting process of the active machine that has gone down is duplicated. For example, if the active machine is disconnected by a system reset, the state of the information processing apparatus at the time of the first reset is destroyed by the second reset, which may hinder the analysis of the cause of the down. According to the present invention, when operating as an active device, and means for preventing the overlapping execution of the isolation process
Count the number of disconnections, and the count value is 0.
Since a means for disconnecting is provided on the condition that such a situation occurs, such inconvenience can be avoided.

[0014]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a schematic block diagram showing an example of an information processing apparatus of the present invention used as an active machine or a standby machine in a hot standby system. In FIG. 1, the information processing device 100 has a main processing device 110 that executes a business process or a backup process, and an auxiliary processing device 120 that is involved in backup switching.
The auxiliary processing device 120 includes a communication unit 121, a sensor interface unit 122, a communication port 123, a reset signal driving unit 124, and a control unit 125.

The reset signal driving unit 124 is the main processing unit 1.
The reset signal RST for 10 is driven. The communication unit 121 is a unit for passing information between the main processing unit 110 and the auxiliary processing unit 120, and is, for example, a serial communication line, or a shared memory or a shared register with the main processing unit 110. Sensor interface unit 12
2 is the main processing unit 11 such as the operation abnormality of the main processing unit 110, the voltage abnormality of the power supply 112, the operation abnormality of the cooling fan 114, etc.
This is to detect an abnormal condition in which it is impossible to continue work due to 0. The communication port 123 is the communication path 130 between the auxiliary processing devices.
Is for communicating with an auxiliary processing device of another information processing device connected to. Using this inter-auxiliary processing device communication path 130, a notification of a failure occurrence and a notification of a disconnection request are transmitted between auxiliary processing devices of a plurality of information processing devices. The control unit 125 is a unit that controls each unit in the auxiliary processing device 120.

FIG. 2 shows an example of a hot standby system in which two information processing apparatuses in FIG. 1 are used as one working machine or one standby machine. In FIG. 2, the two information processing devices 100 (1) and 100 (2) each have the configuration shown in FIG. 1, but the internal configuration is simplified to avoid complexity of the drawing. Here, for convenience, the information processing apparatus 100 (1) is the active machine and the other information processing apparatus 10 is
Although 0 (2) will be described as a standby machine, the reverse may be true. The business resource 200 is an external storage device that stores data necessary for the main processing device to execute business processing,
A communication line or the like.

First, the case of activating the backup switching from the spare device 100 (2) will be described. In this case, the trigger for starting the disconnection of the active machine 100 (1) is the disconnection start operation by the operator of the standby machine 100 (2),
Alternatively, it is an abnormality detection by a regular health check on the active machine 100 (1). This health check is performed from the standby machine 100 (2) on a regular basis by the active machine 10 as in the conventional case.
A confirmation message is sent to 0 (1), and the active machine 100 corresponding thereto is sent.
This is done by checking the response message from (1). For example, in the standby machine 100 (2), the program on the main processor 110 (2) is the auxiliary processor 120.
Instruct (2) to send a confirmation message to the active machine. Upon receiving this instruction via the communication means 121, the control unit 125 of the auxiliary processing device 120 (2) sends a confirmation telegram for the active machine 100 (1) from the communication port 123 to the inter-auxiliary processing device communication path 130. In the active device 100 (1), when the auxiliary processing device 120 (1) receives this confirmation message via the communication port 123, the control unit 125 indicates that the sensor interface unit 122 is normal unless the sensor interface unit 122 detects an abnormality. Is returned from the communication port 123 to the backup device 100 (2) through the inter-auxiliary processing device communication path 130. In the standby machine 100 (2), the auxiliary processing device 120
(2) receives the response message at the communication port 123 and sends it to the main processing unit 110 (2) via the communication means 121. The program on the main processing unit 110 (2) determines whether the active machine 100 (1) is normal or abnormal by confirming the response message to the issued confirmation message.

In the standby machine 100 (2), when the health check detects an abnormal operation of the active machine 100 (1) or the operator starts the disconnection operation, the program on the main processing unit 110 (2) is executed. Instructs the auxiliary processing device 120 (2) to disconnect the active machine via the communication means 121. The control unit 125 of the auxiliary processing device 120 (2) sends a disconnection request message for the active machine 100 (1) from the communication port 123 to the communication path 1 between the auxiliary processing devices.
Send to 30. The format of this disconnection request message includes a transmission destination address 300, a transmission source address 301 and a disconnection command identifier 302, as shown in FIG. In this example, the working device 100 (1) is assigned the address # 1, and the standby device 100 (2) is assigned the address # 2.

This disconnection request message is the active machine 100.
The communication port 123 in the auxiliary processing device 120 (1) of (1)
Be received via. When the control unit 125 of the auxiliary processing device 120 (1) confirms that the destination address in the received disconnection request message and the address of the host system match, it determines that the message is a disconnection request message for the host system, and a reset signal The main processing unit 110 (1) is stopped by driving the reset signal RST by the driving unit 124. As a result, access from the main processor 110 (1) of the active machine 100 (1) to the business resource 200 is stopped. After this, the main processing unit 110 (2) of the standby machine 100 (2) uses the business resource 200 to take over the business processing. Working machine 100
During processing of each transaction by the main processing unit 110 (1) of (1), information indicating the processing progress status is sequentially stored in the business resource 200 by a special program on the main processing unit 110 (1). . Spare machine 100 (2)
Grasps the status of transaction processing by the active machine 100 (1) based on this information, and the active machine 100 (1)
Can be properly taken over.

Next, a case will be described in which the abnormality is detected on the side of the active machine 100 (1) and the backup switching is started. Auxiliary processor 120 of active machine 100 (1)
In (1), the control unit 125 causes the main processing unit 110 (1) to perform a machine check, power supply abnormality, cooling fan abnormality, etc. via the sensor interface unit 122.
When (1) detects a failure state in which the operation cannot be continued, the reset signal driving unit 124 drives the reset signal RST to stop the main processing device 110 (1). The business resource 200 is now disconnected from the active machine 100 (1).

After that, the control unit 125 of the auxiliary processor 120 (1) of the active machine 100 (1) sends a down notification message to the auxiliary machine 100 (2) to the inter-auxiliary processor communication path 130 via the communication port 123. Send out. The down notification message includes a destination address 400, a source address, and a message type, as shown in FIG. This down notification message is the auxiliary processing device 120 (2) of the standby device 100 (2).
Received via the communication port 123. The control unit 125 of the auxiliary processing device 120 (2) sends the content of the down notification message via the communication means 121 to the main processing device 110 (2).
Pass to. When the program on the main processing unit 110 (2) confirms that the transmission destination address of the down notification message matches the address of its own system, it starts the backup process of the active machine 100 (1) and saves it on the business resource 200. The business process is taken over by referring to the stored process progress information of the active machine 100 (1). If the backup relationship between the standby machine 100 (2) and the active machine 100 (1) is clear,
It goes without saying that the down notification message may be a broadcast message (described later) as shown in FIG.

FIG. 5 shows an example of a hot standby system in which three of the information processing apparatuses shown in FIG. 1 are used as an active machine and a standby machine. In FIG. 5, three information processing devices 10
0 (11), 100 (12) and 100 (13) have the configurations shown in FIG. 1, respectively, but the internal configuration is simplified to avoid the complexity of the drawing as in the case of FIG. .

The work is composed of a series system of process A, process B, process C, and process D, and it is assumed that four processes A, B, C, and D need to operate simultaneously to execute the work. . The four processes are distributed to three information processing devices and executed as active processes. Each process has process resources such as an external storage device and a communication line necessary for executing its function, and the process resources are connected so that they can be accessed from information processing devices having a backup relationship with each other. Further, it is assumed that, for each active process, a standby standby process is placed on standby on an information processing device different from the information processing device on which the active process is executed.

In the example of FIG. 5, the information processing apparatus 100 (11) having the address # 1 is a working machine for the process A and a spare machine for the process B. Normally, the working process A is executed and the spare process B is executed. Wait for execution. Therefore, the process A resource 501 and the process B resource 502 are connected to the main processing unit 110 (11) of the information processing apparatus 100 (11). The information processing apparatus 100 (12) having the address # 2 is an active machine for processes B and C, and a standby machine for processes A and D.
Normally, the active processes B and C are executed, and the standby processes A and
Wait for execution of D. Therefore, this information processing device 10
0 (12) main processor 110 (12) has process A resource 501, process B resource 502, process C
Resource 503 and process D resource 504 are connected. In addition, the information processing device 100 (13) of the address # 3
Is the current machine for process D and process C
It is a standby machine for the above, and normally executes the active process D and waits for the process C to be executed. This information processing device 10
A process C resource 503 and a process D resource 504 are connected to the main processor 110 (13) of 0 (13).

Each information processing apparatus 1 as an active machine and a standby machine
00 (11), 100 (12), 100 (13) are main processing units 110 (11), 110 (12), 110
(13) With the above program, the status of the corresponding process is recorded in the virtual memory as the standby status storage status 511, 512, 513 as shown in the lower part of FIG. In these standby state storage states, when the process is in the standby state, the address of the information processing device to be backed up by the process is also recorded. For example, the standby state storage status 511 of the information processing apparatus 100 (11) at address # 1 is the information processing apparatus 100 (11).
Indicates that there is an active process A521 and a backup process B522, and the backup process B522 is waiting to back up the active process B523 on the information processing device 100 (12) at address # 2. Similarly, the standby state storage status 512 of the information processing device 100 (12) at the address # 2 indicates that the active process B523 and the active process C524 operate on the information processing device 100 (12).
Information processing apparatus 1 whose spare process A 525 is address # 1
This indicates that the active process A on 00 (11) is backed up and on standby, and the backup process D 526 is backed up on standby and the active process D on the information processing device 100 (13) at address # 3 is on standby.

Here, the information processing apparatus 10 of address # 2
0 (12), the operation of the backup switching when the abnormality of the main processing unit 110 (12) occurs will be described.

First, the information processing apparatus 100 in which a failure has occurred
A case where (12) itself activates backup switching will be described. In the information processing device 100 (12), the auxiliary processing device 120 (12) performs a machine check of the main processing device 110 (12), a power supply abnormality, a cooling fan abnormality, etc. via the sensor interface unit 122.
When the control unit 125 of the auxiliary processing device 120 (12) detects that the 10 (12) cannot continue to operate, the reset signal drive unit 124 drives the reset signal RST,
The main processing unit 110 (12) is replaced with the process resources 501-5.
04, and in this case, contention of resource access with the information processing devices 100 (11) and 100 (13) operating as a standby device is prevented. After this, the information processing device 100
In the auxiliary processing device 120 (12) of (12), the control unit 125 sends a down notification message to the inter-auxiliary processing device communication path 130 via the communication port 123.

As shown in FIG. 6, the format of this down notification message is a broadcast notification that should be received by the auxiliary processing devices of all the information processing devices in the system, and the broadcast address is set in the transmission destination address 601. , The address # 2 of the downed information processing apparatus 100 (12) is set to the transmission source address 602.

Address that received this down notification message #
No. 1 information processing device 100 (11) auxiliary processing device 120
(11) transmits the content of the down notification message to the main processing unit 110 (11) by the communication means 121. The program on the main processing unit 110 (11) requires that the source address shown in the down notification message, that is, # 2, and the standby target address of the backup process B522 in the standby state storage status 511, that is, # 2, match. To
The backup process B522 is used as the current process. The backup process B522 becomes the active process and partially takes over the work by using the process B resource 502.

Since the down notification message is a broadcast notification, the information processing apparatus 100 (13) at address # 3
It is similarly received by the auxiliary processing device 120 (13).
In response to this, the information processing device 100 (1
In 3) as well, similar process switching is performed, the spare process C528 is set as the active process, and the process C resource 503 is used to partially take over the business processing. In this way, the information processing device 1 of the address # 2 that has gone down
Two information processing devices 100 (1) excluding 00 (12)
All processes A, B, C and D necessary for business processing are provided on 1) and 100 (13), and business can be continued as before.

Next, the case where the backup switching is activated from the spare side will be described. Each information processing device 10
0 (11), 100 (12), and 100 (13) perform regular health checks on other information processing devices that are standby targets of the backup process. For example, the main processing unit 110 of the information processing apparatus 100 (11) at the address # 1
(11) The above program is the standby state storage information 5
11, the confirmation message for the information processing device 100 (12) at the address # 2 which is the standby target of the backup process B522 is sent to the inter-auxiliary processing device communication path 130 via the auxiliary processing device 120 (11), and The health check of the information processing device 100 (12) at the address # 2 is performed by checking the response message to the.

When an abnormality is detected in the information processing apparatus 100 (12) at address # 2 in this health check (the information processing apparatus 100 (12) at address # 2 is operated by the operator of the information processing apparatus 100 (11) at address # 1). The same applies to the case where the separation start operation is performed), the program on the main processing unit 110 (11) of the information processing apparatus 100 (11) at address # 1 is transferred to the auxiliary processing unit 120 (11) via the communication unit 121. Information processing device 10 of address # 2
Instruct to disconnect 0 (12). Auxiliary processing device 120
The control unit 125 of (11) sends a disconnection request message (FIG. 3) for the information processing apparatus 100 (12) which is the down working machine from the communication port 123 to the communication path 13 between the auxiliary processing apparatuses.
Send to 0.

The auxiliary processing unit 12 of the information processing unit 100 (12) at the address # 2 that has received the disconnection request message
At 0 (12), when the control unit 125 confirms that the destination address in the disconnection request message matches the address of the own system, it determines that the message is a disconnection request message for the own system, and the reset signal drive unit 124 Reset signal R
By driving ST, the main processing unit 110 (12)
Is stopped and separated from the process resources 501 to 504. After this, the control unit 12 of the auxiliary processing device 120 (12)
5 sends the down notification message, which is the above-described broadcast notification, to the inter-auxiliary processing device communication path 130 via the communication port 123. The information processing apparatus 110 (11) having the address # 1 and the address # 3 that have received the down notification message
The information processing apparatus 100 (13) switches the processes as described above, shares the processes B and C as the active process, and continues the business process.

By the way, disconnection for the same information processing apparatus may be activated in duplicate. For example, when an abnormal information processing device drives the reset signal to the main processing device by its own startup, the down notification message at that time is not normally transmitted to the other information processing device on the backup side, and then the backup is performed. This is a case in which another information processing apparatus on the side detects the abnormality by a health check and disconnects it and sends a request message. If, in response to the disconnection request message, the information processing device in which the abnormality occurred drives the reset signal for the main processing device again, the status of the information processing device at the time of the first reset is not saved and It interferes with the analysis of the cause. In order to prevent this, in each information processing device (100), the control unit (125) of the auxiliary processing device (120) counts the number of disconnections of the main processing device (110), and the count is 0. Under the condition, the reset signal RST is driven, and the duplicate driving of the reset signal RST is prohibited. Then, the control unit (125) clears the counter to zero when the main processing unit (110) is rebooted.

Up to this point, an example in which a reset signal is used as a stop means of the main processing unit for disconnecting the active machine from the business resources or process resources has been shown. The register contents at the time of failure may be lost and trouble may be hindered. In order to prevent this, the auxiliary processing device uses an interrupt signal instead of the reset signal in the above-mentioned backup switching processing procedure, and the interrupted program on the main processing device stops access to the business resource or process resource. Procedures can be adopted. In addition, the response to stop access to the business resource or process resource due to the interrupt is transmitted from the main processing unit to the auxiliary processing unit within a predetermined time by the communication means. The reset can be performed from the processing device. As a result, it is possible to reliably disconnect the faulty machine and leave a detailed fault condition in the information processing apparatus according to the degree of the fault.

[0036]

As is apparent from the above description, the present invention
According to the information processing device of
It is possible to make backup switching reliable and speed up .

[Brief description of drawings]

FIG. 1 is a block diagram showing a configuration example of an information processing apparatus of the present invention used in a hot standby system.

FIG. 2 is a block diagram showing an example of a hot standby system including two information processing devices of the present invention.

FIG. 3 is a diagram illustrating an example of a disconnection request message.

FIG. 4 is a diagram illustrating an example of a down notification message.

FIG. 5 is a block diagram showing an example of a hot standby system in which three information processing apparatuses of the present invention mutually back up four processes.

FIG. 6 is a diagram showing an example of a down notification message.

[Explanation of symbols]

100 Information processing device 110 Main processing device 112 Power supply 114 Cooling fan 120 Auxiliary processing device 121 Communication means 122 Sensor interface unit 123 Communication port 124 Reset signal drive unit 125 Control unit 130 Communication path between auxiliary processing devices 100 (1) Information processing device ( Active machine 100 (2) Information processing apparatus (spare machine) 100 (11) Information processing apparatus (active machine / spare machine) 100 (12) Information processing apparatus (active machine / spare machine) 100 (13) Information processing apparatus ( (Working machine / standby machine) 200 Business resource 501 Process A resource 502 Process B resource 503 Process C resource 504 Process D resource 511, 512, 513, 514 Standby state Storage status RST Reset signal

Continuation of the front page (56) References JP-A-7-44413 (JP, A) JP-A-60-100231 (JP, A) JP-A-6-325008 (JP, A) (58) Fields investigated (Int .Cl. ⁷ , DB name) G06F 11/16-11/20 G06F 11/28-11/34 G06F 15/16-15/177

Claims (2)

(57) [Claims] Claim: What is claimed is: 1. A plurality of processes, a plurality of working machines and spare machines.
The information processing apparatus hot standby system to be processed in the information processing apparatus dispersing the working machine relates a process
As a standby machine for another process
And, said means for detecting the down of the working machine to start the isolation process and backup switching from a working business process of the working machine during operation as a working machine, the down of the working machine side during operation as the spare machine An information processing apparatus having means for detecting and activating backup switching for the active machine, wherein the information processing apparatus is a standby target process which is a standby machine.
Device address of the active machine whose operating process is
And a means for storing, when the self-information processing device detects that the active machine is down when operating as an active machine, disconnects the active machine from the active business process and broadcasts a down notification message including the self- device address. , When the down notification message transmitted by another active device side is received, the device address in the received down notification message is received.
The dress and the stored device address match.
On the condition that
A means for taking over the business process, and an information processing device. 2. The information processing apparatus according to claim 1, wherein
Count the number of disconnections and check that the count value is 0.
It is specially equipped with a means for separating under the condition of
Information processing equipment to be collected.