JPH06175868A - Duplex computer fault monitoring method - Google Patents

Abstract

PURPOSE:To provide a mutual fault monitoring function with simple algorithm and hardware configuration without lowering the entire reliability of a duplex computer system. CONSTITUTION:Concerning a duplex computer connecting an A system computer provided with a central processing unit (CPU) 10A and a main storage device 14A connected through a local bus 12A to this CPU 10A and a B system computer provided with a CPU 10B and a main storage device 14B connected through a local bus 12B to this CPU 10B by line controllers 16A and 16B respectively connected to the local buses 12A and 12B and a line 24 for mutual monitor to connect these line controllers 16A and 16B, monitor limit time shorter than that of a slave system computer on standby is set to a main system computer under operating in the case of setting the monitor limit time to be time-up from the state transmission of the present system computer to the return reception from the other system computer.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a dual computer fault monitoring method, and more particularly to a dual computer fault monitoring method that can be effectively applied to mutual fault monitoring in a duplex computer system.

[0002]

2. Description of the Related Art In a duplex computer based on a duplex system, a main computer that performs main business processing and a subordinate computer that normally waits and takes over the business when the main computer fails The system is configured.

As a failure monitoring method adopted in the above system, a monitoring signal is mutually transmitted between the main system computer and the secondary system computer, and the response from the other system is time-monitored. There is known a method of detecting that a failure has occurred in the.

However, in the method of detecting the occurrence of a failure by the time monitoring as described above, even when the communication means for mutual monitoring fails, it is determined that the computers of the partner systems have failed. It may become inoperable.

Therefore, in order to avoid such a situation that the mutual monitoring communication means becomes inoperable due to the failure, if the failure is detected separately from the communication means, There is known a technique in which a failure point determination communication means for determining whether it is a failure of the mutual monitoring communication means or a failure of a computer of either system is also provided.

[0006]

However, as described above, in the case where the communication means for determining a failure portion is provided side by side,
Redundancy Since the communication means will also be duplicated for fault monitoring between computers, the amount of hardware required for communication for monitoring between the main computer and the slave computers will increase, and the mutual fault monitoring algorithm will increase. There was a problem of complication.

The present invention has been made to solve the above-mentioned conventional problems, and a mutual failure of a redundant computer system is achieved by a simple algorithm and a hardware configuration without lowering the reliability of the entire redundant computer system. An object is to provide a redundant computer failure monitoring method capable of realizing a monitoring function.

[0008]

SUMMARY OF THE INVENTION According to the present invention, a monitoring communication means for mutually notifying the state of a self-system computer to another system computer and a response signal to the transmission after transmitting the state of the self-system computer. In a redundant computer having means for monitoring the time until it is returned from the other system computer, in the redundant computer failure monitoring method in which the own system computer and the other system computer mutually monitor the occurrence of an abnormal state, The above problem is achieved by setting a monitoring time limit for the main computer that is shorter than that of the standby sub computer.

[0009]

In the present invention, when the signals from other computers are mutually time-monitored using the failure monitoring communication means, the main computer is set to have a monitoring time limit shorter than that of the slave computers. Therefore, when the failure monitoring communication means fails, the main computer side always has a timeout in the monitoring time.

As a result, by detecting this time-out, it is possible to detect that a failure has occurred in either the failure monitoring communication means or the slave computer, so that the main computer continues to operate. In the meantime, it becomes possible to take countermeasures against breakdowns. Therefore, it becomes possible to guarantee the reliable operation of the redundant computer system by the standby operation system by using the failure monitoring communication means of only one line.

[0011]

Embodiments of the present invention will now be described in detail with reference to the drawings.

FIG. 1 is a system configuration diagram showing a redundant computer to which an embodiment according to the present invention is applied.

The above-mentioned redundant computer system is basically A
It is composed of two independent computers of the system and the B system, and a console terminal and an external storage device shared by these computers. In the following description, the reference numeral A is used for the A-system computer and the reference numeral B is used for the B-system computer.

In the above system, the A-system computer (hereinafter simply referred to as the A-system) and the B-system computer (hereinafter simply referred to as the B-system) are each a central processing unit (CPU-A, CPU-).
B) 10A and 10B, and these central processing units 10A and 10B have high-speed local buses 12A and 12B.
Main memory device (MEM-A, MEM-B) 14 via B
A and 14B are respectively connected. Two line control devices (CCA1,
CCA2) 16A, 18A, and also on the B system local bus 12B, two line control devices (CCB1, CB)
CB2) 16B and 18B are respectively connected.

The line control devices 16A and 16B are connected via a changeover switch (SW1) 20 and can be switched to either one of them by an input from a console terminal 22 connected to the changeover switch 20. ing. The console terminal 22 is used by the operator to give commands to the system and display messages from the system.

The line control devices 18A and 18B are connected by a mutual monitoring line 24, and messages are exchanged between the A system and the B system for mutual failure monitoring via the line 24. It is possible. This mutual monitoring function will be described in detail later.

Input / output buses 26A and 26B are connected to the central processing units 10A and 10B, and various input / output control devices described below are connected to the input / output buses 26A and 26B. .

Reference numerals 28A and 28B denote system control devices (CTLA, CTLB) for turning on / off the power source of the partner system and controlling the changeover switch (SW1) 20 and the changeover switch (SW2) 36 described later. or,
Reference numerals 30A and 30B are SCSI bus control devices (HDCA, HDCB) which are standard buses for connecting an external storage device such as a magnetic disk. This SCSI bus is
It is shared by the control devices 30A and 30B, can be commonly accessed by the A system and the B system, and is connected to the magnetic disks (HDTA, HDTB) 32A, 32B, respectively.

The above two magnetic disks 32A and 32B
Are mirrored so that work can be continued even if one of them fails, and these two magnetic disks 32A,
32B basically stores the same contents.

In OS-A-1 and OS-A-2 of the magnetic disks 32A and 32B, files used by an OS (operating system) of system A are stored with the same contents. The files used by the B-system OS are stored in the OS-B-1 and OS-B-2 with the same contents. Further, in BATA1 and BATA2, data files used by the user in the A system or the B system are stored with the same contents.

The I / O buses 26A and 26B are provided with line control devices (CCA3 and CC) for controlling a plurality of lines, respectively.
B3) 34A, 34B are connected, and which of the line group from the line control device 34A and the line group from the line control device 34B is output to the outside is determined by a changeover switch (S).
It can be switched by W2) 36.

In the normal operation state, the line control unit on the operating main system computer (hereinafter, also simply referred to as the main system) is connected to the outside, and the standby system computer (hereinafter referred to as the standby system computer due to the failure of the main system). , Also referred to as a slave system) to take over the work of the master system, the switch control signal from the system controllers 28A and 28B is used to switch the switch 36 so that the line controller on the slave side is connected to the outside. Switching is performed.

In addition to the above-mentioned various devices, when a backup MT device or various communication devices are used as peripheral devices, input / output buses 26A and 26B of A system and B system, respectively.
It is also possible to connect the control device to the peripheral device and connect the peripheral device independently from the control device for each system, or to connect to the peripheral device via the switch.

Next, the failure monitoring processing procedure according to this embodiment will be described in detail with reference to the flowcharts of FIGS.

Normally, which of the A system and the B system is the main system is designated by means such as a flag stored in the auxiliary storage device by setting with a selection switch (not shown) or by user's setting. To be done.

In the main system, failure management processing is executed according to the flow shown in FIG. That is, first, in step 201, the message transmission interval T, the monitoring time limit TA for time monitoring, and the like are initialized. Also, the main business application program may be started here.

In the next step 202, a normal message indicating that the master system is normal is sent to the slave system through the mutual monitoring line 24.

Next, in step 203, a message is read from the slave. At this time, the time monitoring with TA seconds as the time limit is performed at the same time, and a correct message is read from the slave in the next determination step 204, or the message is not transmitted from the slave within the time limit TA seconds, and a timeout occurs. Determine if it has become.

If it is not determined in step 204 that the monitoring time has timed out, step 205
And waits for T seconds before returning to step 202.

On the contrary, if it is determined in step 204 that the time-out has occurred, it is determined that the slave system has failed, the power supply of the slave system is cut off, and the main system directly executes the work.

On the other hand, in the slave system, the failure monitoring process is executed according to the flow shown in FIG. That is, first, similarly to the case of the main system, the transmission interval T of the message, the monitoring time limit TB, etc. are set.

Next, in step 302, a message is read from the master system. At this time, the time monitoring with the time limit of TB seconds is simultaneously performed, and the normal message from the master is read in the next determination step 303, or the message is not transmitted from the master within the time limit TB seconds and the timeout occurs. It is determined whether or not.

If it is not determined in step 303 that the result of monitoring in step 302 is a time-out, the process proceeds to step 304, waits for T seconds, and then proceeds to step 305 to send a normal message to the main system. , Return to step 302.

On the contrary, if it is determined in step 303 that the time-out has occurred, the process proceeds to step 306, in which it is determined that the main system has failed and the main system is powered off.
Start the business application program on the subordinate side.

The business application program activated on the subordinate side is the magnetic disk 32A shown in FIG.
The checkpoint data stored in DATA-1 and DATA-2 of 32B is used to take over and execute the work. At the same time, at the same time, if necessary, the switches such as the changeover switches 20 and 36 are changed over to the slave side.

Conventionally, the time limit TA on the master system side and the time limit TB on the slave system side are set to be the same, and a time sufficiently longer than the transmission interval T of the message is set. Therefore, although the system operates properly in the case of a hardware failure such that one system cannot operate as a system, the mutual monitoring line 24 and the line control devices 18A, 1A that are communication units for mutual monitoring.
When 8B fails, there is a possibility that the other system will be judged as failed and the system will be switched even if it is not necessary to switch the system. Therefore, in such a case, as described above, an inquiry is made using the separately prepared mutual communication means, and it is determined whether it is a system failure or a monitoring communication means. Therefore, there is a problem that it is necessary to additionally have a communication means for inquiry and the algorithm becomes complicated.

In this embodiment, the monitoring time limits TA and TB are sufficiently longer than the message transmission interval T, and TA is sufficiently shorter than TB, that is, T <TA <TB (for example, T = 1, TA = 5, TB = 20). As a result, when the monitoring communication means fails, the master side always times out, and in that case, it is possible to disconnect the slave side from the power supply and continue the work of the master side. Becomes Of course, even when a failure occurs that makes one of the systems inoperable as a system, the failure can be detected by time-out and correct processing can be performed.

Next, a specific example of the operation of the system when the monitoring communication line fails will be described with reference to FIG.

In FIG. 4, in the normal operation state,
The master sends a normal message at a1 and the slave reads it at b1. The slave system waits for T seconds at the next b 2 and then sends a normal message to the master system at b 3. After that, the subordinate system enters the time monitoring state at the same time as waiting for reading a message from the master system at b4. When the master receives the normal message from the slave in a 2,
After waiting for T seconds at a3, a normal message is sent at a4.

Here, it is assumed that the mutual monitoring line fails and communication is disabled while waiting for T seconds at a3. In this case, the slave system is in the time monitoring state for waiting for a message from the master system, and at the same time, the master system is also in the time monitoring state for waiting for a message from the slave system in a5.

However, since the time limit of the master system is sufficiently shorter than that of the slave system, a timeout of a6 always occurs on the master system side. Therefore, at a7, the power of the slave system is turned off, and the business application can be continuously executed in the master system.

In addition to the operation sequence described above, a line failure can occur at any timing, but it can be similarly corrected. In addition, as the form of line failure,
There may be a case in which bidirectional communication is disabled and a case in which unidirectional communication is disabled. In either of these modes, the correct operation is possible.

In the above description, the case of a failure in which the time monitoring for the partner system times out is shown. However, when each system can detect its own failure and notify the partner system of the failure. In the normal message sending procedure in step 202 or step 305, the other system is notified that it is abnormal, and the same process as when the system receiving it is timed out to operate correctly as a system. It can be done easily.

According to the present embodiment described above, when the abnormality of the partner system is detected by the time-out, it is determined at the time of the abnormality detection whether the partner system has a failure or the monitoring communication means has a failure. Although it is not possible to distinguish between them, in such a case, first run the diagnostic program on the system that was determined to be abnormal, diagnose the failure point, and if both the main system and the slave system are normal, then monitor them. Since the failure location can be determined by running the program for diagnosing the service line, it is possible to accurately identify the failure location as a result.

Therefore, according to this embodiment, it is possible to construct a highly reliable redundant computing system with a single communication line for mutual monitoring and a simple hardware configuration and processing procedure.

Although the present invention has been specifically described above, the present invention is not limited to the above-described embodiments, and various modifications can be made without departing from the scope of the invention.

For example, the specific system configuration of the redundant computer is not limited to that shown in the above embodiment.

[0048]

As described above, according to the present invention, a simple algorithm and hardware configuration can be used without deteriorating the reliability of the entire redundant computer system.
The mutual failure monitoring function of the redundant system can be realized.

[Brief description of drawings]

FIG. 1 is a system configuration diagram showing a redundant computer to which an embodiment according to the present invention is applied.

FIG. 2 is a flow chart for explaining the operation of the above embodiment.

FIG. 3 is another flowchart for explaining the operation of the above embodiment.

FIG. 4 is an explanatory diagram showing an operation example of the system when the monitoring communication line fails.

[Explanation of symbols]

 10A, 10B ... Central processing unit 12A, 12B ... Local bus 14A, 14B ... Main storage device 16A, 16B, 18A, 18B ... Line control device 20 ... Changeover switch 22 ... Console terminal 24 ... Mutual monitoring line 26A, 26B ... Output bus 28A, 28B ... System control device 30A, 30B ... SCSI control device 32A, 32B ... Magnetic disk 34A, 34B ... Line control device 36 ... Changeover switch

Claims (1)

[Claims] 1. A monitoring communication means for notifying the status of an own system computer to another system computer and a status of the own system computer, and then a response signal to the transmission is returned from the other system computer. In a redundant computer that has a means to monitor the time until arrival, in the redundant computer failure monitoring method in which the own computer and the other computer mutually monitor the occurrence of an abnormal state, the standby computer waits for the operating main computer. A redundant computer fault monitoring method characterized by setting a monitoring time limit shorter than that of a subordinate computer.