JP2000353087A - Computer system having operation scenario developing environment of high available system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a developing tool which can easily generate the desired operation scenario of a distributed system without an error by generating the parts of the scenario through the use of a parts editor and holding the generated parts in a scenario parts library. SOLUTION: A parts editor 3 constituting a scenario developing environment 1 generates parts constituting a scenario by using a graphical user interface(GUI) and registers them in a parts library for HA system 5. A constitution editor 7 compiles an element depending on the constitution of a system and the operation of the system and generates a scenario constitution file 9. A parameter item editor 11 designs the setting items of a parameter depending on the system which is actually operated and designs keys to be operated actually in the system and items to be monitored. A compiler 13 converts a scenario constitution file generated in GUI into a scenario template.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a distributed system,
More particularly, the present invention relates to a development environment for an operation scenario of a high availability system in which a plurality of server computers cooperate to perform processing, and even if a failure occurs in any one of the server computers, another server computer can take over the processing.

[0002]

2. Description of the Related Art High availability computer systems (hereinafter referred to as HA (High
Availability) system), a plurality of server computers that provide services to other client computers are linked by a network, and even if a failure occurs in any one of the server computers, other server computers By taking over the service, the system as a whole is designed to minimize the interruption of the service as much as possible.

To realize such a high-availability system, in addition to the design items of a general system such as a server computer, the number of devices to be used, and a software configuration,
You must decide how to take over the service in the event of a failure.

A simple method of realizing a conventional HA system is that a fixed hardware configuration and a fixed service takeover procedure for a failure are prepared and used. In general, since it is necessary to flexibly cope with various system forms, a service takeover procedure at the time of a failure has often been described in a script language.

[0005]

The HA system is a system in which reliability is most important. Therefore, if the intended service takeover is not performed or a new malfunction is caused due to a design error due to an actual failure, the HA system is meaningless.

However, in the prior art in which the system designer describes the operation of the system in a script language each time, a large number of work steps are required to create the system, and there is a high possibility that a description error is mixed.

An object of the present invention has been made in view of the above circumstances, and it is an object of the present invention to provide a tool for developing an operation scenario of a distributed system, which can easily create a desired operation scenario of the distributed system without error. .

[0008]

SUMMARY OF THE INVENTION The present invention provides an operation scenario development environment for a high availability system for developing the behavior of a high availability system in which a plurality of server computers cooperate to perform processing as a scenario described in a script language. A computer system having a component editor for creating components of the scenario, a scenario component library for holding a component group created by the component editor, a configuration editor for defining a configuration of the high availability system, A scenario configuration file for a high availability system that holds a definition related to a system configuration in a scenario, a parameter item editor that defines items to be set by a user in a real system, and the scenario configuration file for a high availability system is described in a scenario description language. Scenario template Characterized by comprising a compiler to convert the bets, the.

The present invention can be used for high-availability computer systems of various configurations by creating scenario components using a component editor and storing the created components in a scenario component library. The configuration editor can be used to define the system configuration of the scenario.
Therefore, if you create a configuration file for a configuration,
It can be easily used to create scenarios with different configurations. Further, by using the parameter item editor, it is possible to completely define all necessary items using the system configuration definition held in the HA system scenario configuration file. Further, the compiler converts the information created by the GUI into a scenario template. If there is an inappropriate part during the conversion, it will be indicated by a message. If there is an inappropriate portion during the conversion, an error portion is displayed by a message, so that the error can be easily detected. Further, since the simulation of the scenario can be executed by the simulator and the operation can be confirmed, the created scenario can be verified without the real system.

Further, the present invention relates to a computer system having a high availability system operation scenario development environment for developing a behavior of a high availability system in which a plurality of server computers cooperate to perform processing as a scenario described in a script language. A configuration editor for defining a configuration of a high availability system, a parameter item editor for defining items to be set by a user in a real system, controlling the configuration editor, generating a scenario configuration file and controlling the parameter item editor And a scenario template automatic generation control unit for defining information on system-specific parameters for the scenario configuration file.

According to the present invention, a scenario template can be automatically generated from a defined requirement specification by creating a component library that can support various high availability computer systems.

[0012]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a system block diagram showing an operation scenario development environment of a distributed system according to the present invention and its periphery. In FIG. 1, a scenario development environment 1 includes a component editor 3, a component library 5 for an HA system, a configuration editor 7, a scenario configuration file 9 for an HA system, a parameter item editor 11, a compiler 13, and a simulator 15.

The component editor The component editor 3 creates components constituting a scenario using a graphical user interface (GUI) and registers the components in an HA system component library 5 (hereinafter sometimes simply referred to as a library). The HA system component library 5 is composed of (1) a tree structure expressing the namespace of the created components and (2) components placed in the namespace.

The components created by the component editor 3 are components (functions) constituting the logic of the scenario template, and a hierarchical namespace (library) for registering the components. Parts library for HA system parts 5
By registering the part, a name is given to the part. HA
There are three types of basic components constituting the components registered in the system component library 5, a primitive component, a Structure component, and a reference component. The parts to be registered in the HA system parts library 5 are created by connecting the parts constituting the parts and by structuring a hierarchy using Structure parts. By connecting the parts with wires,
The association between the connected components is performed. The wire connections are
This is done by connecting the ports on the component. Port attributes include direction, data type, and name.

A primitive component is a component registered in the HA system component library 5 in advance, and is a minimum unit component that cannot be further disassembled. There are, for example, 14 types of primitive parts, each of which has a defined function.
By connecting a plurality of primitive parts, a part having a desired function can be created. Structure parts
This is a component for constructing components hierarchically. Structure
A part can have other parts inside it. plural
The same part can be placed on the Structure part. Struc
When a part is placed on the ture part, the placed part is a hard link, and even if the name of the part is changed, the placed part does not change. The outer part and the inner part of the Structure part can be connected via the port of the Structure part. In the initial state of the Structure part, there are no ports, and all ports are added by the user.

The reference component is a component for referencing an entity from the component. References to entities are symbolic links, and reference parts are:
Contains the name of the referenced entity. The entity is
This represents the actual state of the objects that make up the scenario template, and is created by the entity editor.
In the case of making a complex part, first, a part having a simple function of constituting the part can be created and registered in a library, and a complex part can be created and registered in the library using them.

Parts are primitive GUs prepared in advance.
Created by combining I parts. Primitive GUI parts are
It is defined as a part that cannot be further divided.

FIG. 2 shows a GUI screen 17 of the component editor 1. The GUI screen 17 includes a design screen display unit 19 and a menu screen display unit 21. In the menu screen display unit 21, a primitive component group, AND, OR, a component for notifying a server status change, BRANCH, and the like are registered in advance. When the operator selects any of the above components and clicks with, for example, a mouse, the selected component is displayed on the design screen display unit 19. The operator can move the selected part to an arbitrary position on the design screen display unit 19 by dragging the selected part with a mouse. In the example shown in FIG. 2, AND and OR are selected as primitive components, and AND output and O
An example of components connected to one input of R is shown. The components are associated with each other by connecting ports as shown in FIG. A port has a direction, and there are IN (input) 23 and OUT (output) 25 in the direction. The connection between the ports is possible only between the OUT port and the IN port. The port has a data type and the data type is bool
(FIG. 3 (d)), read (FIG. 3 (b)), write (FIG. 3
(C)) and event (FIG. 3 (a)). bool is true,
Take a fake value. read takes a string value. write takes a string value. event has no value. Connection between ports is possible only between ports of the same data type.

The possibility of branching indicates that a plurality of wires can be connected to a port. When branching is possible, zero or more wires can be connected. The fact that no connection is made indicates a state where no connection is made. If not, always connect one to the port. read line is out
It is possible to branch from to in. (The out port of read can branch.) This indicates that any person can read. The read in port is not branchable.

The bool line can branch from out to in. (The out port of the bool can branch.) This indicates that anyone can read the data. bool
The in port is not branchable.

The write line can branch from in to out. (The in port of write can be branched.) This indicates that anyone can write. write
Out port is not branchable.

The event line can be bidirectionally branched. That is, it does not know whether or not there is a partner in both directions. If there are multiple receivers, the event is broadcast. For example, memory packages include read out and w
There are rite in as ports, and both of these ports can branch from the above definition.

An event represents some kind of context. In particular, the order of operation is defined by events. That is, a part operates after receiving an event. Some components output an event after completing the operation. Coherency is always preserved for read and write. In other words, writ which has
The order of e and read effects is guaranteed. Where write and
The read order relation means that the order is determined by the event. Regarding the ordering by events, only the transition rule in a strong sense is established. That is, A
→ B, A → C, C → D, then A → D, but B → D
Is not always the case. That is, the connection of the event lines does not represent a continuation of the context. In particular, when a reference is crossed over a context, and when it crosses a delay of a primitive part, the context is interrupted there.

The event shown in FIG. 3A outputs an event to O after the execution of the part A, and the part B becomes executable. A is executed before B. FIG. 3 (b)
Read reads a value (arbitrary character string) from I when component B is executed. Further, write shown in FIG. 3C writes a value (arbitrary character string) from O when the component A is executed.
Further, the bool shown in FIG.
Read value (true or false) from.

FIGS. 4 and 5 show primitive parts registered in the library in advance. FIG. 4A shows “Li
teral "component, and outputs a constant to O. FIG. 4 (b)
Is a "memory" part, which stores when I is input,
Output the memory to O. FIG. 4 (c) shows a "compare" component. When A and B are equal, Q is true, and when they are not equal, Q is false. FIG. 4D shows a “selector” component, which outputs A to O when C is true, and outputs B to O when C is false. FIG. 4E shows a “not” part.
When C is true, Q becomes false, and when C is false, Q becomes true. FIG. 4 (f) shows an "AND" component, where Q is false when C or D is false, and Q is true when C and D are true. FIG. 4 (g) shows an "OR" component, where Q is true when C or D is true, and Q is false when C and D are false. FIG. 4H shows an “assign” component, which outputs A to S when K is input. After that, F is output. FIG.
(I) is a "branch" part, and when K is input,
If C is true, output F. FIG. 4 (j) shows a "notify" component, which outputs F when the value obtained by A changes. FIG. 4K shows a “Delay” component, which delays the input of K and outputs it to F. FIG. 4 (l) shows “DomainState”
It is a component and outputs an event to F when the state of the context changes. Output the context status to O. FIG. 5A shows a “Timer” component.
When C is false when is input, a timer is started, and an event is output to F when a timeout occurs. If K is input by the time the timer starts and time out, and if C is true, the timer is canceled and an event is output to E when it is completed. A represents a timeout value. FIG. 5B shows “proces
s "part, start the process when K is input,
If successful, an event is output to F; if unsuccessful, an event is output to E. A1 is the current directory, A2 is the end code, B0 is the executable file path,
B1 to B16 each represent an argument.

An entity in the scenario configuration file can be referred to by the reference component. A reference is a symbolic link (reference by name) to an entity in the scenario configuration file. The function of the reference component is determined by (the component indicated by) the reference destination. That is, in the example illustrated in FIG. 6, the service 1 includes three servers, and the reference component is associated with the process processing of the server 3. Therefore, the function of the reference component in this case is to execute the process. If you want to change the context executed in the part, use a reference part. The context is each server constituting the distributed system or a global context. A global context exists across all servers. The context to be executed is not considered when creating the component. Since the context is specified for the entity in the scenario configuration file, the reference is used to change the context in the component.

FIGS. 7 and 8 show reference components. There are the following eight types of reference parts.

[0029] 1. Reference parts 2. AbsoluteReference parts 3. ButtonReference component 4. ButtonAbsoluteReference part5. MonitorReference parts 6. 6. MonitorAbsoluteReference part 7. ConstantReference parts ConstantAbsoluteReference component The Reference component is a general-purpose reference having a relative path to an entity, as shown in FIG. The relative path is a relative path from the directory where the entity indicating the component where the reference component is located is located. In the initial state, the reference component has no port, and a port must be created in accordance with the port configuration of the component indicated by the reference destination entity.

The AbsoluteReference component is a general-purpose reference component having an absolute path to an entity, as shown in FIG. The absolute path is the path from the root of the directory. AbsoluteReference parts are
In the initial state, no port exists, and a port must be created in accordance with the port configuration of the component indicated by the referenced entity.

The ButtonReference is a reference dedicated to the Button entity, and refers to the Button entity by a relative path. The ButtonReference port is fixed, and has a port configuration as shown in FIG. The port configuration shown in FIG. 8A outputs an event to E when a button is pressed with the operation tool.

The ButtonAbsoluteReference is a reference dedicated to the Button entity, and refers to the Button entity by an absolute path. ButtonAbsoluteRefere
The nce port is fixed, and has a port configuration as shown in FIG.

The MonitorReference is a reference dedicated to the Monitor entity, and refers to the Monitor entity by a relative path. The port of MonitorReference is fixed, and has a port configuration as shown in FIG. The port configuration shown in FIG. 8B displays the value obtained by I on the operation tool.

The ConstantReference is a reference dedicated to the Constant entity, and refers to the Constant entity by a relative path. The port of the ConstantReference is fixed, and has a port configuration as shown in FIG. In the port configuration shown in FIG. 8C, a constant is output to O.

ConstantAbsoluteReference is Constant
This is an entity-specific reference, and refers to the Constant entity with an absolute path. ConstantAbsolu
The port of teReference is fixed, and has a port configuration as shown in FIG.

Structure components are components for constructing components hierarchically. Structure parts can have parts in them. Parts outside the Structure part and Str
The components in the structure are connected via the ports of the structure component. Fig. 9
As shown in (a), the inner and outer ports are divided, and the directions of the inner and outer ports are opposite. That is, port A is an IN port when viewed from the outside, and is an OUT port when viewed from the inside.
Port. Port B is OU when viewed from the outside.
It is a T port and an IN port when viewed from the inside.

The event type port can branch both IN and OUT. Fig. 9 for Structure part port
As shown in (b), the connection to the outside and the connection to the inside can be branched.

The read type and bool type ports can branch from OUT to IN, but not from IN to OUT. Fig. 9 for Structure part port
As shown in (c), the outer OUT and the inner OUT can branch, and the outer IN and the inner IN cannot branch.

A write-type port can branch from IN to OUT, but cannot branch from OUT to IN. In the case of a port of a Structure part, as shown in FIG. 9D, the outer IN and the inner IN can branch, and the outer OUT and the inner OUT cannot branch.

Atomic attributes can be specified for Structure components. The atomic attribute is an attribute that affects the order of execution of components. When an atomic attribute is specified for a Structure component, the Structure component is executed atomically like one primitive component. In other words, when an event is input to a Structure component having an atomic attribute specified, a plurality of components inside the Structure component are executed, and finally, when the event is output from the Structure component, the event is input and then output. Until then, components outside the Structure component are not executed.
As an example, the parts A, B, C, X,
Consider the execution order of Y and Z. Assume that all connections between components in the figure are events.

In FIG. 10A, the execution order is A → B →
C and X → Y → Z. This connection defines only the execution order of the A, B, and C values and the execution order between X, Y, and Z. The execution order between the components A, B, and C and the components X, Y, and Z is not specified. That is, A → B → C →
Like the sequence of X → Y → Z, the sequence of X, Y, Z may be executed after the sequence of A, B, C ends, or the sequence of A → X →
A, B, C columns and X, Y, Z, such as B → Y → C → Z
May be mixed and executed.

In FIG. 10B, A, B, and C are included in Structure S2 in which the atomic attribute is specified. In this case, the sequence of execution of A → B → C is not decomposed, so that A
As in the case of → X → B → Y → C → Z, execution of another component does not enter during the execution of A, B and C.

Further, as shown in FIG. 11, Structures having an atomic attribute may have a nested structure. In this case, the sequence of execution of the components in Structure S2 is not decomposed, and the sequence of execution of the components in Structure S1 is not decomposed.

A structure having an atomic attribute must satisfy the following conditions.

(1) An atomic structure must not have two event IN ports.

(2) A logic component in an atomic structure must not be referenced from outside the atomic structure. In other words, Stru with atomic attribute
If there is a reference in the cture and the component pointed to by the reference contains a logic component, the entity specified atomic
Must not be referenced outside of Structure. Logic components are Assign, Branch, Notify, Delay, Time
r, each primitive part of Process.

Also, even when the above-mentioned entity is a Button, it must not be referenced from outside the Structure that has been specified atomically.

In the example shown in FIG.
Is an atomically designated Structure, and Assign1 which is a logic component exists before following Reference 1 in the Structure. Structur containing its Assign1
Entity3 that points to e3 does not satisfy the condition because it is referenced from Reference3 outside the Atomic Structure.

(3) Parts in an atomic structure must be in the same context. That is, all parts and entities in an atomic Structure must belong to the same context. If a reference exists in an atomic structure, all components following the reference must belong to the same context.

In the example of FIG. 12B, the Atomic Structure
Is an atomically designated Structure, and its context is cpu1. Following Reference1 in Atomic Structure1, Entity with cpu2 which is a different context from cpu1
The condition is not satisfied because 3 exists.

(4) There must be no event loop in the atomic structure. The event loop includes the case where the event is performed via the reference.

Configuration Editor The scenario configuration file created by the configuration editor 7 represents (1) the name of the scenario parts library corresponding to the scenario configuration file 9 and (2) the system configuration.
It is composed of elements of a tree-structured namespace. By copying the tree structure of the name space with the GUI, the system configuration can be easily changed. For example, as shown in FIG. 13, server3 of a scenario for a distributed system composed of three servers.
Can be easily copied to server4 to create a scenario for a distributed system consisting of four servers.

The configuration editor 7 is an editor for editing an element depending on the configuration of the system and the operation of the system. The configuration editor 7 is an entity representing the entity of the object constituting the scenario template, and a hierarchical namespace (directory) for registering the entity. Create The structure of the namespace of the directory expresses the configuration of the scenario template (the number of servers, the number of services, the number of processes in service, and the like).

One directory is associated with one library. The entity registered in the directory has a symbolic link to the component in the library (the name of the component in the library) associated with the entity. Therefore, when the library corresponding to the directory is replaced, the component indicated by the entity becomes different, and has another function.

There are four types of entities: a component entity, a constant entity, a button entity, and a monitor entity.

The component entity has one symbolic link (name in the library) to the component in the library associated with the directory in which the component is registered. A component entity is an entity of an object constituting a scenario template, and its function is determined by a component indicated by the component. A plurality of component entities may have symbolic links to the same component, in which case those component entities have the same function but are different entities.

The functions of the constant entity, button entity, and monitor entity are determined only by the entities, and do not correspond to components.

A constant entity is an entity of a constant. The value of the constant can be set in the configuration editor or
Use the value set in the system scenario configuration file. To use the value set in the HA system scenario configuration file, use the parameter item editor
The constant entity is associated with the setting items in the HA system scenario configuration file. If you want to reference a constant entity from the library, use Cosnta
Use ntReference or ConstantAbsoluteReference.

The button entity corresponds to a button of the operation management tool. In order to display the button corresponding to the button entity on the operation management tool, the button item is associated with the definition of the button in the HA system scenario configuration file using the parameter item editor. When referencing the button entity from the library, use the ButtonReference and ButtonAbsoluteReference references.

The monitor entity corresponds to the state variable display label of the operation management tool. In order to display the state variable display label corresponding to the monitor entity on the operation management tool, the monitor entity is associated with the display level definition in the HA system scenario configuration file using the parameter item editor. If you want to reference the monitor entity from the library, use MonitoReferenc
e, Use each reference of MonitorAbsoluteReference.

A context is specified for an entity. The contexts are cpu1, cpu2, cpu3,
Either cpu4 or global, and represents the context in which the entity is executed. cpu1 to cpu4 are local contexts of each server,
global is the synchronization context. The correspondence between cpu1 to cpu4 and the actual server is performed by the parameter item editor.

In the library, the context in which the component is executed is not specified. In order for the connection between the components to cross the context, it is necessary to use at least one of the components as a reference and appropriately specify the context of the entity referred to by the reference.

The subtree of the namespace can be stored in a file and used in another scenario configuration file. Also,
It has a function to automatically generate the name of the entity referenced by the reference in the library file associated with the scenario configuration file. This makes it possible to omit creation of necessary entities.

Parameter Item Editor The parameter item editor 11 designs the setting items of the parameters depending on the system to be actually operated and the buttons to be operated in the system to be actually operated and the items to be monitored. These designs are performed using a slot method. For details of the slot system, see Japanese Patent Application No.
307131.

The setting items are specified by the following paths.

Type / target / name Type / target / property name / item Type / target / connection name / server / item In the above path, “target” indicates the type of device used in the system (for example, server, disk, LAN, etc.). “Type” designates, for example, the name of a server or a disk. "Name" represents the name of the row. For example, if "name" is described as "name", it indicates that the line is a line representing a name. If "property" is described, it indicates that the line is an attribute line. For the “property name”, for example, if the type of device is LAN, the IP address name is described, and the “item” describes the actual IP address. The “connection name” indicates an attribute determined by the server and the device. Therefore, connection / server /
The item indicates, for example, an IP address connected to a certain server on a certain LAN.

The path of the setting item is created by using a GUI tool. The configuration data in the configuration file 9 corresponding to the setting item is designated and linked. (The entity specifies the path of the target configuration data in the GUI.) The type of configuration data to be displayed at the time of designation is associated with a constant entity. (Error check / display) Setting attributes are specified as type (character string, numeric value, etc.), default value, setting type (display only, required item, etc.), input type (character input / Item selection), range specification (when characters are input) (for example, when a numerical value is input, the range of numerical values is limited), and specification of a selection item (when an item is selected).

The operation information is specified by the following path.

Type / Target / Connection / Server / Item Type / Target / Connection / Server / Item The type in this case is “monitor” or “button”. These operation information paths are created using a GUI tool. The link of the operation information specifies and links the configuration data corresponding to the operation information. The entity specifies the path of the target configuration data in the GUI.

Monitor-Monitor / Configuration Data Button-Button / Configuration Data The data created by this tool is passed to the compiler 13 to create slots and frames for the control scenario of the distributed object.

Since the path of the configuration data is determined in advance, the type, target, item, and server can be automatically generated from the configuration data path (according to the slot file description rules). Also, a path for setting item / operation information can be automatically created from the constant, monitor, and button of the configuration data arranged according to a predetermined rule, and the target configuration data can be linked.

The following is an example of creating a library and a directory. As an example, a service start process part of a two-unit scenario is created.

Here, the service start processing for two systems is created as one component (SevericeStart2Cpu). This component activates a service when a service start button is pressed for a service. FIG. 14 shows the top-level structure of the service start component to be created.

When the service start button (Start Button) is pressed, Start Check is executed. In the Start Check, the processes that make up the service are started, and if the start is successful, the Complete Action is executed. If the start is failed, the Fail Action is executed.

Next, details of each component of the service start component are created.

Start Button The Start Button corresponds to the start button on the operation tool for both cpu1 and cpu2, and is therefore a Button reference indicating a Button entity. The context in which the Start Button is executed must be a local context. The context is specified by the entity.

Start Check A Start Check for cpu1 can be created as shown in FIG. First, when an event is input to Start Check, an event is input to the primitive component Branch. The primitive component branch checks the service state (GROUP_STATE (cpu1)) of the own server, and outputs an event if the service state is the built-in state (IN). Check Another Server's State checks whether the service is running on another server and outputs an event if it is not running on another server. Check GROUP_S
This is done by checking the value of TATE (cpu2). Check Another Se
A detailed description of the structure of rver's state is omitted. The primitive part Assign assigns START to GROUP STATE (cpu1). c
The same applies to the structure of Start Check for pu2. The difference from cpu1 is that GROUP STATE (cpu1) becomes GROUP_STATE (cpu2) and GROUP_STATE (cpu2) becomes GROUP_STATE (cpu1).

Here, GROUP_STATE (cpu1) and GROUP_STATE
(cpu2) is used in both Start Check (cpu1) and StartCheck (cpu2). GROUP_STATE (cpu1) and GROUP_STATE
(cpu2) is used as a reference because each entity must be 1. The part (GroupState) indicated by the reference destination entity of the GROUP STATE can be created using the primitive part Memory as shown in FIG. GroupState uses Monitor references for display. Start C
Although heck can be registered in the library with a name, here, as an unnamed Structure, Service
Put directly in Start2Cpu part. Check An in Start Check
other Server's State is also an unnamed Structure and S
Place directly during tart check. The contexts of all components during Start Check need to be synchronous contexts.

Execute Processes Execute Processes is a component that executes a plurality of processes. Since the number of processes to be executed differs depending on the scenario, it is desirable that an arbitrary number of processes can be executed by combining parts. Here is one eventIN
Prepare two parts with ports and two eventOUT ports. (See Fig. 17) The output port complete outputs an event when the process is successfully started, and fail outputs this type of component
I will call it cedure.

(A) OneProcessProcedure is a component that executes one process, and internally executes a primitive component Process. Input to Process is the path of executable file (Pa
th) can be specified, and the current directory is "/",
Other inputs are fixed at 0. Path is a Constant reference so that it can be specified.

(B) TwoProcduresProcedure consists of two P
Parts that execute rocedure. OnePro for P1 and P2
Put cessProcedure or TwoProceduresProcedure. By taking a recursive structure, any number of processes can be performed. P1 and P2 are two types of Proc
Set to Reference so that edure can be specified. OnePro
Since cessProcedure and TwoProceduresProcedure can be used for general purposes, register them in the library. Execute Proces
ses is a Reference so that two types of Procedures can be specified. The context in which Execute Processes is executed must be a local context.

Complete Action, Fail Action As shown in FIG. 18 and FIG.
Fail Action simply assigns a state to GROUP_STATE. The GROUP_STATE in the figure needs to refer to the same entity as that in the Start Check, so it is used as a reference.
Complete Action and Fail Action are unnamed Struct
ure and put directly on ServiceStart2Cpu. Complete Action
The context in which the Fail Action is executed must be a synchronization context.

StartCheck is for cpu1 and cpu2, and both are executed in a synchronous context. Also, Start Ch
eck (cpu1) and Start Check (cpu2) are both GROUP_STAT
Refer to E and assign to GROUP_STATE.

Start Check (cpu1) and Start Check (cpu2)
FIG. 20 illustrates the GROUP_STATE relationship so that it can be easily understood. (A), (B), (C),
Consider the execution order of (X), (Y), and (Z). Regarding the execution order of these components, the order of (A) → (B) → (C) and the order of (X) → (Y) → (Z) are defined by the connection relation of the event lines. Only.
As a whole, for example, (A) → (B) → (X) →
There is a possibility that the order is (Y) → (C) → (Z). In this case, if the values of the two GROUP STATEs are both IN, both (c) and (Z) are executed, and the same service is started in both cpu1 and cpu2. In such a case, it is necessary to specify Start Check Structure atomically so that the execution sequence of parts in the Structure cannot be decomposed. By specifying both Start Checks atomically, the execution order is ((A) → (B) →
(c)) → ((x) → (y) → (z)). In this case, the values of both GROUP STATEs are I
If N, both (c) and (z) will be executed, and the same service will be started on both cpu1 and cpu2. In such a case, it is necessary to specify Start Check Structure atomically so that the execution sequence of parts in the Structure cannot be decomposed. By specifying both Start Checks atomically, the execution order is ((A) → (B))
→ (C)) → ((X) → (Y) → (Z)) or
((X) → (Y) → (Z)) → ((A) → (B) →
(C)), and the same service is not executed on both servers.

Among the created components (functions), the following four should be registered in the library.

I. ServiceStart2Cpu II. OneProcessProcedure III. TwoProceduresProcedure IV. GroupState I and IV are parts related to service, and II and III are parts for process execution. Therefore, as shown in FIG. Divide into service and procedure. Furthermore, since I is a logic component and IV is a variable that represents a state, the area under service is divided into logic and state. Also, I is for 2 systems only, so put it under 2cpu.

The references used are as follows:

A) Start Button B) GROUP_STATE C) GROUP_STATE Monitor D) Execute Processes E) P1, P2 F) For Path reference, whether the path indicating the entity is a relative path or an absolute path, and the path name Must be determined, but these must be considered in conjunction with the structure of the entity.

In general, the creator of the library is different from the creator of the directory. The creator of the library must determine the reference destination path of the reference used in the part. To do so, you must also consider the directory structure. If the directory creator selects a library and determines the functions required for the scenario, most of the directory structure is naturally determined, so that the scenario can be created relatively easily.

The entities to be registered in the directory correspond to the following parts.

(A) ServiceStart2Cpu (A) Start Button (C) GROUP_STATE (D) GROUP_STATE Monitor (E) Execute Processes (F) P1, P2 (G) Path Create on a directory. In this example, the service is 1
Create a directory for two cases.

(A) ServiceStart2Cpu Since an entity corresponding to ServiceStart2Cpu is required for each service, SERVIC under root as shown in FIG.
Create a directory called E1 and create it under the name start. Entity start is part / service /
Refers to logic / 2cpu / start. The context specifies global.

(B) Start Button / service / logic / 2cpu / start includes two Button references (Start Button (cpu1) and Start Button (cpu2)). Since Button entities corresponding to these are required for each server, they have a directory structure as shown in FIG.

That is, Start Button (cpu1), ./cpu1/B
UTTON / START OP, ./CPU2/BUTTON/START OP Specify these paths as relative paths so that they do not depend on the service (reference type is ButtonReferenc
e). The relative path is a relative path from the directory where the entity indicating the component where the reference exists is located. In this example, / service / logic / 2cpu / star
Since the reference that specifies the relative path is used in t, the directory where the start entity is located / SE
This is a relative path from RVICE1.

The context of the Button entity specifies a local context.

(C) GROUP_STATE Although a plurality of GROUP_STATE references are used,
Since everything is in the / service / logic / 2cpu / start part, it can be specified with a relative path (reference type is Reference).

The directory structure is as shown in FIG. That is, GROUP_STATE (cpu1) reference and GROUP
The reference path of the _STATE (cpu2) reference is ./
STATE / CPU1 / GROUP_STATE and ./STATE/CPU2/GROUP STATE. These entities are parts / service / state / gro
Indicates upState. The context specifies global.

(D) GROUP_STATE Monitor component / service / state / groupState contains Mon for status display.
There is an itor reference. The reference path of the Monitor reference for status display is a relative path, ./GROUP_STAT
As E_MONITOR, the reference type is MonitorRe
ference. The directory structure is as shown in FIG.

(E) Execute Processes The Execute Processes reference is / service / logic / 2c
It is used in the pu / start part, and the reference destination can be indicated by a relative path. (The reference type is Referenc
e). The directory structure is as shown in FIG.
That is, Execute Processes (cpu1) reference and E
The reference path of the xecute Processes (cpu2) reference is
./CPU1/PROCESS/START/PROCEDURE and ./CPU2/PRO respectively
CESS / START / PROCEDURE. The parts pointed to by these entities are determined by how many processes are started. Here we decide to run two processes, / p
Refers to rocedure / twoProceduresProcedure. The context of the process execution is the local context.

(F) (P1, P2) The / procedure / twoProceduresProcedure part has two references. Recursively in those references
Make the / procedure / twoProceduresProcedure part applicable. Therefore, the directory structure is as shown in FIG. That is, the type of reference is Referenc
e, and the reference destination paths are ./P1/PROCEDURE and ./P2/PROCEDURE, respectively. In addition, those entities are parts that execute one process / procedure / onePr
Points to ocessProcedure. If you want to run more than two processes, instead of procedure / oneProcessProcedure,
You can also point it to / procedure / twoProcessProcedure.

(G) Path / procedure / oneProcessProcedure component has a reference for giving a path name of a process execution file. This reference, as shown in FIG.
Reference, and the path of the referenced Constant entity is ./PATH.

With the above, the creation of the part related to the service start of the directory is completed. After creating the directory, the scenario creator must associate the Monitor entity, Button entity, and Constant entity in the directory with the status display label, operation button, and setting value items on the slot file. The association is performed with the parameter item editor.

The HA system scenario configuration created by the configuration editor 7 in this manner is stored in the HA system scenario configuration file 9. This is executed, for example, by selecting the "save" command displayed on the menu screen.

Compiler As shown in FIG. 29, the compiler 13 converts a scenario configuration file created by the GUI into a scenario template. The compiler 13 has an internal representation conversion unit 29 that converts information of the scenario configuration file into an internal representation 27 of the compiler. That is, since the library 5 and the scenario configuration file 9 are linked, the compiler 13 follows the link and creates the connection of the parts as a graph structure inside the compiler. The compiler 13 has primitive component information 31 as information for converting primitive components on the GUI into a scenario description language. Further, it has a conversion unit 33 for converting a scenario description from an internal representation and primitive component information into a scenario description. The scenario description conversion unit 33 has a logic generation unit 35, and generates a scenario template logic unit 41. The logic generation unit includes an error check unit 37. The scenario description conversion unit 33 has a symbol information generation unit 39 and generates symbol information of the scenario template. The symbol information has GUI code correspondence information 45, and expresses correspondence information between primitive parts on the GUI and descriptions in the scenario template. The symbol information has component position information 47 and expresses detailed information on the position of the primitive component on the GUI.

The compiler 13 has the following check functions.

(I) Check related to library (i-1) Structure There is a part in the part itself.

If the named component has a hierarchical structure using Structure, and if itself appears anywhere in the hierarchical structure, it is an error. It is considered an error if itself appears anywhere in the layered structure. In the example of FIG. 30, / tools / function1 is stored in / tools / function2 located in the structure named / tools / function1.
It is an error because it is located.

(I-2) Reference There is no reference destination entity.

The reference from the reference to the entity is a symbolic link (reference by name), and the reference can be created without the referenced entity. An error will occur if the referenced entity does not exist.

Inconsistency between the port of the reference and the port of the part for the entity of the reference destination (a) When the reference destination entity is a part entity The data types, directions, and names of all the ports of the reference point to the entity of the reference destination Port of parts must match.

(B) The reference destination entity is Co
For nstant, Button, Monitor ConstantReference, Constant as a reference for each entity of Constant, Button, Monitor
AbsoluteReference is provided. In these references, the ports required for the corresponding entity are fixed in advance, so that it is not necessary to add or delete ports.

Reference, Ab, which are general-purpose references
When soluteReference is used for these entities, the ports are configured as ConstantReference, ButtonReference, MonitorR as shown in Figure 31.
Must be similar to eference.

Reference Reference Group As shown in FIG.
If there is a structure that returns from the reference in the part for the entity to the entity and the reference from the reference to the entity in the part for the entity, and returns to the original entity, it is an error.

(Ii) Checking Port Connections (ii-1) event A connection between event ports where event ports are connected between different local contexts is permitted in the following (a) or (b): Is the case.

(A) Connection within the same context (b) Connection between local context and global context ・ There is an event loop that does not pass through Delay.

When an event is input and a component for outputting the event is connected to form a loop, a primitive component must be used. If the event loops without using Delay, it is an error. The example shown in FIG. 33 results in an error. (It is assumed that all of A, B,... C are not delays.) FIG. 34 is obtained by adding delays to FIG.

(Ii-2) read The read port is connected between different contexts.

Only connections within the same context are permitted for connections between read ports.

The readIN port must be connected to one port because it cannot branch.

A loop was detected by expanding the input value of the readIN port.

If there is a loop structure that returns to the original part when the readIN port is traced in the opposite direction, it is determined that an error has occurred.

In the example shown in FIG. 35, when the readIN port of component A is traced in the opposite direction, Selector2 → Selector1 → Select
An error occurs because there is a loop called or2.

(Ii-3) bool bool The bool port is connected between different contexts.
Only connections within the same context are allowed for connections between ports.

The boolIN port is not connected to one port.

Since the boolIN port is not branchable, it must be connected to one port.

A loop is detected by expanding the input value of the boolIN port. If the boolIN port has a loop structure that returns to the original part when the boolIN port is traced in the reverse direction, an error is generated. In the example shown in FIG. 36, if the boolIN port of the component A is traced in the opposite direction, an error occurs because there is a loop of And2 → And1 → And2.

(Ii-4) write The write port is connected between different contexts.

The same connection is permitted between write ports.
Only connections within ontext.

A writeOUT port whose writeOUT port is not connected to one port must be connected to one port because it cannot be branched.

(Ii-5) DomainState Directly to the rreadOUT port of DomainState or Selector
Indirectly connected to Notify or Monitor via parts.

DomainState is a change in the state of the context:
Since it is obtained by the event output to the eventOUT port F and the change of the output of the readOUT port cannot be obtained, as shown in FIG.
It is an error if tor is connected.

(Iii) Atomic Structure If the condition to be satisfied by the Structure having the atomic attribute is not satisfied, it is regarded as an error.

[0133] An atomic structure is composed of two or more eves.
Structure eve with atomic designation with ntIN port
You must cry with no more than one ntIN port.

(Iii-2) If a logic component in an atomic structure is referenced from outside the atomic structure, an error is generated.

(Iii-3) Parts in an atomic structure are not in the same context All parts and entities in an atomic structure must belong to the same context. If a reference exists in an atomic structure, all components that follow the reference must belong to the same context.

(Iii-4) An event loop exists in an atomic structure If an event loop exists in an atomic structure, an error is generated.

As described above, the scenario for the HA system created by the compiler 13 is used as a template as the scenario template file 49 for the HA system.
Is output to The parameters used in the actual system are set in the template held in the HA system scenario template file 49 using the parameter setting tool 51, and the scenario for the HA system used in the actual operation is created. 53. The scenario held in the HA system scenario file 53 is distributed to each server 57 by the scenario distribution tool 55.

Simulator The simulator 15 reads the scenario used in the actual execution environment from the HA system scenario file 53 and simulates the operation of the entire scenario. The simulator 15 has a state table of a plurality of servers, and simulates a state conversion occurring in each system. Thus, it is possible to confirm / verify how the created scenario operates.

The logic component debugger in the simulator 15 reads the logic component created by the component editor 3 and simulates the operation of the logic component alone (ie, the component created by the component editor 3). Parts include
An external input necessary for the simulation is given, and the flow of information to each component and the external output can be confirmed.

The simulator 15 has an operation panel system and a script system as a method for causing a state change necessary for the simulation or operating the operation of the simulation. The operation panel method uses G that can be operated by the user.
By operating an operation panel on which UI components (buttons, character input fields, etc.) are arranged, a state change of the system is caused or a simulation operation is operated. In the script method, a script describing a change in the state of the system or a user operation is input, and simulation is automatically performed according to the script procedure. According to this method, by using a log output from the real system as a script, it is possible to confirm a phenomenon that has occurred in the real system on a simulation. By using the script method in combination with the operation panel method, more detailed verification is possible.

The status operations include (1) system startup and shutdown (abnormal termination) (2) normal / abnormal process power (time from startup to termination; end code can be specified) (3) The following state change can be caused by a user operation (a state change caused by an operation performed by the user on a monitor or the like during actual operation). Further, as the simulation operation, (1) start and stop of the simulation (the number of simulation steps can be set; for example, the simulation is stopped when the state changes three times) (2)
Simulation operation speed setting (one-step time can be set; for example, a time shorter than the actual operation timer time can be set to end the simulation earlier) (3) Snapshot (Simulation of simulation state You can save it as a shot and return to that state; you can take multiple snapshots).

Further, as the state setting, the value of the memory storing the state of the system can be directly set.

The simulator 15 displays simulation information. That is, log display and monitor display are performed. As a log display, an event in which a state change has occurred is received, and various paths (a logic component / structure data, etc.) indicating a time in which the state change occurred and information on the occurrence of the change,
Output the value and type as character strings. The log filter (that is, the condition for displaying only information that satisfies the specified condition as a log) includes (1) context, (2) type, and (3) path. The output log is saved in script format. The saved script can be entered and reproduced.

The monitor display displays the information displayed in the log on a GUI so that the current state and the state of the state change can be easily understood. As a display method, for example, all necessary information can be confirmed by designating a path of information to be monitored on a GUI and arranging a component representing a state of the path.

FIG. 38 is a block diagram showing another embodiment of the present invention. In this embodiment, the scenario component library 5 is created in advance by the component editor 3 so that the user does not input a configuration using the configuration editor 7 and the scenario template automatic generation control unit 61.
Automatically generates a scenario template. In FIG. 38, a system requirement specification design tool 59 is a GUI tool that supports determination of requirement specifications for a distributed system, and outputs requirement specification data to a scenario template automatic generation control unit 61. The scenario template automatic generation control unit 61 controls the configuration editor 7 from the received required specification data to generate a scenario configuration file. The content to be controlled by the configuration editor is to define the system configuration (number of servers, number of application programs, etc.),
This is to select and use necessary parts from the scenario parts library. Further, the scenario template automatic generation control unit 61 controls the parameter item editor 11,
Defines information about system-specific parameters in the scenario configuration file. Information on system-specific parameters includes parameter items to be input and information on the meaning, type, size, etc. of the parameters,
This is information required to set system-specific parameter values in the scenario template. The parameter setting tool 51 reads parameter item information in the scenario template, displays information necessary for parameter input,
Enables accurate parameter input.

In the above-described embodiment, the editing of the scenario template is divided into the component editor and the configuration editor. However, the editing may be performed by one editor. However, when editing is performed by dividing into two editors, there are the following advantages.

(1) Easy Configuration Change The configuration editor has a function for easily defining the system configuration, and can easily add or delete servers and applications. The configuration editor
As shown in FIG. 39, the whole and a part of the defined configuration can be stored in the configuration file. When a new configuration is created, a new configuration can be easily defined by selecting, reading, and editing a configuration file having a similar configuration from the configuration files created so far.

(2) The operation can be changed by replacing the component library. As shown in FIG. 40, the configuration file created by the configuration editor is associated with a scenario component library. By replacing the part, the part to be used is changed, and a scenario having a different operation can be obtained.

[0149]

According to the present invention, a file can be backed up by an operator's instruction without changing an application and without stopping systems and services.

[Brief description of the drawings]

FIG. 1 is a system block diagram showing an operation scenario development environment of a distributed system according to the present invention and its periphery.

FIG. 2 is a view showing an example of a GUI screen of the component editor shown in FIG. 1;

FIG. 3 is a diagram showing a data type of a port.

FIG. 4 is a diagram showing a part of primitive components registered in a library in advance.

FIG. 5 is a diagram showing a remaining part of primitive parts registered in a library in advance.

FIG. 6 is a diagram illustrating a reference component.

FIG. 7 is a diagram illustrating a reference component.

FIG. 8 is a diagram illustrating a reference component.

FIG. 9 is a diagram showing ports of Structure components.

FIG. 10 is a diagram for explaining an execution order of each component when an atomic attribute is specified for a Structure component.

FIG. 11 is a diagram for explaining an execution order of each component when an atomic attribute is specified for a Structure component.

FIG. 12 is a diagram for explaining an atomic attribute.

FIG. 13 is a diagram illustrating an example of a function of a configuration editor.

FIG. 14 is a diagram illustrating a top-level structure of a service start component when a service start process part of a two-system scenario is created as an example.

FIG. 15 is a diagram illustrating an example of components of a Start Check for cpu1 illustrated in FIG. 14;

16 is a diagram illustrating an example of creating a component pointed to by a reference entity of the GroupState illustrated in FIG. 15;

FIG. 17 is a diagram showing components of Execute Processes.

FIG. 18: Complete which is a component of the service start part
FIG. 3 is a diagram illustrating an example of a component configuration for implementing an action.

FIG. 19: Fail Act which is a component of the service start part
It is a figure showing the example of component composition for realizing ion.

FIG. 20: Start Check (cpu1), Start Check (cpu2), and GR
It is a figure showing the relation of OUP_STATE.

FIG. 21 is a diagram for explaining registration to a library.

FIG. 22 is an explanatory diagram when an entity for a component ServiceStart2Cpu is created on a directory.

FIG. 23 is an explanatory diagram when an entity for a component Start Button is created on a directory.

FIG. 24 is an explanatory diagram when an entity for a component GROUP_STATE is created on a directory;

FIG. 25 is an explanatory diagram when an entity for a component GROUP_STATE Monitor is created in a directory.

FIG. 26 is an explanatory diagram when an entity for a component Execute Processes is created on a directory.

FIG. 27 is an explanatory diagram when an entity for a part / procedure / twoProceduresProcedure is created on a directory.

FIG. 28 is an explanatory diagram when creating an entity for a component procedure / oneProcessProcedure in a directory.

FIG. 29 is a block diagram showing details of a compiler.

FIG. 30 is a diagram illustrating an example of a hierarchical structure using Structure.

FIG. 31: The reference destination entity is Constant,
FIG. 3 is a diagram illustrating a configuration of a port in the case of a Button and a Monitor.

FIG. 32 is a diagram illustrating an example of a reference loop of a reference.

FIG. 33 is a diagram for explaining a port connection check function by a compiler;

FIG. 34 is a diagram illustrating a port connection check function by a compiler.

FIG. 35 is a diagram illustrating an example of a case where a loop is detected by expanding a readIN port input value by a compiler.

FIG. 36 is a diagram illustrating an example of a case where a loop is detected by a compiler by expanding an input value of a boolIN port.

[FIG. 37] Directly or directly to the readOUT port of DomainState
It is a figure which shows the example connected to Notify or Monitor indirectly via the Selector component.

FIG. 38 is a block diagram showing another embodiment of the present invention.

FIG. 39 is a diagram for describing an advantage in a case where editing is performed by dividing into two editors, a component editor and a configuration editor.

FIG. 40 is a diagram for describing an advantage in a case where editing is performed by dividing into two editors, a component editor and a configuration editor.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... Scenario development environment 3 ... Parts editor 5 ... HA system parts library 7 ... Configuration editor 9 ... HA system scenario configuration file 11 ... Parameter item editor) 13 ... Compiler 15 ... Simulator 17 ... GUI screen (parts editor) 19 ... Design screen display unit 21 Menu screen display unit 23 IN 25 OUT 27 Internal expression 29 Conversion unit to internal expression 31 Primitive part information 33 Conversion unit to scenario description 35 Logic generation unit 37 Error Check section 39 ... Symbol information generation section 41 ... Logic section 43 ... Symbol information 45 ... GUI code correspondence information 47 ... Part position information 49 ... HA system scenario template file 511 ... Parameter setting tool 53 ... HA system scenario file 55 ... Scenario Distribution tools 7 ... server 59 ... system requirements specification design tool 61 ... scenario template automatic generation control unit

Claims (6)

[Claims] 1. A computer system having a high availability system operation scenario development environment for developing a behavior of a high availability system in which a plurality of server computers cooperate to perform processing as a scenario described in a script language. A component editor for creating components; a scenario component library for holding a component group created by the component editor; a configuration editor for defining the configuration of the high availability system; and a definition for a system configuration in a scenario of the high availability system. Scenario configuration file for a high availability system, a parameter item editor for defining items to be set by a user in a real system, and a compiler for converting the scenario configuration file for a high availability system into a scenario template described in a scenario description language A computer system having an operation scenario development environment for a high availability system, comprising: 2. A computer system having a high availability system operation scenario development environment for developing the behavior of a high availability system in which a plurality of server computers cooperate to perform processing as a scenario described in a script language. A configuration editor for defining the configuration of the user, a parameter item editor for defining items to be set by the user in the real system, controlling the configuration editor, generating a scenario configuration file, and controlling the parameter item editor to control the scenario configuration A computer system having an operation scenario development environment for a high availability system, comprising: a scenario template automatic generation control unit that defines information on system-specific parameters for a file; 3. The part editor displays a part constituting the scenario in a graphical user interface (G).
The scenario component library registered in the scenario component library created in UI), wherein the scenario component library includes a tree structure expressing a namespace of the created component, and a component placed in the namespace. 2. A computer system having an operation scenario development environment for the high availability system according to 1. 4. The operation of a high availability system according to claim 1, wherein said parts are created by combining primitive GUI parts prepared in advance, and said primitive GUI parts are parts that cannot be further divided. Computer system with scenario development environment. 5. The computer system according to claim 4, wherein the parts are associated with each other by connecting lines, and the lines have a data type and a direction. 6. The apparatus according to claim 1, further comprising a simulator for reading a scenario used in an actual execution environment and simulating the operation of the entire scenario.
A computer system having an operation scenario development environment for the high availability system described in the above.