JP2002259355A - Multiplex system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a multiplex system for making arbitrary the location of a plurality of computers and facilitating configuration control processing. SOLUTION: In the multiplex system connected with a plurality of computers 101 and 102 on a network and having a shared external storage to be shared by these computers, a SAN 201 is used for the network and managing communication such as confirmation or change instruction of an operating state or executing state to be executed between the computers is performed on the SAN 201. Thus, the process of configuration control processing in each of computers is changed and zones and virtual communication paths can be set on the SAN 201.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a multiplex system in which a plurality of computers operate in cooperation with each other, and more particularly to a multiplex system in which a storage device for sharing data between the computers constituting the multiplex system is connected to a network. .

[0002]

2. Description of the Related Art Conventionally, as a multiplex system in which a plurality of computers share data stored in a storage device and one of the computers provides a service to a service target device, Japanese Patent Laid-Open No. Hei 10-207855 is known. As described in the gazette, a configuration in which a storage device connected to a shared SCSI bus is shared has been common.

On the other hand, in a computer system, the demand for sharing a storage device between a large number of computers or separating and arranging the storage device from the installation location of the computer body has become apparent, and a dedicated network connects the storage device and the computer. The technology of the connected storage area network (hereinafter referred to as "SAN") has been developed and commercialized. FIG. 18 shows an example of a multiplex system using this SAN.

In this multiplex system, a single SAN95
1, two multiplex systems 911 and 912 are constructed. The multiplex system 911 is a computer 90
1, 902 and a shared disk device 961 are connected via a SAN 951. The computers 901 and 902 are connected by an inter-computer link 921, and management communication for cooperative operation as a multiplex system is performed through this path.

[0005] The contents of the management communication include state information such as the operation state of the computer itself and the load state of calculation processing running on each computer. Computers 901 and 902 are:
Based on this state information, a failure of the partner computer is detected, the computer is stopped, the executed calculation process is taken over, or the calculation process load of the partner computer is determined to be excessive, and the process is performed. To perform a state change that is executed by sharing a part of. Such a process of grasping the operating state of the computer itself and the state of the processing executed on the computer and changing these states is hereinafter referred to as “configuration control”.

When it is necessary to change the operation state of another computer or the operation state of a calculation process operating on another computer as a part of the configuration control processing, it is regarded as one of the management communications. The information is transmitted to the computer. When the management communication is interrupted, each computer erroneously recognizes the state of the other computer (called a split brain state).
Since the cooperative operation cannot be performed, the inter-computer link 921 is duplicated or the service network 971 is used as a backup communication path for redundancy. A LAN such as serial communication or Ethernet (trademark of Xerox Corporation, USA) is used for the inter-computer link.

[0007] The multiplex system 911 is an Ethernet system.
A calculation processing function is provided to the service target device 981 through t971. The service target device 981 may be an information processing client, a control target device, or the like, and the multiplex system 911 performs a database search process, a calculation control process, and the like for these devices. Another multiplex system 912 is similarly composed of computers 903 and 904, a shared disk device 962, and an inter-computer link 922, and similarly provides a calculation processing function to the service target device 982 through the Ethernet 972.

[0008]

In a multiplex system using the above-mentioned prior art, it is necessary to install an inter-computer link between the computers constituting the multiplex system, and the degree of freedom in the installation position of the computers is increased. If they are to be provided, there is a problem that the cost increases due to the extension of the inter-computer link.
A first object of the present invention is to provide a multiplex system in which the installation position of a computer can be freely set.

In a multiplex system using the prior art, a plurality of multiplex systems share a single SAN, and the other multiplex system itself becomes inoperable due to normal operation or malfunction of one multiplex system. Could be unpredictably affected. A second object of the present invention is to provide a multiplex system configured so that the operation of one multiplex system does not affect other multiplex systems.

If a failure occurs in a computer constituting the multiplex system, the redundancy of the multiplex system can be restored by replacing the computer with another backup computer. In particular, when a large number of multiplex systems are connected to a single SAN, the availability of the system can be increased with a small number of computers by preparing a common backup computer. However, in these cases, it is necessary to grasp even the state of the backup computer in the multiplex system, and management becomes complicated. A third object of the present invention is to provide a multiplex system that facilitates the management.

Further, in a multiplex system using the conventional technique, information necessary for configuration control (hereinafter, referred to as "configuration control information") is managed on each computer constituting the system. Processing must always be performed in consideration of information synchronization so that the information does not differ, and the processing becomes complicated. A fourth object of the present invention is to provide a multiplex system which facilitates management processing of configuration control information in each computer.

[0012]

First, "management communication" used in the present invention is defined. Each node of the multiplex system cooperates as a single system by the operation of each management program running on the node. For this purpose, the management programs communicate with each other. The content of the communication is a report on the periodic or status change of the operation status of the management program or application on the sending node,
There is also an instruction to change the operation state of the management program or application on the receiving node. It also includes communicating information about other nodes recognized by the management program on the transmitting node and detecting inconsistencies in state recognition between the management programs. Further, a survival confirmation function for recognizing whether the transmitting node is operating correctly on the receiving node based on the fact that communication is possible is also included. These communications will be referred to herein as "management communications."

Next, the configuration of the present invention for achieving the above object will be described. The present invention includes a plurality of computers, a shared external storage device connected to the plurality of computers via a network and shared by the plurality of computers, and performs processing performed by any of the plurality of computers in any other manner. In a multiplex system in which one of the computers takes over, or in which a part of the processing is shared and executed by another computer, a confirmation or change instruction of the operating state of the computer performed between the plurality of computers, or the plurality of computers The management communication performed for confirming or changing the execution state of the process executed by the computer is performed on the network connecting the plurality of computers and the shared external storage device.

[0014] The network includes a plurality of switches having ports and a storage area network (SAN) having an inter-switch link between the switches. The SAN has a function of including data of a data transfer protocol used between the computer and the shared external storage device in a transfer content data portion of a packet transferred on the network.

Further, network management means for setting the network so that the management communication performed between the plurality of computers is performed with priority over the communication between the plurality of computers and the shared external storage device. have. One of the network management means is a virtual communication path management means (a virtual communication path management server in the embodiment). S
By setting a virtual communication path on the AN and always executing the virtual communication path used by the management communication with priority over other communication, the management communication can be prioritized. Further, by setting the maximum delay time of the virtual communication path used by the management communication, real-time property of the management communication can be ensured. As another network management means, there is a packet priority management means. By setting a higher value in the field indicating the priority of the packet header when transmitting the management communication, a relay device such as a switch on the network does not wait for a low-priority packet waiting to be relayed in the device. A packet with a higher priority is discarded and relayed first, so that the management communication can be prioritized.

Further, the present invention relays communication data transmitted from another multiplex system or another device connected to the network to a plurality of computers and a shared external storage device of the multiplex system. A zone management unit (in this embodiment, a zone management server) configured to set the network so as to prohibit the operation from being performed. Alternatively, when a failure occurs in any of the plurality of computers, the communication data transmitted from the failure-occurring computer to the plurality of other computers and the shared external storage device excluding the failure-occurring computer, It is characterized in that it is set in the network so as to prohibit relaying in the network.

That is, the components of the multiplex system are represented by S
It is defined as a zone on the AN, that is, a group that permits communication, and is set not to relay communication from outside the zone.

Further, the present invention has one or more computers and a shared external storage device connected to the computers via a network, and uses the other computers connected to the network as computers constituting a self-multiplexing system. It is possible to add, take over the processing performed on any of the computers before the addition to any of the other computers, or replace some of the processing performed on any of the computers before the addition with another In a multiplex system that is shared and executed by computers, when performing additional processing of a computer, communication data transmitted from the computer is added to all the computers and the shared external storage device configuring the multiplex system after the addition. On the other hand, there is provided a zone management means for setting the network so as to permit relaying on the network.

Alternatively, the processing performed by one of the plurality of computers is taken over by one of the other computers, or a part of the processing performed by one of the plurality of computers is shared by the other computer. When performing a computer exclusion process in a multiplex system, the communication data transmitted from the computer is excluded from all the computers and the shared external storage device configuring the multiplex system after the exclusion. It is characterized by having zone management means for setting the network so as to prohibit relaying on the network.

According to this, the information on the operating status of the computers constituting the multiplex system is obtained from the SAN zone setting, so that it is not necessary to manage the status of all the computers for each computer, and it is necessary to Then, it is only necessary to use the zone setting information.

Further, the present invention has a plurality of computers, a shared external storage device connected to the plurality of computers via a network and shared by the plurality of computers, and a process performed by any of the plurality of computers. In a multiplex system in which the other computers take over the processing of some of them, or share some of the processing performed by one of the plurality of computers with the other computers, and execute the network. The external storage device is characterized by having a monitoring means (main management program in the embodiment) for monitoring the operating states of the plurality of computers.

The monitoring means, based on the monitoring result,
Instruct to change the operating state of the plurality of computers,
Alternatively, an instruction is issued to change the execution state of the processing being performed in any of the plurality of computers.

According to this, the SAN network component device or the shared storage device connected to the SAN,
Since information related to the configuration control of the multiplex system is held therein and a part or all of the configuration control processing of the multiplex system is executed, the procedure of holding the configuration control information and executing the configuration control is performed. Can be simplified. In addition, since these devices are generally already provided with redundancy, high availability can be realized without additional cost for redundancy.

[0024]

Embodiments of the present invention will be described below with reference to the drawings. The present invention includes a plurality of computers, a shared external storage device connected to the plurality of computers via a network and shared by the plurality of computers, and performs processing performed by any of the plurality of computers in any other manner. This is a multiplex system that is taken over by one computer or shared and executed by another computer. Between multiple calculators,
Management communication for confirming the operation state or execution state of the computer or for instructing a change is performed on the network.

FIG. 1 shows the configuration of a multiplex system according to the first embodiment of the present invention. In this multiplex system, 2
Computers 101 and 102 pass through the SAN 201,
It is connected to the shared disk device 301. The number of computers may be three or more, and the number of shared disk devices may be two or more.
It may be more than one.

Each of the computers 101 and 102 includes a central processing unit 111 (hereinafter referred to as a “CPU”) and a main storage device 11.
2. It has an input / output control unit 113, which is connected to each other by a processor bus 110. An expansion bus 114 is connected to the input / output control device 113, and a device for expanding the functions of the computer is connected to the expansion bus 114. The computers 101 and 102 according to the present embodiment
A disk bus 115 is connected to the expansion bus 114 and a host bus adapter 116 (hereinafter, “HBA”) for connecting to the SAN.
), And an Ethernet adapter 117 is connected.

The Ethernet of each of the computers 101 and 102
The t adapter 117 is connected to the Ethernet 401, and the service target device 4 connected to the network.
02 is communicated. As the service target device 402,
Various devices such as an information processing client and a device to be controlled can be considered, and the computers 101 and 102 provide functions such as a database search process and a calculation control process. Instead of the Ethernet 401, another network such as a token ring or a control real-time network may be used.

The HBA 1 of each of the computers 101 and 102
16 is connected to the SAN 201 and the shared disk device 3
01 and other devices connected to the SAN.

In such a multiplex system, when the computers 101 and 102 are in a normal state, the main storage 11
2, an OS 131 and a management program 132 are loaded and executed. Also, the main storage device 112
Above is loaded an application 133.

The management program 132 recognizes the status of the computers 101 and 102 constituting the multiplex system and the execution status of the application 133 on each computer.
It is a program for changing these states. The management program 132 creates, on the main storage device 112, a status table 135 for managing the status of the multiplex system.

The application 133 is a program for realizing a function to be provided to the service target device 402, which is a main purpose of the multiplex system. A plurality of applications 133 may exist. The execution of one application 133 is limited to one computer at a certain point in time, the availability is improved by switching to another computer when a failure occurs in the computer, and the entire processing is executed by a plurality of computers. There is a configuration for improving the processing performance by dividing and executing. Hereinafter, description will be given based on the former configuration.

However, in the case of the latter configuration, the management program 132 recognizes the execution state of the application on each computer in order to divide the processing, and based on the result, the application on each computer notifies the application on each computer about the processing operation. You need to give instructions. For this reason, among the processing of the former configuration, the algorithm for selecting a specific computer to execute an application is determined by selecting an algorithm for selecting a plurality of computers to execute the application and performing the entire processing for the application on the plurality of computers. Is changed to an algorithm that instructs which part of is processed.

The SAN 201 has a zone management server 21
1 is connected. The zone management server 211 is the storage device 2
12 in which zone definition information 213 is stored. The zone definition information 213 defines a group of devices that are allowed to communicate with each other in the SAN 201.

[0034] The zone management server 211
In response to a request from a device connected to the server, the definition is created, changed, or deleted, or the currently set zone definition information 213 is provided. When the definition is created, changed, or deleted, the SAN 201 is instructed to permit or prohibit communication data relay according to the zone definition.

The SAN 201 is connected to a virtual communication path management server 221. Virtual communication path management server 22
1 has a storage device 222 in which virtual channel definition information 223 is stored. Virtual channel definition information 22
Reference numeral 3 defines a dedicated logical communication path created between specific nodes connected to the SAN 201.

The virtual communication path management server 221 is connected to the SAN 2
Creates a definition in response to a request from the device connected to
It changes, deletes, or provides the currently set virtual channel definition information 223. When a definition is created, changed, or deleted, a logical channel setting, a communication bandwidth, and a maximum communication delay for relaying communication data in accordance with the virtual channel definition information are performed on the SAN 201 components. Instructs reservation of resources necessary for time guarantee.

The details of each section will be described below. The SAN 201 presupposed in the multiplex system includes a function of including data of a data transfer protocol used between the computers 101 and 102 and the shared disk device 301 in a transfer content data portion of a packet transferred on the network. have. That is, data of the data transfer protocol is encapsulated in a packet on the SAN as a payload (transfer content body).

FIG. 2 shows the internal configuration and its operation will be described. The SAN 201 includes one or more switches 231 and an inter-switch link 232 that connects the switches. Each switch is provided with one or more ports 233, and data can be transmitted and received inside the switch 231 and between the switches 231 so that data can be transferred to and from an arbitrary port 233 included in the SAN 201.

The equipment connected to the port 233 is called a node, and is connected by a node link 234. SA
The N201 provides a data transfer function without distinguishing whether the type of node is a computer, a disk device, or another device. Each node has address 2
35, the data transmitted from the node to the port 233 is the address 23 specified in the data.
5 is forwarded to the node with 5.

In FIG. 2, the computers 101, 1 shown in FIG.
02 and the shared disk device 301 are connected by addresses a, b, and c, respectively. In FIG. 2, the other nodes 305a and 305b not shown in FIG.
1

The zone management server 211 and the virtual communication path management server 221 shown in FIG. 1 are connected as ports having a reserved address 236 called an address x and an address y, respectively. The reservation address 236 is an address fixedly assigned for zone management and virtual communication path management, respectively. When each node requests a process related to the function, the node manages the zone management server 211 and the virtual communication path management server 221. The reserved address 236 may be specified without being aware of the entity.

In the configuration shown in FIG. 2, the SAN 201 converts the data addressed to the reserved address 236 into the normal address 23.
Transfer to the server in the same manner as in 5. Meanwhile, zone management,
A function such as virtual communication path management can be implemented as a part of the internal device of the SAN. In this case, the communication data of the request related to the function is not transferred to the server but is processed inside the SAN.

On the other hand, it is also possible to increase the availability of the SAN by making the servers that execute zone management and virtual communication path management redundant, and in this case, at a certain point, the server that is currently providing the function uses the reserved address. Then, when the redundant spare server takes over the function, the reserved address on the SAN is also taken over and processed. In any of these cases, each node does not need to change the procedure of transmitting a processing request by designating a reserved address at all.

The function of zone management will be described. A zone is a group of nodes that mutually permit data transfer among nodes connected to the SAN 201. The SAN 201 executes data transfer between nodes belonging to the set zone, and rejects data transfer between other nodes. However, for nodes that do not belong to any zone, data transfer is performed between these nodes. Since the node having the reserved address 236 provides a management function of the SAN 201, the communication between the reserved address and any node connected to the SAN 201 is always executed.

For setting, modifying and deleting a zone,
A request can be made to the zone management server 211 from any node connected to the AN 201. After confirming that there is no inconsistency in the request parameters, the zone management server 211 stores the zone definition information, transfers the information to the switch 231, and instructs the switch 231 to reflect the information. In addition, the zone management server 211 has the SAN2
When there is a request from an arbitrary node 01, the content of the zone definition information 213 held is notified.

The function of virtual communication path management will be described.
The virtual communication path is a communication path logically set between nodes connected to the SAN 201, and parameters such as a communication bandwidth and a maximum delay time are set in each communication path. The SAN 201 can transfer a predetermined amount of data for a predetermined period of time, for example, one second so that a set communication bandwidth can be guaranteed for data communication specified using the virtual communication path. Resources such as the processing time of the switch 231 and the occupation ratio of the inter-switch link 232 to be relayed are reserved. At the same time, the switch 23 prevents the data exceeding the determined communication bandwidth from flowing into the SAN 201 and consuming more resources than reserved.
1 has a function of requesting a connected node to stop sending data.

Further, the SAN 201 similarly reserves resources for data communication designated to use the virtual communication path so as to keep the set maximum delay time. At this time, the lower limit of the maximum delay time that can be set is limited by the minimum unit of the time for which resources can be reserved. The data communication that does not use the virtual communication path is executed when the resources necessary for the communication exist, and the communication is performed when the resources are insufficient for the communication of the other set virtual communication paths. Is postponed or discontinued.

The setting, correction and deletion of a virtual communication channel can be requested from any node of the SAN 201 to the virtual communication channel management server 221. If there is a request for setting or correction, the virtual communication path management server 211
Calculates the resources required for setting the requested virtual communication path, attaches an ID number for identifying the virtual communication path, and requests each component such as the switch 231 or the inter-switch link 232 to reserve the resource. I do.

If all the requests succeed, it means that the setting of the virtual communication channel has succeeded, and the virtual communication channel management server 22
1 stores the new setting contents in the virtual channel definition information 223 and returns the virtual channel ID number to the request source. On the other hand, if the reservation of any resource fails, the reservation of another new resource is canceled and the failure is reported to the request source without changing the virtual communication path definition information 223. Further, the virtual communication path management server 221 receives the request from an arbitrary node of the SAN 201, and holds the virtual communication path definition information 223 stored therein.
Returns the contents of

FIG. 3 shows the structure of data transferred on the SAN 201. The transmission source address 241, the transmission destination address 242, the virtual communication path I
D243, protocol ID 244, data size 24
5, and has check data 247. The data body 246 to be communicated is variable-length data, and the length is stored as the data size 245.

The source address 241 is the SAN address of the source.
The above is the node address 235. The destination address 242 is the address 235 to the reservation address 236 of the destination node described above. When using a virtual communication channel, the virtual communication channel ID 243 is the ID returned from the virtual communication channel management server 221 at the time of setting the virtual communication channel.
Set the D number. Specify 0 when not using a virtual communication channel. The protocol ID 244 indicates a rule for interpreting data held by the data body 246.
In this multiplex system, a SCSI protocol, an IP protocol, and a protocol for SAN management communication are used. The check data 247 is for confirming whether or not there is a transmission error in the communication data. The check data 247 is calculated and added by a predetermined mathematical formula at the transmitting node, and is recalculated and confirmed at the receiving node.

FIG. 4 shows a switch 231 in the SAN 201.
Shows a processing flow 501 when communication data is received from a node.

First, the combination of the source address 241 and the destination address 242 is compared with the zone information provided from the zone management server 211, and whether the combination of the addresses is included in the same zone, or both addresses are both Confirm that it does not belong to the zone of (50
2). If the condition is not met, the communication data is discarded (503), and the communication is not performed.

Next, the virtual communication path ID 243 is checked, and it is checked whether the data having the virtual communication path ID has been transmitted within a certain period of time to a capacity exceeding the resource reserved for the switch. (504). If the capacity exceeds the capacity, the communication data is discarded (50) because the resource reserved by the switch is exceeded.
5) The transmission source is notified of the capacity over, and the transmission is stopped for a certain period of time (506), and then the transmission is permitted again (507). Although not shown in FIG.
1 accepts transmission of communication data having another virtual communication path ID even before the transmission is permitted again.

The communication data that has not been discarded as described above is divided depending on whether or not the destination node is connected to the switch (508), and if connected, is transmitted to the destination node (509). Otherwise, it is transferred to the switch to which the node is connected using the inter-switch link 232 (510). In the latter case, there is a possibility that resources reserved on the inter-switch link 232 may be exceeded, and in this case, an error report is returned to the transmission source switch (511), and the communication data is transmitted in the same manner as described above. Discard and suspend transmission (505-507).

Incidentally, regarding the protocol ID 244,
The switch 231 has no effect. The receiving node determines whether the protocol specified by the protocol ID 244 of the communication data can be processed, and discards the communication data if the protocol cannot be processed. Also, when the check data 247 does not match the result of the recalculation, the communication data is discarded.

Next, the operation of the management program 132 on the computer constituting the multiplex system will be described. As described above, in this multiplex system, one application 133 is operated on one of the computers at a certain point in time, and when it becomes impossible to execute on the computer, another application 133 is executed. Is taken over and executed. In the following description, it is assumed that two applications (hereinafter, referred to as “application 1” and “application 2”) are operated on the multiplex system.

FIG. 5 shows a management program 132 on the computer.
Shows the contents of the state table 135 constructed on the main storage device 112 of the computer. This table has rows 141a and 141b corresponding to each computer. Further, there is a column 142 for storing the address of the computer on the SAN, and a column 143 for storing the operating state of the computer. Furthermore, columns 144a and 144b storing the priority order of executing the application on the computer, and columns 145a and 14 storing the execution status of the application on the computer.
5b exist as many as the number of applications. Of these, the contents of the column 142 storing addresses on the SAN are determined in advance corresponding to the computers constituting the multiplex system.

Regarding the contents of the columns 144a and 144b for storing the priority of the application, the computer on which the application is prioritized and executed is stored. In this column, values from 1 to 9998 can be set, and a smaller value is set for a computer that is to be executed with higher priority than a computer that is not to be executed. Also 999
When 9 is set, it indicates that the application is not executed on the computer. For example, 1 is set to a computer that preferentially executes the application, and 2 is set to a computer that does not prefer. In the case where the processing may be executed by either computer, 1 is set for both.

In the column 143 for storing the operating state of the computer, "operating" is stored if the management program 132 on the computer is operating normally, and "stop" otherwise. In addition, the columns 145a and 145b storing the execution state of the application store "operating" when the application is operating on the computer, and "stop" otherwise. These values are set by the management program 132 according to the processing flow described later.

FIG. 6 shows a processing flow 521 when the management program 132 is started. The management program 132 is normally executed when the computer is started, and continues to be executed until the computer stops. Therefore, this activation processing flow is usually executed when the computer is activated.

First, the contents of the zone definition information 213 defined in the SAN 201 are obtained from the zone management server 211 (522). Then, it is confirmed whether a zone including the computer is defined (523). Here, it is interpreted that the definition of the zone including the computer on the SAN 201 represents a component of the multiplex system including the computer. The zone representing the configuration of the multiplex system as described above is hereinafter referred to as a “multi-system zone”.

As will be described later, when all the computers of the multiplex system are stopped, the processing for deleting the zone definition is performed. Therefore, the fact that the zone including the computers is defined means that the multiplex system has already been defined. It is determined that the other computers constituting the system have been started. In this case, the computer included in the acquired zone definition information and the state table 135
It is verified whether or not the configurations included in are the same (524).
If they do not match, it indicates that the state table is updated by another computer while the computer is stopped, and that the computer constituting the multiplex system has been changed. In this case, the computer included in the state table is updated with the contents of the zone definition information (525).

Next, a request is issued to the virtual communication path management server 221 so that the computer on which the present management program 132 is operating and the shared disk device 30 used in the multiplex system are used.
A virtual communication channel is set during the period 1 (526). Thereafter, when the computer reads and writes data from and to the shared disk device 301, the virtual communication path set here is used, that is, the ID acquired at the time of setting the virtual communication path is set as the virtual communication path ID 243 of the communication data. And SCSI
Executes by sending and receiving data using a protocol.

Although omitted in FIG. 6, if the shared disk device 301 is not operating or the setting of the virtual communication path fails, the operation as a multiplex system is impossible, so the set zone definition Is deleted, and the operation of the management program 132 ends with an error.

Next, the virtual communication path management server 221 is requested to set virtual communication paths between the computer on which the present management program 132 is running and the other computers included in the status table 135. (527). Thereafter, the management communication for configuration control performed between the management program 132 of the computer and the management program 132 on the virtual communication channel setting destination computer uses the virtual communication path set here, that is, Virtual communication path ID 243 of communication data
Is set to the ID acquired at the time of setting the virtual communication channel, and
This is executed by transmitting and receiving data using the P protocol. Hereinafter, the virtual communication path is referred to as a “management communication path”.

When setting the management communication path, the communication bandwidth is set to the maximum value of the management communication executed on the virtual communication path.
As for the maximum delay time, a time that is sufficiently shorter than the required failure detection time of the computer, for example, 1/3 time is set.

Subsequently, using the management communication path, the management program 132 is started for each computer to notify that the computer has become operable as a multiplex system (5).
28). The management program 132 on another computer that has received the notification returns a response to the computer. When this response is received, it is known that the computer which has returned the response is already operating as a multiplex system, and therefore, “operating” is recorded in the operating state column of the responding computer in the status table 135. (529). Conversely, if there is no response, “stop” is recorded in the column, and the computer is excluded from the target of the configuration control of the multiplex system until a notification that the computer has been started is received (530).

Here, if there is no computer in operation other than the computer in question, it indicates that the multiplex system has been terminated immediately without stopping correctly, and the initialization process of the multiplex system has been completed. The process proceeds to (531).

A configuration may be adopted in which no virtual communication path is set between the computer and the shared disk device 301 used in the multiplex system. In this case, since the necessary communication quality is secured for the management communication between the computers by setting the virtual communication path, the management communication is always executed with priority over the access communication to the shared disk device. Will be.

Subsequently, the contents of the state table 135 are acquired from another computer in the operating state, and the state table 135 of the computer is acquired.
Application execution priorities 144a, 144
b, and application execution state 145a, 145
b is copied (532).

In the meantime, the number of operating computers is limited to one in the case of a dual system, but may be plural in the case of a multiplex system having three or more systems. in this case,
Copying may be performed from any arbitrary one. This is because the execution priority of the application is copied and the same when each management program is started. Further, when the execution state of the application is changed, the change is always notified to the management program 132 of each computer constituting the multiplex system, and the contents of the state table 135 are also consistent.

Next, the status table 135 in which copying has been completed is examined, and among the applications, the execution priority of the application is lower than that of the computer that has just started, that is, the value of the execution priority 144 of the state table is now running. Search for a computer running on a computer that is set larger than the one that was set. If there is a corresponding application, the application is taken over so as to be executed on the started computer (533).
The actual handover process is performed as follows. (A) The management program 132 of the takeover destination computer (higher priority) requests the management program 132 of the takeover source computer (lower priority) to stop the running application. (B) The management program 132 of the takeover source computer stops the application and notifies the management program 132 of the takeover destination computer that the application has been stopped. (C) The management program 132 of the takeover destination computer starts the application and updates the status table 135. (D) The management program 132 of the takeover destination computer notifies other computers constituting the multiplex system of the change in the execution state of the application. (E) The management program 132 of another computer constituting the multiplex system updates the status table 135 according to the contents of the notification.

On the other hand, if the zone including the computer is not defined, the other computers constituting the multiplex system have not been started, and a new zone is defined according to the definition of the state table 135 of the computer. Build a multiplex system. Here, the state table 135 is a table in which information on the constituent devices and applications of the multiplex system is defined in advance, and information written in a nonvolatile storage device such as the disk device 115 in advance is stored in the main storage device 112. Use by loading.

First, a request is made to the zone management server 211,
A zone including each computer in the state table and a shared disk device used in the multiplex system is defined (54).
1). Next, a request is made to the virtual communication path management server 221.
The computer on which the management program 132 is operating;
A virtual communication path is set between the shared disk devices 301 used in the multiplex system (542). This processing has the same contents as the processing 526.

Next, "stop" is recorded in the operation state column 143 of the other computer in the state table 135, and "stop" is also recorded in the execution state column 145 of each application (54).
3). Then, since the only computer operating in the multiplex system is the computer, each application is started on the computer and reflected in the state table 135 (544).

FIG. 7 shows a processing flow 551 of the state monitoring processing of the management program 132. This process is executed at regular time intervals after the normal startup of the management program 132. First, at the beginning of the processing, a notification that this computer is operating normally using a management communication path is sent to all the other computers constituting the multiplex system (hereinafter, this is referred to as a "live notification"). (552).

Next, it is confirmed whether or not each application in the “operating” state is operating normally on the computer (553). As a method of confirmation, there is a method of confirming whether a program process of the application exists, a method of executing a test of the application providing function, and the like. When an operation abnormality is detected, the application is determined to be incapable of operating on the computer, and the disconnection process (554) is performed on the computer.
Specifically, the following processing is performed. (A) The application is completely stopped on the computer. (B) In the state table 135, the content of the application priority column of the computer row is set to 9999, and thereafter,
Prevent applications from running on the computer. (C) Notify all the other computers constituting the multiplex system of the change of the state table via the management communication path.

The other computers that have received the status table change notification update the status table content according to the notification content. From the updated state table, the computer with the highest execution priority of the above-mentioned stopped application newly starts the application and, as a result, takes over the processing.

When an abnormal operation is detected, the application is not restarted immediately on the computer, but the application is restarted on the computer until a predetermined number of abnormal operations are detected. It is good also as processing. Further, instead of the number of operation abnormalities, the frequency of abnormality detection may be used as a reference for determining whether or not operation is impossible.

Next, the arrival status of the live communication from another computer is confirmed, and it is confirmed whether there is any computer that has not arrived for a predetermined time or more (555). Without such a calculator,
Since the multiplex system is operating normally, the status monitoring process ends. On the other hand, if there is a computer to which the notification of the existence has not arrived, it is known that some sort of failure has occurred.

Here, the time required until a failure of another computer is detected is determined by an issuance notification issuance interval (process 552), a maximum delay time which is a parameter of a management communication path, and an arrival status check of alive communication (processing 555). Therefore, the execution interval of the state monitoring process 551 is set to a time sufficiently shorter than the required failure detection time, for example, 時間.

The operation check of the application (process 553) can be executed intermittently, for example, only once each time the state monitoring process 551 is executed a certain number of times, to reduce the load of the check process. is there.

The processing procedure when a failure occurs will be described below. First, the zone management server 211 sends the SAN 201
The content of the zone definition information 213 defined in (1) is acquired, and it is confirmed whether the computer is included (556).
If it is not included in the zone, it means that the computer has already been determined to be abnormal by another computer and the disconnection processing from the multiplex system has been completed. If acquisition of the zone information fails, the computer
It is considered that access to N201 has failed, and it is also separated from the multiplex system. In these cases, the application on the computer is terminated (557), and the computer is stopped (558).

On the other hand, if the computer is included in the zone, it is determined that a failure has occurred in the transmission source computer for which survival monitoring has not been received for a certain period of time. From the multiplex system. (A) Remove the faulty computer from the zone defined as the multiplex system (559). (B) In order to prevent a malfunction of the faulty computer, the faulty computer is requested to stop. Specifically, a zone different from the multiplex system zone is defined between the present computer and the faulty computer, a stop processing request is transmitted, and the zone is deleted (560). On the faulty computer side, there is a method of preparing a program capable of stopping the computer in preference to the OS 131, or providing a mechanism for stopping the computer autonomously when the HBA 116 on the computer receives the request. Conceivable. (C) Delete the row of the faulty computer from the status table 135 (561). (D) In the updated state table 135, if the application with the highest execution priority of this computer is stopped, it is started, and as a result, the process is taken over (562).
(E) Notify the other computers constituting the multiplex system of the change of the state table via the management communication path. However, it is unnecessary in the case of a dual system and is not described in FIG.

In the case of a multiplex system having three or more systems, any one of the processes (a) and (b) may be performed. This means that before (a), it is checked whether the faulty computer is included in the zone, and if the faulty computer has already been removed from the zone, the processes (a) and (b) are performed by another node. It is only necessary to judge that the process is present and skip the process.

FIG. 8 shows a processing flow 571 when the management program 132 ends. The management program 132 normally terminates execution when the computer stops. Therefore, this startup processing flow is usually executed when the computer is stopped.

All the applications running on the computer are terminated (572), and then the management program 13
2 is notified to other computers via the management communication path (573). The management program 132 on the other computer that has received this notification sets the computer operation status column in the row of the computer to be stopped in the status table 135 to “stop”, and executes the columns 145 a and 14 of the execution status of each application.
5b is "stop". And the updated state table 135
Then, if the application with the highest execution priority of the computer among the "operating" computers is stopped, the application is started and, as a result, the process is taken over.

Subsequently, it is confirmed from the status table 135 whether there is an operating computer in addition to the computer to be stopped (574). If there is no other operating computer, it is determined that the multiplex system is to be stopped. Then, a request is made to the zone management server 211 to delete the multiplex system zone corresponding to the configuration of the multiplex system (575).

The above is the description of the multiplex system according to the first embodiment of the present invention. According to the present embodiment, since the SAN is used for the network and the procedure of the configuration control process in each computer is changed and used as an inter-computer link,
Each computer in the multiplex system can be arranged at an arbitrary position such as a remote place. Further, since the virtual communication path is set on the SAN, the real-time property of the management communication path can be guaranteed. Further, since the zone setting information can be used, the management of the computers constituting the multiplex system becomes easy.

Next, a second embodiment of the present invention will be described. FIG. 9 shows a configuration of a multiplex system according to the second embodiment of the present invention. For the SAN 201, the computer 10
1 to 105 are connected. The internal structure of these computers is the same as that of the first embodiment of the present invention. The functions of the SAN 201 and the zone management server 211 and the virtual communication path management server 221 connected to the SAN 201 are the same as those in the first embodiment.

In the second embodiment, the computer 101, the computer 102, and the shared disk device 301 constitute a multiplex system 151, and the computer 104 and the computer 105
And another multiplex system 1 with the shared disk device 302
52. A multiplex system zone is set for the combination of the computer and the shared disk device constituting each multiplex system in the same manner as described in the first embodiment.

Each computer included in the multiplex system has, in addition to the internal structure described in the first embodiment, parameter tables 136 to 137 relating to each multiplex system in the main storage device 112. Each of these multiplex systems is connected to the same Ethernet 401 and communicates with the service target device 402a or 402b to provide a calculation processing function. In addition, as in the first embodiment,
The network 401 may be something other than Ethernet. The number of service target devices is arbitrary, and one service target device may communicate with a plurality of multiplex systems and use these calculation processing functions simultaneously.

The computer 103 is connected to the SAN 201 and the Ethernet 401, but does not belong to any multiplex system at the time shown in FIG. This computer 103 can be incorporated in any multiplex system. Embedding is possible at any time.However, in general, when a failure occurs in one of the computers constituting the multi-system and it is incorporated as a substitute, and when any of the computers constituting the multi-system is maintained This is done when installing as a substitute to stop for work.

The computer 103 has a standby management program 13
4 is loaded and executed. Program 13
While Step 4 is being executed, it is possible to receive a request from another computer for incorporation into a multiplex system.

Although a shared disk device is used for each multiplex system, a single shared disk device may be shared by a plurality of multiplex systems. In this case, one shared disk device is included in a plurality of multiplex system zones.

Hereinafter, portions different from the first embodiment will be described in detail. The operation is described for the multiplex system 151, but the same operation is performed for the multiplex system 152.

FIG. 10 shows the structure of parameter tables 136 to 137 relating to a multiplex system. The parameter table stores a computer that can be a component of the multiplex system, a shared disk device of the component, and a combination of addresses of these components on the SAN 201.

As shown in FIG. 10, the multiplex system 15
In the parameter table 136 corresponding to 1, the computers 1 to 3 are stored, and in the parameter table 137 corresponding to the multiplex system 152, the computers 3 to 5 are stored. Thus, the computer 3 is defined so as to be able to operate as a component of any multiplex system.

Note that a computer already installed as a component of a certain multiplex system may be stored in a parameter table of another multiplex system. For example, the computers 4 to 5 in the state of FIG. 9 can be included in the parameter table 136. By defining in this way, for example, when the processing load in a certain multi-system increases, the computer already incorporated in another multi-system is temporarily deleted from the multi-system,
It becomes possible to incorporate into the multiplex system.

Next, a process for adding a computer to the multiplex system will be described. FIG. 11 shows a multiplex system 15.
Management program 13 on the computer incorporated in
2 shows a processing flow 601 of the second computer addition instruction processing. This process is automatically executed for the purpose of adding an alternative computer after disconnecting the faulty computer in the status monitoring process 551, or is requested by an operator or another program to change the configuration for maintenance or the like. Executed.

First, a request is made to the zone management server 211 to obtain all zone information set in the SAN 201 (602). Next, a computer to be added is selected (603). The computer to be added here is a computer that exists in the parameter table 136 for the multiplex system 151 and is not included in any zone.

The computer selected in this way is incorporated into the multiplex system zone corresponding to the multiplex system (60).
5) Request the standby management program 134 running on the computer to be added to join the node (60)
6). Upon receiving the request, the standby management program 134 activates the management program 132 on the computer and returns success of the request. If success is returned, the requesting source ends the additional processing (607).

On the other hand, if a failure is returned or there is no response, it is considered that the computer is stopped or the like, so the addition of the computer is stopped and the computer is removed from the multiplex zone (608). The user selects again whether there is any other computer to add (603). If there is no computer to select, the addition process fails (604).

FIG. 12 shows a processing flow 611 of the standby management program 134 on the computer 103 which is not incorporated in the multiplex system. First, it waits for a request for addition to the multiplex system to be sent via the SAN 201 (612). When an addition request is received, the parameter table 136 relating to the multiplex system is copied from the request source (613). Subsequently, a request is made to the management program 132 constituting the multiplex system, that is, operating on each computer included in the multiplex system zone, to add the computer to the status table 135 ( 614).

In each computer receiving this request, the state table 1
After adding the computer to 35, the computer operation state is set to "stop" and the operation state of each application is set to "stop". Next, the application 133 to be executed in the multiplex system is transferred from the local disk 115 to the main storage 1.
12 (615). Subsequently, the management program 132 for the multiplex system is started (61).
6).

By this program start processing 521, the relevant computer is updated to the “operating” state in the state table 135 of each computer of the multiplex system, and this computer newly starts to operate correctly as a component of the multiplex system. I do. Finally, the source of the addition request to the multiplex system is notified that the addition processing has been normally completed (617), and the processing ends.

In this processing, the type of the application 133 to be executed in the multiplex system is known in advance and the program is described as being on the local disk 115. In the boot process 521, application information and programs may be copied from another computer. That is, in the process 532, information such as the type of the application is passed as a part of the information of the state table to be copied, and after referring to this state table, the program body may be copied from the copy source of the state table.

In some cases, the SAN 201 has a function of notifying the connected node that the change has occurred when the zone configuration is changed. in this case,
By detecting this notification by the standby management program 134 of the computer to be added, it is possible to substitute for issuing a request for participation in the multiplex system (process 606).

FIG. 13 shows a processing flow 621 of a computer deletion process of the management program 132 on a computer incorporated in the multiplex system 151. This processing is requested and executed by another program to change the configuration for maintenance or the like.

First, a request to stop the operation is issued to the management program 132 running on the computer to be deleted from the multiplex system (622). At this time, there is a possibility that the management program 132 does not correctly process the request because the target computer is stopped, but the processing is ignored and the processing is continued. Then, the computer to be deleted is deleted from the multiplex system zone corresponding to the multiplex system (623).

The multiplex system according to the second embodiment of the present invention has been described. According to this embodiment, the components of the multiplex system can be defined as a SAN zone, that is, a group that permits communication, and can be set not to relay communication from outside the zone. Relaying of communication data from other multiplex systems or other devices above can be prohibited. As a result, the operation of one multiplex system can be prevented from affecting other multiplex systems. In addition,
When a failure occurs in any of a plurality of computers in a multiplex system, it is also possible to prohibit relaying communication data from the failed computer on the SAN.

Further, since information on the operating states of the computers constituting the multiplex system and the common backup computer is obtained from the SAN zone setting, it is not necessary to manage the state of all the computers for each computer. It is only necessary to use the zone setting information when needed.

Next, a third embodiment of the present invention will be described. FIG. 14 shows a configuration of a multiplex system according to the third embodiment.

In the present embodiment, the sub-management program 139 is loaded and executed on the main storage devices of the computers 101 and 102. The sub-management program 139 is, among the management programs 132 described in the first embodiment, a process of stopping the computer and a process of starting, stopping, and confirming the operation of the application 133 operating on the computer. It has only the communication function between The state table 135 is stored in the main storage device 112 on the computer.
Does not exist. Other internal structures on each computer are the same as those in the first embodiment described above.

The functions of the SAN 201 and the zone management server 211 and the virtual communication path management server 221 connected thereto are the same as those in the first embodiment. Also, the service target device 4 via the Ethernet 401
The second embodiment is also the same as the first embodiment of the present invention in that it provides a calculation processing function by communicating with the second embodiment.

The shared disk device 301 connected from the computers 101 and 102 has H for connecting to the SAN 201.
A BA 314 and a disk device 315 are mounted. H
The BA 314 interprets SCSI protocol communication data via the SAN and sends the data to the disk device 315.

The shared disk device 301 also includes a small processing unit 311 (hereinafter, referred to as “MPU”), a main storage device 312, and a recording device 313. These components and the HBA 314 are connected to each other by an internal bus 310. Have been. On the MPU 311, management processing for the shared disk device 301 is performed, such as instructing the operation of the normal HBA 314. The recording device 313 is a place for storing data to be recorded when the power supply to the shared disk device 301 is cut off, such as operation parameters, and a battery-backed SRAM or the like is used. The internal configuration and operation of the shared disk device 301 up to this point are general descriptions, and are the same in the case of the first embodiment.

The present embodiment is further characterized in that the MPU 311 on the shared disk device 301 executes the main management program 138 loaded on the main storage device 312. The main management program 138 has a function of managing the operation state of each computer on the multiplex system and the operation state of the application thereon. State table 13 in the main storage device 112 of the computer in the first embodiment
5 is located on the main storage device 312 on the shared disk device.

With such a configuration, the management of the operating state of each computer in the multiplex system and the operating state of the application thereon can be performed centrally in one shared disk device 301. Communication between the management programs 132 on a plurality of computers as in the embodiment described above eliminates the need to check the computer operation status and update the computer information and application information in the status table. This simplifies the configuration control procedure and improves reliability. Further, the procedure for changing the configuration information is also simplified because it is only reflected in the management table 135 on the shared disk device 301.

Hereinafter, portions different from the first embodiment will be described in detail. In this multiplex system, first, the shared disk device 301 is activated, and the main management program 138 is activated. The main management program 138 sends the computer 101,
102 and a setting of a multiplex system zone including the shared disk device 301 is requested. Next, “stop” is recorded in the operation state column 143 of each computer in the state table 135, and “stop” is also recorded in the execution state column 145 of each application.

FIG. 15 shows a processing flow 701 of the computer startup processing of the main management program 138. When the computer of the multiplex system starts, the sub-management program 139 on the computer starts and notifies the main management program 138 of the start of the computer. Upon receiving this notification, the process 701 is executed.

When the computer is started, a request is made to the virtual communication path management server 221 to set a virtual communication path between the starting computer and the shared disk device 301 (702). Thereafter, when the computer reads and writes data from and to the shared disk device 301, the computer executes the data using the virtual communication path set here.

Next, a request is made to the virtual communication path management server 221 to set a virtual communication path between the boot computer and the device on which the main management program 138 is running (ie, the shared disk device 301) ( 703). After that, communication between the main management program 138 and the sub-management program 139 of the boot computer is executed using the virtual communication path (management communication path) set here. Note that the selection criteria for parameters such as the communication bandwidth and the maximum delay time specified when setting the virtual communication path are the same as in the first embodiment.

Then, “operating” is recorded in the operating state of the boot computer in the state table 135 (704). Subsequently, the state table 135 is examined, and among the applications, the execution priority of the application is lower than the computer that has just started, that is, the numerical value of the execution priority 144 in the state table is set to be higher than the computer that has just started. Find what is running on the calculator. If there is an applicable application, execute it on the computer that has just started.
Instruct the sub-management program to perform the takeover process (7
05). The actual transfer processing instruction is performed as follows. (A) The main management program 138 requests the sub-management program 139 of the takeover source computer (lower priority) to stop the running application. (B) The sub management program 139 of the takeover source computer stops the application and notifies the main management program 138 of the stop. (C) The main management program 138 requests the sub-management program 139 of the takeover destination computer (higher priority) to start the application. (D) The sub-management program 139 of the takeover destination computer activates the application and notifies the main management program 138 of the activation. (E) The main management program reflects the new execution state in the column related to the execution state of the application in the state table 135.

FIG. 16 shows a processing flow 711 of the state monitoring processing of the main management program 138. This process is executed at regular time intervals after the main management program 138 is normally started. The processing is sequentially performed on the computers that are in the operating state in the state table.

First, each computer is requested to report the operation status of the application (712). Each computer checks the operation state of the application in the same manner as described in the first embodiment, and returns a result. Based on the returned report, it is confirmed from the operation table 135 whether each application in the “operation” state is operating normally on the computer (714).

When an abnormal operation is detected, it is determined that the application cannot operate on the computer, and
The next separation process (715) is performed. (A) Instruct the sub management program 139 on the computer to completely stop the application. (B) Set the contents of the computer row and the application priority column of the state table 135 to 9999 so that the application is not started on the computer thereafter.

Subsequently, referring to the updated state table 135, if there is an application to be started, the start is instructed to the sub management program 139 of the computer (71).
6). As a result, the application whose operation has become abnormal is taken over by another computer.

As described in the first embodiment, when an operation abnormality is detected, the operation is not immediately determined to be inoperable on the computer. Alternatively, the processing may be instructed to restart on the computer. Further, instead of the number of operation abnormalities, the frequency of abnormality detection may be used as a reference for determining whether or not operation is impossible.

In the process 713, since it is recognized that some failure has occurred in the computer that has not responded to the operation status report of the application, the following process of disconnecting the computer from the multiplex system is performed. (A) Remove the faulty computer from the zone defined as the multiplex system (717). (B) In order to prevent a malfunction of the faulty computer, the faulty computer is requested to stop. Specifically, a zone different from the multiplex system zone is defined between the fault computer and the device on which the main management program 138 is operating (that is, the shared disk device 301), and then a stop processing request is transmitted.
The zone is deleted (718). The processing on the fault computer side is the same as the processing 560 in the case of the first embodiment. (C) The row of the faulty computer is deleted from the status table 135 (719).

After that, the process 716 is executed, and as a result, the process of the fault computer is taken over.

FIG. 17 shows a processing flow 731 of the processing when the computer is stopped by the main management program 138. When the computer of the multiplex system is stopped, the stop processing of the sub-management program 139 on the stopped computer is executed, and all the applications running on the stopped computer are stopped.
The main management program 138 is notified of the stop of the computer. Upon receiving this notification, the process 731 is executed.

In the main management program 138, the status table 13
Column 14 of the computer operating state in the computer row to stop 5
3 is set to "stop", and the columns 145a and 145b of the execution state of each application are set to "stop" (732). Then, in the updated state table 135, if the application having the highest execution priority of the computer among the “operating” computers is stopped, the application is activated and the process is subsequently taken over (733). ).

It should be noted that, instead of executing the main management program 138 by the MPU 311 on the shared disk device 301,
Zone management server 211 and virtual communication path management server 221
It can be executed by the above CPU or by the MPU on the switch 231 configuring the SAN 201.

These devices are generally equipped with a CPU or MPU for realizing the original functions, and are also connected to a main storage device. Furthermore, since it is connected to the SAN 201, communication with the computers 101 and 102 and the shared disk device 301 is also possible, and the operation of the main management program 138 described above can be executed as it is. In this case, however, it is necessary to add the device itself when defining a multiplex system zone in order to communicate between the device and the computers 101 and 102 or the shared disk device 301.

The above is the description of the multiplex system according to the third embodiment of the present invention. According to the present embodiment, the SAN
The shared storage device connected to the device stores information related to the configuration control of the multiplex system therein and executes a part or all of the configuration control processing of the multiplex system. The procedure for holding and executing configuration control can be simplified.

[0138]

According to the present invention, since the SAN can be shared as the inter-computer link, there is an effect that the computers constituting the multiplex system can be installed at any positions. Also in this case, since the same real-time property as when a dedicated physical communication path is provided for management communication can be ensured, the state of configuration control can be determined without delay, and congestion in calculation processing can be minimized. This has the effect.

According to the present invention, since the components of a multiplex system are set as SAN zones,
Is not affected by the communication by another multiplex system using, and there is an effect that a malfunction of the configuration control is prevented.

Further, according to the present invention, information on the components of a plurality of multiplex systems and the backup computer is
Since it is only necessary to acquire from the zone setting information when it becomes necessary, there is an effect of simplifying management of configuration information in each computer.

Further, according to the present invention, the holding of the configuration control information of the multiplex system or the configuration control process of the multiplex system is executed separately from the low-availability computer itself in the redundant device. Therefore, there is an effect that reliable configuration control can be performed without requiring a new redundancy cost.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a multiplex system according to a first embodiment of the present invention.

FIG. 2 shows a storage system assumed by a multiplex system.
FIG. 2 is a block diagram showing a configuration of an area network (SAN).

FIG. 3 is a configuration diagram of communication data used in a SAN.

FIG. 4 is a processing flow diagram when a switch configuring the SAN receives communication data from a node.

FIG. 5 is a structural diagram showing management contents of a state table.

FIG. 6 is a processing flowchart at the time of starting a management program.

FIG. 7 is a processing flowchart of a status monitoring process of the management program.

FIG. 8 is a processing flowchart at the end of the management program.

FIG. 9 is a block diagram showing a configuration of a multiplex system according to a second embodiment.

FIG. 10 is a structural diagram of a parameter table relating to a multiplex system.

FIG. 11 is a processing flowchart of a computer addition instruction process of a management program on a computer incorporated in the multiplex system.

FIG. 12 is a processing flowchart of a standby management program on a computer that is not incorporated in a multiplex system.

FIG. 13 is a processing flowchart of computer deletion processing of a management program on a computer incorporated in a multiplex system.

FIG. 14 is a block diagram showing a configuration of a multiplex system according to a third embodiment.

FIG. 15 is a processing flowchart of a computer startup process of the main management program.

FIG. 16 is a processing flowchart of a status monitoring process of the main management program.

FIG. 17 is a processing flowchart of a computer stop time process of the main management program.

FIG. 18 is a block diagram showing a configuration of a multiplex system according to the related art.

[Explanation of symbols]

101, 102, 103, 104, 105 ... computer, 1
11 central processing unit (CPU), 116, 314
Host bus adapter (HBA) 132 132 Management program 133 Application 135 State table
201: Storage Area Network (SA)
N), 211: zone management server, 221: virtual communication path management server, 231: switch, 301, 302: shared disk device, 311: small arithmetic processing unit (MPU),
401 ... Ethernet, 402, 402a, 402
b: Service target device.

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Takao Nouchi 5-2-1, Omika-cho, Hitachi City, Ibaraki Prefecture Inside Information Control Systems Division, Hitachi, Ltd. (72) Inventor Hiromichi Endo Omika-cho, Hitachi City, Ibaraki Prefecture 7-1-1, Hitachi Research Laboratory, Hitachi, Ltd. (72) Inventor Hidemitsu Naya 7-1-1, Omika-cho, Hitachi City, Ibaraki Pref. Hitachi, Ltd. Hitachi Research Laboratory, Ltd. (72) Inventor Masahiko Saito, Ibaraki 7-1-1, Omika-cho, Hitachi City Hitachi Research Laboratory, Hitachi, Ltd. (72) Inventor Tetsuaki Nakamikawa 7-1-1, Omika-cho, Hitachi City, Ibaraki Prefecture F-term in Hitachi Research Laboratory, Hitachi, Ltd. (Reference) 5B034 AA04 BB17 CC01 DD02 5B042 GA11 GA34 JJ04 5B045 BB29 BB47 BB49 JJ08 JJ13

Claims (13)

[Claims] 1. A computer comprising: a plurality of computers; and a shared external storage device connected to the plurality of computers via a network and shared by the plurality of computers, wherein processing performed by any of the plurality of computers is performed by another computer. In a multiplex system in which any one of the computers takes over, or a part of the processing is shared and executed by another computer, a confirmation or change instruction of the operating state of the computer performed between the plurality of computers, or the plurality of A multiplex system, wherein management communication performed for confirming or changing an execution state of a process executed by a computer is performed on the network connecting the plurality of computers and the shared external storage device. . 2. The multiplex system according to claim 1, wherein the network includes a plurality of switches having ports and a storage area network having an inter-switch link between the switches. 3. The network according to claim 1, wherein the management communication performed between the plurality of computers is performed prior to the communication between the plurality of computers and the shared external storage device. A multiplex system comprising a network management means for setting a network system. 4. The storage data transfer method according to claim 1, further comprising virtual communication path management means for setting a plurality of virtual communication paths on the network, wherein the plurality of computers and the shared external storage device are connected to each other. A multiplex system, wherein communication and management communication performed between the plurality of computers are performed by different virtual communication paths. 5. The virtual communication path management unit according to claim 4, wherein the virtual communication path management unit sets the virtual communication path to the network so as to guarantee a maximum communication delay time or a communication bandwidth of the virtual communication path used by the management communication. A multiplex system characterized by the following. 6. A computer having a plurality of computers, and a shared external storage device connected to the plurality of computers via a network and shared by the plurality of computers, wherein processing performed by one of the plurality of computers is performed by another computer. In a multi-system in which one of the computers takes over or part of the processing performed by one of the plurality of computers is shared and executed by another computer, a plurality of computers of the multi-system and a shared external storage A zone management unit configured to set the network so as to prohibit the device from relaying communication data transmitted from another multiplex system or another device connected to the network. And a multiplex system. 7. A computer having a plurality of computers and a shared external storage device connected to the plurality of computers via a network and shared by the plurality of computers, wherein processing performed by any of the plurality of computers is performed by another computer. In a multiplex system in which one of the computers takes over or a part of the processing performed by one of the plurality of computers is shared and executed by another computer, a failure has occurred in any of the plurality of computers. In case,
A setting is made in the network so as to prohibit relaying of communication data transmitted from the faulty computer to the plurality of computers other than the faulty computer and the shared external storage device via the network. A multiplex system having zone management means. 8. A computer having one or more computers and a shared external storage device connected to the computer via a network, and adding another computer connected to the network as a computer constituting a self-multiplexing system. Possible, taking over the processing performed on any of the computers before addition to any of the other computers, or sharing a part of the processing performed on any of the computers before the addition with another computer When performing a computer addition process, the communication data transmitted from the computer is added to all of the computers and the shared external storage device configuring the multiplex system after the addition. A multiplex system comprising zone management means for setting the network so as to permit relaying through the network. 9. A computer having a plurality of computers and a shared external storage device connected to the plurality of computers via a network, wherein any computer can be excluded from the computers constituting the own multiplex system. A multiplex system in which a process performed by one of the plurality of computers is taken over by one of the other computers, or a part of the process performed by any of the plurality of computers is shared by the other computer and executed. In performing a computer exclusion process, relaying the communication data transmitted from the computer to all the computers constituting the multiplex system and the shared external storage device after the exclusion through the network. A multiplex system comprising zone management means for setting the network to be prohibited. 10. The storage area network according to claim 8, wherein the network is a storage area network having a plurality of switches having ports and an inter-switch link between the switches. A multiplex system characterized in that relaying or prohibition is set for the system. 11. A computer having a plurality of computers, and a shared external storage device connected to the plurality of computers via a network and shared by the plurality of computers, wherein processing performed by one of the plurality of computers is performed by another computer. Take over at one of the calculators,
Alternatively, in a multiplex system in which a part of the processing performed by any of the plurality of computers is shared and executed by another computer, the device constituting the network or the shared external storage device may be a computer of the plurality of computers. A multiplex system comprising a monitoring means for monitoring an operation state. 12. The multiplex system according to claim 11, wherein said monitoring means is a management program for a multiplex system executed on a device constituting said network or an arithmetic processing unit of said shared external storage device. System. 13. The computer according to claim 12, wherein the monitoring unit issues an instruction to change the operating state of the plurality of computers based on the monitoring result, or performs the instruction at one of the plurality of computers. A multiplex system which issues an instruction to change a processing execution state.