JPH04172536A - Resource management method in fault tolerant system - Google Patents

Abstract

PURPOSE:To simplify address control and so on to suppress an amount of processing calculation for taking a measure for fault by storing only resource information that is independent of an address of processing space in an intermediate storage medium. CONSTITUTION:When a request for using a file resource is issued from an application management section 202 to a file management section 201, the file management section 201 carries out the establishment processing for an open environment on a file management space A in operation. In this processing, file resource information that is independent of address on a virtual storage section 203 in space A is stored in an intermediate medium 204 and resource management mechanism B on memory section 203 and also resource such as queue information of an address dependent file is registered in mechanism B. When a fault occurs in space A, resource information is read from medium 204, resource in file management space A' is constructed, and registered in the entry on the same resource management mechanism B' as the entry on mechanism B for space A. With this, the relationship between resource and identifier is maintained even in space A', and the increase in amount of calculation is suppressed.

Description

[Detailed Description of the Invention] [Summary] Regarding a resource management method for a system that achieves fault tolerance by switching processing spaces, when the resource management space is switched due to the occurrence of a fault, registration in the old processing space in the new processing space is performed. It is possible to reconstruct similar resources depending on the address of the new processing space, and it is also possible to match the relationship between identifiers and resources reconstructed in the new processing space with that in the old processing space. When registering system resources in a processing space, the resources that depend on the address of the processing space are recorded in a resource management mechanism that is provided on virtual memory and corresponds to the processing space, and the resources are A resource registration process that issues a corresponding identifier and records resource information that represents the content of the resource and does not depend on the address of the processing space on an intermediate medium, and when a fault occurs in the processing space, the processing space and the original processing space are The corresponding original resource management mechanism is switched to another new processing space and the corresponding new resource management mechanism, and in the new processing space, the resource information recorded on the intermediate medium is read, and the resource Based on the information, a resource that has the same content as the resource registered in the original resource management mechanism and that depends on the address of the new processing space is rebuilt and re-registered in the new resource management mechanism, and in that case, a resource re-registration process in which the correspondence between each resource and its corresponding identifier is the same as the correspondence between each resource and its identifier registered in the original resource management mechanism; Configure to have.

[Industrial Application Field] The present invention relates to a resource management method for a system that achieves fault tolerance by switching processing spaces.

[Conventional technology]

With the increasing complexity of computer systems and the expansion of applications in various fields, the demand for highly reliable computers is increasing. As a system that requires particularly high reliability,
These include real-time systems such as seat reservation systems, online banking systems, electronic exchange systems, and space navigation systems where computer failures can be life-threatening. Calculators used in hectic situations make up the system! Even if a failure occurs, the system as a whole needs to continue to perform a predetermined function. A system that employs such an architecture for increasing system reliability is called a fault-tolerant system.

One method of realizing a fault-tolerant system is a system that achieves fault-tolerance by switching processing spaces. In such a system,
For example, when the operating system, which controls the basic operations of a computer system, is performing a specified process using virtual memory space, a fault occurs in the processing space due to an application program running out of control. In that case, the operating system switches from the faulted processing space to another spare processing space and continues the same processing.

In particular, consider the case where the above-mentioned processing space is a processing space that performs resource management such as file management. Such resource management processing is realized as a function of the operating system.

In such a resource management space, when an application program running in another general processing space makes a request to use resources available in the system (for example, a request to open a file), the request is processed. The resource is registered, and an identifier that can uniquely specify the resource is determined and issued to the application program. After receiving the above-mentioned identifier, the application program uses the resource via this tree.

Here, if a failure occurs in the resource management space due to, for example, a runaway processing program on the resource management space, the resource management space that has been providing services (hereinafter referred to as the "old processing space") before the fault occurs It is necessary to reconstruct the resource management state in exactly the same way on the switched new resource management space (hereinafter referred to as "new processing space").

In other words, in order to prevent the occurrence of a fault from affecting other general spaces where identifiers have been issued, resources similar to those registered in the old processing space must be rebuilt in the switched new processing space. A mechanism is needed to reconstruct the relationship between identifiers and resources so that it is the same as the relationship between identifiers and resources in the old processing space.

In this case, the resource management space as described above is a virtual storage space to which processing addresses are dynamically assigned for boat fishing, so simply mapping resources based on address correspondence will not provide a fault-tolerant system. cannot be realized. In other words, when reconstructing resources similar to those registered in the old processing space in the new processing space, it is necessary to reconstruct the resources in a manner that depends on the processing address of the new processing space. The relationships between identifiers and resources reconstructed in must match those in the old processing space.

As a first conventional example of realizing the above-described mechanism, there is a method in which the same processing instruction is executed twice in two spaces.

In addition, as a second conventional example, appropriate checkpoints (interruption points) are set in advance in the processing program, and for each checkpoint, the address-dependent resource management relationship between the currently operating space and the standby space is determined. There is a method of controlling the rain space so that they always match so that there is no inconsistency in the resource management relationship of the rain space even if the processing space is switched.

Furthermore, as a third conventional example, there is a method in which the same resource management mechanism is prepared in a separate space, and after switching to that space and registering address-dependent resources, the old identifier is updated to a new identifier.

[Problems to be Solved by the Invention] However, in the case of the first conventional example, the exact same processing instructions are executed in the two spaces, so if a fault occurs in one space, the fault will occur in the other space in exactly the same way. There is a high possibility that this will occur, and even if the processing space is switched, it will often result in a re-fault.

In addition, in the case of the second conventional example, the processing to synchronize the resource management relationships between the two spaces becomes complicated, reducing the processing speed, and if the interval between checkpoints is long, faults may occur. The problem is that there is a high possibility that a contradiction will occur in the resource management relationship between the two spaces and a synchronization loss will occur from the checkpoint immediately before the fault occurs.

Furthermore, in the case of the third conventional example, there is a problem that it takes time to update the identifier, and in some cases, the update of the identifier may be omitted.

The present invention makes it possible to reconstruct resources similar to those registered in the old processing space in the new processing space depending on the address of the new processing space when switching the resource management space due to the occurrence of a fault. The purpose is to make it possible to match the relationship between identifiers and resources reconstructed in the processing space with those in the old processing space.

[Means to solve the problem]

FIG. 1 is a diagram explaining the principle of the present invention. The present invention provides the first
It has a resource registration process as shown in FIG. 1(a) and a resource re-registration process as shown in FIG. 1(b).

First, the resource registration process shown in FIG. 1(a) will be explained.

This process is realized, for example, as a resource registration routine that is part of the file system function in the operating system, as shown in FIG. In the resource registration process, for example, when the operating system uses processing space A in the virtual memory space to register system resources such as files and peripheral devices in response to a request from an application program, the process depends on the address of the processing space. Resources are provided on virtual memory as shown in FIG. 1(a) and recorded in the resource management mechanism corresponding to processing space A.

Then, an identifier corresponding to the resource is issued to, for example, an application program that has issued a request to use the resource.

At the same time, resource information that represents the content of the resource and does not depend on the address of the processing space A is recorded on an intermediate medium such as an auxiliary storage device.

Next, the resource registration process shown in FIG. 1(b) will be explained.

In this process, when a fault occurs in processing space A, the operating system's supervisor function first transfers the original processing space A and its corresponding original resource management mechanism B to another new processing space A' and its corresponding original resource management mechanism. The corresponding new resource management mechanism B' is switched to.

The new processing space A' and the resource management mechanism B' are configured to be initialized as spare processing spaces and placed in a standby state, for example, when the system is started up. Alternatively, the configuration may be such that a new one is generated by the supervisor function when a fault occurs.

Subsequently, the resource information recorded on the aforementioned intermediate medium is read into the new processing space A'. This function is realized, for example, as a resource reading routine that is a part of the file system of the aforementioned operating system.

Next, based on the resource information, a resource that has the same content as the resource originally registered in the resource management mechanism B and that depends on the address of the new processing space A' is rebuilt.

Then, the above-mentioned reconstructed resources are re-registered in the new resource management mechanism B'. In that case, the re-registration is performed so that the correspondence between each re-registered resource and its corresponding identifier is the same as the correspondence between each resource and the identifier registered in the original resource management mechanism B. Specifically, for example, the re-registration is performed so that the entry of each re-registered resource on the new resource management mechanism B' is the same as the entry of each resource on the original resource management mechanism B. . This feature is
For example, it is realized as a resource write routine that is a part of the file system function of the aforementioned operating system.

[For production]

In the present invention, when registering resources in processing space A, resource information that represents the contents of each resource and does not depend on the address of processing space A is recorded on an intermediate medium separately from the resources that are actually registered in resource management mechanism B. Ru. In this way, by recording only the resource information on the intermediate medium at the time of resource registration, complicated processing such as address control is not required, and an increase in the amount of calculation for fault countermeasure processing can be suppressed.

If a fault occurs in processing space A and switching from there to processing space A' is performed, only the resource information is read from the intermediate medium and the new processing space A'
The resources are rebuilt depending on the address. By reconstructing new resources based only on resource information in this way, it is possible to prevent the cause of a fault occurring in the original processing space A from spreading to the new processing space A'.

Furthermore, the reconstructed resource information is used as a new resource management mechanism B'
control so that the correspondence between each re-registered resource and its corresponding identifier is the same as the correspondence between each resource and its identifier registered in the original resource management mechanism B. be done. As a result, an application program or the like that has issued a request to use the resource can use the resource based on the same identifier as before the fault occurred, without having to recognize the occurrence of the fault at all.

〔Example〕

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 2 is a block diagram of an embodiment of the invention.

The virtual storage unit 203 is a storage unit that executes all program processing, and is realized as a logical storage function that combines a main storage device and an auxiliary storage device in a general computer system.

The intermediate medium 204 is a storage unit that stores resource information (described later), and is realized as a function using, for example, an auxiliary storage device in a general computer system.

The file management unit 201 uses a part of the processing space (file management space) on the virtual storage unit 203 to manage files used by application programs.
If a failure occurs in the file management space, the intermediate medium 20
Processing such as extracting the resource information on 4 and switching to another processing space is performed. The management section is realized as a file system function of an operating system in a general computer system.

The application management unit 202 uses a part of the processing space (general space) on the virtual storage unit 203 to execute an application program. The management unit is realized as functions such as process management, program control, and job management of an operating system in a general computer system.

The operation of the above embodiment will be explained in detail below.

FIG. 3 is an explanatory diagram of the file management space initialization process controlled by the file management unit 201. This process is executed, for example, when starting up the operating system.

The file management unit 201 performs processing for managing files used by application programs, as will be described later in the explanation of FIG. To this end, the management section secures a file management space as shown in FIG. 3A on the virtual storage section 203, and then executes initialization processing on this space. As a result, the virtual storage unit 203 shown in FIG. 3B
Initialization of the resource management mechanism secured on the intermediate medium 20
4 initialization is performed. These functions will be described later in the explanation of FIG. After the initialization process, the file management unit 201 puts the file management space A into operation.

At the same time, the file management section 201
After securing a file management space similar to A in FIG. 3, shown as A' in FIG. 3, on 03, initialization processing is executed on this space. As a result, the resource management mechanism secured on the virtual storage section 203 shown in FIG. 3B' is initialized. This file management space A' and resource management mechanism B' are
As will be described later in the explanation of FIG. 5, this is a spare space that is switched and used when the file management space A in operation crashes (when a failure occurs).

After the above initialization processing, the file management unit 201 puts the file management space A' into a standby state.

Next, FIG. 4 is an explanatory diagram of the processing of the file management unit 201 when there is a request to open a file from the general space.

The application management unit 202 in FIG. 2 executes an application program in a processing space called a general space shown in FIG. 4C on the virtual storage unit 203. Here, if an instruction to open a file that is part of an application program is executed in general space C (
4), the application management unit 202 in FIG. 2 issues a request to use file resources to the file management unit 201.

In response, the file management unit 201 executes an oven environment establishment process on the file management space A that is in operation (FIG. 4, ■). In this process, the resource information of the file that does not depend on the address on the virtual storage unit 203 of the file management space A is transferred to the intermediate medium 204 and the virtual storage unit 203.
Resources such as file queue information (or exclusive information to be described later) in the oven environment that is stored in the resource management mechanism B above 3 and that depends on the address on the virtual storage unit 203 of the file management space A are stored in the resource management mechanism B. Registered in B. In this way, the resource information of files that do not depend on addresses is separated from the resources that depend on addresses, and the information is transferred to the intermediate medium 204.
This is the most distinctive feature of this embodiment. Details of the oven environment establishment process are shown in FIG.

The virtual storage unit 20 in FIG.
As shown in FIG. 5, the resource management mechanism B provided on the computer 3 consists of a resource management table B-1 and a control table B-2.

The file management unit 201 first stores the file type specified by the application program, the identification information of the open request source, and the file resource information independent of the address on the virtual storage unit 203 of the file management space A. The resource information of the oven environment itself, such as file exclusion strength, is written to the control table B-2 as shown in FIG. 5, and the information is also written to the control table on the intermediate medium 204.

Subsequently, the file management unit 201 acquires exclusive rights in the file management space A based on the above-mentioned resource information as a file resource that depends on the address on the virtual storage unit 203 of the file management space A. Resources such as exclusive information such as level and information on exclusive relationships with other files are written into the control table B-2 as shown in FIG. This information is not copied to intermediate medium 204.

Then, the file management unit 201 registers the resource by setting a pointer to the control table B-2 in a specific entry (which is referred to as i) on the resource management table B-1. Returning to FIG. 4 again, after the above operations, the file management unit 201 determines the identifier (ID number) corresponding to the entry i in the resource management table B-1 described above, and assigns the application in the general space C. Notify the program (Fig. 4 ■).

This identifier is automatically registered by the application management section 202 in relation to the general space C in an identifier management system provided on the virtual storage section 203. After this, the application management unit 202 in FIG. 2 performs file access based on this identifier.

Next, FIG. 6 is an explanatory diagram of the processing when a fault (failure) occurs in file management space A and it crashes, and the processing when a file close request is issued from an application program on general space C. be. Of these, the former process is the most relevant to the present invention.

When a fault occurs in file management space A, for example, one of the application programs running in parallel on a multitasking operating system runs out of control due to a bug or other cause, and the storage area of file management space A is There may be a case where the file management space A jumps and destroys its contents, or a failure occurs in the operating system itself and the contents of the file management space A are destroyed.

When file management space A crashes (Fig. 6 ■),
The file management unit 201 in FIG. 2 changes the spare file management space A', which has been placed in a standby state in the initialization process described in FIG. 3, from a standby state to an active state.

Here, in the intermediate medium 204, the virtual storage section 203 stores file resource information such as file type, oven requester information, exclusion strength, etc. by the oven environment establishment process (2) shown in FIG. 4 or FIG. Resource information that does not depend on the above address is stored. And intermediate medium 20
Since the contents of 4 are stored, for example, on the auxiliary storage device, the contents will not be destroyed even if the file management space A crashes.

Therefore, the file management unit 201 first executes a process of reading out resource information as inheritance information from the intermediate medium 204 on the newly activated file management space A' (FIG. 6, ■). Then, based on this resource information,
A process is executed to register resources such as file queue information (or exclusive information to be described later) that depends on the address on the virtual storage unit 203 of the file management space A' in the resource management mechanism B' (Fig. 6 ). This resource management mechanism B' is provided on the virtual storage section 203 by the file management section 201 in relation to the file management space A'.

The details of these processes in Figure 6 ■ and ■ are shown in Figure 7 [Phases] ~
Shown as @ processing.

The file management unit 201 first starts with the file management space A'.
Then, the process of reconstructing the resource management table B-1' related to the same space on the virtual storage unit 203 is executed (Fig. 7 [phase]
). This processing is part of the operating system's supervisor function.

Next, the file management unit 201 stores the file management space A′.
In the above, from the control table E (see FIG. 5) on the intermediate medium 204, the file type, identification information of the open request source, and file exclusion are obtained as file resource information that does not depend on addresses on the virtual storage unit 203. Load the resource information of the open environment itself, such as strength (Fig. 7 ■).

Next, the file management unit 201 stores the file management space A.
', resource management table B-1' as resource management mechanism B'
The following three processes for reconstructing the control table B-2' on the virtual storage unit 203 are executed (FIG. 70).

That is, the file management unit 201 is configured as shown in FIG.
The resource information read from the intermediate medium 204 through the process is written into the control table B-2' as shown in FIG.

Furthermore, the file management unit 201 stores the file management space A'
Exclusive information such as the exclusive level is acquired within the file, and the exclusive information is written in the control table B-2', and resources such as information on exclusive relationships with other files are also written in the same way.

Then, the file management unit 201 stores the resource management table B-1'
Resources are registered by setting a pointer to the control table B-2' in the entry i above. This entry i is set to be the same as the entry i on the resource management table B-1 regarding the file management space A before the crash. This processing is part of the operating system's supervisor function.

Returning to FIG. 6 again, by the above operations, file management processing can be restarted using the file management space A' switched from the crashed file management space A (FIG. 6 (2)).

As shown above, when a fault occurs in the file management space A, after switching to the file management space A', resource information independent of addresses on the virtual storage unit 203 is transferred to the intermediate medium. 204 and reconstruct the resources in the file management space A', which are registered in the entry i on the resource management mechanism B' that is the same as the entry on the resource management mechanism B regarding the crashed file management space A. As a result, the relationship between the resources and identifiers in file management space A can be maintained even in file management space A', and the application program in general space C will not be aware of the crash in file management space A. Processing in space can continue.

Finally, as normal processing, processing when a file close request is generated from an application program on -i space C will be described.

The application management unit 202 in FIG.
When the file close command is executed as a process of the above application program, the application management unit 202 records it on the identifier management mechanism on the virtual storage unit 203 provided corresponding to the general space C. The identifier is extracted and a request to close the file resource to which the identifier is added is issued to the file management unit 201 (FIG. 6).

In response, the file management unit 201 deletes resource information that does not depend on the address on the virtual storage unit 203 that is written on the intermediate medium 204 in the active file management space A′, and Delete the resources registered in the resource management mechanism B' on the storage unit 203 (Fig. 6)
).

Although the above embodiments have been explained using file resource management as an example, the present invention is not limited to file management, and can also be applied to various resources available on a computer system (for example, peripheral devices such as input/output devices). It can be applied to the management of resources (which is one of the resources).

〔Effect of the invention〕

According to the present invention, by recording only resource information on an intermediate medium during resource registration, complex processing such as at and response control is not required, and it is possible to suppress an increase in the amount of calculation for processing for fault countermeasures. becomes.

In addition, on the new processing space switched from the original processing space where the fault occurred, new resources are rebuilt based only on the resource information recorded on the intermediate medium, so that the original processing It is possible to prevent the cause of a fault occurring in a space from spreading to a new processing space.

Furthermore, application programs that issue requests to use resources do not need to be aware of the occurrence of faults;
It becomes possible to use resources based on the same identifier as before the fault occurred.

[Brief explanation of the drawing]

1(a) and 1(b) are diagrams explaining the principle of the present invention, FIG. 2 is a block diagram of an embodiment of the present invention, and FIG. 3 is a diagram illustrating initialization processing of a file management space. Figure 4 is an explanatory diagram of the process when a file is requested to open from the general space. Figure 5 is a detailed diagram of the open environment creation process. Figure 6 is the process when the file management space crashes and the general space. FIG. 7 is a detailed explanatory diagram of the file management space switching process. 201...File management unit, 202...Application management unit, 203...Virtual storage unit, 204...Intermediate medium. Patent applicant: Fujitsu Limited Block diagram of an embodiment of the present invention 7 Main management window F, llA
Two-wheel inertia space A' Fu Ding no 1 dynamic engineer!゛1 space,'') Ji;
Figure 1 $, Spatial Force・→ File Winterpu/Sugagugin Processing n
Explanatory diagram, Figure 4 File management space A Figure 5: Development of open environment destruction, clear blue light of Meibu

Claims (1)

[Claims] 1) When registering system resources in a processing space, resources that depend on the address of the processing space are recorded in a resource management mechanism provided on virtual memory and corresponding to the processing space, and a resource registration process that issues an identifier corresponding to the resource and records resource information that represents the content of the resource and does not depend on the address of the processing space on an intermediate medium; The processing space and the original resource management mechanism corresponding thereto are switched to another new processing space and the new resource management mechanism corresponding thereto, and in the new processing space, the resources recorded on the intermediate medium are The information is read, and based on the resource information, a resource that has the same content as the resource registered in the original resource management mechanism and that depends on the address of the new processing space is reconstructed to create the new resource. Re-register with the management mechanism so that the correspondence between each re-registered resource and its corresponding identifier is the same as the correspondence between each resource and its identifier that was registered in the original resource management mechanism. A resource management method in a fault-tolerant system, comprising: a resource re-registration process for re-registering resources; 2) In the resource re-registration process, the entry of each resource to be re-registered on the new resource management mechanism is the same as the entry of each resource corresponding to each resource on the original resource management mechanism. 2. The resource management method in a fault-tolerant system according to claim 1, wherein re-registration is performed so that the information becomes the same.