JPH1196033A - Information processor - Google Patents

Abstract

PROBLEM TO BE SOLVED: To inexpensively realize the sure and quick backup switching for a hot stand-by system. SOLUTION: When an active equipment 100 (1) breaks down, its auxiliary processor 120 (1) drives a reset signal RST to stop a main processor 120 (1), informs a reserve equipment 100 (2) of a break down informing telegram through a communication line 130 to allow a main processor 110 (2) in the reserve equipment 100 (2) to succeed operation. Or when the reserve equipment 100 (2) detects the break down of the active equipment 100 (1) by helth check and outputs a separation request telegram to the line 130 through an auxiliary processor 120 (2), the auxiliary processor 120 (1) starts a reset signal RST to stop the main processor 110 (1) and then the main processor 110 (2) succeeds the operation.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an information processing apparatus which operates as an active unit or a standby unit of a hot standby system in which a standby unit for backup of an active unit stands by in a hot state, and more particularly to a hot standby system. The present invention relates to an information processing apparatus suitable for speeding up backup switching and improving system operation rate.

[0002]

2. Description of the Related Art As a backup switching method of a hot standby system, a health check of an active device is periodically performed on a standby device side, and when a down of the active device is detected, the active device is separated by control from the standby device. After that, a system in which a spare machine takes over the work of an active machine has been widely adopted.

Further, in a duplex system composed of an active processing system and a standby processing system, an interrupt signal is sent to the standby processing system when a failure of the own processing system is detected in the active processing system, and an acceptance signal from the standby processing system is transmitted in response to the interrupt signal. Upon receipt, interrupt signal transmission flag information is set, and the standby processing system sends a forced stop signal to the active processing system after receiving the interrupt signal. The active processing system sends an interrupt signal when the forced stop signal is received. There is known a system switching control system in which the execution of processing of the own system is stopped on condition that the flag information is set, and the standby processing system takes over the processing of the active processing system (for example, Japanese Patent Publication No. 63-43771). .

[0004]

The above-mentioned system in which the backup of the active unit is detected by the health check by the standby unit and the backup is switched has a little lack of certainty. That is, in general, the health check is performed by the standby unit through the communication path between the standby unit and the active unit.
ou alive? ”Is sent to the current machine, and the response message corresponding to“ I am alive. ”Is confirmed by simple loopback communication. There is a risk that the down of the active device is erroneously detected or conversely overlooked. As a result, unnecessary backup switching may be activated or necessary backup switching may not be performed.

In a hot standby system, the backup switching time from when the active unit goes down to when the standby unit starts operating is a non-operation time. Therefore, the operating rate of the system greatly depends on the backup switching time. The backup switching time cannot be shorter than the health check time interval. However, the health check has the possibility of communication errors and missing telegrams as described above, and it is not reliable to determine that the active device is down with one confirmation response. Therefore, it is necessary to make the contents of the confirmation redundant, and as a result of the health check, the time required to determine that the state is down with sufficient accuracy is generally quite long, from tens of seconds to several minutes. Therefore, it has been difficult to reduce the backup switching time.

If the health check time interval is forcibly shortened to shorten the backup switching time,
As described above, there is another problem that the reliability is deteriorated, and that the computer time is largely divided due to the health check, leading to a decrease in the system throughput.

Further, the system switching control system disclosed in Japanese Patent Publication No. 63-43771 is intended to be applied to a hot standby system having a large number of working machines (working processing systems) and spare machines (standby processing systems). Must be connected by a signal line for transmitting an interrupt signal, a reception signal thereof, a forced stop instruction signal, etc. between the machine and the spare machine, and the problem that the backup switching mechanism becomes large-scale and expensive. is there.

An object of the present invention is to provide an information processing apparatus which operates as an active unit or a standby unit of a hot stun bus system without lowering the system throughput.
An object of the present invention is to provide an information processing apparatus capable of performing more reliable backup switching and shortening the backup switching time.

Another object of the present invention is to provide a hot standby system in which the number of active and standby units is large.
An object of the present invention is to provide an information processing apparatus which does not require a huge connection of signal lines for backup switching and can realize a backup switching mechanism at low cost.

[0010]

According to an aspect of the present invention, there is provided an information processing apparatus operating as an active unit or a standby unit of a hot standby system according to the present invention. Both means for activating backup switching for the active device and means for detecting backup of the active device during operation as a standby device and activating backup switching for the active device are provided.

When operating as an active unit, its down can be directly detected, so that backup switching can be promptly performed by starting backup switching from the down active unit. Then, even if the backup switching process fails (for example, the disconnection of the down active device cannot be normally transmitted to the backup device and the backup device does not perform the backup process), the backup of the active device fails. If it is detected on the spare device side, backup switching is started from the spare device when operating as a spare device, and there is a high possibility that the backup switching process will succeed. In other words, in the hot standby system using the information processing apparatus of the present invention, the backup switching start-up from the active unit and the backup switching start-up from the standby unit are used together, so that the backup switching time can be shortened as a whole and the fail-safe effect can be obtained. And increase the certainty of switching backups. Further, even when the standby unit detects the down of the active unit by using the same health check as the conventional one, it is not necessary to forcibly shorten the health check time interval to lower the system throughput.

Also, according to the present invention, a disconnection from the down active unit is notified to the standby unit for the active unit, and the down active unit is disconnected from the standby unit for the active unit. Is indicated. In this case, it is only necessary to provide a single communication path common to all information processing devices for the notification of the disconnection and the transfer of the disconnection instruction between the active device and the backup device related to the backup switching, and the information on the system Even when the number of processing devices is large, it is possible to avoid an increase in the size of the backup switching mechanism as in the method of JP-B-63-43771.

By the way, it may be inconvenient if backup switching is started from the active unit and the standby unit redundantly for the down active unit, and the disconnection process of the down active unit is performed repeatedly. For example, if the active device is disconnected by a system reset, the situation of the information processing apparatus at the time of the first reset is destroyed by the second reset, which may hinder the analysis of the cause of the down. According to the information processing apparatus of the present invention, such a disadvantage can be avoided because the information processing apparatus is provided with a means for preventing the execution of the disconnection process from being performed repeatedly when operating as the active device.

[0014]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a schematic block diagram showing an example of the information processing apparatus of the present invention used as an active unit or a standby unit in a hot standby system. In FIG. 1, the information processing apparatus 100 includes an auxiliary processing device 120 involved in backup switching, in addition to a main processing device 110 that executes a business process or a backup process.
The auxiliary processing device 120 includes a communication unit 121, a sensor interface unit 122, a communication port 123, a reset signal driving unit 124, and a control unit 125.

The reset signal driver 124 is a main processing unit 1
10 is driven by the reset signal RST. The communication unit 121 is a unit for transferring information between the main processing unit 110 and the auxiliary processing unit 120, and is, for example, a serial communication line or a shared memory or a shared register with the main processing unit 110. Sensor interface unit 12
2 is a main processing device 11 such as an abnormal operation of the main processing device 110, an abnormal voltage of the power supply 112, an abnormal operation of the cooling fan 114, or the like.
This is to detect an abnormality that cannot be continued with 0. The communication port 123 is a communication path 130 between the auxiliary processing devices.
For communicating with an auxiliary processing device of another information processing device connected to the information processing device. Using this communication path 130 between auxiliary processing devices, a notification of a failure occurrence and a notification of a disconnection request are transmitted between auxiliary processing devices of a plurality of information processing devices. The control unit 125 is a unit that controls each unit in the auxiliary processing device 120 and the like.

FIG. 2 shows an example of a hot standby system in which two information processing apparatuses shown in FIG. 1 are used as an active unit or a standby unit. In FIG. 2, the two information processing apparatuses 100 (1) and 100 (2) each have the configuration shown in FIG. 1, but the internal configuration is simplified to avoid complication of the drawing. Here, for convenience, the information processing device 100 (1) is an active device, and the other information processing device 10 (1) is
0 (2) will be described as a spare machine, but the reverse is also possible. The business resource 200 is an external storage device that stores data necessary for the main processing device to execute business processing,
It is a communication line or the like.

First, a case where backup switching is started from the standby unit 100 (2) will be described. In this case, the disconnection start operation of the active unit 100 (1) is performed by the disconnection start operation by the operator of the standby unit 100 (2).
Alternatively, an abnormality is detected by performing a periodic health check on the active device 100 (1). This health check is performed periodically from the standby unit 100 (2) to the active unit 10 as in the conventional case.
A confirmation message is sent to 0 (1), and the
This is performed by confirming the response message from (1). For example, in the spare machine 100 (2), the program on the main processor 110 (2) is
Instruct (2) to transmit a confirmation message to the active device. The control unit 125 of the auxiliary processing device 120 (2) that has received this instruction via the communication unit 121 sends a confirmation message for the active device 100 (1) from the communication port 123 to the communication path 130 between the auxiliary processing devices. In the active unit 100 (1), when the auxiliary processing unit 120 (1) receives this confirmation message via the communication port 123, the control unit 125 determines that the sensor interface unit 122 is normal unless the sensor interface unit 122 detects an abnormality. Is returned from the communication port 123 to the standby unit 100 (2) through the communication path 130 between the auxiliary processing devices. In auxiliary machine 100 (2), auxiliary processing device 120
(2) receives the response message at the communication port 123 and sends it to the main processing unit 110 (2) via the communication means 121. The program on the main processing unit 110 (2) determines whether the active unit 100 (1) is normal or abnormal by confirming a response message to the issued confirmation message.

In the standby unit 100 (2), when an abnormality in the operation of the active unit 100 (1) is detected by the health check, or when the operator performs the disconnection start operation, the program on the main processing unit 110 (2) is executed. Instructs the auxiliary processing device 120 (2) to disconnect the active device via the communication means 121. The control unit 125 of the auxiliary processing device 120 (2) transmits a disconnection request message to the active device 100 (1) from the communication port 123 to the communication channel 1 between the auxiliary processing devices.
30. As shown in FIG. 3, the format of the disconnection request message includes a destination address 300, a source address 301, and a disconnection command identifier 302. In this example, the address of # 1 is assigned to the active unit 100 (1), and the address of # 2 is assigned to the standby unit 100 (2).

This disconnection request message is sent to the active device 100
The communication port 123 is connected to the auxiliary processing device 120 (1) of (1).
Is received via When the control unit 125 of the auxiliary processing device 120 (1) confirms that the transmission destination address in the received disconnection request message matches the address of the own system, the control unit 125 determines that the message is a disconnection request message for the own system and outputs a reset signal. The drive unit 124 drives the reset signal RST to stop the main processing unit 110 (1). As a result, access from the main processor 110 (1) of the active unit 100 (1) to the business resource 200 is stopped. Thereafter, the main processing unit 110 (2) of the standby unit 100 (2) takes over the business processing using the business resource 200. Working machine 100
While each transaction is being processed by the main processing unit 110 (1) of (1), information indicating the processing progress status is sequentially stored in the business resource 200 by a special program on the main processing unit 110 (1). . Spare machine 100 (2)
Grasps the status of transaction processing by the active device 100 (1) based on this information, and
Can be appropriately taken over.

Next, a case will be described in which the active unit 100 (1) detects the abnormality and starts backup switching. Auxiliary processing unit 120 of working machine 100 (1)
In (1), the control unit 125 transmits the main processing unit 110 (1) through the sensor interface unit 122, such as a machine check of the main processing unit 110 (1), power supply abnormality, and cooling fan abnormality.
When (1) detects a failure state in which the operation cannot be continued, the reset signal driver 124 drives the reset signal RST to stop the main processing device 110 (1). As a result, the business resource 200 is separated from the active device 100 (1).

Thereafter, the control unit 125 of the auxiliary processing unit 120 (1) of the active unit 100 (1) sends a down notification message to the standby unit 100 (2) via the communication port 123 to the communication line 130 between the auxiliary processing units. Send out. This down notification message includes a transmission destination address 400, a transmission source address, and a message type, as shown in FIG. This down notification message is sent to the auxiliary processing unit 120 (2) of the standby unit 100 (2).
Via the communication port 123. The control unit 125 of the auxiliary processing device 120 (2) transmits the contents of the down notification message via the communication unit 121 to the main processing device 110 (2).
Pass to. When the program on the main processing unit 110 (2) confirms that the transmission destination address of the down notification message matches the address of the own system, the program starts the backup processing of the active device 100 (1) and transfers it to the business resource 200. The business process is taken over by referring to the stored processing progress information of the active device 100 (1). If the backup relationship between the standby unit 100 (2) and the active unit 100 (1) is clear,
Naturally, the down notification message may be a broadcast message (described later) as shown in FIG.

FIG. 5 shows an example of a hot standby system in which three information processing apparatuses shown in FIG. 1 are used as active and standby machines. In FIG. 5, three information processing apparatuses 10
Reference numerals 0 (11), 100 (12), and 100 (13) each have the configuration shown in FIG. 1. However, as in the case of FIG. 2, the internal configuration is simplified to avoid complication of the drawing. .

The business is composed of a series system of process A, process B, process C and process D, and four processes A, B, C and D need to operate simultaneously to execute the business. . The four processes are distributed to three information processing apparatuses and executed as active processes. Each process has process resources such as an external storage device and a communication line necessary for executing the function, and the process resources are connected so as to be mutually accessible from the information processing devices in a backup relationship. Also, it is assumed that a standby spare process is on standby on an information processing apparatus different from the information processing apparatus in which the current process is executed, corresponding to each current process.

In the example shown in FIG. 5, the information processing apparatus 100 (11) having the address # 1 is both a working machine for the process A and a spare machine for the process B. Wait for execution. Therefore, the process A resource 501 and the process B resource 502 are connected to the main processing unit 110 (11) of the information processing apparatus 100 (11). The information processing device 100 (12) at address # 2 is an active device for processes B and C, and is a standby device for processes A and D.
Normally, the current processes B and C are executed, and the preliminary processes A and
Wait for D to execute. Therefore, this information processing device 10
0 (12) main processing unit 110 (12) includes a process A resource 501, a process B resource 502, a process C
Resource 503 and process D resource 504 are connected. Further, the information processing device 100 (13) of the address # 3
Is the active machine for process D and process C
Normally, the active process D is executed, and the process C is awaited. This information processing device 10
The process C resource 503 and the process D resource 504 are connected to the main processing unit 110 (13) of 0 (13).

Each information processing device 1 as an active / standby machine
00 (11), 100 (12) and 100 (13) are the main processing units 110 (11), 110 (12) and 110
(13) By the above program, the status of the corresponding process is recorded on the virtual storage as the standby status storage status 511, 512, 513 as shown in the lower part of FIG. When the process is in the standby state, the address of the information processing apparatus to be backed up by the process is also recorded in these standby state storage states. For example, the standby state storage status 511 of the information processing device 100 (11) at the address # 1 is the information processing device 100 (11).
Shows that the active process A 521 and the backup process B 522 are in standby, and the backup process B 522 is on standby to back up the active process B 523 on the information processing device 100 (12) at address # 2. Similarly, in the standby state storage state 512 of the information processing apparatus 100 (12) at the address # 2, the active process B 523 and the active process C 524 operate on the information processing apparatus 100 (12).
Preparatory process A 525 is the information processing device 1 of address # 1
This indicates that the current process A on 00 (11) is backed up and the standby process D526 is on standby by backing up the current process D on the information processing device 100 (13) at address # 3.

Here, the information processing apparatus 10 at address # 2
The operation of the backup switching when the abnormality occurs in the main processing unit 110 (12) at 0 (12) will be described.

First, the information processing apparatus 100 in which a failure has occurred
The case where (12) starts backup switching by itself will be described. In the information processing device 100 (12), the auxiliary processing device 120 (12) is connected to the main processing device 1 (12) via the sensor interface unit 122, such as a machine check of the main processing device 110 (12), a power failure, and a cooling fan failure.
When 10 (12) detects that the operation cannot be continued, the control unit 125 of the auxiliary processing device 120 (12) drives the reset signal RST by the reset signal driving unit 124,
The main processing unit 110 (12) is used for processing resources 501 to 5
04, and in this case, conflicts in resource access with the information processing apparatuses 100 (11) and 100 (13) operating as standby devices are prevented. Thereafter, the information processing device 100
In the auxiliary processing device 120 (12) of (12), the control unit 125 sends a down notification message to the communication path 130 between the auxiliary processing devices via the communication port 123.

As shown in FIG. 6, the format of the down notification message is a broadcast notification to be received by the auxiliary processing devices of all the information processing devices in the system, and the broadcast address is set in the transmission destination address 601. , The address # 2 of the down-processed information processing apparatus 100 (12) is set to the source address 602.

Address # that received this down notification message
Auxiliary processing device 120 of one information processing device 100 (11)
(11) transmits the contents of the down notification message to the main processing unit 110 (11) by the communication means 121. The program on the main processing unit 110 (11) requires that the source address, ie, # 2, indicated in the down notification message, and the standby target address, ie, # 2, of the standby process B522 in the standby state storage status 511 match. To
The backup process B <b> 522 is operated as a working process. The spare process B 522 becomes an active process, and partially takes over the business using the process B resource 502.

Since the down notification message is a broadcast notification, the information processing apparatus 100 (13) at address # 3
Is also received by the auxiliary processing device 120 (13).
As a result, the information processing apparatus 100 (1
Also in 3), the same process switching is performed, the spare process C528 is set as the active process, and the business process is partially taken over using the process C resource 503. Thus, the information processing device 1 of the down address # 2
00 (12) except for the two information processing apparatuses 100 (1
Processes A, B, C, and D necessary for business processing are all provided on 1) and 100 (13), and business can be continued as before.

Next, a case in which backup switching is started from the standby unit will be described. Each information processing device 10
0 (11), 100 (12), and 100 (13) perform a periodic health check on other information processing devices that are standby targets of the backup process. For example, the main processing device 110 of the information processing device 100 (11) at the address # 1
(11) The above program is the standby state storage information 5
11, a confirmation message for the information processing device 100 (12) at the address # 2 which is a standby target of the preliminary process B 522 is transmitted to the communication path 130 between the auxiliary processing devices via the auxiliary processing device 120 (11). The health check of the information processing apparatus 100 (12) at the address # 2 is performed by confirming the response message to.

When the health check detects an abnormality in the information processing apparatus 100 (12) at address # 2 (the operator of the information processing apparatus 100 (11) at address # 1 operates the information processing apparatus 100 (12) at address # 2. Similarly, the program on the main processing device 110 (11) of the information processing device 100 (11) at the address # 1 is transmitted to the auxiliary processing device 120 (11) via the communication means 121. Information processing device 10 at address # 2
0 (12) is instructed. Auxiliary processing unit 120
The control unit 125 of (11) sends the disconnection request message (FIG. 3) to the information processing device 100 (12), which is the working device that has gone down, from the communication port 123 to the communication path 13 between the auxiliary processing devices.
Send to 0.

The auxiliary processing device 12 of the information processing device 100 (12) at address # 2 that has received the disconnection request message
At 0 (12), when the control unit 125 confirms that the transmission destination address in the disconnection request message matches the address of the own system, the control unit 125 determines that the message is a disconnection request message for the own system, and the reset signal driving unit 124 And reset signal R
By driving ST, main processing unit 110 (12)
Is stopped and disconnected from the process resources 501-504. Thereafter, the control unit 12 of the auxiliary processing device 120 (12)
5 transmits the down notification message, which is the above-described broadcast notification, to the communication path 130 between the auxiliary processing devices via the communication port 123. The information processing device 110 (11) of the address # 1 receiving the down notification message and the address # 3
The information processing apparatus 100 (13) switches the processes as described above, shares the processes B and C as the active processes, and continues the business process.

By the way, there is a possibility that disconnection of the same information processing apparatus is started repeatedly. For example, the information processing device that has generated an error drives the reset signal to the main processing device by its own activation, but the down notification message at that time is not transmitted normally to the other information processing device on the backup side, and then the backup In this case, the other information processing apparatus on the side detects the abnormality in the health check and sends a disconnection request message. If, in response to the disconnection request message, the information processing apparatus in which the abnormality has occurred drives the reset signal to the main processing apparatus again, the state of the information processing apparatus at the time of the first reset is not saved, and Interfere with the cause analysis. In order to prevent this, in each information processing device (100), the control unit (125) of the auxiliary processing device (120) counts the number of disconnections of the main processing device (110), and the count is zero. , The reset signal RST is driven, and the overlap driving of the reset signal RST is prohibited. Then, the control unit (125) clears the counter to zero when the main processing unit (110) is rebooted.

Up to this point, an example has been described in which the reset signal is used as a stopping means of the main processing unit for separating the active unit from the business resources or the process resources. In this case, the register contents at the time of the failure may be lost, which may hinder the measures against the failure. In order to prevent this, the auxiliary processing device uses an interrupt signal instead of the reset signal in the backup switching processing procedure described above, and the interrupted program on the main processing device stops accessing the business resource or the process resource. Procedures can be adopted. In addition, a response to stop access to the business resource or the process resource due to the interruption is transmitted from the main processing unit to the auxiliary processing unit within a predetermined time by the communication means. The reset may be performed from the processing device. By these means, it is possible to reliably disconnect the faulty machine, and to leave a fault situation as detailed as possible according to the degree of the fault in the information processing apparatus.

[0036]

As is apparent from the above description, according to the information processing apparatus of the present invention, it is possible to reliably and quickly switch the backup of the hot standby system.
Also, the backup switching time can be reduced without lowering the system throughput. Further, even when the number of information processing devices constituting the hot standby system is large, it is possible to avoid an increase in the size of the backup switching mechanism. Further, the status at the time of the downtime of the information processing apparatus to be switched can be saved. Therefore, it is possible to obtain the effects of improving the operation efficiency of the hot standby system.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration example of an information processing apparatus of the present invention used in a hot standby system.

FIG. 2 is a block diagram illustrating an example of a hot standby system including two information processing apparatuses according to the present invention.

FIG. 3 is a diagram illustrating an example of a disconnection request message.

FIG. 4 is a diagram showing an example of a down notification message.

FIG. 5 is a block diagram showing an example of a hot standby system in which three information processing apparatuses of the present invention mutually back up four processes.

FIG. 6 is a diagram illustrating an example of a down notification message.

[Explanation of symbols]

Reference Signs List 100 information processing device 110 main processing device 112 power supply 114 cooling fan 120 auxiliary processing device 121 communication means 122 sensor interface unit 123 communication port 124 reset signal driving unit 125 control unit 130 communication path between auxiliary processing devices 100 (1) information processing device ( 100 (2) Information processing device (spare device) 100 (11) Information processing device (active device and standby device) 100 (12) Information processing device (active device and standby device) 100 (13) Information processing device ( (Working machine and spare machine) 200 Business resources 501 Process A resources 502 Process B resources 503 Process C resources 504 Process D resources 511, 512, 513, 514 Standby state storage status RST Reset signal

Claims (3)

[Claims] 1. An information processing apparatus that operates as an active unit or a standby unit of a hot standby system, and detects a down of the active unit when operating as an active unit and activates backup switching for the active unit. An information processing apparatus comprising: a standby unit that detects a down of the active device during operation and activates backup switching for the active device. 2. A means for disconnecting the active device and transmitting a down notification to the standby device when the active device is detected to be down during operation as the active device, and receiving a down notification from the active device during operation as the standby device. Then, means for switching the spare machine to the working machine, and when the working machine is detected to be down during operation as a spare machine,
Means for transmitting a disconnection request to the active unit and switching the standby unit to the active unit; and a unit for disconnecting the active unit when receiving the disconnection request from the standby unit during operation as the active unit. The information processing apparatus according to claim 1, wherein 3. The information processing apparatus according to claim 1, further comprising: means for preventing a duplicate execution of the disconnection process during operation as an active device.