GB2262999A

GB2262999A - A fault tolerant processor

Info

Publication number: GB2262999A
Application number: GB9127552A
Authority: GB
Inventors: Frederick Finlay
Original assignee: I P TECHN Ltd
Current assignee: I P TECHN Ltd
Priority date: 1991-12-31
Filing date: 1991-12-31
Publication date: 1993-07-07
Anticipated expiration: 2011-12-31
Also published as: BE1003773A7; GB9127552D0; GB2262999B

Abstract

A fault tolerant processing apparatus 1 includes an off-host controller 12 which monitors operations of a communications circuit 13 and, on detection of a communications fault, sets a switch to the offline state and retrieves a remote host processor simulation programs from a fixed disk drive 4. This allows a local processor 2 to carry out processing operations while there is a communications fault. When communications is re-established the switch is set to the recovery state and captured data resulting from off-host processing is trickle fed to the host processor provided batch processing operations are not taking place at the host processor. The off-host controller 12 automatically generates reconnection signals while offline. Validation operations are carried out on data which is being trickle fed and access to the processor 2 may not be achieved unless security procedures are adhered to after the setting of the switch to the online state after recovery of data. <IMAGE>

Description

"A Fault Tolerant Processing Apparatus" The invention relates to a fault tolerant processing apparatus of the type which is required to carry out real-time, online processing of data while communicating with a remote host processor. Such an apparatus may, for example, be used at the branch of a financial institution, the host processor being located at the headquarters.

Maintenance of the communication link with the host processor is particularly important in such situations as it allows access of each branch to the records for customers and allows automatic and immediate updating of records so that a comprehensive and efficient service may be provided.

Furthermore, on an increasing basis such a service is expected by customers. Accordingly, there can be considerable disruption, loss of revenue and apparent lack of efficiency and ability to provide a good service to customers if the communications link with the host processor fails.

One approach to solving this problem is described in European Patent Specification No. 346946 (Tandem Computers). In this specification, a communication line controller is described in which there are multiple communication lines, two processors, two communications controllers and up to fifteen : line controllers. By providing additional equipment in this manner, communications problems can apparently be overcome.

However, a major disadvantage of this approach is that considerably more expense is incurred in installation of the additional redundant processors and controllers and also in maintenance of this equipment. This is particularly true where a financial institution may have many branches.

It is thus an object of the invention to provide a fault tolerant processing apparatus which may carry out real-time processing under normal conditions and continues processing in at least the majority of situations when the link has failed. Another object is to avoid the need for the expense of installation and maintenance of additional redundant equipment. A still further object is to minimise the generation of manual records under fault conditions.

The invention is directed towards provided such a processing apparatus.

According to the invention, there is provided a fault tolerant processing apparatus comprising: a fixed disk drive storing transaction data and host processor simulation programs; a user interface; a communications circuit having means for generating, transmitting, and receiving communications signals for a remote host processor via a modem; an off-host controller connected to the communications circuit, and comprising: a communication link status switch settable between online, offline, and recovery states; means for continuously monitoring the communications circuit; means for automatically directing generation of signals for re-connection with the host processor if the link fails; means for setting the switch to the offline state and means for retrieving the host processor simulation programs when the link fails; means for setting the switch to the recovery state and means for directing generation and transmission of trickle feed data signals to the host processor when the link is re established; and means for setting the switch to the online state if the link is established and all necessary data has been trickle feed to the host processor; and a local processor connected to the fixed disk drive, to the user interface and to the off-host controller, the local processor comprising: means for carrying out real-time processing operations in communication with the host processor via the communication circuit while the switch of the off-host controller is at the online state; and means for carrying out processing operations on the transaction data according to the retrieved host processor simulation programs while the switch is at the offline or recovery states and directing capture of the corresponding output signals in a capture file stored on the fixed disk drive, said captured data being for trickle feeding to the host processor.

In one embodiment, the off-host controller comprises means for determining from the host processor which data was communicated immediately before failure of the link and initiating trickle feeding of data to the host processor just after setting of the switch to the recovery state.

Preferably, the off-host controller comprises means for carrying out validation operations on the captured data before trickle feeding, and means for directing storage in the fixed disk drive of non-validated data.

In another embodiment, the off-host controller comprises means for monitoring operations of the host processor to check for initiation of batch processing thereof, and means for interrupting trickle feeding and for directing storage of remaining captured data in a file for generation of printed output if host processor batch processing begins during trickle feeding.

In a further embodiment, the local processor comprises means for preventing transmission of signals from the user interface without reception of a password after switching of the switch to the online state.

The invention will be more clearly understood from the following description of some preferred embodiments thereof, given by way of example only with reference to the accompanying drawing which is a schematic representation of a fault tolerant processing apparatus of the invention.

Referring to the drawing, there is illustrated a fault tolerant processing apparatus of the invention, indicated generally by the reference numeral 1. The apparatus 1 includes a local processor 2 which is constructed to carry out real-time processing operations on transaction data. The processor 2 is connected to three storage controllers 3, each connected to an associated fixed disk drive 4. The processor 2 is also connected to a tape controller 5, which is in turn connected to a bank of magnetic tape reel drives 6 and to a magnetic cassette tape sub-system 7. Line printers 8 are also connected to the processor 2. At input ports, the processor 2 is connected to two local terminal controller 10.

Terminals, not shown, connected to the controllers 10 act as the input and output user interfaces for the apparatus 1. For communication with a remote host processor, the apparatus 1 includes an off-host controller 12 connected to a communications circuit 13, which in turn feeds a modem 14.

The processor 2 is directly connected to both the off-host controller 12 and to the communications circuit 13.

In more detail, one of the fixed disk drives 4 stores a set of transaction data which is commonly used. Another fixed disk drive 4 stores host processor simulation programs. These programs enable the processor 2 to simulate operation of the host processor when interfacing with a user and operating on transaction data for the user.

The communications circuit 13 is constructed to generate signals incorporating data to be transmitted via the modem 14 to the host processor and for receiving return signals and redirecting the return signals as required. The communications circuit 13 also includes circuits for transmission over lengthy cables to local terminals.

The off-host controller 12 includes a communications status switch which may be set to one of three states. One state is "online" which indicates that the communications link with the host processor via the modem 14 is established and working correctly. The second state is "offline" which indicates that the link has failed. This may occur due to a breakdown in the modems at either end, due to breakdown of the host processor or due to severing of the leased or switched line. Finally, the third state is "recovery" which indicates that the communications link has been established but recovery operations, described in more detail below, are taking place.

Setting of the switch is enabled by continuous monitoring of the communications circuit 13 by the off-host controller 12.

The off-host controller 12 includes a circuit for automatically directing the communications circuit 13 to generate re-connection signals in an attempt to receive a reply if the communications circuit 13 fails to receive a reply from the host processor to outgoing signals. The offhost controller 12 automatically directs generation of such signals at regular intervals after the link has failed. In addition, the off-host controller 12 sets the status switch to the offline state immediately when the communications circuit 13 fails to receive a reply. If the link is not established in a short time interval, the off-host controller 12 additionally retrieves, via the direct link with the storage controller 3, the host processor simulation programs and stores these in random access memory, not shown.When this has been done, on receipt of a request for processing of data at the terminals, the processor 2 accesses the simulation programs in the random access memory, and the transaction data stored in the fixed disk drives 4, and carries out a range of processing operations on the data and communicates the output signals from these operations to the user via the terminals.

Because of use of the host processor simulation programs, the outputs at the terminals are similar to those which would be generated if the processor 2 were communicating with the host processor. The range of operations which may be carried out by the processor 2 under these circumstances does not include operations which necessarily involve connection with the host processor, for example, those requiring transaction data which is not stored in the fixed disk drives 4, or for which special processing operations are required. In practice, this means that regular customers may be dealt with for such operations as cash withdrawals and creation of new accounts. For new customers, for whom there is no stored transaction data, it would be necessary to use manual records.This is, however, generally a very slight disadvantage as the apparatus 1 may carry out most of the processing operations required for dealing with regular customers even when the link has failed.

Thus, regular customers will see that a service which is just as efficient and comprehensive as usual is being provided and indeed working practices of staff at a branch need not change when the link has failed because the output signals are similar to those which would be generated when the link is established. There is a further advantage in that no additional staff training is required for dealing with situations when the link has failed.

While transaction processing is taking place and while the status switch is at the offline state, the processor 2 captures all output data and directs storage of it in a capture file on a fixed disk drive 4. Generally, there would be ample storage capacity of the fixed disk drives 4 to cater for such a file.

Meanwhile, the off-host controller 12 is continuously directing generation of re-connection signals and when a reply is received from the host processor 2, the off-host controller 12 sets the switch to the recovery state. When this has been done, the off-host controller 2 accesses the file of captured data, retrieves blocks of the captured data and generates signals for trickle feeding of the data via the communications circuit 13 and the modem 14 to the host processor. The trickle feed signals are transmitted at 9,600 baud which is equivalent to data for one transaction being transmitted every three seconds. Before this is done, the off-host controller 12 has determined, from the host processor, the last data to be communicated so that it can verify that the first trickle fed data follows from what was processed previously.While generating signals for trickle feeding of data, the off-host processor 12 carries out verification operations to ensure that the data is in the correct format and that records which have been transmitted are complete. If any queries arise with data which is to be trickle fed, it is instead directed to a separate query file in a fixed disk drive 4.

When trickle feeding of all of the captured data is complete, the off-host controller 12 sets the switch to the online state, upon which the processor 2 resumes normal real-time processing. However, access to data via the terminals connected to the controllers 10 may not be achieved without re-input of passwords and complying with security procedures.

The reference passwords are stored in encrypted form. This helps to prevent unauthorised access of users to the host processor.

While trickle feeding is taking place, the off-host controller 12 monitors the host processor to check if batch processing is commencing. Such batch processing may be the batch processing carried out on accounts overnight. If such batch processing initiates while trickle feeding is taking place, the off-host controller 12 ceases to generate the trickle feed signals and directs all of the remaining captured data back to the fixed disk drive 4. Subsequently, the off-host controller 12 sets the switch to the online state. In addition, the processor 2 directs generation of reports for all captured data which is not fed back to the host processor during recovery. These reports are delivered to personnel for inputting directly to the host processor. This process ensures that batch processing of the host processor is not interfered with by a transaction processing apparatus in one or more branches.

It will thus be appreciated that the invention allows continuation of data processing for customers even when a communications link has failed. Thus, regular customers of a financial institution branch may obtain the service they are accustomed to and further, staff need not even be aware that a fault has occurred in many instances. This has been achieved at relatively little expense because redundant equipment is not required. This is particularly important where there are many branches.

The invention is not limited to the embodiments hereinbefore described, but may be varied in construction and detail.

Claims

1. A fault tolerant processing apparatus comprising: a fixed disk drive storing transaction data and host processor simulation programs; a user interface; a communications circuit having means for generating, transmitting, and receiving communications signals for a remote host processor via a modem; an off-host controller connected to the communications circuit, and comprising:: a communication link status switch settable between online, offline, and recovery states; means for continuously monitoring the communications circuit; means for automatically directing generation of signals for re-connection with the host processor if the link fails; means for setting the switch to the offline state and means for retrieving the host processor simulation programs when the link fails; means for setting the switch to the recovery state and means for directing generation and transmission of trickle feed data signals to the host processor when the link is re established; and means for setting the switch to the online state if the link is established and all necessary data has been trickle feed to the host processor; and a local processor connected to the fixed disk drive, to the user interface and to the off-host controller, the local processor comprising: means for carrying out real-time processing operations in communication with the host processor via the communication circuit while the switch of the off-host controller is at the online state; and means for carrying out processing operations on the transaction data according to the retrieved host processor simulation programs while the switch is at the offline or recovery states and directing capture of the corresponding output signals in a capture file stored on the fixed disk drive, said captured data being for trickle feeding to the host processor.

2. A fault tolerant processing apparatus as claimed in claim 1 wherein the off-host controller comprises means for determining from the host processor which data was communicated immediately before failure of the link and initiating trickle feeding of data to the host processor just after setting of the switch to the recovery state.

3. A fault tolerant processing apparatus as claimed in claims 1 or 2 wherein the off-host controller comprises means for carrying out validation operations on the captured data before trickle feeding, and means for directing storage in the fixed disk drive of non validated data.

4. A fault tolerant processing apparatus as claimed in any preceding claim, wherein the off-host controller comprises means for monitoring operations of the host processor to check for initiation of batch processing thereof, and means for interrupting trickle feeding and for directing storage of remaining captured data in a file for generation of printed output if host processor batch processing begins during trickle feeding.

5. A fault tolerant processing apparatus as claimed in any preceding claim, wherein the local processor comprises means for preventing transmission of signals from the user interface without reception of a password after switching of the switch to the online state.

6. A fault tolerant processing apparatus substantially as hereinbefore described with reference to and as illustrated in the accompanying drawing.