JP2000194624A - Computer system and communication recovery system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a computer system which can keep the consistency of communication data with another computer system without degrading the communication capability of a system that is kept in a normal processing state. SOLUTION: In a normal processing mode, the transmission/reception data are stored in a communication history recording area 121 via a transmission information store part 104 and a reception information store part 105. In a rollback mode, a transmission history comparison part 109 checks the occurrence state of communication based on the stored transmission/reception data and a reception information reproduction part 108 executes the transmission of data in the same procedure as that executed before occurrence of a failure while generating pseudo-reception of the data. If no change is recognized in the contents or procedure of the transmission data before and after the rollback, it is decided that the consistency of data is kept and the recovery of communication is over. Thus, the normal processing is executed. If the change is recognized in the contents or procedure of the transmission data, it is decided that the consistency of data is not kept and the recovery of communication is not over yet. Thus, a system is restarted or the communication is cut.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a computer system having a failure recovery function based on a checkpoint rollback method and a communication recovery method of the system.

[0002]

2. Description of the Related Art In recent years, the demand for reliability required for a computer system has become more sophisticated. When a failure occurs, processing is resumed after reproducing the state of the system to a previously collected checkpoint state. As a result, computer systems having a failure recovery function based on a checkpoint / rollback method for reducing the frequency of system downtime have begun to spread. FIG. 6 shows an example of a computer system having a failure recovery function based on this checkpoint / rollback method.

As shown in FIG. 6, a computer system having a failure recovery function based on the checkpoint / rollback method includes a CPU 900, a main storage device 920, a secondary storage device 930, a network card 940, a system bus 950, and the like. The computer system is provided with a state storage memory 910 for storing the state of the system at the time of a checkpoint, in addition to the basic components. The CPU 900 collects a system state at the time of a checkpoint and stores the system state in the state storage memory 910. The CPU 900 also stores the system state at the checkpoint from the state storage memory 910 when a failure occurs. And executes a rollback execution unit 902 that implements rollback by resetting the system based on the extracted information. The state of the system collected by the checkpoint collection unit 901 indicates that the CPU 9
00, the data in the main storage device 920 and the contents of the memory of the I / O device.

[0004]

By the way, when this computer system is communicating with another computer system via a network and a failure occurs and rollback is performed, the application process on the computer system is In order to return to the past state, the communication from the point of return to the point of failure is forgotten. Thereafter, in order to proceed with communication without contradiction, it is necessary to maintain consistency of communication data with the application process of the other party in some way.

Conventionally, for communication between a plurality of processes in the same computer system, various methods have been proposed for performing rollback while maintaining the consistency of the communication contents. It is assumed that the process can return to the checkpoint. Therefore, if the communication between the processes is replaced with the communication between the computer systems, this method cannot be used. This is because even if the computer system can be rolled back, the computer system of the communication partner cannot always be rolled back.

[0006] Therefore, in order to maintain the consistency of communication data after rollback even under such conditions, data transmission is delayed until the next checkpoint is collected, and is issued collectively after the checkpoint is collected. Is preferred.

[0007] Thus, when the state of the system returns to the checkpoint, data transmission performed before the occurrence of the failure is not lost after the failure. That is, it is possible to guarantee the consistency of the communication data with the communication partner.

However, on the other hand, there is a problem in that the transmission of data is delayed until a checkpoint is taken, thereby significantly reducing the communication capability of the computer system during normal processing.

The present invention has been made in view of such circumstances, and has been made to maintain the consistency of communication data with another computer system without lowering the communication performance of a system during normal processing. It is an object of the present invention to provide a computer system and a communication recovery method that can be used.

[0010]

According to the present invention, in order to achieve the above-mentioned object, during normal processing, transmission data transmitted to a network and reception data received from the network are stored, and rollback is performed. First, checkpoint collection is prohibited, data writing to the secondary storage device is suppressed, and the occurrence of communication is checked using the stored transmission / reception data, and data reception is simulated. The data transmission proceeds as before the failure while the communication is being generated, so that the communication state is shifted to the time of the failure. Then, when the data can be shifted to the time of the failure, that is, when there is no change in the content and order of the transmission data before and after the rollback, it is determined that the data consistency is maintained, and the communication recovery is completed. Thus, the collection of checkpoints is permitted and normal processing is resumed.

On the other hand, if the data cannot be shifted to the time of failure, that is, if the contents or order of the transmission data changes before and after the rollback, it is determined that data consistency is not maintained. In this case, it is assumed that the communication recovery is not completed, and the system is restarted or the communication is cut off to prevent the communication processing from proceeding in a state where the consistency is lost.

According to the present invention, during normal processing,
Since the transmission of data to the network does not need to be delayed until the next checkpoint is taken, it is possible to maintain the consistency of communication data with other computer systems without reducing the communication capacity of the system. It becomes possible.

[0013]

An embodiment of the present invention will be described below with reference to the drawings.

First, the principle of the communication recovery method of the present invention will be described with reference to FIG. FIG. 1A is a diagram illustrating a state of communication of the application processes A and B before a failure occurs.

Here, the application process A exists on a computer system having a failure recovery function by a checkpoint / rollback method, and this computer system applies the communication recovery method of the present invention. On the other hand, it is assumed that the application process B exists on a normal computer system.

First, it is assumed that after the computer system in which the application process A exists takes a checkpoint, the application process A transmits data a, and the data b is returned from the application process B which receives the data a. ,
It is assumed that the application process A having received the data b further transmits the data c, and thereafter, a failure has occurred.

FIG. 1B shows an example of successful communication recovery in the communication recovery method of the present invention.

After the computer system in which the application process A exists performs the rollback, the application process A transmits the data a in the same manner as before the failure. Next, the reception of the data b is reproduced in the computer system (the reception of the data b is generated in a pseudo manner). Thus, the application process A
Transmits data c. The state of the application process A once returned to the past due to the rollback, but has shifted to the state of transmitting the data c. Thereafter, the communication with the application process B can be continued as before the failure. At this stage,
According to the communication recovery method of the present invention, it is determined that the communication has been successfully recovered.

On the other hand, FIG. 1C is a diagram showing an example of a communication recovery failure in the communication recovery method of the present invention.

In FIG. 1C, after the reception of the data b is reproduced in the computer system, the processing of the application process A is different from that before the failure due to some cause (often a difference in the processing order or the resource allocation order). That is, the data d is transmitted. In this case, in the communication recovery method of the present invention,
Assume that communication recovery has failed.

In other words, the communication recovery method of the present invention is based on the observation that similar communication often occurs before and after rollback, and based on the observation that similar communication occurs, it is determined that communication recovery has succeeded. When the communication occurs, the recovery of the communication is determined to have failed, thereby making it unnecessary to delay the transmission of the data to the network during the normal processing until after the next checkpoint is collected. Here, for example, consider a case where a failure occurs while a certain application process is sending some file contents to a communication partner.

The application process on the transmitting side divides the contents of the file into several blocks and sends the data to the network as transmission data in order from the first block, while the application process on the receiving side combines the received blocks and combines them. Make up the file. The application process on the receiving side does not return a response every time a block is received. Then, it is assumed that a checkpoint is taken before the application process on the transmission side starts transmitting the contents of the file, and a failure occurs after transmitting the contents of the file to half.

In this case, due to the rollback after the occurrence of the failure, the application process on the transmitting side returns before transmitting the contents of the file. Then, if there is no condition such as resource shortage, the sending application process starts sending the contents of the file from the first block in the same way as before the failure, then the next block, and then the next block. Keep sending blocks. In such a case, the contents of the communication do not change before and after the rollback. That is, it can be determined that the communication recovery has succeeded and the process can proceed to the normal processing without any problem.

However, the contents of the communication may change. A typical example is a case where an application process on the receiving side returns an acknowledgment for the received data.

For example, in the above example, it is assumed that the application process A on the transmission side waits for an acknowledgment from the application process B on the reception side after transmitting the block, while the application process B on the reception side transmits the block. After receiving the acknowledgment, an acknowledgment is returned.

In this case, after the rollback, the application process A on the transmission side waits for an acknowledgment after transmitting the first block, but the application process B on the reception side has already received the block before the rollback and received an acknowledgment. Since it has been returned, the acknowledgment is not returned again. Therefore,
In this state, the application process A on the transmission side continues to wait for an acknowledgment from the application process on the reception side.

Therefore, the communication recovery method of the present invention copes with the problem by reproducing the recorded response (received data) before the failure and transferring it to the application process as if it had been received at that time.

As described above, if the transmission / reception packet is monitored and the received data before the failure is pseudo-received, the application process can be operated before the failure and the subsequent data transmission can be executed. become.

According to the communication recovery method of the present invention, if the transmission data generated after the rollback has also occurred before the rollback, the data is transmitted to the network.
This is a process for recording the transmission data before the rollback, but for transmitting the transmission data after the rollback when the transmission data has not actually arrived. This allows the communication partner to send the same data to 2
In most cases, there is no problem because the application process or communication protocol of the communication partner discards duplicate data in order to maintain communication reliability.

If similar communication occurs before and after the rollback, it is considered that the application program or communication protocol that was performing the communication repeated the operation before the failure, and the state almost returned to the time of the occurrence of the failure. It is thought that there is. Therefore, communication can be continued as described above.

On the other hand, when the same communication does not occur before and after the rollback, it is considered that the state of the application program and the communication protocol of the computer system does not reach the state at the time of occurrence of the failure. If communication is performed with the application program of the communication partner in this state, mutual data mismatch will occur, and communication will not be possible or wrong processing will occur. In the above example, for example, if a block cannot be transmitted due to insufficient resources after rollback, subsequent blocks are not transmitted, and communication before the failure is not reproduced. In this case, the receiving application process requests a block ahead of half of the file, but the source application process recognizes that it has not sent blocks of half the file.

In such a case, even if the failure is recovered, communication cannot be recovered. Therefore, in the communication recovery method of the present invention, processing such as restarting the system or disconnecting communication is executed. I do.

When the computer system is restarted without completing the communication recovery, the effect of the processing performed after the rollback must not be left. It should be restarted in the state at the time of failure like a normal computer system. Otherwise, unnatural data that does not match the data sent to the outside world after the restart will be present inside. Furthermore, due to the restart, the effect of the processing after the rollback does not remain in the memory, but may remain inside the secondary storage device.
Therefore, according to the communication recovery method of the present invention, the collection of checkpoints is prohibited from the rollback until the communication recovery is completed, and the writing to the secondary storage device that occurs during that time is prohibited.

FIG. 2 shows the configuration of a computer system according to this embodiment.

The computer system 10 shown in FIG. 2 is a computer system having a failure recovery function based on a checkpoint / rollback method.

As in the existing computer system, a CPU 100, a main storage device 140, a secondary storage device 150, and network cards 130 and 160 as hardware for communication are connected to the computer system 10.

The network card 130 is a communication medium 2
1 while the network card 160
Are connected to the communication medium 31. The computer system 20 is connected to the communication medium 21, and the computer system 30 is connected to the communication medium 31. The computer systems 20 and 30 do not have a failure recovery function based on the checkpoint rollback method.

The computer system 10 is connected to a state storage memory 120 for storing the state of the system at the time of the checkpoint.

The computer system 10 stores an operating system 114 as software. The operating system 114 includes a communication protocol and a device driver for driving the network cards 130 and 160, and provides a communication unit using the communication protocol to an application process. The application process of the computer system 10 is as follows.
It communicates with 30 application processes.

The computer system 10 includes, as software, a checkpoint collection unit 101 for storing a system state in the state storage memory 120 for each checkpoint, and a state storage memory 120 after a failure occurs.
A rollback execution unit 102 that acquires the state of the system at the checkpoint and resets the system, and a write delay unit 103 that delays writing of data to the secondary storage device 150 until after the checkpoint is collected. . When receiving a request to prohibit collection of checkpoints from outside, the checkpoint collection unit 101 stops its execution until a request for permission is received.

In this embodiment, the state storage memory 12
The number of system states to be stored in 0 is one, and the rollback execution unit 102 returns the system to the state of the previous checkpoint.

The computer system 10 includes a transmission information storage unit 104 and a reception information storage unit 10 unique to the present invention.
5, a communication monitoring start unit 106, a communication monitoring end unit 107, a reception information reproduction unit 108, a transmission history comparison unit 109, a communication recovery completion unit 110, and a restart unit 111 are stored as software. Further, timers 112 and 113 for calling the reception information reproducing unit 108 are provided as hardware or software. This timer is
As many as the number of communication media in the computer system are provided. In this example, timers 112 and 113 are used to reproduce data received from communication media 21 and 31, respectively.
Is used.

Next, the processing flow of the computer system 10 will be described.

In the computer system 10, during normal operation, the checkpoint collection unit 101 periodically collects the state of the system, for example, the contents of the register of the CPU 100 and records it in the state storage memory 120.

When data is transmitted to the communication medium 21 or 31 during the normal processing, the transmission information storage unit 104
It operates to store information on transmission data in the communication history storage area 121 in the order of occurrence for each communication medium 21 or 31 of the transmission destination. Further, when data is received from the communication medium 21 or 31, the reception information storage unit 105 operates to store the information on the reception data in the communication history storage area 121 in the order of occurrence for each of the communication media 21 or 31 of the reception source. .

The communication history storage area 121 may be on any memory as long as the memory area is not changed by rollback. In this embodiment, it is located inside the state storage memory 120. Since the rollback only returns to the previous checkpoint, the communication history storage area 121 may be deleted after the checkpoint is collected.

The information stored by the transmission information storage unit 104 and the reception information storage unit 105 is a transmission / reception data body and a tag. The transmission / reception data body includes a header part and a data part of the communication protocol. The tag indicates whether the information is transmission data or reception data. For example,
The tag “S” is added to the transmission data and the tag “R” is added to the reception data. In addition, the transmission history comparison unit 109 and the reception information reproduction unit 1
08 is provided with a mark area for marking a certain mark in order to manage transmission / reception data. FIG. 3 shows the structure of the communication history recording area 121.

On the other hand, when a failure occurs, the rollback execution unit 102 reproduces the state of the system at the time of the checkpoint. At this time, the network cards 130, 16
The state of the hardware 0 also shifts to a state in which transmission and reception are possible. Note that the failure is a failure not caused by hardware and software related to communication.

Hereinafter, communication recovery by the communication recovery method of the present invention will be described in detail.

First, the communication monitoring start unit 106 issues a request to stop transmission to the transmission information storage unit 104 and the reception information storage unit 105 and a request to prohibit collection to the checkpoint collection unit 101. As a result, collection of the checkpoint is stopped, and no data is written to the secondary storage device 150 thereafter.

Next, the communication monitoring start unit 106 activates all the communication media 21 and
The timers 112 and 113 for 31 are set. It is preferable that the time until the timers 112 and 113 activate the reception information reproducing unit 108 is a checkpoint collection interval or a time several times as long as the checkpoint collection interval.

FIGS. 4 and 5 show transmission history comparing section 109.
4 shows a flowchart of an operation performed by the reception information reproducing unit 108.

For example, when data transmission to the communication medium 21 occurs, the transmission history comparison unit 109
In the information recorded in the communication medium 21, the main body of all transmission data relating to the communication medium 21 is compared with the main body of the generated transmission data (step A1). Communication history recording area 1
21 is the same as the transmission data generated in the main body of the transmission data (Y in step A2).
ES), the data is transmitted to the communication medium 21 (step A3), and if not, the transmission of the data is suspended until the communication recovery is completed (step A8). Then, the information of the transmission data found in the communication history recording area 121 is marked (step A4). This mark indicates that the transmission data has been reproduced after the rollback. After the marking, the communication recovery completion section 110 is executed (step A5) to check whether the communication recovery is completed. If not completed (NO in step A6), in order to continue the communication recovery, the timer 112 related to the communication medium 21 to which the data has been transmitted among the timers for activating the reception information reproducing unit 108 is temporarily canceled, and after a predetermined time, It is reset to be activated (step A7).

The transmission data bodies may be compared with each other in data units such as octets. Also,
In order to regard two transmission data as being the same, a comparison function is defined and used according to the communication protocol that constituted the transmission data. For example, assume that there is a communication protocol that embeds the time in a part of certain transmission data. Looking at the data generated by this communication protocol, the main parts of the data generated before and after the failure have different time parts. But,
If it is assumed that the difference between the transmitted times before and after the failure does not particularly change the computer system of the communication partner, in this case, a function for comparing two pieces of transmission data except for the time portion may be defined and used. Properly making the comparison function makes it possible to more reliably find the information of the same transmission data from the information of the transmission data recorded in the communication history recording area 121. Increase the probability.

[0055] The reception information reproducing unit 108 is started by a timer. The timer notifies the received information reproducing unit 108 of the communication medium to be noted. For example, the timer 112
Executes the reception information reproducing unit 108 and informs the user that attention should be paid to the communication medium 21. Reception information reproducing unit 10
8, first, the main body of the received data relating to the communication medium 21 of interest recorded in the communication history recording area 121 is checked in order from the oldest occurrence time, and one unmarked one is found (step B1). ). If the body of the received data is found (YES in step B2), the received data is reproduced from the body of the received data (step B3), and the received data is transmitted to the computer system as if it were received from the communication medium 21 of interest. Hand over to 10 communication protocols. Then, the information of the reproduced received data is marked (step B4). Thereafter, the timer 112 relating to the communication medium 21 of interest is temporarily canceled and reset (step B5).

On the other hand, if the main body of the received data is not found in step B2 (NO in step B2), it is determined that communication recovery could not be completed, and the restart unit 111 is executed to restart the system (step B6). .

The communication recovery completion section 110 is called from the transmission history comparison section 109. The communication recovery completion unit 110 checks whether or not the body of all transmission data recorded in the communication history recording area 121 is marked. If all the transmission data are marked, it means that all the transmission data transmitted before the failure has been reproduced after the failure, and it is determined that the communication recovery has been completed.

When the communication recovery completion unit 110 determines that the communication recovery has been completed, it calls the communication monitoring termination unit 107. The communication monitoring end unit 107 notifies the check point collection unit 101 of permission for collection. As a result, the writing of data to the secondary storage device 150 is restarted. Or later,
The computer system 10 shifts to a state where communication can be performed as in the normal state.

As described above, according to the communication recovery method of this embodiment, the transmission of data to the network during normal processing is not delayed until the next checkpoint is taken, and the communication data after recovery from the failure is recovered. It is possible to maintain consistency.

In the above-described embodiment, information of transmission / reception data is managed for each communication medium. However, it is also effective to further divide the information and manage each communication protocol and each communication port of an application process.

[0061]

As described above in detail, according to the present invention, for example, in a computer system having a failure recovery function by a checkpoint rollback method for communicating with a communication partner that cannot perform rollback, It is possible to maintain the consistency of the communication data after the failure recovery without delaying the communication output processing to the check point during the normal processing. That is, during the normal processing, by not performing the delayed execution of the data transmission, it is possible to prevent a decrease in the communication capability.

[Brief description of the drawings]

FIG. 1 is a diagram for explaining the principle of a communication recovery method according to the present invention.

FIG. 2 is a diagram showing a configuration of a computer system according to the embodiment of the present invention.

FIG. 3 is an exemplary view showing the structure of a communication history recording area according to the embodiment;

FIG. 4 is an exemplary flowchart illustrating an operation procedure of a transmission history comparison unit according to the embodiment.

FIG. 5 is an exemplary flowchart illustrating the operation procedure of the reception information reproducing unit of the embodiment.

FIG. 6 is a diagram illustrating an example of a computer system having a failure recovery function based on a conventional checkpoint / rollback method.

[Explanation of symbols]

 10, 20, 30 Computer systems 21, 31 Communication media 100 CPU 101 Checkpoint collection unit 102 Rollback execution unit 103 Write delay unit 104 Transmission information storage unit 105 Received information storage unit 106 Communication monitoring Start unit 107: Communication monitoring end unit 108: Reception information reproducing unit 109 ... Transmission history comparison unit 110: Restart unit 112, 113 ... Timer 114 ... Operating system 120 ... State storage memory 121 ... Communication history recording area 130, 160 ... Network card 140: Main storage device 150: Secondary storage device

Continued on front page F-term (reference)

Claims (7)

[Claims] 1. A computer system having a failure recovery function based on a checkpoint rollback method and delaying the writing of data to a secondary storage device until after the next checkpoint is collected. Communication history storage means for sequentially storing received data; and communication monitoring start means for prohibiting data storage in the communication history storage means and collection of the checkpoint after a failure has occurred and rolled back to a checkpoint. When data transmission to the network occurs after rolling back to the checkpoint, the transmission data is compared with the transmission data stored in the communication history storage unit, and the same data is stored in the communication history storage unit. If so, send that data to the network. Transmission history comparison means to execute, and reception data stored in the communication history storage means when transmission to the network for the transmission data stored in the communication history storage means has not occurred within a predetermined time. Receiving data reproducing means for reproducing the data as received data, and when all the transmission data stored in the communication history storing means are transmitted to the network within a predetermined time after the rollback, determine that the communication recovery is completed. A computer system comprising communication recovery completion means. 2. When the communication recovery completion means determines that the communication recovery is completed, checkpoint collection is permitted, and when the communication recovery completion means does not determine that the communication recovery is completed, 2. The computer system according to claim 1, further comprising a communication monitoring termination unit that restarts the system. 3. The transmission history comparison means, if there is no identical data in the communication history storage means, suspends the data transmission until communication recovery is completed.
Computer system as described. 4. The transmission history comparison unit and the received data reproduction unit, according to claim 1, mark the data stored in the communication history storage unit corresponding to the transmitted data and the reproduced data. Computer system. 5. The computer system according to claim 1, wherein said communication history storage means stores said transmission data for each communication port used by an application process or a communication protocol. 6. A communication recovery method for a computer system having a failure recovery function based on a checkpoint rollback method and delaying the writing of data to a secondary storage device until after the next checkpoint is collected. The steps of sequentially storing data transmitted to the network and data received from the network at the time of checkpoint collection, and performing the storage step and collection of the checkpoint at the time of communication recovery processing after rolling back to the checkpoint due to a failure. Prohibiting, and when data is transmitted to the network, comparing the transmitted data with the transmitted data stored in the storing step, and transmitting the transmitted data to the network if the same data is stored. If it is not saved, Waiting for transmission of the data to the network until communication recovery is completed; and when the transmission to the network has not occurred within a predetermined time for the stored transmission data, the stored reception data Reproducing all of the stored transmission data within a predetermined time after the rollback, and determining that communication recovery has been completed. Communication recovery method. 7. The method further comprises the steps of: permitting collection of a checkpoint when it is determined that communication recovery has been completed; and restarting the system when it is not determined that communication recovery has been completed. 7. The communication recovery method according to claim 6, wherein