JP2000215074A - Operation system for system and automatic fault recovery system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To obtain an operation system for a communication system and an information processing system and a fault recovery system which can securely detect a fault, facilitate automatic recovery from the fault, and are small in economical load for installation and reduce the installation space. SOLUTION: The system is equipped with a process control part 2 which controls the operations of all processes that the system is equipped with, original processes 3 and 4 having operation program for the system operation and all operation managing programs managing the system operation, and clone processes 3a and 4a having necessary irreducible operation managing programs among the operation managing programs of the original processes 3 and 4, and a periodic communication is made between the original processes 3 and 4 and clone processes 3a and 4a.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system operation system and an automatic recovery system for a communication system or an information processing system, and more particularly to a system capable of reliably detecting a failure and facilitating automatic recovery from a failure. Thus, the present invention relates to a system operation method and a failure recovery method that can reduce the economical burden of installation and reduce the installation space.

[0002] In communication systems and information processing systems, it can be said that there is no one that does not handle online data. The most important thing in a system that handles such online data is that there is no system down, that is, to ensure high reliability, but to ensure the reliability of failure detection, the ease of automatic recovery, and the high reliability. It can only be said that a practical system can be achieved if it is backed by the economic burden and reduced installation space.

The means for eliminating the system down has been researched and developed from various aspects. However, it is still not sufficient, and it is possible to reliably detect the failure, and it is easy to automatically recover from the failure. Development of a system operation system and an automatic failure recovery system that can reduce the economic burden and reduce the installation space is awaited.

[0004]

2. Description of the Related Art FIG. 16 shows a configuration of a conventional operation system of a duplex system.
04, "Redundant system switching system of communication system" and JP-A-8-316957, "Redundant network management system".

In FIG. 16, reference numeral 51 denotes hardware of the first communication apparatus, 52 denotes an application program of the hardware 51 of the first communication apparatus (in FIG. 16, only an application is described). 53 is hardware of the second communication device, 54 is an application program of the hardware 53 of the second communication device,
Reference numeral 55 denotes a monitoring switching device.

In the configuration shown in FIG. 16, for example, when the hardware 51 of the first communication apparatus is used as an active system (also referred to as an operation system, an operation system, or an act system), the first communication device is not used. The hardware 53 of the second communication device is a standby system (sometimes called a standby system or a standby system), and the information being processed is not used, and the hardware of the first communication device is not used. The information that is being processed for the first time when the wear 51 has failed is used.

To explain a little supplementary explanation, in the normal case, the same communication line on the incoming side is connected to both the hardware 51 of the first communication device and the hardware 53 of the second communication device. Both receive the same information and receive an application program 52 of the first communication device and an application program 5 of the second communication device, respectively.
4 in the same communication process.

However, the hardware 51 of the first communication device is an active system and the hardware 53 of the second communication device is
Is the standby system, the processing output of the hardware 51 of the first communication device is supplied to the output communication line, and the processing output of the hardware 53 of the second communication device is output to the output communication line. Has not been supplied. In other words, physically both systems are operating, but only one processing output is used.

While the hardware and the application of the active communication device and the hardware and the application of the standby communication device are operated in this way, the monitoring and switching device 55 is connected to the hardware of the first communication device. 5
1. The monitoring of the behavior of the application program 52 of the first communication device, the hardware 53 of the second communication device, and the application program 54 of the second communication device is continued. In the case of FIG. 16, it is assumed that the monitoring switching device 55 performs monitoring via the application program 52 of the first communication device and the application program 54 of the second communication device.

When it is detected that there is a failure in either the hardware 51 of the first communication device or the application program 52 of the first communication device, the monitoring switching device 55 sets the outgoing communication line. Is switched from the hardware 51 of the first communication device to the hardware 53 of the second communication device.

Here, both the hardware 53 of the second communication device and the application program 54 of the second communication device are physically in use, and the switching is usually performed electronically. Since consideration is given to the phase synchronization between the system and the standby system, the time from the detection of a failure to the end of switching and the restoration of the system may be considered to be very short.

FIG. 17 shows the configuration of a conventional failure recovery system.
For example, this is described in Japanese Patent Application Laid-Open No. Hei 3-148331 “System restoration method”. This assumes a system failure recovery method in a personal computer having a plurality of processing functions.

In FIG. 17, reference numeral 61 denotes a process control unit which includes a failure detecting means 61-1 and a failure recovery means 61-2. 62 to 64 are the process control units 61
Is a process that operates in cooperation under the control of
Denotes a process A, 63 denotes a process B, and 64 denotes a process C.

In the configuration shown in FIG.
1-1 constantly monitors the states of the process A62, the process B63, and the process C64, determines the part causing the detected failure, and notifies the failure recovery unit 61-2 of the determination result. The failure recovery means 6 that has been notified
1-2 performs a recovery process in accordance with the failure site and the failure content. For example, when the failure site is specified as the process C64, the failure content is closely related to the original function of the process C64, and therefore, a recovery process specific to the process C64 is performed.

Therefore, in a normal case, the recovery process can be automated, and the recovery process of the failed process and the original process in the process that continues the normal operation are performed in parallel.

Further, in the configuration of FIG. 17, since there is no need for duplication, it is possible to avoid an increase in system scale.

[0017]

However, the configuration shown in FIG. 16 uses the same communication device hardware and application software.
It is difficult to avoid system bloat because the program must be duplicated. Since most communication systems and information processing systems are used in social economic activities, the increase in economic burden and installation space due to the enlargement of the scale increases the investment burden on companies. The problem is significant because it is an increase itself.

In addition, since the operation is switched to the normal standby system after the occurrence of a failure, there is no problem in system operation. However, in a normal case, hardware replacement of a failed part and termination processing of a runaway application program are performed. There is a problem that it becomes necessary through manual operations such as maintenance personnel.

On the other hand, in the configuration shown in FIG. 17, the biggest problem is that the processing of the failed process is stopped during the recovery process of the failed process. Since the recovery process of the failed process is performed in parallel with the normal process, the original processing capability of another normal process may be reduced.

The monitoring switching device 5 in the configuration of FIG.
5 or when a failure has occurred in the failure detection means 61-1 and the failure recovery means 61-2 in the configuration of FIG.
Since the failure detection function itself or the failure recovery function itself does not work, a fatal situation occurs in system operation.

Further, the configuration of FIG. 17 employs a failure recovery method in which a failed process is forcibly terminated and restarted, and the process is started from an initial state. There is a major problem that the processing data immediately before the failure is lost.

As described above, there are various problems in the conventional operation system of the duplex system and the system restoration system.

In view of the above problems, the present invention can reliably detect a failure, facilitate automatic recovery from a failure, reduce the economic burden on installation, and reduce the installation space. An object of the present invention is to provide a redundant system operation method.

[0024]

According to the principle of the present invention, each process started when the system is started (these processes become originals) autonomously starts a clone having only necessary minimum resources. The original and the clone perform regular communication to understand each other's status and share necessary data, and in the event of an original failure, recover the failure with the help of a part of the process control unit. Sometimes the original is a technology that autonomously recovers from a failure.

According to the principles of the present invention, each process has an original and a clone, but requires two independent devices.
It doesn't provide any resources and gives clones only the minimum resources they need, thus avoiding system bloat.

Also, since the original and the clone can monitor each other's status through regular communication, it is possible to construct a system that can reliably detect a failure.

Furthermore, since the original and the clone share the operation management data, the operation management data will not be lost even if the original becomes a failure and is forcibly terminated. Also, since the original and the clone are deployed on the same program memory, it is possible to forcibly terminate the original after redistributing the program memory between the original and the clone, which is an obstacle. The processing data of the original can be transferred from the clone to the transformed new original.

Therefore, even if the failed original process is cloned and the failed process is restored by originalizing the cloned process, the operation management data and the processed data are not lost.

When a failure of a clone is detected, since the original which has detected the failure has all the data, the operation management data can be passed to the clone when the clone is reproduced, so that there is no problem.

[0030]

DESCRIPTION OF THE PREFERRED EMBODIMENTS FIG. 1 is a diagram for explaining the outline of the system configuration of the present invention and the activation of the system of the present invention. It was done.

In FIG. 1, 1 is a hard disk,
In the hard disk 1, a process control unit load module ("." Is not described in FIG. 1 but is the same, but is the same. Hereinafter, similar omission may be performed in the figure). Process A load module 1
2, a process B load module 13 and a dynamic link library 14 are stored.

Reference numeral 2 denotes an original process control unit, which includes a process start / control unit 21-1 and a dynamic link unit.
An operation program 21 including a library reading unit (in FIG. 1, although denoted as a reading unit but being the same as the reading unit) 21-2, and an operation management program 22 are provided.

Reference numeral 2a denotes a clone of the process control unit original 2 which is started by the process control unit original 2 (the process control unit is also described in the text but is the same).

Reference numeral 3 denotes an original of the process A, which includes an operation program 31 and an operation management program 32 having a dynamic link library reading unit 31-1.

3a is a clone of the process A original 3 started by the process A original 3.

Similarly, reference numeral 4 denotes an original of the process B, and the dynamic link library reading unit 41
-1 and an operation management program 42.

Reference numeral 4a denotes a clone of the process B original started by the process B original 4.

Here, the operation program of each process is a program unique to each process, and the operation management program of each process is a program common to each process.

The details of the operation program, operation management program, and clone of each process will be described later.

Now, the process control unit original 2, process A and process B can realize the application function only after being loaded on the program memory. The triggers for each are as follows.

That is, the process control unit 2 is started by a manual start of the user according to a Windows system program start procedure, or by an automatic start by registration in the startup.

Each process is sequentially activated by the activation request from the process activation / control unit 21-1 of the process control unit activated as described above.

Further, the dynamic link library 14 stores the dynamic library of the activated process control unit 2.
It is automatically loaded by a start request from the link library reading unit 21-2 or the dynamic link library reading unit of each started process.

Hereinafter, the start-up procedure will be described along the reference numerals with circles in FIG.

When the user double-clicks the icon or directly specifies the program name of the process control unit on the command line, the Windows operation system (so-called OS) specifies and starts the program. Give instructions.

The load module of the process control unit stored on the hard disk 1 is loaded on the program memory.

The dynamic link library reading unit 2 of the process control unit 2 loaded in
From 1-2, a request is made to load the operation management program stored in the dynamic link library 14.

The contents of the dynamic link library stored on the hard disk 1 are additionally loaded into the process control unit 2.

The process control unit 2 issues a start request for each process according to the start procedure of a start table (not shown) provided in the process start / control unit 21-1 of the process control unit 2.

The load module of each process stored on the hard disk 1 is loaded on the program memory.

Then, the dynamic link library reading unit of each process loaded on the program memory issues a load request for an operation management program common to each process.

An operation management program common to each process stored on the hard disk 1 is additionally loaded to each process on the program memory.

The contents of the operation management program will be described later in detail.

The process control unit 2 and each process (these are originals) loaded on the program memory and operable in this way are respectively operated by the operation of the function program stored in the operation management program. Generate your own clone, with the minimum resources required.

The originals and the clones periodically communicate with each other to grasp the state of each other and to share operation management data.

If the clone determines that the original is faulty during the periodical communication, the clone notifies the process control unit 2 of the failure, and the clone control is performed by the process control unit 2 through the originalization operation. To the original, and the process that is the original creates a clone, as at startup.

If a failure of the clone is detected by the original during the periodical communication, the clone is forcibly terminated from the original and a new clone is reproduced.

The activation of the clone, the periodic communication between the original and the clone, the status monitoring of each other, and the recovery from the failure will be described later in order.

FIG. 2 shows the internal structure of the system according to the present invention.

In FIG. 2, reference numeral 2 denotes a process control unit original, which comprises an operation program 21 for realizing functions originally required for the process control unit original 2 and an operation management program 22 for realizing functions unique to the present invention. I have.

The operation program 21 starts the process /
A control unit 21-1 and a dynamic link library reading unit (abbreviated as a DLL reading unit in FIG. 2) 21-2 are provided.

The operation management program 22 includes a startup process registration table 22-1 for registering the started processes, a periodic communication / failure detection unit 22-2, and a startup process detection unit (not shown). , Process type determination unit,
It has a clone generator.

Reference numeral 2a denotes a process control unit clone, not shown, but it is preferable that a program having at least the same content as that of the original process control unit 2 is loaded. Is preferred. The reason will be explained when all the explanations have been completed.

Reference numeral 3 denotes a process A original, which includes an operation program 31 and an operation management program 32.

The operation management program 31 includes a program necessary for the process A to realize the original function, including the dynamic link library reading unit as shown in FIG.

In the operation management program 32, the started process itself is executed by the start process registration table 22-.
1; a start process detection unit 32-1 for detecting whether or not the process itself is an original; a process type determination unit 32-2 for determining whether or not the process itself started based on the detection result is an original; Has a clone generating unit 32-3 for generating a clone and a periodic communication / failure detecting unit 32-4 for performing periodic communication with the clone to share data and determine each other's situation.

Reference numeral 3a denotes a process A clone, which is used for regular communication /
Only the failure detection unit 32-4a is provided.

Similarly, 4 is a process B original, 4a
Is a process B clone, and the loaded contents are a process A original 3 and a process A clone 3a, respectively.
Therefore, the description is omitted.

FIG. 3 shows communication resources in the system.
It is a configuration diagram of a system focusing on communication resources.

In FIG. 3, 2 is a process control unit, 3 is a process A original, 3a is a process A clone, 4
Is a process B original, 4a is a process B clone, and the system configuration is the same as that shown in FIG.
Note that FIG. 3 does not show a clone for only the process control unit 2.

Reference numeral 5 denotes an inter-process communication resource, which is a communication resource provided between the process control unit 2 and the original of each process. The inter-process communication resource 5 can be provided exclusively for each process or can be provided as a common communication resource. In the case where dedicated buses are provided, bus arbitration is not required, but a large number of buses are required. On the other hand, when they are provided in common, there is an advantage that the number of buses can be reduced while bus arbitration is required.

The original of each process is
The communication with the process control unit 2 and the communication with the original of another process are performed via the inter-process communication resource 5.

Reference numeral 6 denotes a common clone communication resource provided commonly to each process clone. Normally, each process clone does not communicate outside the process, and is used when the clone detects an original failure and communicates with the process control unit 2 as will be described later. The communication resources outside the process may be common to each clone.

Reference numeral 7 denotes an original-clone communication resource used for communication between the original and the clone of each process. The original and the clone of each process perform regular communication via the original-clone communication resource 7.

As described above, the process control unit and each process have an original and a clone. However, since the internal configuration and communication resources are not completely duplicated,
The system size can be prevented from being enlarged.

The procedure for starting the system of FIG. 2 focusing on the original has been described in detail with reference to FIG. 1 and will not be described here.

Hereinafter, activation of a clone, periodic communication using an original and a clone, fault detection and fault recovery will be described. However, since the present invention can be applied to both a single process and a multi-process, the following will be described. For simplicity, the description of the operation of the system at various stages will be continued as if it were a single process of process A only. In the following description of the operation, the internal configuration of the process control unit and the process A indicates only those most closely related to the operation.

FIG. 4 is a diagram for explaining the process type determination for determining whether the started process is the original process.

In FIG. 4, reference numeral 2 denotes a process control unit;
-1 is a process start / control unit of the process control unit 2;
2-1 is an activation process registration table provided in the process control unit 2. Reference numeral 3 denotes a process A, 32-1 an activation process detection unit for the process A3, and 32-2 a process type determination unit for the process A3.

As described above, according to the instruction of the process start / control unit 21-1 of the process control unit 2, the process A
3 is expanded on the program memory, initialized and activated. This is the activation described in FIG.

The activated process detection unit 32-1 of the activated process A3 accesses the activated process registration table 22-1 of the process control unit 2 via the inter-process communication resource 4 shown in FIG. It is checked whether the ID of the process A3 itself is registered. This is shown in FIG.
It is a process type survey described in the table.

The activation process registration table 22-1 is
As shown in the configuration example of the activation process registration table in FIG. 5, a process name and an ID of the process are set as one block, and a plurality of blocks can be registered corresponding to a plurality of processes. Is registered in advance, but the process ID is registered for the first time upon access from the started process.

Therefore, if the process A3 in FIG. 4 is a process started for the first time, since the process ID is not registered in the start process registration table, the process type examination and the subsequent process type determination in the process type selection unit 32-2 are performed. Turns out to be the original.
Then, its own process ID is registered in the activation process registration table 22-1, and this routine ends. This is the ID registration described in FIG.

Then, through the process type investigation, the process type determination, and the process ID registration, the process A3 in FIG.
Is determined to be the original of process A.

Since the clone is started from the original as described later, the process start / control unit 21-1 is used.
If the process A3 is passed the ID unique to the process activation / control unit 21-1 when the process A3 is activated, the necessity of the process type examination is reduced. However, since it is highly necessary for the process control unit 2 to recognize the activated process, it is important that the activated process registers its own process ID even in this case.

FIG. 6 is a diagram for explaining the activation of the clone.

In FIG. 6, reference numeral 3 denotes a process A original, and the process type determination unit 32-2 and the clone generation unit 3
2-3 are provided. Reference numeral 3a denotes a process A clone, which includes a periodic communication / failure detection unit 32-4a.

When the process A original 3 is started,
When the process type determination unit 32-2 determines that the process itself is the original, the determination result is passed to the clone generation unit 32-3. In response to this, the clone generation unit 32-3 develops the periodic communication / failure detection unit of the process A original 3 on the same program memory and starts up as a process A clone.

That is, the process A original 3 autonomously starts its own clone without going through the process control unit.

The process A original 3 and the process A clone 3a communicate with each other via the regular communication / failure detection units to grasp each other's state and to determine the sequence number in program execution. And other operation management data. Hereinafter, these will be described.

The mode of the regular communication can be either a clone-initiated type in which a request is transmitted from a clone or an original-initiated type in which the original takes the initiative in communication. The description will be made assuming that communication is performed periodically.

FIG. 7 is a diagram for explaining data sharing between original clones.

In FIG. 7, 2 is a process control unit, 3 is a process A original, and 3a is a process A clone. In FIG. 7, the internal configuration of the process control unit 2 is not shown. For the process A original 3, the periodic communication / failure detection unit 32-4 and the original data 32-
5, only the regular communication / failure detection unit 32-4a and the clone data 3 for the process A clone 3a.
Only 2-5a is shown.

The process A original 3 communicates with the regular communication /
Using the failure detection unit 32-4, the process A clone 3
a perform regular communication with each other using the regular communication / fault detection unit 32-4a, and at the time of the regular communication, the original data 32-5 from the process A original 3 is transmitted to the process A.
Transmitted to the clone 3a and the clone data 32-5
a. Note that the process A original 3 has operation management data such as a processing sequence number and processing data, and it is possible to pass all data to the process A clone 3a, but it is only necessary to pass only operation management data. .

FIG. 8 is a diagram (part 1) for explaining the basic operation of periodic communication / failure detection, and explains the operation in the case where the original and the clone are both normal and share data through the periodic communication. . Hereinafter, description will be given along the reference numerals shown in FIG.

S41. At the start of the regular communication, the clone is a timeout timer (in FIG. 8, the symbol "." Is omitted to save the number of characters, such as "timeout timer", but it should be understood that the clone is exactly the same. Other technical terms may be described in the same way.)

S42. A request for regular communication is transmitted to the original ("REQ" is written in FIG. 8 to save the number of characters. The same notation is used in other cases).

[0098] The format example of the periodic communication request is as follows.
As shown in (a) of the configuration example of the periodic communication data in FIG. 9, for example, the first three bytes are identifiers indicating a request, and one spare byte is added.

S43. The original which received the request from the clone edits necessary data, forms a periodic communication answer, and transmits it to the clone.

An example of the format of the periodic communication answer is shown in (b) of the configuration example of the periodic communication data in FIG. 9. For example, the first three bytes are the answer (ANS in FIG. 9).
It is labeled. Similar notations are used elsewhere. ), And a data expansion request indicating whether data expansion is necessary is mounted next. After that, the type of data to be transmitted (for example, the process ID of the activation process registration table or the number of the processing sequence)
The data size indicating the total size of the data to be transmitted is mounted, and the data to be transmitted last is mounted, and one block from the data type to the transmission data is configured. In general, a plurality of blocks are mounted in the periodic communication answer and transmitted.

S44. The clone receives data from the original and expands it on memory.

Then, although not shown in the drawing, the apparatus waits for a predetermined time until the time of the next regular communication, and when the time of the regular communication comes, the same step as the above step, ie, S45. When the regular communication starts, the clone times out.
Clear the timer.

S46. Send a request for regular communication to the original.

S47. The original that received the request from the clone edits necessary data and sends it to the clone.

S48. The clone receives data from the original and expands it on memory. repeat.

Thus, the original and the clone can share the same data.

FIG. 10 is a diagram for explaining original failure detection and process forced termination.

In FIG. 10, reference numeral 2 denotes a process control unit;
Is a process A original and 3a is a process A clone.

In FIG. 10, only the process activation / control unit 21-1 and the activation process registration table 22-1 are described for the process control unit 2, and the periodic communication / failure detection unit for the process A original 3 is described. 32-
4, only the periodic communication / failure detection unit 32-4a is described for the process A clone 3a.

FIG. 10 shows that the process A original 3 and the process A clone 3a perform regular communication, but the process A clone 3a issues a periodic communication request, but the process A original 3 It is illustrated assuming that the answer does not return from.

When it is detected that the process A clone 3a does not return an answer from the process A original 3 continuously for a predetermined number of times (this is the failure detection described in FIG. 10), Communication / failure detector 32
-4a determines that the process A original 3 is faulty and notifies the process control unit 2 via the common clone communication resource shown in FIG. 3 (this is the fault notification described in FIG. 10). is there.). Upon receiving the notification, the process control unit 2 finally forcibly terminates the process A original 3 (this is the forced termination described in FIG. 10).

When the forced termination is performed, only the operation program and the operation management program are terminated, and the data held by the process A original 3 is not deleted.

FIG. 11 is a diagram (part 2) for explaining the basic operation of the periodic communication / failure detection, and explains the operation in the case where the clone detects the original failure. Hereinafter, the above operation will be described along the reference numerals in FIG.

S51. The clone clears the timeout timer prior to regular communication.

S52. Send a periodic communication request to the original.

In this case, since it is assumed that the original is a failure, the answer to the periodic communication request does not return from the original. During this time, the clone runs a timeout timer.

S53. The clone increments the retry counter in response to the detection of the elapse of the predetermined time by the timeout timer. The retry counter is a counter that counts the number of times that the answer has not returned from the original in response to the periodic communication request, and determines that the original has a failure by reaching a predetermined number.

Then, although not shown, it waits for a predetermined time until the time of the next periodic communication.

S54. The clone times out again.
Clear the timer, S55. Send a periodic communication request to the original.

At this time, the answer does not return from the original.

S56. Therefore, the clone detects the timeout again and increments the retry counter.

S57. As a result of repeating such operations, the clone detects that the retry counter has reached a predetermined number of times, and detects that the original is a failure.

S58. Then, the process enters a failure processing routine.

In this routine, first, the process A clone notifies the process control unit of the process A original process ID, and the process control unit finally finds the failed process A original process ID from the startup process registration table. The ID is erased, and the process A original is forcibly terminated.

FIG. 12 is a diagram for explaining the creation of a clone and the generation of a new clone, and corresponds to step S58.

In FIG. 12, reference numeral 2 denotes a process control unit;
b is a process A new original in which the process A clone is originalized, 3c is the process A new original 3b
Is a reproduced clone of the process A reproduced by the process A.

In FIG. 12, for the process control unit 2, only the process start / control unit 21-1 and the start process registration table 22-1 are described.
For the new original 3b, the activation process detection unit 32-
1. Process type determination unit 32-2, clone generation unit 32
-3, only the periodic communication / failure detection unit 32-4a is described for the process A reproduction clone 3c.

As shown in FIG. 10, the process control unit 2, which has been notified from the process A clone 3a that the process A original 3 has failed, performs the same procedure as the process start described in FIGS. 4 and 6. To make the process A clone original and start the process A new original 3b. Therefore, an operation program and an operation management program including all functions are loaded and expanded in the process A new original 3b.

Then, as described in the description of FIG.
Since the data held by the failed process A original is stored in the memory area, if the data area storing this data is connected to the operation program and the operation management program of the process A new original 3b, Data can be taken over from the failed process A original 3 to the newly activated process A new original 3b.

Next, in the same manner as shown in FIG. 4, the process A new original 3b is
1 accesses the activation process registration table 22-1 and checks whether or not its own process ID is registered in the activation process registration table 22-1.

In this case, the process A new original 3b
Has just been started, so its own process ID has not been registered. Therefore, the process type determination unit 32-2 determines that the process A is the original of the process A,
It registers its own process ID in the activation process registration table 22-1.

Next, according to the judgment result of the process type judgment unit 32-2, the clone generation unit 32-3 starts a new clone and sets it as the process A reproduction clone 3c.

FIG. 13 is a diagram for explaining fault detection and clone reproduction during runaway of a clone.

In FIG. 13, reference numeral 2 denotes a process control unit;
Is Process A original, 3a is Process A clone,
3d is a process A reproduction clone.

The internal configuration of the process control unit 2 is not shown, and only the periodic communication / failure detection unit 32-4 and the clone generation unit 32-3 are described for the process A original 3, and the process A clone The regular communication / failure detection unit 32-4a for the process 3a and the process A reproduction clone 3d
Only listed.

The process A original 3 and the process A
Although the clones 3a are performing regular communication via their mutual regular communication / failure detection units, the process A original 3 that cannot continuously receive the regular communication request from the process A clone 3a is the process A clone 3a. Is determined to be a failure (this is the failure detection described in FIG. 13).

In this case, the process A original 3
Forcibly terminates the process A clone 3a (this is the forced termination described in FIG. 13), and the periodic generation / failure detection unit 32-
4a is loaded and expanded, and the clone of the process A is started again, and this is set as the process A reproduction clone 3d (this is the reproduction described in FIG. 13).

As described above, when the original detects a failure of the clone, the original autonomously reproduces and starts the clone without passing through the process control unit 2.

FIG. 14 is a diagram (part 3) for explaining the basic operation of periodic communication / failure detection, and shows the operation in the case where the original detects a clone failure. Hereinafter, the above operation will be described along the reference numerals in FIG.

S61. The original clears the timeout timer after the previous periodical communication ends, and S62. The clone is waiting for a regular communication request.

In the present case, since it is assumed that the clone has failed, the clone does not send a periodic communication request.

S63. Accordingly, the original increments the retry counter because the original timeout timer detects the passage of a predetermined time.

Thereafter, there are a method in which the original sends a retransmission request to the clone, and a method in which the original does not request a retransmission, and waits for a periodic communication request. In any case, the same step as the above step, that is, S64. Clear the timeout timer, S65. The clone is waiting for a regular communication request.

S66. Then, since the original timeout timer detects the elapse of the predetermined time, the original increments the retry counter. repeat.

S67. When it is detected that the retry counter has reached the predetermined number of times in this way, the original is determined to have a fault in the clone, and S68. Enter the failure handling routine.

FIG. 15 is a flowchart of the periodic communication / failure detection, in which all the above operations are integrated and illustrated. Although most of the contents have already been described, it is important to explain the operation in which all the operations are integrated.

FIG. 15 assumes a clone-driven type.
The figure also assumes a method in which, when a regular communication request from a clone has not arrived for a predetermined time, the original does not request retransmission and waits for the next predetermined time.

S1. The clone clears the timeout timer after the previous periodic communication, and S2. Send a regular communication request to the original, and S3. Waiting for answer from original.

S4. Determine whether an answer from the original has been received.

S5. If it is determined in step S4 that no answer from the original has been received (No),
It is determined whether the timeout timer has reached a predetermined time τ.

If it is determined that the predetermined time τ has not been reached (No), the process returns to step S3 to continue waiting.

S6. If it is determined in step S5 that the timeout timer has reached the predetermined time τ (Yes), the retry counter is incremented.

S7. It is determined whether the count value of the retry counter has reached a predetermined number. If it is determined that the number has not reached the predetermined number (No), step S
Return to 3.

S8. When it is determined in step S7 that the count value of the retry counter has reached the predetermined number (Y
In es), a failure processing routine is entered.

That is, by performing regular communication between the original and the clone, the clone can find the original failure.

On the other hand, if the answer has returned from the original, it can be detected in step S4 that the answer has been received (Yes), so the flow proceeds to step S9. That is, S9. It is determined whether there is a data expansion request, and S10. If it is determined in step S9 that there is a data development request (Yes), the data is developed in the memory.

As a result, the original data can be shared by the clones.

S11. If it is determined in step S9 that there is no data expansion request (No), and if the processing in step S10 has been completed, the process waits for the regular communication interval T.

S12. Then, the retry counter is cleared and the process returns to step S1.

On the other hand, the original operates as follows.

S15. After the previous regular communication, the timeout timer is cleared, and S16. Waiting for regular communication request from clone.

S17. It is determined whether a regular communication request from the clone has been received.

S18. If it is determined in step S17 that the periodic communication request has not been received from the clone (No), it is determined whether or not the timeout timer has detected the elapse of the predetermined time τ. Predetermined time τ
If the elapsed time has not been detected (No), step S
Return to 16.

S19. If it is determined in step S18 that the predetermined time τ has elapsed (Yes), the retry counter is incremented.

S20. It is determined whether or not the count value of the retry counter has reached a predetermined number. If it is determined that the count has not reached the predetermined number (No), step S16 is performed.
Return to

S21. On the other hand, if it is determined in step S20 that the number of times has reached the predetermined number (Yes), a failure processing routine is entered.

That is, the original can detect a failure of the clone by performing regular communication between the original and the clone.

When a regular communication request is received from the clone, it is determined in step S17 that the regular communication request has been received (Yes).
Move to 2.

S22. It is determined whether it is necessary to answer the periodic communication request.

S23. If it is determined in step S22 that the answer is necessary (Yes), the answer is edited and transmitted to the clone.

S24. When it is determined that there is no need for an answer in step S22 (No), step S23
Is completed, the process waits for the regular communication interval T.

S25. Then, the retry counter is cleared, and the process returns to step S15.

Here, the case of the regular communication led by the clone has been described, but it is easily conceivable that the regular communication can be led by the original.

Further, it can be easily understood that the method of making a retransmission request after determining that the original does not receive a regular communication request from the clone can be realized by slightly changing the above method.

In the description of FIG. 2, it is described that it is preferable to load the same program as the original in the clone of the process control unit. On the other hand, if the regular communication / failure detection unit is loaded in the clone of each process. It was described as good. It is clear from the following description that the periodic communication / failure detection unit may be loaded into the clone of each process.

Thus, the above-mentioned reason will be described.

When a clone detects that the original of each process is faulty, the clone that has detected the fault notifies the process control unit to that effect as described above, and the original copy of the clone and the fault occur. The original forced termination can be performed by the process control unit.

On the other hand, when assuming that the original of the process control unit is detected as a failure, if only the periodic communication / failure detection unit is loaded in the clone of the process control unit, the process control unit It is possible to indicate that the original is an obstacle. Then, by executing the startup process described with reference to FIG. 1 again in response to the failure display, the failed process control unit can be recovered.

However, when the process control unit is activated by the activation process described with reference to FIG. 1, each process is automatically activated again, and the operation management data and processing data possessed by each process are deleted. In order to prevent this, it is necessary to download the operation management data and processing data held by each process once and then execute the start-up process described with reference to FIG.

On the other hand, if the clone of the process control unit shares the same program as the original, the clone has exactly the same function as the original. Similarly, the clone of the process control unit can forcibly terminate the original of the failed process control unit and erase the original of the failed process control unit from the program memory.

In addition, since all the programs and data are retained even if they are clones, they can be changed to originals.

Then, in the same way as the original reproduces the clone in FIG. 13, the process control unit which has become the new original can reproduce the new clone.

Therefore, if the clone has the same program and data as the original in the process control section, it is possible to autonomously recover the failure even if the original of the process control section fails.

In the above sense, it has been described in the description of FIG. 2 that in the case of the process control unit, it is preferable to load the same program as the original into the clone.

However, if the original program and the clone of the process control unit have the same program and data, the system scale must be increased. However, usually, a large number of processes are loaded in the system, and these clones give the clone only minimal resources, and only the process control unit performs full duplication. Is minor.

[0186]

As described above in detail, according to the present invention, it is possible to realize a system operation method capable of avoiding an increase in the scale of a system. -A system operation method capable of reliably detecting a process failure can be realized, and a system operation method capable of sharing data between an original process and a clone process can be realized. Can be realized.

Therefore, the reliability of the communication system or the information processing system can be improved while avoiding an economic burden and an increase in installation space.

[Brief description of the drawings]

FIG. 1 is a diagram for explaining an outline of a system configuration according to the present invention and explaining activation of a system according to the present invention.

FIG. 2 shows the internal configuration of the system according to the present invention.

FIG. 3 shows communication resources in the system.

FIG. 4 is a diagram illustrating a process type determination.

FIG. 5 is a configuration example of a startup process registration table.

FIG. 6 is a view for explaining activation of a clone.

FIG. 7 is a view for explaining data sharing between original clones.

FIG. 8 is a view for explaining the basic operation of periodic communication / failure detection (part 1).

FIG. 9 is a configuration example of data of periodic communication.

FIG. 10 is a diagram for explaining original failure detection and process forced termination.

FIG. 11 is a view for explaining a basic operation of periodic communication / failure detection (part 2).

FIG. 12 is a view for explaining originalization of clones and generation of new clones.

FIG. 13 is a view for explaining failure detection and clone reproduction at the time of clone runaway.

FIG. 14 is a diagram illustrating the basic operation of periodic communication / failure detection (part 3).

FIG. 15 is a flowchart of periodic communication / failure detection.

FIG. 16 shows a configuration of a conventional operation system of a duplex system.

FIG. 17 shows a configuration of a conventional failure recovery system.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 Hard disk 2 Process control part original 2a Process control part clone 3 Process A original, process A 3a Process A clone 3b Process A new original 3c Process A reproduction clone 3d Process A reproduction clone 4 Process B original 4a Process B clone 5 Process Inter-communication resources 6 Common clone communication resources 7 Original-clone communication resources 11 Process control unit load module 12 Process A load module 13 Process B load module 14 Dynamic link library 21 Operation program 22 Operation management program 31 Operation program 32 Operation Management Program 41 Operation Program 42 Operation Management Program 21-1 Process Activation / Control Unit 21-2 Dynami Link library reading unit 22-1 startup process registration table 22-2 periodic communication / failure detection unit 31-1 dynamic link library reading unit 32-1 startup process detection unit 32-2 process type determination unit 32- 3 Clone Generator 32-4 Periodic Communication / Fault Detector 32-4a Periodic Communication / Fault Detector 41-1 Dynamic Link Library Reading Unit 51 Hardware of First Communication Device 52 Application of First Communication Device Program 53 Hardware of second communication device 54 Application program of second communication device 55 Monitoring and switching device 61 Process control unit 62 Process A 63 Process B 64 Process C 61-1 Failure detection means 61-2 Failure recovery means

Continuation of the front page (72) Inventor Yuji Goto 2-2-1 Momichihama, Sawara-ku, Fukuoka, Fukuoka Prefecture Inside Fujitsu Kyushu Communication Systems Co., Ltd. (72) Katsuyuki Fujiyoshi 2-2-1 Momichihama, Sawara-ku, Fukuoka, Fukuoka No. Fujitsu Kyushu Communication System Co., Ltd. (72) Inventor Yukio Mitsuno 2-2-1 Momichihama, Sawara-ku, Fukuoka, Fukuoka Prefecture Inventor Daisuke Namoto Mochihama, Sawara-ku, Fukuoka, Fukuoka 2-2-1 Fujitsu Kyushu Communication System Co., Ltd. F-term (reference) 5B034 BB02 CC03 5B042 JJ04 JJ08 5B045 JJ02 JJ12 JJ42 JJ45 JJ48 5B089 GA01 GB02 HA01 JA40 JB17 KA12 KB06 KC30 LB14 MC02 MD02 MD03 ME15

Claims (6)

[Claims] A process control unit for controlling operations of all processes provided in the system; an original process including all of an operation program for system operation and an operation management program for managing system operation;
A clone process having a minimum necessary operation management program among the operation management programs of the original process, wherein the original process and the clone
A system operation method characterized in that periodic communication is performed between processes. 2. The system operation method according to claim 1, wherein, for the process control unit, all programs and all data are shared by an original and a clone. 3. The system operation method according to claim 1, wherein said original process and said clone process share data by said periodic communication. 4. The system operation method according to claim 1, wherein the periodic communication detects that the original process detects a failure of the clone process, and that the clone process detects a failure of the original process. The operating system of the featured system. 5. The automatic recovery method according to claim 4, wherein when the clone process detects a failure of the original process, the clone process notifies the clone process of the original process. An automatic failure recovery method, in which the control unit recovers outside the original process where the failure occurred. 6. An automatic failure recovery method in the system operation method according to claim 4, wherein when the original process detects a failure of the clone process, the original process autonomously performs the recovery. An automatic failure recovery method characterized by regenerating a clone process.