JP2000293389A - Mirror disk restoration system in fault tolerant system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce time taken by mirroring and recovery time and to improve reliability by minimizing data transfer quantity when the system is restored. SOLUTION: Computers 1 and 2 have the same hardware configuration, are connected to each other by a link cable 3 and constitute a fault tolerant system. Also, the disks 15 and 25 of the respective computers 1 and 2 perform mirroring and hold the same information mutually. Data information updated while one computer 2 stops due to some factor other than a fault of the disks 15 and 25 is stored in a special area of the computer 1, i.e., in a data access table 18. Then, the computer 2 where the fault occurs is repaired to be returned to be the system of a dual system, and when disk data is recovered, the data information of the updated disk 15, i.e., only differential information while the computer 2 stops and recovery work is performed is transferred to the disk 25 of the computer 2.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a failure recovery processing method in a fault-tolerant system for constructing a redundant computer system, and more particularly to an online data recovery method in which two computers back up each other online data.

[0002]

2. Description of the Related Art Disk mirroring in a fault-tolerant system interconnects hard disks of two computers, writes data to both at the same time, and can continue to process data even if one computer fails. Widely used as a method. For example, in Japanese Patent Application Laid-Open No. 9-204319, two opposing computers mutually hold opposing system operation information, and transfer the same online data to each other by data transfer control means to achieve data duplication. ing. Then, when one of the computers recovers from the failure, all the online data of the normal computer is automatically transferred to the opposite computer, and the online data is recovered quickly and easily.

[0003]

However, in the prior art as described above, in a fault-tolerant system, the shorter the time from the occurrence of a failure until recovery is improved, the more the reliability is improved, Since the time required for the recovery mirroring occupies most of the system recovery time, there is a problem that the reliability of the entire system is reduced. In particular, the aforementioned Japanese Patent Laid-Open No. 9-2
The technology disclosed in Japanese Patent No. 04319, for example, transfers all online data to an opposite computer at the time of recovery, which is a factor that prolongs the recovery time.

The present invention has been made in view of such circumstances, and an object of the present invention is to reduce the time required for mirroring by minimizing the amount of data transfer at the time of system recovery, thereby reducing the time required for mirroring. It is an object of the present invention to significantly reduce time and to construct a highly reliable fault-tolerant system.

[0005]

According to the present invention, there are two computers having the same hardware configuration, and the two computers perform the same operation while communicating with a cable connected between the computers. A fault tolerant system that mirrors the hard disks connected to each computer and retains the same information with each other to perform recovery processing after a computer stop due to a failure other than a hard disk This relates to a mirror disk recovery method.

In order to solve the above-mentioned problem, a mirror disk recovery method in a fault-tolerant system according to the present invention employs a method of recovering a disk updated while one computer is stopped due to a factor other than a disk failure. Save the data information in a special area. When the failed computer recovers and returns to the system and recovers the disk data, only the updated disk data information, that is, the difference information when one computer was stopped and recovered. By transferring the data, the system can be restored earlier than before without stopping the original processing of the system.

That is, in the mirror disk recovery method in the fault tolerant system according to the first aspect, the two opposing computers having the same hardware configuration perform the same operation while communicating with each other, thereby improving the reliability. Fault-tolerant system that is configured to mirror the hard disks connected to each computer, retain the same information mutually, and perform recovery processing after the computer stops due to a failure other than a hard disk In the mirror disk recovery method in the tolerant system,
Each computer has a special storage area to save the differential data information updated while the other computer is shutting down and recovering due to factors other than a hard disk failure, so that the failed computer can recover. When recovering the disk data after returning to the second system, the normal computer must transfer only the difference data information stored in its own special storage area to the computer that has returned to the system. In this way, the system is returned to the dual system.

According to a second aspect of the present invention, there is provided a system for recovering a mirror disk in a fault tolerant system according to the first aspect, wherein each of the computers constituting the second system comprises a CPU (Central Processing Unit) for performing a main operation. , A disk interface that provides an interface between the disk and other hardware, a disk controller that directly accesses data to and from the disk, and a disk that is used to store data. Data communication means for realizing delivery, fault detection means for monitoring hardware failures of the entire computer and stopping the function of the entire computer when a failure is found, Difference data created during system operation or recovery operation A storage medium for recording information, a data access table that stores the write position when a disk write command required for mirror copy is issued, and the status at that time, and whether the disk access command is data read. Data monitoring means for creating data to be written to the data access table by determining whether the data is to be written, and updating the data access table as a special storage area while the other computer is stopped and restored. The stored difference data information is stored.

According to a third aspect of the present invention, there is provided a mirror disk recovery method in the fault tolerant system according to the second aspect, wherein the data access table is constituted by a storage medium of a flash memory capable of retaining contents even when the power is turned off. It is characterized by. According to a fourth aspect of the present invention, there is provided a mirror disk recovery method in the fault tolerant system according to the third aspect, wherein the data access table is provided in an unused area of a disk provided in the computer.

[0010]

Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a block diagram illustrating a configuration of a computer system according to an embodiment of the present invention. In FIG. 1, a computer 1 and a computer 2 have the same hardware configuration, and have CPUs 11 and 21 for performing main operations, disk interfaces 12 and 22 for providing an interface between the disk and other hardware, and a Data monitoring means 1 for determining whether the access instruction of the data is read or write data and creating data to be written to the data access table
3 and 23; disk controllers 14 and 24 for directly accessing data with the disks; disks 15 and 25 used for storing data;
And data communication means 16 and 26 for realizing the exchange of data between the computer 2 and failure detection having a function of monitoring hardware failure of the entire computer and stopping the function of the entire computer when a failure is found. Means 17, 27, and a storage medium required for the system to record difference information of data created during one-system operation or recovery operation, and a write position at the time of issuing a disk write command required for mirror copy and at that time And the data access tables 18 and 28 which store the statuses of the data.

However, the data access tables 18, 2
Reference numeral 8 denotes a device such as a flash ROM that can retain the contents even when the power is turned off, or a storage medium such as a disk in place of the device. Further, the functions of the data access tables 18 and 28 can be provided by using the unused areas of the disks 15 and 25.
The computer 1 and the computer 2 are connected by a link cable 3 and are used for mutual processing information, data transfer between the computers, and status confirmation.

Next, the operation of the embodiment in such a configuration will be described. In a fault-tolerant system using two computers 1 and 2, one computer stops due to a failure other than the disks 15 and 25 and must continue to operate on the remaining one computer (1 or 2). In the case of running out, the update information of the disk (15 or 25) generated during operation of one unit is stored in the data access table (18 or 28) which is a specially prepared storage area.

When the fault is removed and the stopped computer (1 or 2) is restarted, it is updated during the stop using the update information of the data access table (18 or 28) stored during the stop. By adding hardware or software that can transfer only the contents of the disc (15 or 25), the mirror copy can be completed in a shorter time than before. I do. Also, by devising the data structure of the data access tables 18 and 28, the data access table can be updated even during the mirror copy, so that normal operations can be performed even during the mirror copy. is there.

Next, as an example of the operation, a method of restoring the system will be described in detail using the systems and algorithms shown in FIGS. 1, 2, 3, and 4 as examples. still,
FIG. 2 shows an algorithm of processing performed by the data access table in FIG. FIG. 3 is a state transition diagram that can be taken by a fault-tolerant system having a configuration of two computers in FIG. Further, FIG.
FIG. 2 is a flowchart showing a flow of processing from failure to recovery of one computer in the configuration of FIG. 1.

First, a normal operation will be described. C
The checksums of the calculation results of the PU 11 and the CPU 21 are transferred to the data communication means 16 and 26, and the mutual data is transferred using the link cable 3 to confirm data consistency. Then, at the time of disk access, the data monitoring means 13 and 23 generate a checksum of the read and write data and perform read and write.
The generated checksums are transferred to each other from the link cable 3 using the data communication means 16 and 26 and the data communication means 16 and 26 to confirm whether or not the data match. Move on.

Here, the operation of the data access tables 18 and 28 will be described in detail using the algorithm of FIG. One element of the data access tables 18 and 28 corresponds to an area when the total capacity of the disks 15 and 25 is divided into N, holds disk update information of the area, and addresses 0, 1 in order from the upper left. When it reaches the upper right, it shifts to the lower left by one step and assigns the address, and the address is assigned to the N-1st address. One element of each of the data access tables 18 and 28 has the format of the data format 1, and includes failure occurrence information 211 indicating that the data is written when a failure occurs, and calculation when writing the data. The check sum 212 includes a next checksum 212 and a next address pointer 213 storing addresses of the data access tables 18 and 28 to which data has been written next.

The data access tables 18, 28
Is assigned a data address register 2 which holds an address required for failure recovery. The data address register 2 stores a last address 221 indicating the address of the data access tables 18 and 28 corresponding to the area in which data was updated last, and the address of the data access table corresponding to the area in which data was updated immediately before. The pre-last address 222, the failure occurrence address 223 that records the address of the data access table corresponding to the area updated first after the failure occurs, and the data corresponding to the area at the time of the write access. A current access address 224 indicates the address of the access tables 18 and 28.

When writing to the disks 15 and 25 occurs, the data monitoring means 13 and 23
It is determined in which area of data 25 the data is to be written, the area is converted into an address of the data access tables 18 and 28, and the address is stored in the current access address 224 in the data address register 2. Then, the checksum calculated at the time of the write access is written to the checksum 212 in the data access tables 18 and 28 indicated by the current access address 224.

Further, the currently generated write access is the next access after the last write access, so that the data access table 18 indicated by the last address 221
The next address pointer 213 in 28 is updated to the current access address. That is, the current access address 224 is stored in the next address pointer 213. Then, since the data access tables 18 and 28 of the currently accessed area indicate the last accessed area, the contents of the last address 221 are stored in the pre-last address 222, and the contents of the current access address 224 are stored. Save to the last address 221. In this way, the update history of the disks 15 and 25 is stored by connecting the data access tables 18 and 28 of the areas to which the write access has been made with the pointer.

Next, with reference to the state transition diagram of FIG. 3, the state transition that can be taken by the fault-tolerant system constituted by the two computers 1 and 2 will be described. When the computer 1 and the computer 2 are running, there is no difference in the data contents of the disks 15 and 25, and the same operation is performed. The normal operation 311 and the computer (1 or 2) operates only one of them. The one-way operation 312,
Stop the system that cannot be operated as a system 31
3. By setting the state in which the difference between the disks 15 and 25 is being transferred as the recovery operation 314, the state can be represented by four states.

The state transition occurs in the direction of the arrow, and the respective conditions are as follows: a condition that the computer detects an abnormality and stops, one stop 301, and another stop when one is stopped. Another condition stop 302, a computer restarted during the recovery operation is stopped, a condition transfer destination is stopped 303, a condition for restarting a computer stopped in the single operation state, a condition one restart 304, Transfer source restart 305 of the condition that the computer that has been operating for a long time from the system stop state is restarted, transfer source of the condition that the computer that has been running for a long time during the recovery operation stops due to an abnormality is stopped 306, and the disk difference The transition is made according to the seven conditions of the end of disk copy 307, which is the condition of ending all information transfer.

Next, referring to the flowchart of FIG. 4, in the state where the computer 2 is stopped due to a failure, the one-way operation 312 is executed.
The flow of the processing performed until the operation returns to the normal operation 311 will be described. First, when the failure detecting means 27 detects a hardware failure of a device inside the computer 2, the operation of the computer 2 is stopped (Step 1). As a result, the computer 1 shifts to the failure avoidance mode. That is,
The data communication means 16 of the computer 1 is
Since the communication with the data communication means 26 cannot be performed, the stop of the computer 2 is detected, and the information is transmitted to the disk interface 12. Then, the disk interface 12
Recognizes that it operates only on the computer 1,
The information is notified to the data monitoring means 13. Upon receiving this information, the data monitoring means 13 sends the pre-last address 22
2 is written to the fault occurrence address 223, and the fault occurrence information 211 of the data access table 18 indicated by the addresses written in the pre-last address 222 and the last address 221 is turned on. By doing so, a failure flag indicating that a failure has occurred is raised, and when writing information to the data access table 18, the failure occurrence information 211 is turned on to shift to a mode for writing data (Step 2).

Next, the disk access requested by the CPU 11 is controlled (Step 3). This control method will be described with reference to Setp20 to Step26 of another flow. That is, CPU
When 11 requests access to the disk 15, an instruction is transferred to the data monitoring means 13 via the disk interface 12 (Step 20). Next, the instruction is analyzed (St
ep21) If the read command, disk controller 14
To read data from the disk 15 (Step
26), the access request to the desk ends (Step 25).
On the other hand, if the analysis result in Step 21 is a write command, the disk controller 14 is controlled to write data to the disk 15 (Step 22). At that time, the data monitoring means 13 generates a checksum. Further, the address of the data access table 18 corresponding to the write address is determined, and is written to the current access address 224.

Next, the data access table 18 is created. That is, the current access address 224 is stored in the next address pointer 213 in the data access table 18 at the address indicated by the last address 221.
Is written, and the failure occurrence information 21 in the data access table 18 indicated by the current access address 224 is written.
1 is set to ON to indicate that it is a write access during one-way operation 312. Also, the checksum 212 includes St
The checksum generated in ep22 is written, and an address (N) that does not exist to indicate the end of the list is written in the next address pointer 213 (Step 2).
3).

In step 23, when the data access table 18 is updated, the fault occurrence information 211 is already
N indicates that write access to the area has already occurred during the one-way operation 312 state. In this case, only the checksum 212 is rewritten to
Proceed to ep25. That is, only the update data information for the same address is rewritten, and the access request to the disk is terminated (Step 25). On the other hand, in Step 23, when the failure occurrence information 211 is OFF when updating the data access table, the last address 221 is written to the pre-last address 222, the current access address 224 is written to the last address 221, and the data address register is updated. Then, the end of instruction execution is transmitted to the disk interface 12 to terminate the access to the disk (Step 25).

When the disk access is completed in this manner, the process proceeds from Step 3 described above to Step 4. That is, the data communication means 16 confirms whether the computer 2 has been restarted (Step 4), and if NO, returns to Step 3, executes the above-described Step 20 to Step 26, and executes the failure occurrence information 211 of the data access table. By updating the record while turning ON, the data update history in the state of the one-way operation 312 is stored.

On the other hand, in Step 4, the data communication means 1
If the confirmation of whether or not the computer 2 has been restarted by YES is YES, the process proceeds to Step 5. That is, when the computer 2 is restarted, each of the last address 221 and the pre-last address 222 recorded in the data access table 28 is used to check whether the disk data of the disk 25 has the same contents as before the stop. Checksum 21 of data access table 28 indicated by
2 is taken out, the actually recorded disk data is read out to generate a checksum, and it is confirmed whether or not the checksum is the same as before the stop. That is, the data communication means 16 of the computer 1 confirms whether or not they match, and notifies the data monitoring means 13 via the disk interface 12 (Step 5).

The data on the disk 25 is not updated during the one-way operation 312 in which the computer 2 is stopped, and becomes old data.
Cannot use the data on the disk 25, and therefore does not use the disk interface 22 and uses the data communication means 26,
The disk interface 12 is used by using the link cable 3 and the data communication means 16.

Then, in Step 6, the mode shifts to the mirror copy mode and the state of the recovery operation 314 in FIG. 3 is set. That is, if both of the comparison results of the checksums transferred to the data monitoring means 13 match, the disk 2
Since it can be determined that the data No. 5 is the same as before the stop of the computer 2, the mode is switched to the mode for transferring only the difference between the data. If even one comparison result of the checksums does not match, it is possible to judge that the data on the disk 25 is different from that before the computer 2 stopped due to disk exchange or the like. Is switched to the transfer mode (step 6).

Here, in Step 6, in the case of the mode for transferring only the data difference, the data on the disk 15 corresponding to the address indicated by the fault occurrence address 223 stored in the data address register 2 is transferred. In order to sequentially transfer the disk data corresponding to the address written in the next address pointer 213 of the data access table indicated by the failure occurrence address 223, the process proceeds to Step 7 disk access.

In Step 6, if the mode is to transfer all data, all the data in the disk 15 must be transferred to the disk 25, so the difference information in the data access table 18 is discarded, and all the data is discarded. The following processing is performed so that data can be transferred. That is, the failure occurrence information 211 of a certain address (i) is turned ON.
Then, the address (i +
The work of writing 1) is performed at address (0)
To the address (N-1). When the data access table 18 has been updated,
(N-1) is written to the last address 221, (N-2) is written to the pre-last address 222, and (0) is written to the failure occurrence address 223, and the process proceeds to Step 7 disk access.

In Step 7, the CPU 11 or the CPU 21
In this step, the same process as in Step 3 is performed. That is, the data of the disk 15 can be updated even during the mirror copy. CPU1
If there is no write access request from the CPU 1 or the CPU 21, the disk access in Step 7 is not performed, and the process proceeds to the disk copy in Step 8.

That is, in Step 8, the computer 1 sets the fault occurrence address 223 of the data access table 18 to
Disk 15 corresponding to the data access table indicated by
Is transferred to the disk 25. In the computer 2, since the data monitoring means 23 performs the same processing as in the normal operation, the checksum generation and the current access address 224 are updated at the time of the write access, and the data access table indicated by the current access address 224 of the data access table 28 is written. Checksum 21 of the address
2, the current access address 224 is written to the next address pointer 213 of the address of the data access table indicated by the last address 221, the contents of the last address 221 are set to the pre-last address 222, and the contents of the current access address 224 are set to the last address 2
21 (Step 8).

Next, in Step 9, the data address register is updated. That is, when the write access is normally completed on the disk 25 of the computer 2, the data monitoring unit 23 sets the disk interface 22, the data communication unit 26, the link cable 3, and the data communication unit 16.
Then, the end confirmation is notified to the data monitoring means 13 of the computer 1 via the disk interface 12. When the information of the normal end is confirmed, the computer 1 turns off the failure occurrence information 211 written in the data access table 18 indicated by the failure occurrence address 223 of the data access table 18. In addition, failure address 2
23, the next address pointer 113 written in the data access table 18 is set to the fault occurrence address 2
23 is written (Step 9).

Then, in Step 10, it is determined whether or not mirroring has been completed. That is, if the failure occurrence address 223 of the data access table 18 is not N (that is, if NO), the process returns to Step 7 disk access. If N (that is, if YES), there are no more lists, and the two computers are returned to the normal system (Step 11). That is, Step 7 to Step 9
By repeating the above processing until the next address pointer of the data access table 18 reaches the address (N) indicating the end, the updated data can be transferred during the one-way operation 312.

In Step 11, the data monitoring means 13 shifts to the normal operation mode. That is, the normal mode is indicated by the disk interface 12, the data communication unit 16,
C via the link cable 3 and the data communication means 26
Notify PU21. The CPU 21 of the computer 2 recovers the data of the disk 25 when the transfer of the differential data between the disk 15 and the disk 25 is completed, uses the disk interface 22 when accessing the disk, and can return to the normal system.

The embodiment described above is an example for describing the present invention, and the present invention is not limited to the above embodiment, and various modifications are possible within the scope of the invention. is there. For example, it goes without saying that the present invention can be applied to a redundant network server system in which the same file is stored in a plurality of computers.

[0038]

As described above, in a fault-tolerant system using a dual computer, if a hardware failure is found, a defective component cannot be replaced unless the computer is stopped. In particular, when the hard disks are mirrored in both systems, it is necessary to make the information of each hard disk the same in both systems in order to restore a stable system from a single operation state.
However, in the conventional method, when one computer is recovered from the down state and the hard disk information of the recovered computer is restored, all the information in the disk of the computer that has been running continuously is copied to the disk of the recovered computer. Therefore, it takes a considerable time to complete the mirroring of the disk, and most of the time until the failure recovery is occupied by the mirror copy time for the disk data recovery, resulting in a decrease in system reliability. I was However, by applying the present invention, it is only necessary to transfer the minimum necessary data when restoring disk data, so the restoration time is greatly reduced, and a more reliable fault-tolerant system is constructed compared to the past. You can do it.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration of a computer system according to an embodiment of the present invention.

FIG. 2 is an algorithm of a process performed by a data access table in FIG. 1;

FIG. 3 is a state transition diagram that can be taken by a fault-tolerant system having two computers in FIG. 1;

FIG. 4 is a flowchart showing a flow of processing from failure to recovery of one computer in the configuration of FIG. 1;

[Explanation of symbols]

1, 2, computer, 11, 21 CPU, 12, 2
2 ... Disk interface, 13, 23 ... Data monitoring means, 14, 24 ... Disk controller, 15, 2
5 disk, 16, 26 data communication means 17, 2,
7: Failure detecting means, 18, 28: Data access table

Claims (4)

[Claims] 1. A fault-tolerant system in which two opposite computers having the same hardware configuration perform the same operation while communicating with each other to improve reliability. A mirror disk recovery method in a fault-tolerant system that mirrors a hard disk connected to the computer to mutually retain the same information and performs recovery processing after a computer stoppage due to a failure other than the hard disk, Has a special storage area for storing differential data information that was updated while other computers were shutting down and recovering due to factors other than a hard disk failure. System and restore the disk When recovering data, a normal computer must be able to return to the secondary system by transferring only the differential data information stored in its own special storage area to the computer that has returned to the system. Mirror disk recovery method in a fault-tolerant system. 2. Computers constituting a two-system system include: a CPU (Central Processing Unit) for performing main operations; a disk interface for providing an interface between a disk and other hardware; and data for the disk. A disk controller for performing direct access, a disk used for storing data, data communication means for realizing data exchange between the respective computers, and monitoring of hardware failure of the entire computer ,
A failure detection unit having a function of stopping the function of the entire computer when a failure is found; and a storage medium for recording difference data information created during the single system operation or the recovery operation by the second system. Yes, a data access table that stores a write position at the time of issuing a disk write instruction required for mirror copy, and a status at that time, and determines whether the access instruction to the disk is data read or write, Data monitoring means for creating data to be written to the data access table, wherein the data access table stores, as the special storage area, difference data information updated while other computers are stopped and restored. 2. The mirror device in a fault tolerant system according to claim 1, wherein Disk recovery method. 3. The mirror disk recovery method in a fault tolerant system according to claim 2, wherein said data access table is constituted by a storage medium of a flash memory capable of retaining contents even when power is turned off. 4. The mirror disk recovery method in a fault tolerant system according to claim 3, wherein said data access table is provided in an unused area of a disk provided in said computer.