JP2002259154A - Fault tolerant computer system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a fault tolerant computer system to control whether to stop a system by specification of a preset fault processing mode or to restart a processing by a normal processor by performing a processing to specify faulty processors and to separate them when faults are caused in two of three processors. SOLUTION: The fault tolerant computer system is provided with a mode specifying means 31 to be freely set by an operator to indicate whether to stop the system or to continue the processing to the utmost by one remaining arithmetic processing means when one of triplicated arithmetic processing means is separated due to the fault, the fault is caused in one of the arithmetic processing means in duplicated operation and multiple faults are caused.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a triple fault tolerant computer system, and more particularly to a fault tolerant computer system for performing fault processing control in the event of a serious fault (double fault) in an arithmetic processing unit.

[0002]

2. Description of the Related Art In a conventional fault-tolerant computer system, when a triple operation processing means causes a double failure, the system is always stopped. In a high-availability computer system in which arithmetic processing means are duplicated, if one of the arithmetic processing means fails, the processing is temporarily stopped, a self-diagnosis is performed, and the arithmetic processing means on the faulty side is identified. Later, it was common to return to the checkpoint and restart the process.

[0003]

Problems to be Solved by the Invention
Patent Document 4 discloses an invention in which the cause of failure (accidental error, failure, latent error, etc.) is verified by a diagnostic processor, and a recovery process corresponding to the cause is performed. However, if the cause is specified for each failure and the recovery is performed according to the cause, the process is stopped for the recovery, that is, the performance is deteriorated.

Further, Japanese Patent Application Laid-Open No. 6-124213 discloses an invention characterized in that the fault tolerance is increased up to a double fault (two processor faults) by majority decision of four processors. However, if there are four processors, it is naturally possible to specify up to two faults.

In view of the above-mentioned problems of the prior art, an object of the present invention is to stop the system by specifying a failure processing mode set in advance when two processor failures occur in three processors, It is an object of the present invention to provide a fault-tolerant computer system which performs processing for identifying and disconnecting a failed processor and controls whether or not processing is resumed by a normal processor.

[0006]

A fault-tolerant computer system according to the present invention takes a triple arithmetic processing means and a majority decision of the output of the arithmetic processing means to form one of the triple arithmetic processing means. A redundant majority processing means for identifying the arithmetic processing means in which the failure has occurred when the failure has occurred, suppressing the calculation result of the identified arithmetic processing means, and disconnecting from the system; In a fault-tolerant computer system with improved fault-tolerance that can continue operation with two arithmetic processing units, one of the triple arithmetic processing units is disconnected due to a failure, and one of the arithmetic processing units that are operating in a duplicated manner. In the event of a failure and multiple failures, stop the system,
Indicate whether to continue processing as much as possible with the remaining one arithmetic processing means, having mode designating means that can be freely set by the operator, each of the duplicated majority processing means,
The status is set according to the result of the majority decision by the majority circuit in the majority processing means, and the triple operation processing means is operating in a triple state without any obstacle, or any one of the operation processing means It has a status display means for indicating whether or not the operation is continued by the remaining two redundant arithmetic processing means, and the display of the status display means is:
If one of the arithmetic processing means has failed and the remaining two arithmetic processing means continue to operate, and if a failure has occurred in the arithmetic processing means operating further in duplex, the mode is specified. If the system has been set to stop during multiple failures by the means, the system will be stopped if the mode has been specified by the mode designating means so that it can operate as much as possible during multiple failures. The failure processing device temporarily stops processing, performs self-diagnosis of the self-processing device, and, after the self-diagnosis, disconnects from the system any of the duplicated processing devices that failed due to the self-diagnosis from the system. A failure processing notification means for notifying the system based on the content notified by the failure processing notification means, and To control whether retry the operation back to the cement.

The arithmetic processing means may include an arithmetic processor, a main memory, and a control means including a self-diagnosis function of the self-processing processing means offline.

A fault tolerant computer system according to the present invention comprises a first triple processing unit, a second triple processing unit and a third triple processing unit for performing arithmetic processing, and a first duplicated processing unit. A first majority processing unit, a second majority processing unit, an I / O card, and a failure processing unit that manages failure processing; a first arithmetic processing unit, a second arithmetic processing unit, and a third arithmetic processing unit Are connected to each of the first majority processing means and the second majority processing means via signal lines, and each of the first majority processing means and the second majority processing means Means, a second arithmetic processing means, and a third arithmetic processing means.
When one of the arithmetic processing means, the second arithmetic processing means and the third arithmetic processing means fails, the arithmetic processing means in which the failure has occurred is specified, and the calculation result of the specified arithmetic processing means is suppressed. In addition, it has dual majority processing means for disconnecting it from the system, enables operation to be continued by the other two normal operation processing means to improve fault tolerance, and outputs from the two normal operation processing means are respectively I / O The I / O card is output to the O bus and is connected to a peripheral device or a local area network by an I / O card connected to the I / O bus. The first majority decision processing means and the second majority decision processing means send fault information notifications to signal lines. Fault tolerant to notify the fault handling device via
In the computer system, one of the tripled first processing means, the second processing means, and the third processing means is disconnected due to a failure, and one of the processing processing means which is operating in a duplex state is failed. Occurs and multiple failures occur,
A mode designating means that can be freely set by an operator, which indicates whether to stop the system or continue processing as much as possible with the remaining one processing means,
In each of the first majority processing means and the second majority processing means,
The status is set according to the result of the majority decision by the majority circuit in the majority processing means, and the tripled first arithmetic processing means, the second arithmetic processing means and the third arithmetic processing means are tripled without any trouble. Status display means for indicating whether the operation is being performed in a state where the operation has been performed, or whether any one of the arithmetic processing means has become an obstacle and continuing operation with the remaining two redundant arithmetic processing means. When the display indicates that one of the processing means has failed and the remaining two processing means continue to operate,
Furthermore, if a failure occurs in the arithmetic processing means operating in duplex, the system designating means will stop the system if multiple system failures have been set, and the mode designating means will also stop the system failure if possible. If the mode is specified to enable operation, processing is temporarily stopped when a failure occurs, self-diagnosis of the self-processing unit is performed, and after the self-diagnosis, self-diagnosis is performed among the duplicated processing units. Has a failure processing notifying means for notifying the failure processing device that the arithmetic processing means which has caused the failure is disconnected from the system, and based on the content notified by the failure processing notifying means, causes the failure processing apparatus to bring down the system. Or return to the checkpoint and retry the process.

The arithmetic processing means may include an arithmetic processor, a main memory, and control means including a self-diagnosis function of the self-processing processing means offline.

Accordingly, it is possible to flexibly control whether to stop the system or continue by retrying when a double fault occurs in the arithmetic processing means, and to perform the arithmetic operation in the conventional triple fault-tolerant system. Even in the event of a double failure of the processing means, a retry function at the high availability system level that is duplicated according to the user's application is also provided, so that the availability can be flexibly set according to the user's application. .

[0011]

FIG. 1 shows an example of the configuration of a fault-tolerant computer system according to an embodiment of the present invention.

The arithmetic processing means for performing the arithmetic processing is tripled, and each of the first arithmetic processing means 1, the second arithmetic processing means 2, and the third arithmetic processing means 3 outputs
The first majority processing means 4 and the second majority processing means 5 are connected via signal lines 7-12.

The outputs of the first arithmetic processing means 1, the second arithmetic processing means 2, and the third arithmetic processing means 3 are subjected to a majority decision by a first majority processing means 4 and a second majority processing means 5. ,
The selected output is output to the I / O bus 13 or 14, respectively. Also, the I / O card 6 and the like connected to both the I / O buses 13 and 14 connect to peripheral devices and local area networks.

Further, the first majority decision processing means 4 and the second majority decision processing means 5 transmit a failure information notification to be described later on a signal line 33.
Alternatively, the failure is notified to the failure processing device 35 via 34, and the failure processing device 35 manages the failure processing of the fault-tolerant computer.

FIG. 2 shows a detailed example of the first arithmetic processing means 1. The arithmetic processors 18 to 21 constitute a shared memory multiprocessor (SMP), are connected to the internal bus 24, and have control means 22 for controlling the input / output and the input / output with the main memory 23. The input / output of the first arithmetic processing means 1 is connected to the outside via the signal line 7 by means 22.

FIG. 3 shows a detailed configuration of the first majority decision processing means 4 which is a feature of the present invention. The output of each of the tripled first arithmetic processing means 1, second arithmetic processing means 2, and third arithmetic processing means 3 is input to majority decision circuit 26 and selector 28 via signal lines 7, 9, and 11. Is done. Upon receiving the input, the majority decision circuit 26 performs a majority decision on the outputs of the first arithmetic processing means 1, the second arithmetic processing means 2, and the third arithmetic processing means 3 and checks whether there is a mismatch output. If there is no output mismatch by the check by the output majority, all outputs are determined to be normal, and the output of the selector 28 is set as a default and the first arithmetic processing means 1
An instruction signal is issued to select the output of (1), and the status display means 27 is set to indicate that no failure of the arithmetic processing means has occurred in the machine cycle.

In the selector 28, the output of the first arithmetic processing means 1 inputted through the signal line 7 in accordance with an instruction from the majority decision circuit 26 through the signal line 29 is selected and outputted to the I / O bus 13. In the next machine cycle, the status indicating that no fault has been set in the status display means 27 is sent to the fault processing notifying means 32, and the fault processing notifying means 32 notifies that no fault has occurred via the signal line 33. To the failure processing device 35. Since no failure has occurred in the failure processing device 35 due to the notification, no action is taken.

Next, the operation in the case where a failure has occurred in the first arithmetic processing means 1 and an output abnormality has occurred will be described.

When the output of the arithmetic processing means is checked by majority decision, there is an output mismatch, and the first arithmetic processing means 1
Is different from the other two, when it is determined that the output is abnormal, the output of the selector 28 is
An instruction signal is issued to select the output of the first arithmetic processing means 1 in the status display means 27, and a failure occurs in the first arithmetic processing means 1 in the machine cycle, and the output of the selector 28 is switched. Set that the output of is unused.

In the selector 28, the output of the second arithmetic processing means 2 input via the signal line 7 according to an instruction from the majority circuit 26 via the signal line 29 is selected and output to the I / O bus 13. In the next machine cycle, the first arithmetic processing means 1 set in the status display means 27
Is sent to the fault processing notifying means 32, and the fault processing notifying means 32 notifies the fault processing device 35 via the signal line 33 of the fact that the fault of the first arithmetic processing means 1 has been received. Notice. In the failure processing device 35, since the first arithmetic processing means 1 has failed due to the notification, the first arithmetic processing means 1 is disconnected from the system, but the processing is continued without stopping. The operation up to this point is what has been done as a general technique of the conventional triple fault-tolerant computer.

Next, a case in which a failure occurs in the second arithmetic processing means 2 in a state where the first arithmetic processing means 1 is separated and a double failure occurs, which is a feature of the present invention. explain. If a failure occurs in the second arithmetic processing means 2 in a state where the first arithmetic processing means 1 is disconnected, the majority decision circuit 26 sets the second arithmetic processing means 2 and the third arithmetic processing means 3
However, it is not possible to specify which of the second processing means 2 and the third processing means 3 has failed. Here, the majority decision circuit 26 does not change the output of the selector 28 and sets the status display means 27 to the status of the double failure occurrence of the arithmetic processing means.

In the next machine cycle, the status display means 27 notifies the fault processing notifying means 32 of the occurrence of the double fault. Upon receipt of the notification, the failure processing notifying means sends the following two types of instructions depending on the contents of the mode designation means 31 set in advance.
Do 5

As the first pattern instruction, when the instruction set in the mode designating means 31 indicates the system down mode, an instruction to stop the system is issued to the failure processing unit 35. As another pattern instruction, when the instruction set in the mode designating means 31 is the retry mode, the system operation is temporarily stopped for the fault processing device 35, and the self-diagnosis of the arithmetic processing means 2 and 3 is performed.
If the arithmetic processing unit in which the failure has occurred can be identified as the second arithmetic processing unit 2 by the self-diagnosis, only the third arithmetic processing unit 3 is used, and the processing is resumed from the check point.

[0024]

As described above, the present invention has the following effects.

With the above-described means, it is possible to flexibly control whether to stop the system or to continue by retrying when a double fault occurs in the arithmetic processing means. Even in the event of a double failure of the arithmetic processing means in the system, a dual high availability system level retry function is provided according to the user's application, and the availability can be flexibly set according to the user's application. There is an effect that it becomes possible.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating a configuration example of a fault-tolerant computer system according to an embodiment of the present invention.

FIG. 2 is a diagram illustrating a configuration example of an arithmetic processing unit.

FIG. 3 is a diagram showing a configuration example of majority decision processing means.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 1st arithmetic processing means 2 2nd arithmetic processing means 3 3rd arithmetic processing means 4 1st majority processing means 5 2nd majority processing means 6 I / O card 7-12, 15-17, 25, 30, 33, 34 signal lines 13, 14 I / O bus 18-21 arithmetic processor 22 control means 23 main memory 24 internal bus 26 majority circuit 27 status display means 28 selector 29 selector output selection signal 31 mode designation means 32 failure processing notification Means 35 Fault handling device

Claims (4)

[Claims] 1. A triple arithmetic processing means, and an arithmetic processing means which takes a majority decision of an output of the arithmetic processing means and generates a failure when one of the triple arithmetic processing means fails. And a redundant majority processing means for suppressing the operation result of the specified arithmetic processing means and disconnecting from the system, and capable of continuing operation by the other two normal arithmetic processing means. In a fault-tolerant computer system with improved operability, one of the triple arithmetic processing units is disconnected due to a failure, and a failure occurs in one of the arithmetic processing units operating in duplex, resulting in multiple failures. If the system is down,
An operator has a mode designating means which indicates whether processing is continued as much as possible by the remaining one arithmetic processing means and which can be freely set by an operator. Each of the duplicated majority processing means has The status is set according to the result of taking the majority vote in the majority circuit, and the tripled arithmetic processing means is operating in a tripled state without a failure, or any one of the arithmetic processing means becomes a failure, Status display means for indicating whether or not the operation is continued by the remaining two redundant arithmetic processing means, and the display of the status display means indicates that one of the arithmetic processing means has become an obstacle and the remaining two arithmetic processing means have failed. When the processing means indicates that the operation is continued, if a failure occurs in the arithmetic processing means which is further operating in duplex, the mode designating means causes a failure in the case of multiple failures. If the system stop is set, the system is stopped, and if the mode is specified by the mode specifying means so that operation is possible as much as possible even in the case of multiple failures, processing is temporarily performed when a failure occurs. Stop, perform self-diagnosis of the self-processing unit, and, after the self-diagnosis, notify the fault processing unit of disconnection from the system of the processing unit that has failed due to the self-diagnosis among the duplicated processing units. Notifying means, based on the content notified by the fault processing notifying means,
A fault-tolerant computer system, which controls whether the system goes down or returns to a checkpoint and retries processing by a fault handling device. 2. The fault tolerant computer system according to claim 1, wherein said arithmetic processing means has an arithmetic processor, a main memory, and a control means including a self-diagnosis function of the self-processing processing means offline. . 3. Triplet first arithmetic processing means for performing arithmetic processing, second arithmetic processing means, third arithmetic processing means, duplicated first majority processing means, and second majority processing. Means, an I / O card, and a fault processing device for fault processing, wherein each of the first arithmetic processing means, the second arithmetic processing means, and the third arithmetic processing means comprises The first majority processing means and the second majority processing means are connected via a signal line to each of the first majority processing means and the second majority processing means, and each of the first majority processing means and the second majority processing means comprises the first arithmetic processing means And the majority of the outputs of the second and third arithmetic processing means are taken and one of the first and second arithmetic processing means and one of the third arithmetic processing means When a failure occurs, the arithmetic processing means in which the failure has occurred is specified, and the specified A duplicated majority processing means for suppressing the operation result of the arithmetic processing means and disconnecting from the system is provided, the operation can be continued by the other two normal arithmetic processing means, and the fault tolerance is improved. The outputs of the arithmetic processing means are respectively output to an I / O bus, and are connected to a peripheral device or a local area network by the I / O card connected to the I / O bus. In a fault tolerant computer system for notifying the fault processing device to the fault processing device via a signal line in the second majority processing means, the tripled first arithmetic processing means and second arithmetic processing means If one of the third arithmetic processing means is disconnected due to a failure and one of the arithmetic processing means operating in duplicate has a failure, resulting in multiple failures, whether to stop the system. An operator has a mode designating means that can be set freely, indicating whether processing is continued as much as possible with the remaining one arithmetic processing means. The duplicated first majority processing means and second majority processing A status is set in each of the means by a result of a majority vote taken by a majority circuit in the majority processing means, and the tripled first arithmetic processing means, second arithmetic processing means, and third arithmetic processing are performed. Status display means for indicating whether the means are operating in a triple state without any failure, or whether any one of the arithmetic processing means has failed and the operation of the remaining two redundant arithmetic processing means is continued. When the status display means indicates that one of the arithmetic processing means has become an obstacle and the remaining two arithmetic processing means continue to operate, Performance When a failure occurs in the processing means, the mode designating means makes the system stop when the system is stopped at the time of multiple failures, and the mode designation means makes it possible to operate as much as possible at the time of the multiple failures. If the mode is specified, the processing is temporarily stopped when a failure occurs, the self-processing unit performs a self-diagnosis, and after the self-diagnosis, a failure has occurred due to the self-diagnosis of the redundant processing means. A fault processing notifying means for notifying the fault processing device of disconnection of the arithmetic processing means from the system, based on the content notified by the fault processing notifying means,
A fault-tolerant computer system, which controls whether the system goes down or returns to a checkpoint and retries processing by a fault handling device. 4. The fault tolerant computer system according to claim 3, wherein said arithmetic processing means has an arithmetic processor, a main memory, and a control means including a self-diagnosis function of the self arithmetic processing means offline. .