JP2003258997A - Standby system for service control node system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a distributed service control system overcoming the drawbacks of an n+1 standby system with hardware volumes reserved as backup equivalent to the hardware volumes of the n+1 standby system. <P>SOLUTION: The copy of a database for active data retained in the main storage device MM of each active module M<SB>1</SB>, M<SB>2</SB>, and M<SB>3</SB>is divided into two. The backup databases of the divided databases are distributed and stationed to and in the respective secondary memories SM of two other modules. For example, when rewriting is encountered in certain user information of an active database WDB<SB>1</SB>, rewriting is applied to a backup database SDB<SB>1</SB>in the secondary memory SM of the same module corresponding to the active database WDB<SB>1</SB>. In addition, a module (M<SB>2</SB>or M<SB>3</SB>) having a backup database SDB including the user information is specified from a management table BFT for backup application. Rewriting is also instructed to the module. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a service control node system that is provided in a communication network and is involved in the realization of network services, and in particular, it is composed of a plurality of modules that can operate independently and a coupling mechanism for them. The present invention relates to a distributed control type service control node system in which a database for service control is distributed and arranged in a plurality of modules.

[0002]

2. Description of the Related Art FIG. 3 shows an example of a network to which the present invention is applied. This is because the conventional public switched telephone network (PSTN: Public Switched Tel.
rk) and an Internet Protocol (IP) network are integrated. The interface between the PSTN and the IP network is taken by the media gateway MG. In such a next-generation network, the voice of the telephone is converted into a packet format and transferred over the IP network.
OIP (Voice over IP) services are typical.

C is used for connection control of calls made to this network.
A (call agent) or SA (service agent) is used. CA controls MG via IP network,
The GK (gatekeeper) is accessed to obtain the IP address corresponding to the destination telephone number. That is, the GK manages a database holding a correspondence table of telephone numbers and IP addresses. Further, SA corresponds to the service control point (SCP) in the advanced IN.

In order to enable continuous communication when the IP terminal moves, the correspondence between the home address (IP address) for identifying the terminal and the care-of address (IP address) given at the moving destination is managed. HA (Home Agent) is used. When the mobile IP terminal obtains the care-of address at the destination, it registers the care-of address with the HA. Further, when another IP terminal that does not know the care-of address of the mobile terminal transmits a packet to the mobile terminal using the IP address, the IP packet is transmitted to the home address of the mobile terminal, but the HA accommodates it. The IP packet provided with the home address of the mobile terminal is encapsulated and transferred to the corresponding care-of address. H
A manages a database that holds a correspondence table of home addresses and care-of addresses.

Large scale SCP, CA (including GK), S
When configuring service control nodes such as A and HA,
A distributed control type configuration in which a database is distributed to a plurality of devices is generally adopted because of a bottleneck in processor performance.

FIG. 4 shows an example of the configuration of a service control node system according to the prior art. This system is composed of K modules M _{1 to} M _K that can operate independently, and a module coupling mechanism IMC that relays communication between each module M _{1 to} M _K and each module via an IP network.

Each of the modules M _{1 to} M _K has an IMC interface control unit IMCI for interfacing with the module coupling mechanism IMC, a central processing unit CPU for executing main processing by software, a main storage unit MM,
And a secondary memory SM. Main memory MM,
When it is necessary to distinguish the secondary memory SM for each module, a number is given and shown as MMi and SMi (1 ≦ i ≦ K). In the main memory MM of each module M _{1 to} M _K , data for each user necessary for controlling the service provided to the contract user by the communication network is held as an active database. Specifically, the data corresponding to a certain user is the main storage device MM of any one module Mi (1 ≦ i ≦ K).
Hold in the current database in i. Further, the spare of the working database is held in the secondary memory SM of the module having the working database, and the MM of the module Mi is stored.
When the current database in i is destroyed, the spare in the secondary memory SMi is expanded in the main memory MMi and the process is continued. Hereinafter, the backup of the current database is called a backup database.

The module coupling mechanism IMC holds a user-module conversion table UM for recording the correspondence between the user number and the module number holding the data of the user as an active database. When all the modules in the system are normal, the module coupling mechanism I reads and rewrites instructions from the communication network (IP network).
When the MC receives it, the module coupling mechanism IMC refers to the user-module conversion table UM, and transfers the instruction to the module that holds the working database corresponding to the instruction. The module receiving the instruction reads or rewrites the active database in the main storage device MM according to the content of the instruction, and the module coupling mechanism IMC.
A response is returned to the communication network via. When rewriting occurs, the corresponding spare database of the secondary memory SM in the module is changed.

When a failure occurs in a module Mi (1≤i≤K), it is necessary for the module to have a redundant configuration in order to continue the service. As a conventional redundant configuration, there are a 1 + 1 spare system and an n + 1 spare system. Here, a module having a working database is called a working module, and a module having no working database is called a spare module.

FIG. 5 shows an example of a redundant configuration when the 1 + 1 spare system is applied. The number of modules required as a system when a redundant configuration is not taken is n, and a set of an active module and a spare module in the case where each of n modules has a dual configuration is shown. Number "i"
Is a number given to each set of the active module and the spare module, and "0" or "1" following the number "i" represents the active module and the spare module, respectively.

In the case of the 1 + 1 spare system, the number of modules (n) required as a system when the redundant configuration is not adopted.
However, twice as many modules (2n) are required.

Active module M_i-0Current database
WDB_i-0Preliminary database SDB _i-0Is the active module
SM of Hur_i-0And spare module M_i-1MM_i-1
And SM _i-1Hold on.

Reading user data from the communication network and
And rewriting is the current module M _iWorking database in
Source WDB_i-0To use. Current database WDB_i-0
When the rewriting of the
Preliminary database SDB in SM of the same module_i-0
In addition to the spare module MM_i-1And SM_i-1Inside
Storage database SDB_i-1Rewrite. Other working
If the current database is rewritten in the module
The same applies to the case.

Each spare module monitors the normality of the corresponding active module according to the module failure detection logic example shown below, and when a failure of the module is detected, the module coupling mechanism IMC indicates to the user-module. Instruct to change the inter-module conversion table UM.

Example of module failure detection logic: The active module periodically sends a signal indicating the normality of its own module to the corresponding spare module. When the signal indicating the normality does not arrive for a predetermined time or longer, the spare module determines that the corresponding working module has failed.

Upon receiving the rewriting instruction of the user-module conversion table UM, the module coupling mechanism IMC switches the transfer destination module of the database access request instruction from the communication network from the active module to the backup module. When the spare module M _i-1 receives the database access request instruction, it uses the spare database SDB _i-0 in the main memory MM _i-1 as a new working database and responds to reading and rewriting of user data.

Similarly, when a failure occurs in another active module, the spare module is switched to.

When the number of spare modules is not required as much as the number of modules currently in use due to the quality to be satisfied by the system, a method of saving the number of spare modules by the n + 1 spare method can be considered.

FIG. 6 shows an example of a redundant configuration when the n + 1 spare system is applied. In this configuration, a switching management server is installed in the system. When the redundant configuration is not adopted, the number of modules required for the system is n, and one spare module is provided for n active modules. In FIG. 6, n = 2, M ₁ and M ₂ are active modules, and M ₃ is a spare module.
The same applies when is an arbitrary integer of 3 or more.

In the case of the n + 1 spare system, the number of modules (n) required as a system when the redundant configuration is not adopted.
, (N + 1) / n times as many modules (n + 1)
is necessary. The active databases WDB _{1 of} the active modules M ₁ and M ₂ and the spare database SDB _{1 of} the WDB ₂ ,
The SDB ₂ is held in the secondary memory SM and the switching management server SM corresponding to each active module.

The reading and rewriting of user data from the communication network uses the working database in the working module. For example the active module when rewriting the current database WDB ₁ occurs in M _1, in addition to the secondary memory SM ₁ in preliminary database SDB ₁ module with the developing database WDB _1, the switch management server S
Rewrite the corresponding preliminary database SDB ₁ in M. Other active module M ₂ with active database WDB ₂
The same applies when rewriting occurs.

The switching management server SM monitors the normality of each of the modules M ₁ and M _{2 according to} the failure detection logic example shown below, and when the failure of the module M ₁ is detected, for example, the switching management server SM. To the current database WDB
₁ copy SDB ₁ to the main memory M of the spare module M ₃
The data is transferred to M ₃ and the secondary memory SM ₃ , and the module coupling mechanism IMC is instructed to change the user-module conversion table UM.

Example of module failure detection logic: The active module periodically sends a signal indicating the normality of its own module to the switching management server. The switching management server determines that the corresponding active module has failed when the signal indicating the normality does not arrive for a certain time or longer.

When the module coupling mechanism IMC receives the rewriting instruction of the user-module conversion table UM, it switches the database access request instruction for the active module M ₁ from the communication network from the active module M ₁ to the backup module M ₃ . When the spare module M ₃ receives the database access request instruction, it uses the spare database SDB ₁ in the main memory MM ₃ as a new working database and responds to reading and rewriting of user data. Similarly, when a failure occurs in another active module M ₂ , the spare module M ₃ is switched to.

[0025]

As described above, n +
In the case of the 1-spare system, the number of modules can be saved as compared with the 1 + 1-spare system, but it has the following drawbacks. When a failure occurs in the active module, it is necessary to transfer the backup database from the switching management server to the backup module, so switching takes longer than in the 1 + 1 backup method, and database access during switching is not possible, so quality of service is reduced. descend. Since an unnecessary switching management server is required in the 1 + 1 standby system, extra device cost and maintenance cost are required. Furthermore, when the system is normal, the spare module cannot be used for current processing, so the CP of the spare module
U performance cannot be used effectively. It should be noted that this defect is also the same in the 1 + 1 spare system.

It is an object of the present invention to provide a distributed service control system which overcomes the drawbacks of the n + 1 backup system as described above while making the hardware reserved for the backup equivalent to the n + 1 backup system.

[0027]

According to the present invention, there are n (1 <1 <1) copies of the active database held in each active module.
n ≦ K−1, K is divided into the number of modules (> 1), and the spare database of the working database divided into each of the other n working modules is distributed and arranged. Each of the n active modules having a backup database of the active database of the active module continues the process of database access.

Since the spare database is divided into n active modules, there is no need to transfer data from the switching management server to the spare module, which occurs in the n + 1 spare system at the time of switching. As a result, it becomes possible to execute the module switching in a shorter time than the n + 1 standby method.

Regarding the amount of hardware, the number of modules is the same as that of the n + 1 backup system, but the switching management server required in the n + 1 backup system is not required.

Further, since the spare module is not required, the CPU performance of each module can be effectively used when the system is normal.

[0031]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 shows an example of the configuration of a service control node system according to an embodiment of the present invention that realizes a high-performance service in an IP network. The system includes a module M ₁ ~M _K of K heights that can operate independently (K> 1), the relay communication in each module M ₁ ~M _K and between the modules M ₁ ~M _K and IP networks It is composed of a module coupling mechanism IMC for performing.

Each of the modules M _{1 to} M _K has an IMC interface controller IMCI for interfacing with the module coupling mechanism IMC, a central processing unit CPU for executing main processing by software, and a main memory MM.
And a secondary memory SM. Main memory MM, 2
When it is necessary to distinguish the next memory SM for each module, a number is given and shown as MMi and SMi (1 ≦ i ≦ K). In the main memory MM of each module M _{1 to} M _K ,
Data for each user, which is necessary for controlling the service provided by the IP network to the contracted user, is held as an active database. Specifically, the data corresponding to a certain user is held in the active database in the main memory MMi of any one module Mi (1 ≦ i ≦ K). Further, the backup of the active database is held in the secondary memory SM of the module having the active database, and when the active database in the main memory MMi of the module Mi is destroyed, the backup of the secondary memory SMi is mainly saved. Storage device MMi
Expand to and continue processing. Hereinafter, the backup of the current database is called a backup database. The inter-module coupling mechanism IMC holds a user-to-module conversion table UM that records the correspondence between the user number and the module number that holds the data of the user as an active database.

When all the modules in the system are normal, when the module coupling mechanism IMC receives the reading and rewriting instruction from the IP network, the module coupling mechanism IMC refers to the user-module conversion table UM and writes the instruction. The instruction is transferred to the module that holds the corresponding working database. The module that has received the instruction reads or rewrites the active database in the main storage device MM according to the content of the instruction, and returns a response to the IP network via the module coupling mechanism IMC. When rewriting occurs, the secondary memory S in the corresponding module is rewritten.
Change M's preliminary database.

FIG. 2 shows an example of a redundant configuration in this embodiment. When the redundant configuration is not adopted, the number of modules required for the system is n, and n + 1 active modules are provided. Although FIG. 2 shows the case of n = 2, n
The same applies when is an arbitrary integer of 3 or more.

In the case of this embodiment, (n + 1) / n times as many modules (n + 1) are required as the number of modules (n) required as a system when the redundant configuration is not adopted.

Copies SDB ₁ , S of the active databases WDB ₁ , WDB ₂ , WDB ₃ held in the main storage devices MM ₁ , MM ₂ , MM ₃ of the active modules M ₁ , M ₂ , M _3.
DB ₂ and SDB ₃ are secondary memories SM ₁ and
It is located in SM ₂ and SM ₃ . Furthermore, copies SDB ₁ , SD of the active databases WDB ₁ , WDB ₂ , WDB ₃ held in the active modules M ₁ , M ₂ , M ₃ respectively.
B ₂ and SDB ₃ divided into n (= 2) pieces are secondary databases SM ₂ and SM ₃ of other active modules M ₂ and M ₃ , M ₁ and M ₃ , and M ₁ and M ₂ as a preliminary database. , SM ₁ and SM
₃ , distributed in SM ₁ and SM ₂ . In the case of the working module M ₁ , SDB ₁ , SM ₂ in WDB ₁ to SM ₁
This is indicated by an arrow to SDB ₁ in S3 and SDB ₁ in SM ₃ . Therefore, the backup database of a certain working database is distributed and exists in the secondary memory SM in the working module having the working database and the other n working modules. However, when paying attention to the data of a certain subscriber, the backup of the data is stored in the secondary memory SM of the active module having the active database containing the data and in the secondary memory SM of any one of the active modules. Exists in. In addition, the spare destination management table BFT manages in which active module each spare database corresponding to the active database of each active module exists. Further, the spare source management table BBT manages which of the working databases each of the spare databases of each working module corresponds to.

If the active database size and the CPU load of each active module are set to D and C, respectively, in the case where the redundancy is not taken, in this embodiment, all (n + 1) modules operate as the active modules. The size and CPU load of the active database of the active module are {n / (n + 1)} × D and {n / (n +), respectively.
1)} × C. However, in the present embodiment, since the capacity of the database main memory MM requires a spare resource of D / n, the total amount per module of the database main memory MM including the spare is D. In addition, the total amount of the secondary memory SM for database per module requires twice the resource of the current database size per module in this embodiment, so {2n /
(N + 1)} × D. However, in this embodiment, n +
The switching management server (including the SM of size n × D) required in the one standby system is unnecessary. Therefore, in the entire system, the amount of (2n + 1) × D is required for the n + 1 preliminary method for storing the preliminary database, but 2n × D is sufficient in the present embodiment.

Reading user data from the IP network and
And rewriting is the current module M ₁Working database in
Source WDB₁To use. For example, the current database W
DB₁Rewriting occurs for user information with
And module M₁CPU is the current database WD
B₁Preliminary database in SM of the same module corresponding to
S SDB₁And the spare management table B
Preliminary database SDB containing the user information from FT₁
With module (M₂Or M₃) Is specified and the
Instructs to rewrite the rules as well. Other active modules
If the current database is rewritten in
It is the same.

The CPU of each module M ₁ , M ₂ , M ₃ is
The normality of the module registered in the spare source management table BBT is monitored by the module failure detection logic example shown below. For example, when the active modules M ₂ and M ₃ detect the failure of the active module M _1, the active module M _2
2 and M ₃ instruct the module coupling mechanism IMC to change the user-to-module conversion table UM, and refer to the spare destination management table BFT to identify the module in which the spare database corresponding to the failed module exists, The preliminary database SBD ₁ in each secondary memory SM is expanded in the main storage devices MM ₂ and MM ₃ , respectively.

Example of module failure detection logic: The active module periodically sends a signal indicating the normality of its own module to the module registered in the spare destination management table BFT. Modules with a preliminary database are
If the signal indicating the normality does not arrive for a certain time or more, it is determined that the corresponding active module has failed.

The module coupling mechanism IMC is user - upon receiving a rewrite instruction of the module between the conversion table UM, a database access request instruction addressed working module M ₁ from the IP network, based on the user ID, M ₂ from the module M ₁ Or switch to M ₃ . Working module M ₂
When the CPUs of M and M ₃ receive the access request instruction to the active database WDB ₁ , the CPUs of the main memory MM ₂
And the spare database SDB ₁ in MM ₃ is used as the new working database (indicated by the dashed arrow in FIG. 2) and responds to reading and rewriting user data. Similarly, when a failure occurs in another active module, it is similarly switched to n other active modules having a backup database of the active module database.

The processing performed in each of the modules M _{1 to} M ₃ is programmed in a computer-readable recording medium, and the program recorded in this recording medium is stored in the CPU.
Is executed by reading. The computer-readable recording medium refers to a recording medium such as a proppy disc, a magneto-optical disc, a CD-ROM, and a storage device such as a hard disk device built in a computer system. Further, the computer-readable recording medium is
One that dynamically holds the program for a short time (transmission medium or wave), such as when transmitting the program via the Internet, and volatile memory inside the computer system that serves as the server in that case. , Including those holding the program for a certain period of time.

The following modifications of the above embodiment from the viewpoint of the database holding method are possible. In the above-described embodiment, the active database is provided in the main memory MM, but the same effect can be achieved even if the main database MM is not placed and only the secondary memory SM is provided. In the above embodiment, the spare database of another module is placed in the secondary memory SM of the own module, but it may be placed in the main storage device MM of the own module. In this case, the required size of the main memory device MM increases, but since it is not necessary to copy data from the secondary memory SM to the main memory device MM at the time of switching, it is possible to further shorten the switching time.

From the viewpoint of module failure detection logic,
In the above-described embodiment, an example is shown in which the failure of each module is mutually monitored, but the module coupling mechanism IMC monitors the normality of each module M ₁ , M ₂ , M ₃ and detects the failure. A method of changing the user-module conversion table UM or issuing an instruction to expand a database in the main storage device MM to a module having preliminary information in the secondary memory SM may be used. Alternatively, for example, a maintenance management device which is not in the above embodiment detects a failure, instructs to change the user-module conversion table UM, and stores a spare database as a main database for a module having spare information in the secondary memory SM. A method of issuing an instruction to expand to the storage device MM may be used.

Further, in the above embodiment, one module is added to the number of modules n required when the redundancy is not taken. However, for example, the number of modules required when the redundancy is not taken is K. When (K> n), K × (n +
1) / n modules may be provided, and the above embodiment may be applied to n + 1 active modules.

Further, in the above embodiment, the active database divided into 1 / n is copied to each of the other modules as a spare database. However, by copying each of them to different m modules, n + m
It is possible to guarantee the reading and rewriting of the database even when m modules out of the modules fail. In the case of this modification, the backup database corresponding to a certain working database exists in m modules other than the module holding the working database. Therefore, when a module fails,
It is necessary to determine in advance the priority order of which module the backup database is to be the active database. At this time, the active database size and the CPU load of each active module are n / (n + m) times as large as when the redundancy is not taken.

[0048]

As described above, according to the present invention,
The following effects are obtained as compared with the conventional n + 1 preliminary method. 1) Since the backup database of the working database exists in each module, it is not necessary to transfer data from the switching management server to the module when switching, which occurs in the n + 1 backup method. Therefore, the time during which the database cannot be accessed is shortened as compared with the n + 1 backup method. 2) The size of the active database is n + 1 in the spare system
/ (N + 1) times, so the main memory M
The amount of data copied to M is small, and the time during which the database cannot be accessed is further shortened. In the modification of the above-described embodiment, in the mode in which the spare database is provided in the main storage device MM, it is not necessary to copy it to the main storage device MM. 3) The number of modules, the total CPU performance and the total MM performance of each module are the same as those of the n + 1 spare system. In addition, the entire system stores n as a preliminary database
In the +1 spare system, the amount of the secondary memory S of (2n + 1) × D
Although M is required, in the present invention, 2n × D secondary memory S
Since M is sufficient, the amount of hardware can be further reduced as compared with the n + 1 spare method. 4) Also, the switching management server necessary for the n + 1 backup method can be deleted. 5) Further, the CPU load when each active module is normal is n / (n + 1) times as large as when the redundancy is not taken,
The 1 / (n + 1) times is the preliminary performance for switching, but since the preliminary performance can be applied to the processing of the active database, the CPU performance can be effectively used when the system is normal.

[Brief description of drawings]

FIG. 1 is a configuration diagram of a service control node system according to an embodiment of the present invention.

FIG. 2 is a diagram showing an embodiment of a redundant configuration.

FIG. 3 is a diagram showing an example of a network to which the present invention is applied.

FIG. 4 is a diagram showing a configuration example of a conventional service control node system.

FIG. 5 is a diagram illustrating an implementation example of a 1 + 1 redundant configuration.

FIG. 6 is a diagram showing an implementation example of an n + 1 redundant configuration.

[Explanation of symbols]

Mi (1 ≦ i ≦ K) active module IMC module coupling mechanism UM user-module conversion table IMCI IMC interface CPU central processing unit MM main memory SM secondary memory M ₁ , M ₂ , M ₃ module MM ₁ , MM ₂ , MM ₃ main storage devices SM ₁ , SM ₂ , SM ₃ secondary memory WDB ₁ , WDB ₂ , WDB ₃ working databases SDB ₁ , SDB ₂ , SDB ₃ spare database BBT spare source management table BFT spare destination management table

Continued front page    (72) Inventor Shiro Mizuno             2-3-1, Otemachi, Chiyoda-ku, Tokyo             Inside Telegraph and Telephone Corporation F-term (reference) 5B082 DE03 DE04                 5K051 AA04 BB00 CC00 CC15 EE01                       EE02 LL01 LL07

Claims (6)

[Claims] 1. The data for each user, which includes K (1 <K) modules and is necessary for controlling a service provided by a communication network to a contract user, is distributed and held in an active database in each module. User data exists in any one of the active databases, and in a service control node system capable of reading and rewriting the active database from the communication network, a copy of the active database held by each module is n
(1 <n ≦ K−1), and each of the n copies of the active database is distributed and deployed as a backup database in different n modules, and when a module fails, The n modules having a spare database corresponding to the working database of the module convert the spare database into a working database in the module, and the communication network reads and rewrites the working database. A standby method in a service control node system for switching to a module having the current database after conversion. 2. The module includes K (1 <K) modules and an inter-module coupling mechanism that connects each module, and the inter-module coupling mechanism is connected to a communication network and holds a user and data of the user. Holding a user-module conversion table that records the correspondence relationship with the module in which the active database exists, and when the inter-module coupling mechanism receives a database access request from the communication network, the user-module conversion table is generated based on the user-module conversion table. In the distributed service control system that transfers the database access request to the module corresponding to the database access request and reads or rewrites the active database corresponding to the database access request, the copy of the active database held by each module is n
(1 <n ≦ K−1), and each of the n copies of the active database is distributed and deployed as a backup database in different n modules, and when a module fails, A standby method in a service control node system, wherein the user-module conversion table is changed, and the transfer destination of a database access request corresponding to the module is switched to n modules having a backup database of the working database of the module. 3. The rewriting of the active database, when the rewriting of the active database occurs, the module holding the active database rewrites the auxiliary database to the module having the auxiliary database corresponding to the active database. Preliminary method in the described service control node system. 4. A priority order of backup databases used by a communication network when a failure occurs in the active database by using a copy of the active database divided into n pieces as a backup database and allocating each of the divided databases to m other modules. When a module fails, the standby database with the highest priority among the standby databases corresponding to the active database of the module is converted to the active database, and the communication network reads and reads the active database. The standby method in the service control node system according to claim 1, wherein a module that executes rewriting is switched to a module that has the current database after the conversion. 5. The module includes K (1 <K) modules and an inter-module coupling mechanism that connects each module, and the inter-module coupling mechanism is connected to a communication network and holds a user and data of the user. Holding a user-module conversion table that records the correspondence relationship with the module in which the active database exists, and when the inter-module coupling mechanism receives a database access request from the communication network, the user-module conversion table is generated based on the user-module conversion table. The database access request is transferred to the module corresponding to the database access request, and the copy of the current database held by each module is n.
(1 <n ≦ K−1), and each of the copies of the active database divided into n is distributed as a backup database to n different modules of the service control node system. A processing program in a module, when an access request is issued for the data in the active database in the own module, the spare database in the own module corresponding to the active database is accessed,
Further, a command step of specifying a module having a spare database corresponding to the active database and instructing the module to access the spare database,
When the normality of another module is monitored and a failure is detected, the module of the user-module conversion table is
If the inter-module coupling mechanism is instructed to change to a module having a spare database corresponding to the active database of the module in which the failure is detected, and then an access request to the active database of the own module is received, the module is in the own module. A processing program having an instruction step of using, as an active database, a spare database corresponding to the active database of the module in which the failure is detected. 6. A recording medium on which the processing program according to claim 5 is recorded.