JP2004110803A - Fault tolerant computer, its transaction synchronous control method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To propose a fault tolerant computer and a transaction synchronous control program for tolerating out-of-step of a processor with a fixed range. <P>SOLUTION: In the fault tolerant computer 10 in a lock step system which processes the same instruction column by performing clock synchronization by a plurality of CPU modules 20, 30, regarding IO transaction to be issued from the plurality of CPU modules 20, 30, mutual coincidence is checked within fixed time by every device controller of IO modules 50, 60 and IO transaction in which the coincidence is obtained is regarded as non out-of-step. <P>COPYRIGHT: (C)2004,JPO

Description

The present invention relates to a lock-step type fault tolerant computer in which a plurality of CPU modules process the same instruction sequence in exactly the same way by synchronizing clocks, and in particular, issues a plurality of CPU modules to an IO module. The present invention relates to a fault-tolerant computer that allows a time lag between IO transactions to be performed, a transaction synchronization control method thereof, and a transaction synchronization control program.

A fault-tolerant computer that multiplexes conventional hardware and synchronizes with the same clock has a plurality of CPU modules and a plurality of IO modules, and each IO module checks whether the operations of the plurality of CPU modules are synchronized. Each device has a device, and when an IO transaction is input at the same time, it is determined that the CPU modules are synchronized, and an IO process is performed to guarantee that the CPU modules are synchronized unless a failure occurs.

However, with the recent increase in the speed of processors, out-of-synchronization occurs in which the processors mounted on each CPU module are not completely synchronized even when the same clock is input. There may be a time difference between issued IO transactions.

Regarding the out-of-synchronization phenomenon that is not caused by the failure of the CPU module, it is known that the same operation is performed in the program, although there is a difference in the hardware operation in the CPU module. However, in a conventional fault-tolerant computer, a degraded state of the CPU module or an operation of re-installation may occur even though synchronization is not lost due to a failure.

As described above, in a conventional fault-tolerant computer, when a time difference occurs between IO transactions issued from a plurality of CPU modules in each IO module due to loss of synchronization of each CPU module, synchronization caused by a failure occurs. There is a problem in that the CPU module may be degenerated or re-integrated even though it does not come off. This also reduces the Mean Time Between Failure (MTBF) of a fault-tolerant computer, which results in a loss of the inherent advantages of the fault-tolerant computer. Also.

It should be noted that between the active processor and the standby processor, by using the data transfer start and end signals of the bus between the processors and waiting for the processing delay of the standby processor, the two can be synchronized in a short time ( For example, Japanese Patent Application Laid-Open No. H10-157, and various conventional techniques for solving the loss of synchronization between a plurality of processors have been proposed, but all of them are characterized by allowing a time lag of an IO transaction for each IO controller. Is different from the present invention.

JP-A-11-338832

SUMMARY OF THE INVENTION An object of the present invention is to determine that, even if an IO transaction is issued with a time lag, if a logical sequence match is obtained, synchronization is not caused by a failure. Nevertheless, an object of the present invention is to propose a fault-tolerant computer and a transaction synchronization control method capable of minimizing the occurrence of degeneration or re-incorporation of a CPU module and allowing a certain range of processor out-of-synchronization.

A fault tolerant computer according to the present invention comprises: a plurality of CPU modules for processing the same instruction sequence in synchronization with a clock; a plurality of IO modules including a plurality of device controllers for executing input / output control processing on devices; And a transaction synchronization control unit for checking the consistency of the sequence of IO transactions issued from each of the plurality of CPU modules and deeming that the synchronization is not out of synchronization if a match is obtained. .

In the fault tolerant computer according to the second aspect of the present invention, the transaction synchronization control unit may determine whether a sequence of the IO transaction issued from a plurality of CPU modules is identical for each of the device controllers with a timer means for measuring a predetermined time. And comparing means for judging while waiting for the predetermined time.

The fault tolerant computer according to the third aspect of the present invention is characterized in that the transaction synchronization control unit has an output control unit that outputs the IO transaction to the device controller at a timing when the sequence matches are obtained. .

In the fault tolerant computer according to the fourth aspect of the present invention, the output controller may be configured to send the matched IO transactions one by one to the device controller at a timing when the matched IO transactions from the respective CPU modules are obtained. It is characterized by outputting.

6. The fault tolerant computer according to claim 5, wherein the transaction synchronization control unit stores a plurality of the IO transactions issued from the plurality of CPU modules, and the IO transaction stored in the storage unit. And a timer means for measuring the predetermined time.

According to a sixth aspect of the present invention, in the fault tolerant computer, the transaction synchronization control unit includes a plurality of storage units for storing the IO transactions issued from the plurality of CPU modules.

8. The fault tolerant computer according to claim 7, wherein the transaction synchronization control unit selects whether the IO transaction to be input to the comparison unit is input from the plurality of storage units or the CPU module. It is characterized by having.

According to the present invention, even if an out-of-synchronization occurs in a processor of a plurality of CPU modules and an IO transaction is not issued to an IO controller of an IO module at the same timing, a sequence match of an IO transaction is checked for each IO controller. If a sequence match is obtained within a certain period of time, it is considered that synchronization has not been lost due to a failure, and the IO transaction is output to the IO controller. The occurrence of the degeneration and the re-integration operation of the processor can be minimized, and the processor can be out of synchronization within a certain range.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a fault-tolerant computer according to an embodiment of the present invention.

Referring to FIG. 1, the fault tolerant computer 10 according to the present embodiment includes a plurality of CPU modules 20 and 30. Each of the CPU modules 20 and 30 processes the same instruction sequence in synchronization with the clock. The fault tolerant computer 10 according to the present embodiment compares the processing results of the respective CPU modules, so that even if a failure occurs in one CPU module, the processing can be continued by the remaining CPU modules. I have. Each of the CPU modules 20 and 30 has one or more processors, a processor external bus, and a memory. In FIG. 1, only the characteristic configuration of the present embodiment is described, and the description of other general configurations is omitted.

The fault tolerant computer 10 includes a first IO module 50 and a second IO module 60. A first IO module 50 and a second IO module 60 are connected to both the CPU modules 20 and 30, respectively.

The first and second CPU modules 20 and 30 operate at the same clock and issue IO transactions to the first and second IO modules 50 and 60, respectively.

The first and second IO modules 50 and 60 include two IO controllers 52A and 52B and 62A and 62B, respectively. In addition, the first and second IO modules 50 and 60 of the present embodiment are configured to include the transaction synchronization control units 51A and 51B and 61A and 61B for each IO controller.

Devices that include, for example, a network controller and a disk controller are connected to the IO controllers 52A and 52B and 62A and 62B. The IO controllers 52A and 52B and 62A and 62B execute input / output control processing on these devices according to IO transactions.

(4) The transaction synchronization control units 51A, 51B, 61A, and 61B check whether the sequences of the IO transactions from the first and second CPU modules 20 and 30 match each other for each corresponding IO controller. Here, the sequence means a series of operations of a plurality of IO transactions. The transaction synchronization control units 51A, 51B, 61A, and 61B of the present embodiment allow the same IO transaction to be input at different timings even if a time lag occurs. That is, even if an IO transaction is input at a different timing, it waits for a predetermined period of time, and if the input IO transactions match within the predetermined time, it is considered that the sequences match. If an IO transaction is input from only one of the CPU modules within a certain time, it is determined that they do not match. Also, when the same IO transaction is input but the input order is different, it is considered that they do not match. The transaction synchronization control units 51A, 51B, 61A, 61B output IO transactions to the IO controllers 52A, 52B, 62A, 62B corresponding to the devices at the timing when the sequences match.

FIG. 4 shows a configuration example of the transaction synchronization control unit 51A. Here, the transaction synchronization control unit 51A is shown for convenience, but the other transaction synchronization control units have exactly the same configuration.

As illustrated, the transaction synchronization control unit 51A includes a first transaction storage unit 81-1 that stores IO transactions issued from the first CPU module 20 and the second CPU module 30 to the IO controller 52A. A second transaction storage unit 81-2, a comparison unit 82 for comparing and discriminating the coincidence of the IO transaction sequences of both the first and second transaction storage units 81-1 and 81-2, It has timer means 83 for measuring the progress, and output control means 84 for outputting the IO transaction to the IO controller at the timing when the sequence of the IO transaction is obtained by the comparing means 82. The output control unit 84 notifies the failure monitoring unit or the like of the failure when the sequence of the IO transaction cannot be obtained even after a certain period of time has elapsed by the timer unit 83. The time set for the waiting by the timer unit 83 is set to, for example, about 10 times of the hardware sequence of the IO of the PCI-BUS, and at most about 100 to 1000 times. For example, if one time is about 1 μsec, it is about 10 μsec, and at most about 100 μsec to 1 msec.

Note that the configuration example of the transaction synchronization control unit shown in FIG. 4 is merely an example of the configuration, and is not limited to the illustrated configuration.

FIG. 5 is a flowchart illustrating the operation of the transaction synchronization control unit. First, an IO transaction including a command indicating a destination of a device is input from the first CPU module 20 and the second CPU module 30, and by seeing this command, it is determined whether or not the own IO transaction is performed. It is stored in the storage means (step 501), and it is determined whether or not the IO transaction sequences of the first and second CPU modules match each other (step 502). Here, one IO transaction is input to the comparing means 82 one by one in the order of storage from the transaction storing means and compared. If the corresponding IO transactions match, the next corresponding IO transaction stored in the transaction storing means is compared with each other. The process of being input to the comparing means 82 and being compared is repeated.

(4) If all the IO transactions match, it is considered that the sequences match, and the input IO transaction is output to the IO controller (step 503).

In step 502, when the IO transaction has arrived from only one CPU module and the sequence of the IO transaction does not match, it is determined whether a certain time has elapsed since the IO transaction arrived from one CPU module. (Step 504). If the fixed time has not passed, the input of the IO transaction is waited for. That is, returning to step 501, the process of comparing the input IO transaction sequence again is repeated until a certain time has elapsed. If the predetermined time has elapsed, the occurrence of a fault is notified to a fault monitoring unit provided in the fault-tolerant computer. An IO transaction arrives from the other CPU module before the predetermined time elapses, and if the sequences match, the IO transaction input in step 503 is output to the IO controller. In step 502, if the IO transactions have arrived from both CPU modules but the arrival sequences do not match, steps 504, 501 and 502 are repeated, and after a certain period of time, the failure monitoring unit is notified of the occurrence of the failure. Will do.

Next, referring to FIGS. 1, 2 and 3, how the first and second CPU modules 20 and 30 issue IO transactions, and how the first and second IO modules 50 and 60 issue IO transactions. A description will be given of a specific example as to whether a match check is performed and an IO transaction is processed.

Here, in the case of the processor out of synchronization, the IO transaction from the first CPU module 20 to the first IO module 50 includes an IO transaction (IO-A1), an IO transaction (IO-B1), and an IO transaction (IO-A2). ), And IO transactions (IO-B2).

The IO transactions (IO-A1) and (IO-A2) are issued to the IO controller 52A, and the IO transactions (IO-B1) and (IO-B2) are IO transactions issued to the IO controller 52B. And

On the other hand, regarding the IO transaction from the second CPU module 30 to the first IO module 50, the IO transaction (IO-A1), the IO transaction (IO-A2), the IO transaction (IO-B1), and the IO transaction (IO-IO) -B2).

Comparing the order of the IO transactions, as shown in FIG. 2, among the IO transactions issued from the first and second CPU modules 20 and 30 to the first and second IO modules 50 and 60, It can be seen that the order of the IO transactions (IO-B1) and (IO-A2) is opposite to each other, and the two IO transactions do not match.

Since the first IO module 50 normally has a difference in the IO transaction at the same timing, even if the operation of degenerating or re-incorporating one of the CPU modules is normally performed, By providing the transaction synchronization control units 51A and 51B for checking the sequence (order) of the IO transaction, even if the timing is shifted, it recognizes the same IO transaction and continues the processing.

For example, assuming that the IO transaction to the IO controller 52A is IO-Ax and the IO transaction to the IO controller 52B is IO-Bx, as shown in FIG. 3, the transaction synchronization control unit 51A shows the first and second CPUs. The IO transactions issued from the modules are (IO-A1)-(IO-A2), which coincide with each other. The IO transactions issued from the first and second CPU modules are also seen from the transaction synchronization control unit 51B. (IO-B1)-(IO-B2).

At this time, the transaction synchronization control units 51A and 51B check the sequence matching for each IO controller because there is a high possibility that a time difference between IO transactions between the first CPU module 20 and the second CPU module 30 occurs. It does not judge the temporal coincidence of IO transactions. That is, the transaction synchronization control units 51A and 51B wait for a certain time until the same IO transaction from the first CPU module 20 and the second CPU module 30 arrives, and then transmit the IO transaction to the IO controllers 52A and 52B. Output.

Focusing on the IO controller 52A, first, the same IO transaction (IO-A1) is issued from the first CPU module 20 and the second CPU module 30 at the first timing, and the second CPU module 30 is issued at the next timing. (IO-A2) from the first CPU module 20, but not the IO transaction (IO-A2) from the first CPU module 20. The transaction synchronization control unit 51A corresponding to the IO controller 52A waits for a predetermined time (IO transactions (IO-A1) and (IO-A2)) until receiving the IO transaction (IO-A2) from the first CPU module 20. When the IO transaction (IO-A2) arrives from the first CPU module 20 at the next timing, it is determined that the sequence of the IO transaction matches, and the IO transaction (IO-A2) is determined. A1) and (IO-A2) are output to the IO controller 52A.

As a result of the comparison by the transaction synchronization control units 51A, 51B, 61A, 61B, if the sequences of the IO transactions from the first and second CPU modules 20, 30 to the IO controller are different from each other, the fault tolerant The occurrence of a failure may be notified to a failure monitoring unit or the like provided in the computer.

In the fault-tolerant computer according to the present invention, the function of each unit executed by the transaction synchronization control unit is realized by hardware, and the transaction control program 100 for executing the function of each unit is executed by a processor such as an IO controller. By loading and executing the program on a (CPU), it can be realized as software. The transaction control program 100 is stored in a magnetic disk, a semiconductor memory, or another recording medium, loaded from the recording medium into the memory of the CPU, and executed by the CPU to realize the above-described functions.

Next, a modified example of the transaction synchronization control unit of the present invention will be described. In the above example, even if the same IO transaction (IO-A1) is issued from the first CPU module 20 and the second CPU module 30, (IO-A2) from the second CPU module 30 arrives and the In the state where the IO transaction (IO-A2) from the first CPU module 20 has not arrived, the IO transaction (IO-A1) and (IO-A2) are held without being output. 5 is different from the example in FIG. 5 in that when one IO transaction matches between two CPU modules, the IO transaction is immediately output to the IO controller.

FIG. 6 is a flowchart illustrating an operation example of the transaction synchronization control unit according to the present modification. First, the IO transactions from the first CPU module 20 and the second CPU module 30 are input and stored in the corresponding transaction storage means (step 601), and the earliest IO transaction stored in each transaction storage means is compared. The data is input to the means 82 (step 602). At this time, unless a valid IO transaction is stored, no IO transaction is input from the transaction storage unit to the comparison unit.
At most one IO transaction input from each transaction storage unit is compared by the comparison unit 82 (step 603). If the comparison shows that the IO transactions match, the matching IO transaction is immediately output to the IO controller (step 604). At this time, the output IO transaction is deleted from both transaction storage means. It is determined that the transaction is the last IO transaction (step 605). If it is not the last, the process returns to step 602, and the next IO transaction is input to the comparing means 82 and compared.

If there is no match in step 603, for example, if the IO transaction has arrived from only one CPU module and the sequence of the IO transaction does not match, a certain time has elapsed since the IO transaction arrived from one CPU module. It is determined whether the operation is performed (step 606).
If the fixed time has not elapsed, the process returns to step 601 and if an IO transaction has newly arrived from the CPU module, the IO transaction is stored in the corresponding transaction storage means, and the IO transaction newly stored in each transaction storage means is compared again. Is repeated until a certain time has elapsed. If the predetermined time has elapsed in step 606, the occurrence of a fault is notified to a fault monitoring unit provided in the fault-tolerant computer.

(4) An IO transaction arrives from the other CPU module before the given time elapses, and if they match, a match is made in step 603, and in step 604, the matched IO transaction is output to the IO controller. In step 603, if the IO transactions have arrived from both CPU modules but the arrival sequences do not match, steps 606, 601, and 602 are repeated, and after a certain period of time, the failure monitoring unit or the like is notified of the occurrence of the failure. Will do.

Note that the transaction synchronization control unit includes a plurality of timer means, and the first and second transaction storage means have a capacity capable of storing a plurality of IO transactions. When an IO transaction is input from a module, the input may be received and a plurality of IO transactions may be configured to wait.

If an IO transaction is continuously input from the same CPU module while waiting for an input from the other CPU module, the timer means different from the timer means that has already been started is started, and the input is performed this time. The IO transaction is stored at an address different from the address where the previously received IO transaction is stored. As a result, it is possible to wait for a plurality of transactions and determine whether the IO transactions from each CPU module match.

The operation when the sequence of the IO transaction shown in FIGS. 2 and 3 is input to this modification will be described. First, when the same IO transaction (IO-A1) is issued from the first CPU module 20 and the second CPU module 30, the IO transactions are compared at this timing. -A1) is output to the IO controller 52A. At the next timing, the (IO-A2) from the second CPU module 30 arrives, but the IO transaction (IO-A2) from the first CPU module 20 does not arrive.

The transaction synchronization control unit 51A corresponding to the IO controller 52A stores (IO-A2) from the second CPU module 30 in the second transaction storage unit 81-2, and stores the IO transaction from the first CPU module 20. (IO-A2) is waited for a certain period of time, and when an IO transaction (IO-A2) from the first CPU module 20 arrives, an IO transaction from the first CPU module 20 and a second transaction at this timing. The IO transaction is compared with the IO transaction stored in the storage unit 81-2, and when it is determined that they match, the IO transaction (IO-A2) is output to the IO controller 52A.

Next, another modification of the transaction synchronization control unit of the present invention will be described. FIG. 7 is a block diagram showing a configuration of another modification of the transaction synchronization control unit of the present invention. In this modified example, the first and second CPU modules 20 and 30 are directly connected to the comparison unit 182, and the first and second CPU modules 20 and 30 and the first and second transaction storage units 181 are connected. The first and second selection circuits 185-1 and 185-2 for selecting from which of the -1 and 181-2 the input of the IO transaction is provided.

FIG. 8 is a flowchart illustrating an operation example of FIG. First, when a new IO transaction is input to the comparison means, it is determined whether valid data is stored in each transaction storage means (step 801). If valid data is stored, the corresponding selection circuit is switched to the transaction storage means (step 802). If valid data is not stored, the selection circuit is set to the CPU module side (step 802). Therefore, in a normal state in which an unprocessed IO transaction is not stored in the storage unit and the IO transaction is input from the CPU module at the same time, the IO transaction is directly stored in the storage unit without being stored in the storage unit. Is done.

Then, it is determined whether or not the IO transaction sequences match each other (step 804). If the IO transactions input to the comparing means 182 match, the matching IO transaction is output to the IO controller (step 805).

(4) If they do not match in step 804, the IO transaction has arrived from only one CPU module, and if the IO transaction has not been stored in the transaction storage means, it is stored (step 806). If the IO transaction sequences do not match, it is determined whether a certain time has elapsed since the IO transaction arrived from one of the CPU modules (step 807).

If the predetermined time has not elapsed, the process returns to step 801 to repeat the process of comparing the IO transaction no sequence again until the predetermined time has elapsed. If the predetermined time has elapsed, the occurrence of a fault is notified to a fault monitoring unit provided in the fault-tolerant computer. An IO transaction arrives from the other CPU module before the fixed time elapses, and if it matches in step 804, the input IO transaction is output to the IO controller in step 805.

In step 804, if there is no match, and the IO transactions have arrived from both CPU modules but the sequence has reached, they will be notified of the occurrence of a failure to a failure monitoring unit after a certain period of time has elapsed.

Although the present invention has been described with reference to the preferred embodiments, the present invention is not necessarily limited to the above embodiments and can be variously modified and implemented within the scope of the technical idea.

FIG. 1 is a block diagram illustrating a configuration of a fault-tolerant computer according to an embodiment of the present invention. FIG. 4 is a diagram illustrating a specific example of an IO transaction issued from each CPU module of the fault-tolerant computer according to the embodiment of the present invention. FIG. 9 is a diagram illustrating a specific operation example of the fault-tolerant computer according to the embodiment of the present invention. FIG. 3 is a block diagram illustrating a configuration example of a transaction synchronization control unit provided in the fault-tolerant computer according to the embodiment of the present invention. 5 is a flowchart illustrating an operation example of a transaction synchronization control unit provided in the fault-tolerant computer according to the embodiment of the present invention. 13 is a flowchart illustrating an operation example of a modification of the transaction synchronization control unit. FIG. 21 is a block diagram illustrating a configuration of another modification of the transaction synchronization control unit. 8 is a flowchart illustrating an operation example of FIG. 7.

Explanation of reference numerals

DESCRIPTION OF SYMBOLS 10 Fault-tolerant computer 20 1st CPU module 30 2nd CPU module 50 1st IO module 60 2nd IO module 51A, 51B, 61A, 61B Transaction synchronization control part 52A, 52B, 62A, 62B IO controller 81- DESCRIPTION OF SYMBOLS 1 1st transaction storage means 81-2 2nd transaction storage means 82 comparison means 83 timer means 84 output control means

Claims (20)

A plurality of CPU modules for processing the same instruction sequence in clock synchronization;
A plurality of IO modules including a plurality of device controllers for executing input / output control processing on the device;
For each of the device controllers, a transaction synchronization control unit that checks a match of a sequence of IO transactions issued from each of the plurality of CPU modules, and considers that it is not out of synchronization if a match is obtained,
A fault-tolerant computer comprising: The transaction synchronization control unit, timer means for measuring a certain time,
A comparing unit configured to wait, for each of the device controllers, to determine whether a sequence of the IO transactions issued from a plurality of CPU modules matches each other by waiting for the predetermined time;
The fault tolerant computer according to claim 1, comprising: The fault tolerant computer according to claim 2, wherein the transaction synchronization control unit includes an output control unit that outputs the IO transaction to the device controller at a timing when the sequence matches. 4. The output controller according to claim 3, wherein the output unit outputs the matched IO transactions one by one to the device controller at a timing when the matching of the IO transactions from the respective CPU modules is obtained. Fault tolerant computer. 3. The output control unit outputs a failure notification when a sequence match cannot be obtained within a predetermined time, or when IO transaction sequences are different from each other. 4. The fault tolerant computer according to any one of 4. The transaction synchronization control unit,
The fault tolerant computer according to any one of claims 2 to 5, further comprising a plurality of storage units for storing the IO transactions issued from the plurality of CPU modules. The transaction synchronization control unit,
6. The apparatus according to claim 2, further comprising a selection circuit for selecting whether to input the IO transaction to the comparing unit from the plurality of storage units or the CPU module. Fault tolerant computer as described in. A first step of inputting a plurality of identical IO transactions from a plurality of CPU modules that process the same instruction sequence in clock synchronization to an IO module;
A second step of checking the sequence of the input IO transaction for each of a plurality of device controllers provided in the IO module and, if a match is obtained, assuming that the synchronization is not out of synchronization. Transaction synchronous control method of fault tolerant computer. 9. The transaction synchronization control method for a fault-tolerant computer according to claim 8, wherein the second step waits for a certain period of time to determine whether the sequences of the IO transactions match each other. The method according to claim 9, further comprising a third step of outputting the IO transaction to the device controller at a timing at which a sequence match is obtained. The first step stores the IO transaction issued from the plurality of CPU modules in a plurality of storage units for each device controller,
In the second step, the IO transaction input from each CPU module is input to the comparing means, and the IO transactions are compared. If the IO transactions do not match, it is determined whether a predetermined time has elapsed. Is not out of sync,
The transaction synchronization control method for a fault-tolerant computer according to claim 9, wherein: 12. The transaction synchronization control of a fault-tolerant computer according to claim 11, wherein at the timing when the coincidence of the input IO transactions is obtained, the IO transactions with the coincidence are output one by one to the device controller. Method. 13. The transaction synchronization control method for a fault-tolerant computer according to claim 9, further comprising a step of outputting a notification of a failure when a sequence match cannot be obtained within a predetermined time. 14. The method according to claim 11, further comprising the step of selecting whether to input a new IO transaction from the plurality of storage units or from the CPU module when inputting the new IO transaction to the comparison unit. 2. The transaction synchronization control method for a fault-tolerant computer according to claim 1. The step of selecting whether to input from the plurality of storage units or input from the CPU module switches to input from a CPU module when valid data is not stored in the storage unit. Item 15. A method for controlling transaction synchronization of a fault-tolerant computer according to item 14. Executed by a plurality of CPU modules in a fault-tolerant computer that processes the same instruction sequence in clock synchronization;
A first process of inputting a plurality of identical IO transactions from a plurality of CPU modules to an IO module, and for input IO transactions, checking a sequence match for each of a plurality of device controllers provided in the IO module. A synchronous processing program for a fault-tolerant computer, which performs a second process in which, if a match is obtained, it is considered that synchronization is not lost. 17. The computer-readable storage medium according to claim 16, wherein the second process waits for a certain period of time to determine whether the sequences of the IO transactions match each other. 18. The transaction synchronization control program for a fault-tolerant computer according to claim 17, wherein a third process of outputting the IO transaction to the device controller is executed at a timing when a sequence match is obtained. 19. A process for outputting a notification of a failure when a sequence match cannot be obtained within a predetermined time or when IO transaction sequences are different from each other. A transaction synchronization control program for a fault-tolerant computer according to any one of the above. The first process includes a process of storing the IO transaction issued from the plurality of CPU modules in a plurality of storage units for each device controller, and the second process includes inputting the IO transaction from each CPU module. The process of inputting the IO transaction to the comparing means and comparing the IO transaction is not performed. If they do not match, it is determined whether or not the predetermined time has elapsed. The transaction synchronization control program for a fault-tolerant computer according to any one of claims 17 to 19, wherein the program executes a process.

Images