JP2005084947A - Fault recovery system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a fault recovery system which, if part of redundant portions is separated from a computer system during maintenance work in a maintenance mode, delivers the computer system without fault to a customer by notifying maintenance personnel of the occurrence of fault prior to customer operation. <P>SOLUTION: A computer system in which command processors, input/output processors, power units and the like are made redundant has a means for recording faults in the units of the redundant portions such as the command processors, input/output processors, power units and the like. During maintenance, fault information recorded at the time of initialization is reported so as to make system initialization abend. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a failure processing method for a computer system in which the inside of a CPU is made redundant, and more particularly, to a failure processing method for a computer system by separating a redundant part that occurs during maintenance work.

  In recent years, computer systems are required to operate for 24 hours, and redundancy of computer systems is becoming mainstream. In such a redundant computer system, when a redundant part is disconnected due to some failure, the system does not stop. However, if a new failure occurs after failure countermeasures have not been completed, the system can be stopped.

  The computer system has means for switching between maintenance work and customer operation, the maintenance work is performed in the maintenance mode, and the customer operation has means for operating in the customer mode. Since maintenance personnel perform maintenance work near the computer system during the maintenance mode, no failure is reported to the maintenance center even if some failure occurs in some of the redundant parts in the computer system. For this reason, if the maintenance staff misses the failure, the computer system is handed over to the customer with the failure included.

  If it is assumed that a redundant part is disconnected due to a failure during maintenance of the computer system, an error code reporting the failure (hereinafter referred to as RC) is reported on the console device, but the maintenance staff misses the RC for some reason. In such a case, the system will be started up and operated as a customer in a state where a fault exists in a part of the redundant part.

  As conventional techniques related to the present invention, there are Patent Document 1, Patent Document 2, and Patent Document 3.

JP 2002-288000 A JP 2001-5692 A JP 2002-32351 A

  As described above, the conventional computer system does not take measures to prevent oversight of maintenance personnel during maintenance work.

  The purpose of the present invention is to notify the maintenance personnel that a failure has occurred before the customer operation as much as possible when a part of the redundant part is disconnected from the system during the maintenance work in the maintenance mode. An object of the present invention is to provide a failure processing method capable of handing over a computer system to a customer without any failure.

There is a means for recording faults occurring in the computer system and a means for displaying the recorded contents on the console device so that the faulty part can be identified, so that the maintenance mode and customer mode can be identified. When a failure occurs due to a part of a redundant part in the computer system being disconnected in the maintenance mode in the means (manual switching between maintenance mode and customer mode), it was disconnected from the system Is recorded in the failure registration file.
After that, in maintenance mode, refer to the failure registration file recorded at the initial setting of the computer system. If a failure is recorded, the system initialization is terminated abnormally, and the maintenance staff is informed that the failure has occurred. Notify and prevent delivery to customers in the presence of disabilities.
After the normal initialization of the system, the failure of the redundant part that occurred before switching to the customer mode is referred to the failure registration file periodically after switching to the customer mode. Report that there is a problem. When reporting, a failure registration file is attached, and the maintenance center analyzes the failure registration file and identifies the failure site.

  The failure processing method of the present invention can prevent the system from going down due to a failure of a part of a redundant part that occurs during maintenance work.

  The concept of the fault handling method of the present invention will be described with reference to FIG.

  The failure of the redundant part A that occurred at time t1 in the maintenance mode is notified by the system initial setting process at time t2. The failure of the redundant part B that occurred at time t3 in the maintenance mode is notified by the periodic redundant part check process at time t4 after switching to the customer mode. The failure of the redundant part C that occurs at time t5 in the customer mode is notified together with the occurrence of the failure. However, even if the system initialization is performed at time t6 while failure countermeasures for the redundant part C are not completed, the system starts up normally. If the failure countermeasure for the redundant portion C is not taken for a long time, the failure of the redundant portion C is notified again by the periodic redundant portion check process at time t7.

  In a computer system with redundant instruction processors, input / output processors, power supply units, etc., maintenance is performed as a failure handling method when a part of the redundant part is disconnected from the system due to a fault in the redundant part that occurs during maintenance work. The embodiment will be described with reference to the drawings by dividing into a processing method during work and a processing method during customer operation.

  FIG. 2 is a block diagram showing the configuration of a computer system according to an embodiment of the present invention. Broadly speaking, F-SVP (100), C-SVP (200), PU (300 to 302), HDD (400 to 400). 401), PS (500 to 501), CHP (600 to 601), IOP (700), CH (800 to 803), SC (900), SC I / F (1000 to 1001), computer system mode switch ( 1100), and PU (300 to 302), HDD (400 to 401), PS (500 to 501), CHP (600 to 601), and SC I / F (1000 to 1001) are made redundant. ing.

  As shown in FIG. 2, the computer system according to the present embodiment includes PU (300 to 302), HDD (400 to 401), PS (500 to 501), CHP (600 to 601), SC I / F (1000). 1001-1001) are made redundant, and if a failure occurs in the active device, the operation can be continued in the backup system.

  The computer system according to the present embodiment has a switch for switching between maintenance work and customer operation (hereinafter referred to as an operation switch) and is manually switched. A state in which the operation changeover switch is set to the customer operation mode side is referred to as a customer mode, and a state in which the operation switch is set to the maintenance work mode side is referred to as a maintenance mode. Further, the state of this switch can be determined by the software embedded in the service processor, and during the maintenance mode, the failure check of the redundant part is performed at the time of initializing the system. Also, during the customer mode, the redundant part is checked for failures periodically.

  When a failure occurs in a redundant part constituting the computer system, the service processor recognizes the failure at the timing shown in Table 1 and registers that there is a failure in the failure registration file of FIG. The failure registration file exists in the HDD (400 to 401) shown in FIG. For example, when a failure is detected in AP0 (301) in FIG. 2, the contents of the address 01 of the failure registration file shown in FIG. 3 are set from 00 (no failure) to FF (failure present).

障害登録ファイルへ登録された障害情報は、下記条件でリセットされる。
顧客運用中（顧客モード中）に障害部位を交換し障害部位を再びシステムに組込んだ場合。保守作業中（保守モード中）にシステム全体のパワーオン処理を実施した場合。このケースは、システムを停止し障害部位を交換した場合であり、全障害が対策されたとみなし全障害情報がリセットされる。全障害が未対策（複数の障害部位のうち、全部位の対策が行われていない）の場合は、障害部位の障害情報が障害登録ファイルに再設定される。

Fault information registered in the fault registration file is reset under the following conditions.
When the faulty part is replaced and the faulty part is incorporated into the system again during customer operation (in customer mode). When the entire system is powered on during maintenance (maintenance mode). This case is a case where the system is stopped and the faulty part is replaced, and it is considered that all faults have been taken and all fault information is reset. If all the faults have not been taken (all of the faulty parts have not been taken), the fault information of the faulty part is reset in the fault registration file.

  The notification method during the maintenance work will be described with reference to FIGS. 4 to 6 and Table 1 in the notification method of the disconnected part of the redundant part constituting the computer system.

  FIG. 4 shows a maintenance work outline flow. The maintenance staff usually takes over the computer system from the customer, switches the “operation changeover switch” to the maintenance mode (3001), and performs maintenance inspection. Thereafter, system initial setting (3003) is performed, and after confirming normal completion, the “operation changeover switch” is switched to the customer mode (3004), and the computer system is delivered to the customer. According to the present invention, the failure of the redundant part that occurred during the maintenance inspection (3002) is the periodicity after the failure of the redundant part that occurred between the initial setting of the computer system and the switch to the customer mode. Notification is made in the redundant part check process (3006).

  FIG. 5 shows details of the computer system initial processing. Since the system initialization process from 4000 to 4003 is a process for starting up the system, it is processed regardless of the state of the “operation changeover switch”. For this reason, if the process up to the IOP initial setting (4003) is completed normally, the system can be operated even if there is a failure in a part of the redundant part. Therefore, when the “operation changeover switch” is in the customer mode, the system initial setting process is normally terminated to enable the system operation (4006). When the “operation changeover switch” is in the maintenance mode, the failure information in the failure registration file is searched and if the failure information is not registered, the system initial setting process is terminated normally (4006), and if the failure information is registered. Even if the system can be operated, the system initial setting process is abnormally terminated (4007). At this time, a message indicating that a failure has occurred in a part of the redundant portion is displayed on the console device (100) of FIG. 2 (4008). In addition, the faulty part is identified and countermeasures are taken on the redundant part state display screen.

  FIG. 6 shows a regular system redundant part failure notification process during system operation. In the customer mode, as described above, the system initial setting process cannot be abnormally terminated due to a failure of a part of the redundant part. Therefore, if failure information is registered by searching for failure information in the failure registration file periodically (about once a day), a failure code is generated and a failure occurs in a part of the redundant part to the maintenance center. (5004). At this time, by attaching the failure registration file to the report data, the maintenance registration center edits the failure registration file so that the failure portion can be identified. If failure information is not registered in the failure registration file, automatic notification is not performed (5003 to 5002). In the maintenance mode, since there is a maintenance person near the computer system, the redundant part notification process in the regular system does not operate (5001 to 5002).

It is a figure which shows the view of the redundant part separation notification function. It is a block diagram of a redundant configuration computer system. 3 is a file format for storing failure information for each device when a failure occurs in the computer system in FIG. It is a computer system maintenance execution outline flowchart. It is a check processing flowchart at the time of computer system initialization (SYSIML). It is a redundant part isolation | separation periodic check flow figure during computer system operation.

Explanation of symbols

100 Console device (F-SVP)
200 Computer system control and monitoring device (C-SVP)
300 Instruction processor (IP)
301-302 Alternate processor (AP)
400 to 401 Magnetic disk device 500 to 501 Power supply unit 600 to 601 Channel control device (CHP)
700 Input / output unit (IOP)
800 to 803 channel device (CH)
900 SC
1000-10001 SC I / F
1100 Computer system mode switch

Claims (1)

An external storage device for storing a failure in a redundant part in a computer system having a service processor for controlling the instruction processor, input / output processor, power supply unit, etc. And a means for switching the computer operation mode, and the service processor searches the failure registration file recorded in the external storage device when the computer operation mode switching means is in the maintenance mode when the system initial setting is executed. A failure processing method for a computer system, characterized in that if the information is registered, the system initial setting process is abnormally terminated.

Images