JP2005108034A - Computer system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a computer system which can seek a cause of failure easily when the failure occurs in a computer, and also can surely make the computer resume the operation. <P>SOLUTION: When a fault surveillance object computer is in a communicable state in which at least neither memory dump nor fault diagnosis is carried out, if the computer does not make a response and decided to be in a fault, an interruption signal is outputted so as to make the computer carry out restart processing, and if it is decided that there is no response from the computer after that, a reset signal is outputted so as to make the computer carry out restarting. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to failure countermeasure technology when a failure occurs in an operating computer in a computer system.

  Conventionally, in a computer system, there have been the following techniques as a countermeasure when a failure occurs in an operating computer.

  The main processor periodically inquires and confirms whether or not the slave processor is operating normally. If there is no response from the slave processor, the master processor recognizes that the slave processor has failed. Reset and restart (Patent Document 1, paragraphs 0010 to 0016, FIGS. 1 and 2).

  There are two types of computer failures: hardware failure due to hardware failure and software failure due to software failure. In the above conventional technology, if a failure occurs, the processor is uniformly reset and restarted. The cause of the failure was not easily pursued.

Also, in a dual computer system, when the failed computer itself is performing a memory dump (crash dump) and collecting the memory status, the system is temporarily operated with only one computer, When one of the computers is performing its own failure diagnosis (test), a serious failure such as the computer being unable to restart may occur if the conventional failure countermeasures are implemented.
JP-A-6-236299

  An object of the present invention is to provide a computer system that facilitates pursuing the cause of a failure of a computer and can reliably restart the computer.

  The computer system according to the present invention includes a communicable state determining means for determining whether or not a computer to be monitored for failure is in a communicable state in which at least a memory dump and a fault diagnosis are not performed, and when the computer is in a communicable state, An operation confirmation signal output means for outputting an operation confirmation signal to the computer, and a first response determination means for determining whether or not there is a response from the computer after the operation confirmation signal output means outputs an operation confirmation signal to the computer; When the first response determination means determines that there is no response from the computer, an interrupt means for outputting an interrupt signal for causing the computer to restart processing, and the interrupt means outputs an interrupt signal to the computer. After that, when the second judging means for judging whether or not there is a response from the computer and the second judging means judges that there is no response from the computer, Characterized by comprising a reset means for outputting a set signal.

  According to the present invention, it is possible to provide a computer system that facilitates pursuing the cause of a failure of a computer and can reliably restart the computer.

  Embodiments of the present invention will be described below with reference to the drawings.

Hereinafter, a first embodiment of the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram showing a dual computer system. A computer (A) 1 and a computer (B) 2 are connected to each other via a LAN 3 to constitute a dual system computer system. One of the dual computer systems is configured as an active computer (online computer) and the other as a standby computer (standby computer). The computer (A) 1 and the computer (B) 2 mutually transmit and receive communication signals 100 and 101 between computers, reset signals 102 and 103, interrupt signals 104 and 105, and status signals 106 and 107.

  FIG. 2 is a diagram showing details of the computer (B) 2 shown in FIG. The configuration of the computer (A) 1 is the same as that shown in FIG. The first controller 10, the second controller 111, the processor 12, the memory 13, the I / O controller 14, and the network interface 15 are connected to each other via the system bus 17. A magnetic disk device (HDD) 16 is connected to the I / O controller 14.

  The first controller 10 receives an operation confirmation signal 100, a reset signal 102, an interrupt signal 104, and a status signal 106 from a computer A1 (not shown). On the other hand, the first controller 10 transmits an operation confirmation signal 101, an interrupt signal 103, a reset signal 105, and a status signal 107 to a computer A1 (not shown). A reset signal 102 is output from the first controller 10 to the second controller 11. The interrupt signal 104 is output from the first controller 10 to the processor 12.

  FIG. 3 is a diagram showing details of the second controller 11. The second controller 11 includes an external reset flip-flop circuit 111, a power-on reset circuit 112, and an OR circuit 113. The external reset flip-flop circuit 111 receives and sets the reset signal 102 output from the first controller 10, and outputs the set output to the OR circuit 113. The power-on reset circuit 112 outputs a reset signal to the OR circuit 113 when the power source of the computer (B) 2 is turned on or reset. The OR circuit 113 ORs the set output signal output from the external reset flip-flop circuit 111 and the reset signal output from the power-on reset circuit 112 and outputs the result as the reset signal 102. In FIG. 3, the illustration of circuits related to the interface with the system bus 17 is omitted.

  FIG. 4 is a diagram showing the state of the status signal 107 and whether or not the computer is in a communicable state corresponding to the state. The status signal 107 includes 1 bit indicating whether or not the computer is in an operating state, 1 bit indicating whether or not the computer is performing a memory dump, and the computer performs a fault diagnosis (test). It is a signal composed of 1 bit 3 bits indicating whether or not In FIG. 4, "1" is displayed when the state is set, and "0" is displayed when the state is reset. As shown in FIG. 4, when the computer is in the operating state (online state), the memory dump is not performed, and it is not in the test (diagnosis) state, the computer is in a communicable state. In this state, the computer cannot communicate.

  Next, based on the flowcharts shown in FIG. 5, FIG. 6, FIG. 7, and FIG. 8, the operation when the computer (B) 2 that is the active system fails in the dual computer system will be described. FIG. 5 is a flowchart for explaining the operation of the computer (A) 1 which is a standby system. FIG. 6 is a flowchart for explaining the interrupt processing operation of the computer (B) 2 which is the active system. FIG. 7 is a flowchart for explaining the operation of the reset acceptance process of the computer (B) 2. FIG. 8 is a flowchart for explaining the reset processing operation of the computer (B) 2.

The computer (A) 1 that is a standby system monitors the occurrence of a failure in the computer (B) 2 that is an active system, and operates to take countermeasures when a failure is found. First, the computer (A) 1 is
The status signal 107 is checked to determine whether or not communication with the computer (B) 2 is possible. (FIG. 5, step S46). As shown in FIG. 4, when the computer (B) 2 is in an operating state (online state), a memory dump is not performed, and it is not in a test (diagnosis) state, it is determined that communication is possible, and the others In this case, it is determined that communication is not possible. If the computer (B) 2 is in a communicable state, the process proceeds to step S50. If the computer (B) 2 is in a communicable state, the process proceeds to step S47. In step S47, the computer (B) 2 waits for a certain period of time for the purpose of waiting for the completion of the memory dump or diagnosis. This waiting time varies from system to system. After a certain time, in step S48, the status signal 107 is checked to determine whether or not communication is possible. If the communication is possible, the process proceeds to step S50. If the communication is impossible, the computer (B) 2 determines that the lock is in effect, sets a flag indicating that the step has been forcibly advanced in step S49, and then proceeds to step S50.

  Next, the computer (A) 1 outputs the operation confirmation signal 100 to the computer (B) 2 (step S50). Thereafter, the computer (A) 1 checks whether or not the operation confirmation signal 101 output from the computer (B) 2 is received as a response to the operation confirmation signal 100 and checks whether or not there is a response from the computer (B) 2. (Step S51). When the computer (A) 1 receives the operation confirmation signal 101, the computer (B) 2 determines that there is a response and returns to step S46 (Y in step S51). If the computer (A) 1 cannot receive the operation confirmation signal 101, it is determined that there is no response from the computer (B) 2 and a failure occurs, and the process proceeds to step S52 (N in step S51).

  In step S52, the computer (A) 1 outputs the interrupt signal 104 of the highest level that cannot be masked (non-mascarable) to the computer (B) 2. In step S53, the computer (A) 1 outputs from the computer (B) 2. The presence or absence of a response from the computer (B) 2 is determined by checking whether or not the operation confirmation signal 101 is received.

  On the other hand, the computer (B) 2 that has received the interrupt signal 104 from the computer (A) 1 cannot perform interrupt processing even if it receives the interrupt signal 104 if a hardware failure has occurred. The operation confirmation signal 101 cannot be output to the computer (A) 1. If the computer (B) 2 has a software failure such as an infinite loop in the processing due to a software bug or the like, the interrupt processing shown in FIG. 6 is executed.

  First, the computer (B) 2 outputs the operation confirmation signal 101 to the computer (A) 1 (step S60). Next, the computer (B) 2 collects the storage contents of the memory 13, I / O setting information, register information of the processor (CPU) 12, etc. for failure cause analysis (step S 61). The data is stored in the magnetic disk device (HDD) 16 (step S62). Next, the computer (B) 2 clears the memory 13 (step S63) and boots the system (step S64). Thereafter, the computer (B) 2 transmits a message indicating that the system has started up to the computer (A) 1 via the LAN 17 (step S65), and ends the interrupt processing.

  On the other hand, in step S53, the computer (A) 1 checks whether or not a message indicating that the system output from the computer (B) 2 has started up is received and determines whether or not there is a response from the computer (B) 2. . If there is a response from the computer (B) 2, the computer (A) 1 determines that the failure in the computer (B) 2 has been recovered and returns to step S46. If there is no response from the computer (B) 2, the computer (A) 1 determines that a failure (hardware failure) has occurred in the computer (B) 2, and proceeds to step 54 to check the status signal 107. It is determined whether or not communication with the computer (B) 2 is possible. If it is determined that communication is possible, it is determined that a failure (hardware failure) has occurred in the computer (B) 2, and the computer (A) 1 outputs a reset signal 102 to the computer (B) 2 (step S57). . On the other hand, when it is determined that communication is not possible, the computer (B) 2 waits for a certain period of time for the purpose of waiting for the completion of the memory dump or diagnosis (step S55). This waiting time varies from system to system. After a certain time, the computer (A) 1 checks the status signal 107 to determine whether or not communication with the computer (B) 2 is possible (step S56). If it is in a communicable state, it is determined as normal and the process returns to step S46. If communication is not possible, it is determined that a failure (hardware failure) has occurred in the computer (B) 2, and the process proceeds to step S57 to output the reset signal 102 to the computer (B) 2.

  The computer (B) 2 receives the reset signal 102 by the first controller 10 and sets the external reset flip-flop circuit 111 in the second controller 11 (step S70 in FIG. 7). The output of the set external reset flip-flop circuit 111 is output as the reset signal 102 to the processor 12 via the OR circuit 113 (step S71 in FIG. 7). The processor 12 that has received the reset signal 102 checks whether or not the external reset flip-flop circuit 111 is set (step S80 in FIG. 8). If the external reset flip-flop circuit 111 is not set, it is determined that the reset is a normal reset, for example, a power-on reset, and the process proceeds to step S83.

  If the external reset flip-flop circuit 111 is set, it is determined that the reset process is from the computer (A) 1, and the process proceeds to step S81. The computer (B) 2 stores the memory for failure cause analysis. The storage contents 13, I / O setting information, register information of the processor (CPU) 12, and the like are collected (step S 81), and the collected information is stored in the magnetic disk device (HDD) 16 (step S 82). Next, the computer (B) 2 clears the memory 13 (step S83) and boots the system (step S84). Thereafter, the computer (B) 2 transmits a message indicating that the system has been started up to the computer (A) 1 via the LAN 17 (step S85), and the reset process is terminated.

  On the other hand, the computer (A) 1 outputs a reset signal 102 to the computer (B) 2 in step S57 in FIG. 5, and then receives a message indicating that the system output from the computer (B) 2 has been started. A check is made to determine whether there is a response from the computer (B) 2 (step S58). When there is a response from the computer (B) 2, the computer (A) 1 determines that the failure in the computer (B) 2 has been recovered and returns to step S46 (Y in step S58). When there is no response from the computer (B) 2 (N in step S58), the computer (A) 1 determines that the failure has not been recovered by the computer (B) 2, and notifies the operator of the failure. Error processing (step S59) is performed.

  As described above, since it is determined whether or not the computer B is in a communicable state in step S46 of FIG. 5, since the failure of the computer B is monitored, a serious failure such as the computer B cannot be restarted is detected. It can be avoided. In step S61 in FIG. 6 and step S71 in FIG. 7, the storage contents of the memory 13, the I / O setting information, the register information of the processor 12, and the like are collected and stored in the magnetic disk device 16. By referring to the history of whether B is restarted by resetting or restarting by interruption, the cause of the failure of the computer B can be easily pursued.

It is a figure which shows the dual system computer system which is an Example of this invention. It is a figure which shows the detail of the computer B in FIG. It is a figure which shows the detail of the 2nd controller 11 in FIG. It is a figure which shows whether the computer is in the state which can communicate according to the state of the status signal 107, and its state. It is a figure which shows the flowchart for demonstrating operation | movement of the computer A. FIG. It is a figure which shows the flowchart for demonstrating the operation | movement of the interruption process of the computer B. FIG. It is a figure which shows the flowchart for demonstrating operation | movement of the reset reception process of the computer B. FIG. It is a figure which shows the flowchart for demonstrating the operation | movement of the reset process of the computer B. FIG.

Explanation of symbols

1 Calculator A
2 Calculator B
3 LAN
10 first controller 11 second controller 12 processor 111 external reset flip-flop circuit 112 power-on reset circuit 113 OR circuit

Claims (1)

A communicable state judging means for judging whether or not the fault monitoring computer is in a communicable state where at least a memory dump and a fault diagnosis are not performed;
An operation confirmation signal output means for outputting an operation confirmation signal to the computer when the computer is in a communicable state;
After the operation confirmation signal output means outputs the operation confirmation signal to the computer, first response judgment means for judging whether or not there is a response from the computer;
When the first response determination means determines that there is no response from the computer, an interrupt means for outputting an interrupt signal for causing the computer to perform a restart process;
After the interrupt means outputs the interrupt signal to the computer, second determination means for determining whether or not there is a response from the computer;
A computer system comprising: a reset unit that outputs a reset signal to the computer when the second determination unit determines that there is no response from the computer.

Images