JP2016115239A - Fault tolerant system, fault tolerant method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a fault tolerant system that has reduced the probability that a system in which fault is not occurring is erroneously cut off or a server is stopped by increasing the probability of being able to detect a real fault place.SOLUTION: In a fault tolerant system 10 that operates two servers 11A and 11B in parallel, a server detects an error about which the two servers cannot identify its occurrence place through their communication, the server disconnects communication with the other server, and the system independently operates each server for a prescribed time, and identifies the occurrence place of the error.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a fault tolerant system, a fault tolerant method, and a program therefor.

  Patent Document 1 discloses a technique that can significantly reduce the possibility of a system failure of a fault tolerant computer system. When an error is detected in the module of one of the two computers that make up the fault-tolerant computer system at startup, the module that generated the error is disconnected from the computer and the module that generated the error Disconnect the other computer module. Then, it is possible to start up the system using only normal modules, with a hardware configuration in which both computers are degenerated, and maintaining duplication.

  In Patent Document 2, in order to realize a fault-tolerant function, when it is impossible to specify a specific error location, the service is continued with a CPU (Central Processing Unit) subsystem whose operation mode is “active” mode. However, a technique for disconnecting a CPU subsystem whose operation mode is “standby” mode is disclosed.

Japanese Patent Application Laid-Open No. 2014-041503 JP 2006-178616 A

  A fault tolerant computer system (fault) in which two systems are multiplexed and operated in parallel, such as by a lock step operation in which multiple CPUs (processors) always execute the same operation at the same timing while synchronizing. (Tolerant system) has the following problems.

  The fault-tolerant system does not immediately identify the failure location, and when a failure that requires system disconnection occurs, for example, performing a system disconnection operation while leaving a system with a predetermined high priority, etc. Yes.

  However, in this case, there may be a case where it becomes clear that a failure has occurred in the remaining system after a certain time. In the worst case, the server is stopped.

  In Patent Document 1, at the time of startup, it is only necessary to separate the module of one computer that is clearly known to have an error and the module of the other computer that is paired with that module, and the location where the error has occurred It can only be applied to limited cases that can be easily found.

  Patent Document 2 is a technique for operating a CPU subsystem in a preset active mode, that is, the above-described high priority system.

  For this reason, the object of the present invention is to increase the probability that a true fault location can be detected in the fault-tolerant system, which is the problem described above. It is to provide a means for reducing the probability that the server will stop.

  In the fault tolerant system of the present invention, in the fault tolerant system in which two servers are operated in parallel, when each of the servers detects an error in which the occurrence point cannot be specified by communication between the two servers, Cross-link means for disconnecting communication connection with the server, and control means for operating each of the servers independently for a predetermined time and specifying the location where the error has occurred.

  In the fault-tolerant method of the present invention, in a fault-tolerant system in which two servers are operated in parallel, when each of the servers detects an error in which the occurrence point cannot be specified in communication between the two servers, The communication connection with the server is disconnected, each server is operated independently for a predetermined time, and the location where the error occurs is specified.

  In the fault tolerant system in which two servers are operated in parallel, the computer program of the present invention is configured so that when each of the servers detects an error in which the occurrence location cannot be specified by communication between the two servers, A computer is caused to execute a process of disconnecting a communication connection with a server and a process of operating each of the servers independently for a predetermined time and specifying the location where the error has occurred.

  According to the present invention, in the fault-tolerant system, by increasing the probability that a true failure location can be detected, the probability that the server on the side where no failure has occurred will be accidentally disconnected and the server will stop in the worst case is increased. It is possible to achieve an effect of reducing.

FIG. 1 is a block diagram illustrating an example of the configuration of a fault tolerant system. FIG. 2 is a block diagram illustrating an example of a hardware circuit in which the fault tolerant system is realized by a computer apparatus. FIG. 3 is a flowchart showing the operation of the fault tolerant system. FIG. 4 is a block diagram showing an example of the configuration of the fault tolerant system according to the second embodiment.

  A first embodiment for carrying out the invention will be described in detail with reference to the drawings.

  FIG. 1 is a block diagram illustrating an example of the configuration of the fault tolerant system 10.

  The fault tolerant system 10 includes two systems 11A and 11B. Hereinafter, the server 11A is also described as “A system” and the server 11B is described as “B system”.

  The A-system server 11A includes a control unit 12A, an FT (fault tolerant) cross link unit 13A, and an IO (input / output) unit 14A.

  Similarly, the B-system server 11B includes a control unit 12B, an FT cross link unit 13B, and an IO unit 14B.

  The control units 12A and 12B operate the servers 11A and 11B independently for a predetermined time, and specify the location where the error occurs.

  When the FT cross link unit 13A or 13B of one server detects an error in which the occurrence location cannot be specified in communication between the two servers 11A and 11B, the FT cross link unit of the other server 11A or 11B Disconnect the communication connection with 13A or 13B.

  The IO unit 14 </ b> A accesses the outside of the fault tolerant system 10.

  In addition, the FT cross link unit 13 </ b> A and the FT cross link unit 13 </ b> B are connected via the cross link 15.

  By the way, in this embodiment, for example, in the fault tolerant system 10 in which two systems are operated in a lockstep operation, when a failure that does not immediately reveal a failure location and needs to separate a failure side system occurs, It is characterized by accurately disconnecting the system on the failure side.

  In the fault tolerant system 10, a case is assumed in which an error is not immediately identified, such as an error is detected by the cross link 15 that performs communication between systems, and a failure that requires disconnecting the system occurs. In this case, each of the servers 11A and 11B temporarily stops access to the outside of the fault tolerant system 10 and enters a special mode called a split mode in which each system is operated independently.

  Then, the fault tolerant system 10 is operated for a while without determining the system to be disconnected, and when the true fault location can be identified thereafter, the faulty system is disconnected and has not failed. The external server 11A or 11B system is used as an effective system and access to the outside is resumed.

  If the true fault location cannot be identified within a predetermined time, the fault tolerant system 10 performs the disconnection operation while leaving a system with a predetermined high priority, and resumes access to the outside.

  FIG. 2 is a block diagram illustrating an example of a hardware circuit in which the fault tolerant system 10 is realized by the computer apparatus 20.

  The A-system server 21A includes a CPU 22A, a memory 23A, an FT chip set 24A, and an IO device 25A.

  Similarly, the B system server 21B includes a CPU 22B, a memory 23B, an FT chip set 24B, and an IO device 25B.

  The CPUs 22A and 22B operate the operating system to control the entire servers 21A and 21B. In addition, the CPUs 22A and 22B read programs and data from, for example, a recording medium mounted on a drive device to the memories 23A and 23B. Moreover, CPU22A, 22B functions as a part of server 11A, 11B in 1st embodiment, and performs various processes based on a program. CPU22A, 22B may be comprised by several CPU.

  The memories 23A and 23B are, for example, semiconductor memories.

  The memories 23A and 23B and the CPUs 22A and 22B correspond to the control units 12A and 12B in FIG.

  The A-system FT chip set 24A is connected to the B-system FT chip set 24B via the cross link 26.

  The FT chip sets 24A and 24B are, for example, electronic circuit chips. The FT chip sets 24A and 24B correspond to the FT cross links 13A and 13B in FIG.

  The IO devices 25A and 25B exchange data with the outside of the servers 21A and 21B. The IO devices 25A and 25B are, for example, electronic circuit chips. The IO devices 25A and 25B correspond to the IO units 14A and 14B in FIG.

  The cross link 26 performs data transfer between the server 21A and the server 21B. The cross link 26 is a signal transmission path that can be interconnected, and is configured by, for example, a cross cable.

  FIG. 3 is a flowchart showing the operation of the fault tolerant system 10.

  In FIG. 3, an operation will be described as an example when a failure of the cross link 15 due to a failure in the B system is detected as a failure whose failure location cannot be immediately determined.

  First, it is assumed that the fault torrent system 10 is in a duplex operation (step S1). In this state, when an error is detected in the cross link 15 (step S2), the FT cross link units 13A and 13B temporarily stop access to the outside by temporarily stopping communication via the IO units 14A and 14B. (Step S3).

  Then, the fault tolerant system 10 shifts to the split mode (step S4).

  Note that the split mode is a mode in which the communication of the cross link 15 between the FT cross link unit 13A and the FT cross link unit 13B is stopped, and the A system and the B system operate independently.

  In this mode, the servers 11A and 11B continue to operate for each system (step S5).

  Until the predetermined time elapses, the control units 12A and 12B operate the servers 11A and 11B independently, and until a predetermined time elapses, error detection of each FT cross link unit 13A and 13B ( Wait for the result of failure analysis (step S6).

  The control units 12A and 12B repeat steps S5 to S7 when the failure location is not found within a certain time.

  Here, it is assumed that a certain time has not elapsed (No in step S6), and the failure of the B system is determined by the control unit 12B (Yes in step S7).

  In this case, in the fault tolerant system 10, the non-failed system (system A) operates as an active system (step S8).

  Then, the FT cross link unit 13A resumes communication with the IO unit 14A (step S9). Thereby, the fault tolerant system 10 resumes the operation of the system only in the A system in this example (step S10).

  On the other hand, if the failure location is not found after a predetermined time has elapsed (Yes in step S6), the fault tolerant system 10 selects a system with a high priority determined in advance as an active system of the system (step S11). ).

  For example, when the system with a high priority determined in advance is the A system, the FT cross-link unit 13A resumes communication with the IO unit 14A (step S9). As a result, the fault tolerant system 10 resumes operation in one system (system A) (step S10).

  The fault tolerant system 10 according to the present embodiment has the following effects.

  The effect is to increase the probability that a fault location can be detected in the fault tolerant system 10, thereby erroneously disconnecting the system on the side where no failure has occurred, and reducing the probability that the server will stop in the worst case. It becomes possible.

The reason is that in the fault tolerant system 10 composed of two systems, when a failure occurs and the system is disconnected, each system is operated independently for a predetermined time without determining the system to be disconnected, This is because the probability of detecting a true fault location is increased.
<Second Embodiment>
Next, a second embodiment for carrying out the present invention will be described in detail with reference to the drawings.

  FIG. 4 is a block diagram showing an example of the configuration of the fault tolerant system 30 according to the second embodiment.

  The fault tolerant system 30 includes a server 31A and a server 31B.

  The fault tolerant system 30 operates two fault tolerant servers 31A and 31B in parallel. When each server 31A, 31B detects an error in which the occurrence location cannot be specified in communication between the two servers 31A, 31B, the cross link units 33A, 33B that disconnect the communication connection with the other server 31A, 31B; And control units 32A and 32B that operate each of the servers 31A and 31B independently for a predetermined time and specify an error occurrence location.

  The fault tolerant system 30 according to the present embodiment has the following effects.

  The effect is that by increasing the probability that a fault location can be detected in the fault-tolerant system 30, the system on which the fault has not occurred is erroneously disconnected, and the probability that the server will stop in the worst case is reduced. It becomes possible.

  The reason is that in the fault tolerant system 30 composed of two systems, when a failure occurs and the system is disconnected, each system is operated independently for a predetermined time without determining the system to be disconnected, This is because the probability of detecting a true fault location is increased.

  As mentioned above, although embodiment of this invention was described with reference to drawings, this invention is not limited to the said embodiment. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

DESCRIPTION OF SYMBOLS 10 Fault tolerant system 11A server 11B server 12A Control part 12B Control part 13A FT cross link part 13B FT cross link part 14A IO part 14B IO part 15 Cross link 20 Computer apparatus 21A server 21B server 22A CPU
22B CPU
23A Memory 23B Memory 24A FT Chip Set 24B FT Chip Set 25A IO Device 25B IO Device 26 Cross Link 30 Fault Tolerant System 31A Server 31B Server 32A Control Unit 32B Control Unit 33A Cross Link Unit 33B Cross Link Unit

Claims (10)

In a fault-tolerant system that operates two servers in parallel,
Each said server
Cross-link means for disconnecting the communication connection with the other server when an error that cannot identify the occurrence location is detected in the communication between the two servers;
A fault-tolerant system including control means for operating each of the servers independently for a predetermined time and specifying the location where the error occurs. Furthermore, each of the servers includes input / output means for accessing the outside of the fault tolerant system,
2. The fault tolerant system according to claim 1, wherein, when the cross-link unit detects the error, the communication connection with the input / output unit is disconnected, and then the communication connection with the other server is disconnected.   If the control means cannot identify the location where the error occurred within the predetermined time, the cross-link means of the server having a predetermined high priority is connected to the communication with the other server. The fault tolerant system according to claim 1, wherein the fault tolerant system is disconnected.   The fault tolerant system according to any one of claims 1 to 3, wherein the two servers are operated in parallel by a lock step operation. In a fault-tolerant system that operates two servers in parallel,
Each said server
When an error that cannot identify the occurrence location is detected in communication between the two servers, the communication connection with the other server is disconnected,
A fault-tolerant method of operating each of the servers independently for a predetermined time to identify the location where the error has occurred.   Further, when each of the servers detects the error, it disconnects the communication connection with the outside of the fault tolerant system, and then disconnects the communication connection with the other server. Fault tolerant method. If the location where the error occurred cannot be specified in the predetermined time,
The fault tolerant method according to claim 5 or 6, wherein a connection of communication with the other server of the server having a high priority determined in advance is disconnected. In a fault-tolerant system that operates two servers in parallel,
Each said server
A process of disconnecting the communication connection with the other server when an error that cannot identify the occurrence location is detected in the communication between the two servers;
A program for causing a computer to execute a process of operating each of the servers independently for a predetermined time and specifying the location where the error has occurred.   Further, when each of the servers detects the error, the server is caused to disconnect the communication connection with the outside of the fault-tolerant system, and thereafter, the computer executes a process of disconnecting the communication connection with the other server. The program according to claim 8. If the location where the error occurred cannot be specified in the predetermined time,
The program according to claim 8 or 9, which causes the computer to execute a process of disconnecting communication connection with the other server of the server having a predetermined high priority.

Images