JP2019021257A - Multiplex system and method for resynchronization of multiplex system - Google Patents

Abstract

To complete resynchronization of each task processing states in a short length of time between a plurality of calculators while preventing a skip of cycles of cycle driving tasks.SOLUTION: The multiplex system makes the processing states of tasks accord to one another between calculators to be restored and calculators in an operating mode when all the tasks are stopped in the calculators, adjusts the time of initiation of cycles so that the cycle initiation times of a plurality of cycle driving tasks of all the tasks become the same on a regular basis, and stops the execution of the cycle driving task over a predetermined period of time immediately before when the cycle driving tasks of each task start at the same time.SELECTED DRAWING: Figure 3

Description

  The present invention relates to a multiplex system and a resynchronization method in the multiplex system, and in particular, for a computer to be restored, operates by resynchronizing by matching the task processing state of the task to the processing state of the task of the operating computer. This is suitable for application to a multiplex system configured as described above.

  In a certain multisystem, a plurality of computers operate synchronously. That is, in a multisystem, one or more tasks (software programs) run on each computer, the same input is given to these tasks, the same processing is executed, and the same output is obtained at the same timing. . Then, these outputs are compared and collated, and if they match, they are output outside the system. Here, even if some of the plurality of computers stop operating due to a failure, as long as the remaining other computers continue to operate, it is possible to realize non-stop for the entire system.

  However, if the stopped computer is left as it is, no operating computer will eventually exist, and the multiplex system will stop as a whole system. Therefore, in the multi-system, the internal state of the task to be driven by the stopped computer to be restored is matched with the internal state of the task of the operating computer, and is operated again in synchronization. The “internal state of the task” here indicates a data group necessary for the task to operate. For example, the memory contents managed by the task, the contents of the shared memory, the files on the storage device, and the communication buffer The contents are listed.

  As a resynchronization method in a multiplex system, there is a technique that is implemented in three phases. In the first phase, all the internal states of the running computer tasks are transferred to the computer to be restored without stopping the execution of the running task. In the second phase, the updated state of the internal state of the running computer task is gradually transferred. When the update amount of the internal state becomes sufficiently small, the process proceeds to the third phase. In the third phase, all the tasks that can update the internal state of the task are temporarily stopped in the operating computer, and all the internal state of the task that has been updated since the last transfer is transferred to the computer to be recovered and operated. The internal states of the tasks of the computer in the middle and the computer to be restored are matched. Thereafter, by restarting the execution of the stopped task, the stopped computer operates in synchronization with the operating computer.

  Here, in the third phase, when the execution of a task is temporarily stopped at an arbitrary timing or an arbitrary period, a period of a task that periodically operates is lost. This is an event that should not occur particularly in a control system that requires real-time characteristics.

  In order to prevent such an event from occurring, in the conventional multiplex system, the first computer and the second computer connected to the external network are respectively the periodic drive software, the communication drive software, and the software. And a memory for storing processing data by driving (see Patent Document 1). The first computer stores in the memory by providing a memory matching mechanism, a timer matching mechanism, and a reception matching mechanism that perform a plurality of functions with the processing contents shared by the first computer and the second computer. The processed data is transferred to the second computer and resynchronized while preventing period omission and reception omission.

JP 2009-217505 A

  In recent years, multi-core processors have become widespread, and a large number of tasks can be executed in parallel. In other words, a plurality of periodic drive tasks and event drive tasks can be operated in parallel, and tasks such as batch processing having a relatively long processing time can be executed in parallel.

  However, resynchronization by the above-described method does not necessarily function when a large number of periodically driven tasks and tasks having a long processing time are operated in parallel. For example, when two periodic drive tasks that operate with a cycle of 1 and an average processing time of 0.5 are operating, when one periodic drive task finishes processing of that cycle and waits for the next cycle When the other periodic drive task starts processing of a new cycle, the multi-system system cannot secure sufficient time to execute the above-described third phase processing and continues to fail in resynchronization. Although it is conceivable to temporarily stop the periodic drive task over the third phase, there is a possibility that a period loss may occur or the responsiveness requirement may not be satisfied. On the other hand, depending on the driving trigger and processing time of the event-driven task, there may be a situation where the periodic drive task continues to operate while waiting for the next cycle.

  The present invention has been made in consideration of the above points. In a multi-system system in which a task operates on a plurality of computers, the task cycle is prevented from being lost, and the task processing state can be quickly changed between the plurality of computers. The present invention intends to propose a multisystem that can complete synchronization and a resynchronization method in the multisystem.

  In order to solve such a problem, in the present invention, in a multi-system where each task executes the same process in a plurality of computers, all of the tasks are stopped in the plurality of computers. By matching the task processing state of the recovery target computer to the processing state of the task of the running computer, the processing state of each task is matched between the plurality of computers, and each task is again the same The state matching unit for enabling processing to be executed synchronously, and the plurality of periodic driving tasks so that the start times of the periodic driving tasks periodically driven among the tasks are periodically aligned A start time adjusting unit that adjusts the start time of the plurality of periodic drives, and the plurality of periodic drives over a predetermined period immediately before the start times of the plurality of periodic drive tasks are aligned. And task execution inhibiting unit to restrict the execution of non-task task, in that it comprises the features.

  Further, in the present invention, in a resynchronization method in a multi-system where each task executes the same processing in a plurality of computers, the multi-system is in a state where all the tasks are stopped in the plurality of computers. By matching the processing state of the task with the processing state of the task of the computer in operation for the computer to be restored among the plurality of computers, the processing state of each task is matched between the plurality of computers. A state matching step in which a task is again ready to execute the same process in synchronization, and a start time of a period of a plurality of periodically driven tasks that the multi-system system periodically drives among the tasks. A start time adjustment step of adjusting a start time of a period of the plurality of periodic drive tasks so as to be regularly arranged, and the multi-system system, A task execution suppression step of regulating the execution of a task other than the plurality of periodic driving task over a predetermined time period immediately before the serial start time of a plurality of periodic driving task is aligned, and having a.

  According to the present invention, it is possible to prevent a task from being missed in a multiplex system in which tasks operate on a plurality of computers, and to complete synchronization of task processing states among a plurality of computers in a short time.

1 is a block diagram illustrating a schematic configuration example of a multiplex system according to a first embodiment. FIG. It is a block diagram which shows the structural example of the computer shown in FIG. It is a block diagram which shows the example of a structure of the software and table which operate | move in a computer. It is a specific example of a resynchronization period management table. It is a specific example of a periodic drive task management table. It is a flowchart which shows an example of operation | movement of a period drive task. It is a flowchart which shows an example of operation | movement of an event drive task. It is a flowchart which shows an example of the period timer registration process of a period drive task. FIG. 19 is a specific example of a resynchronization cycle management table for explaining FIGS. 17 and 18. FIG. FIG. 19 is a specific example of a periodic drive task management table for explaining FIGS. 17 and 18; FIG. It is a flowchart which shows an example of a state matching process. It is a flowchart which shows an example of the update location extraction process of the process state of the task in the state matching process shown in FIG. It is a flowchart which shows an example of the detailed content of the updated process state transfer process shown in FIG. It is a flowchart which shows an example of a state matching process. It is a flowchart which shows an example of a process when the resynchronization interruption timer act | operates. It is a flowchart which shows an example of a task execution availability determination process. It is a flowchart which shows an example of the periodic timer registration process in 2nd Embodiment. It is a flowchart which shows an example of the method of calculating the next resynchronization period start time in FIG.

  Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. In a certain type of multi-system, a method of synchronizing internal states of tasks in a plurality of computers (hereinafter also referred to as “resynchronization method”) is divided into three phases: a first phase, a second phase, and a third phase. It is divided and implemented.

  Specifically, in the first phase, all the internal states of the tasks of the operating computer are transferred to the recovery target computer without stopping the execution of the running task. In the second phase, the updated portion of the internal state of the running computer task is transferred gradually. When the update amount of the internal state becomes sufficiently small, the process proceeds to the third phase as follows.

  In the third phase, first, in the operating computer, all tasks that can update the internal state of the task are suspended, and all the internal state of the task that has been updated since the last transfer is transferred to the computer to be restored. Then, the internal states of the tasks of the operating computer and the recovery target computer are matched. Thereafter, by resuming the execution of the stopped task, the computer to be restored operates in synchronism with the operating computer described above.

  In this embodiment, in such a multiplex system, the third phase is divided into a new third phase and a fourth phase as will be described later, so that the computer to be restored is in operation. Re-synchronized with the computer. This will be specifically described below.

(1) First Embodiment (1-1) Hardware Configuration Example FIG. 1 shows a schematic configuration example of a multiplex system 1 according to the first embodiment.
The multiplex system 1 includes a plurality of computers 10 to 12 on which a plurality of tasks operate, and includes the computers 10 to 12 as an example. The computers 10 to 12 exchange information with each other via the internal network 50.

  On each of the computers 10 to 12 described above, the same task group operates in synchronization. That is, each task operating on each of the computers 10 to 12 receives the same data from the external device 40 or the collation device 30 via the internal network 50 and the communication device 104, and executes the same processing at the same timing. And the same processing result is obtained. Each task outputs the result of the above process to the verification device 30 via the internal network 50.

  The collation device 30 compares the processing results received from the computers 10 to 12 and outputs only the processing results determined to be correct to the external device 40. On each of the computers 10 to 12, other tasks that do not operate in synchronization with these tasks may operate as long as the results of the above processing are not affected.

  FIG. 2 shows a configuration example of the computer 10 shown in FIG. Since the computers 11 and 12 have the same configuration as the computer 10, description thereof is omitted.

  The computer 10 includes a memory 102 for storing at least a task (software program) for executing the above processing, data, and the like, a CPU (Central Processing Unit) 101 for executing a software program on the memory 102, and a storage device for storing data 103, a communication device 104 that transmits and receives data via the internal network 50, and a timer device 106 that controls the wake-up timing of the task by a time measuring function. Note that the collation device 30 and the external device 40 may have the same hardware configuration as that of the computer 10, and thus description thereof is omitted.

(1-2) Software Configuration Example FIG. 3 is a block diagram illustrating a configuration example of software and a table operating in the computer 10. Note that the computers 11 and 12 also have the same software and tables as the computer 10 and therefore will not be described.

  The computer 10 includes a resynchronization unit 70, a task scheduler 80, a timer unit 81, a task 90, a resynchronization cycle management table 600, and a cycle driven task management table 700.

  The task 90 is a set of software programs that perform business in the multisystem. This task 90 is a periodically driven task that is periodically driven, a task that is not a periodically driven task and that is driven at a predetermined trigger (hereinafter referred to as “event driven task”), a task that executes batch processing, and the like. Is included.

  When the task 90 or the other software program is in an executable state, the task scheduler 80 selects one of them based on a predetermined algorithm, and causes the CPU 101 to execute the selected one. When the computers 10 to 12 are provided with a plurality of CPUs 101, the above tasks and the like are selected and executed for each CPU 101.

  The timer unit 81 provides at least a function for giving a trigger for the periodic drive task to be driven at a constant cycle and realizing a timeout process. For example, as in a row 710 shown in FIG. 5 to be described later, a periodic drive task (task identifier = 3) whose cycle start time 703 is 100 and whose cycle T (corresponding to the value of the cycle 704) is 3. ) Is registered, the timer unit 81 gives a driving trigger to the task having the task identifier 701 of 1 at the timings of 100, 103, and 106.

  The resynchronization unit 70 matches the task processing state of the computer 11 to be restored with the processing state of the task of the operating computer 10, sets the computer 11 to the operating state again, and configures the rest of the multiplex system. A function for operating in synchronization with the computer 12 is provided.

  The resynchronization unit 70 includes a task execution suppression unit 71 and a state matching unit 72. Regardless of whether it is operating or stopped, not only the computer 10 but also the computers 11 and 12 are configured in the same manner as the computer 10. Here, as an example, it is assumed that the computer 10 out of the plurality of computers 10 to 12 is an operating computer, while the computer 11 among the remaining computers 11 and 12 is a computer to be restored that needs to be resynchronized. .

  When the state matching unit 72 of the computer 10 receives the resynchronization start request, the state matching unit 72 of the computer 11 transmits the task state content or the difference thereof via the internal network 50. To do. Further, the state matching unit 72 of the computer 11 reflects the contents of the received task state or the difference thereof on the task group activated in advance. Details of processing performed by the state matching unit 72 will be described later.

  The resynchronization cycle management table 600 manages the times and cycles at which the start times of the cycles of all the cycle-driven tasks match. Each cycle driving task is in a state (idle state) in which nothing is executed until the start time of the next cycle after finishing the processing of the cycle. For this reason, it is expected that the periodic drive task does not start operation over a certain period immediately before the time at which the start times of the cycles coincide. This period is suitable as a period for performing the third and subsequent phases of the resynchronization process. A detailed configuration of the resynchronization cycle management table 600 will be described later.

  The periodic drive task management table 700 manages the start time of the initial period and the driven period T for each active periodic drive task. The task scheduler 80 and the timer unit 81 refer to the periodic drive task management table 700 and drive each periodic drive task at an appropriate timing managed as described above. The detailed configuration of the periodic drive task management table 700 will be described later.

FIG. 4 shows an example of the resynchronization cycle management table 600. Resynchronization cycle management table 600 has as its columns, update time 601, the resynchronization period start time _{t R,} and the resynchronization period _{T R.}

  The update time 601 indicates the time when the row is updated. The resynchronization cycle start time 602 represents one of the times at which the cycle start times of all the cycle driving tasks that are in operation match. The resynchronization period 603 represents a time interval between the above-mentioned coincidence time and the next coincidence time.

  The resynchronization cycle management table 600 is updated each time the cycle drive task performs a cycle timer registration process described later. In the illustrated example, the content of the row 610 is registered when the update time 601 is 100, and the content of the row 620 is registered when the update time 601 is 104.

The resynchronization cycle management table 600 does not actually need to hold the past update history (corresponding to the contents of the row 610 when the update time 601 is 100) in this way, and starts the latest resynchronization cycle. It is sufficient to hold only the time t _R (corresponding to the value of the resynchronization cycle start time 602) and the resynchronization cycle T _R (corresponding to the value of the resynchronization cycle 603) (corresponding to the contents of the row 620).

  FIG. 5 shows an example of the periodic drive task management table 700. The periodical task management table 700 has a task identifier 701, a request period start time 702, a period start time 703, and a period 704 as its columns.

  The task identifier 701 is an identifier for specifying a periodic drive task to be driven when the timer is activated. The request cycle start time 702 indicates the time indicated as the start time of the initial cycle. In the illustrated example, it is assumed that the start time of the initial cycle is the same as the time at which the cycle timer registration is to be performed for the task whose task identifier is 1. The cycle start time 703 indicates the start time of the initial cycle adjusted by the cycle start time adjustment function, and is the time after the request cycle start time 702.

  A period 704 indicates a period requested from the periodic drive task, and represents a time interval at which the periodic task executes periodic processing. For example, according to the contents of the row 710, it means that the task whose task identifier 701 is 1 is started at the time 100, 103, 106 every cycle 3 from the time when the start time is 100.

(1-3) Resynchronization Method in Multiplexed System (1-3-1) Operation Example of Periodic Drive Task FIG. 6 shows an example of the periodic drive task processing of the periodic drive task. When the activation of the periodic drive task is started, the task state is initialized as an initialization process (step S401).

  Next, a periodic timer registration process is performed (step S402), and the timer unit 81 is operated at a predetermined period set by the periodic timer registration process. At this time, the time when the timer unit 81 operates for the first time is also specified.

  Thereafter, the waiting process continues to be executed until the timer unit 81 is activated (step S403), and after the timer unit 81 is activated, the periodic process in the cycle is performed (step S404). In this periodic processing, it is assumed that the operation is uniquely performed according to the processing state of the periodic driving task, and the processing result is reflected in the processing state of the periodic driving task, and is used after the next period. When the periodic process ends, the periodic drive task returns to step S403 and continues the waiting process again. Details of the cycle timer registration will be described later.

(1-3-2) Operation Example of Event Driven Task FIG. 7 shows an example of event drive task processing by the event drive task. When the event-driven task is started, for example, initialization of the task state is executed as initialization processing (step S501). Thereafter, the event-driven task stops execution until an event that causes the task to wake up occurs (step S502). After the occurrence of an event that causes a wake-up factor, the event-driven task determines whether or not the task can be executed (step S503).

  If it is determined that execution is to be inhibited, the event-driven task pauses execution until the execution inhibition is canceled. Details of the task execution availability determination will be described later. On the other hand, when it is determined that the task can be executed in the task execution enable / disable determination, the event-driven task executes event processing (step S504).

  In event processing, it is assumed that an event-driven task operates uniquely according to the processing state of the task described above, and the processing result is reflected in the processing state of the task and is used at the next and subsequent wake-ups. When the event-driven task finishes the event process, the event-driven task returns to step S502 and continues the event wait process again.

(1-3-3) Re-synchronization method by multi-system system The multi-system system 1 has the above-described configuration. Next, as an operation example, a resynchronization method in the multi-system system 1 will be described. In the present embodiment, as a resynchronization method in the multiplex system 1, the start period of the periodic drive task is adjusted. 8 to 10 described below are flowcharts showing an example of the adjustment function.

FIG. 8 shows a detailed example of the periodic timer registration process (see step S402 in FIG. 6) of the periodic drive task. Here, a case where there is a cycle timer registration request whose request cycle start time is t _req (request cycle start time 702) and whose cycle is T (corresponding to the value of cycle 704) is illustrated.

First, the timer unit 81 checks whether or not the resynchronization cycle management table 600 is empty (step S801). If the resynchronization cycle management table 600 is empty, the timer unit 81 substitutes t _req for the cycle start time t (corresponding to the value of the cycle start time 703) (step S802), and the resynchronization cycle start time t _R. While substituting t _req for the value of resynchronization cycle start time 602, T is substituted for the resynchronization cycle T _R (corresponding to the value of resynchronization cycle 603) (step S803).

On the other hand, if the resynchronization cycle management table 600 is not empty, the timer unit 81 sets t to the next resynchronization cycle start time (step S805). That is, the timer unit 81 obtains the minimum t that satisfies t _{req <} t _R + n · T _R = t (n is an integer).

Subsequently, the timer unit 81, the re-synchronization period start time t _R sets the t (step S806), further minimum period 704 in the resynchronization period T _R total cycle driving task (including the periodic driving task) The common multiple is set (step S807). Finally, the timer unit 81 registers the period start time t and the period T related to the periodic drive task in a new row of the periodic drive task management table 700 (step S804).

  Here, the specific processing flow of FIG. 8 will be described using the specific examples of FIGS. As an initial state, it is assumed that the resynchronization cycle management table 600 shown in FIG. 6 and the periodic drive task management table 700 shown in FIG. 7 are empty. In this embodiment, after that, when the time is 100, the cycle is 3 (corresponding to the value of the cycle 704), when the time is 104, the cycle is 4, and when the time is 110, the cycle is 6. Consider a case where a periodic timer is registered.

  First, when the time is 100, since the resynchronization cycle management table 600 is empty, the timer unit 81 sets the resynchronization cycle start time 602 to 100 in the resynchronization cycle management table 600 and the resynchronization cycle 603. Is set to 3. Furthermore, the timer unit 81 registers an entry (corresponding to a task having a task identifier of 1) having a cycle start time of 100 and a cycle of 3 in the periodic drive task management table 700.

  Next, the timer unit 81 registers a periodic timer whose period 704 is 4 when the time is 104 in the periodic drive task management table 700. Since the start time of the next resynchronization cycle is 100 + 2 · 3 = 106, the timer unit 81 sets 106 to the cycle start time 703 in the cycle drive task management table 700. The timer unit 81 similarly updates the resynchronization cycle start time 602 to 106 in the resynchronization cycle management table 600, and updates the resynchronization cycle to 12 which is a common multiple of 3 and 4.

  Subsequently, the timer unit 81 registers a periodic timer having a period of 6 when the time is 110. Since the start time of the next resynchronization cycle is 106 + 1 · 12 = 118, the timer unit 81 sets the cycle start time 703 to 118 and sets the cycle to 6 (corresponding to the value of the cycle 704) in the periodic drive task management table 700. ). The resynchronization period 603 should be updated to 12, which is the least common multiple of 3, 4, and 6. However, if the resynchronization period 603 is equal to the current value, the timer unit 81 does not need to update the resynchronization period management table 600. good.

  According to the procedure as described above, a time at which the start times of the cycles of the all-cycle driving task coincide with each other at least in the cycle represented by the least common multiple of the cycles of the all-cycle driving task. That is, it can be expected that immediately before the coincident time is a time zone in which the periodic drive task does not operate for the longest time. That is, it is expected that resynchronization between a plurality of computers 10 and 11 can be completed, for example, without hindering the execution of the periodic drive task by waiting for the cycle time indicated by the least common multiple at the latest.

  Next, the state matching unit 72 that is the main process of the resynchronization unit 70 will be described. Here, it supplements about the state made to correspond. In order to actually realize resynchronization, it is necessary to match various “processing states”. Such a processing state is, for example, a state relating to the memory contents, shared memory, file, and communication buffer of each task. In this embodiment, for example, it is assumed that all processing states are stored in the shared memory of the collation device 30 and the processing states are matched. This is because most of transfer data necessary for state matching is generally processing data stored in a memory, and transfer of other processing states is expected to be performed in a short time. If the state of the shared memory can be matched, it can be applied to a task private memory.

  FIG. 11 shows an example of the state matching process. This state matching process is a process executed by the state matching unit 72 as the first phase and the second phase described above.

  The state matching unit 72 is activated when the computer 10 is activated. The state matching unit 72 sets the resynchronization state to “stopped” (step S1301), and executes standby processing until a resynchronization request is generated (step S1302).

  When the re-synchronization request is subsequently generated, the state matching unit 72 sets the re-synchronization state to “first phase” (step S1303), and starts update recording of the task processing state (step S1304). The task processing state referred to here indicates, for example, data that can uniquely determine the processing content of the task among data placed on the memory 102. As described above, when the task processing state indicates data on the memory 102, there is a method of using the dirty bit of the page table as a method of recording the update. In this method, a page obtained by dividing the memory area of the memory 102 into blocks of a predetermined size is called a page, and the state of this page is managed using a page table (not shown). For example, the dirty bit managed by this page table is set to “1” by hardware when writing occurs in an arbitrary area in the page. Therefore, the update can be recorded by clearing the dirty bit of the page table to 0 for the page on the memory 102 in which the task state is stored. After that, if the dirty bit is 1, it is considered that there has been an update.

  Here, in order to prevent the contents of the memory 102 from being updated during the update recording start process, it is necessary to temporarily stop the execution of all tasks that can refer to the memory. Since this temporary suspension period is sufficiently short, it does not become a cause of missing the periodic drive task.

  Subsequently, the state matching unit 72 transfers all task processing states to the computer 11 to be restored to be resynchronized (step S1305).

  The state matching unit 72 transfers all the task processing states to the stop computer 11 and then sets the resynchronization state to “second phase” (step S1306). Further, the state matching unit 72 clears the content of an “updated LRU (Last Recently Used) list” to be described later (step S1307). The updated LRU list includes the old and new lists, but both are cleared.

  Thereafter, the state matching unit 72 extracts an update location of the task processing state at an appropriate timing (step S1308). Details of this extraction method will be described later.

  Subsequently, the state matching unit 72 calculates an update amount from the update location extracted in this way (step S1309), and determines whether the update amount is equal to or greater than a threshold value (step S1310). This threshold value may be a fixed value determined by the user, or may be a value obtained by a conventional method (for example, the method described in Patent Document 1).

  If the update amount is equal to or greater than the threshold value in step S1310, that is, the state matching unit 72 sequentially transfers the updated processing state (difference) of each task from the operating computer 10 to the recovery target computer 11 (step S1310). S1311) When all the transfers are completed, the flow returns to step S1309 to execute this. On the other hand, when the update amount is less than the threshold value in step S1310, the state matching unit 72 proceeds to a third phase described later.

  FIG. 12 shows an example of detailed processing contents of the update part extraction process (see step S1308 in FIG. 11) of the task processing state in the state matching process shown in FIG. In this process, the state matching unit 72 uses two types of data structures, that is, an update bitmap and an update LRU list, as working areas.

  The update bitmap manages the updated page with the bitmap. For example, when the contents of the first page (0th page) of the memory area storing the processing state are updated, the state matching unit 72 sets the 0th bit of the update bitmap to 1. A value indicating the page number from the top of the memory area is called a page frame number (hereinafter abbreviated as “PFN”).

  On the other hand, the updated LRU list manages the PFN of recently updated pages. The PFN of the page updated most recently is stored at the top of the list, while the PFN of the page most recently updated is stored at the end of the list. In particular, in this embodiment, an updated LRU list is used to manage pages that are updated by a high-priority event-driven task that requires high responsiveness. In the present embodiment, pages are managed using two new and old update LRU lists (new update LRU list and old update LRU list).

  First, the state matching unit 72 temporarily stops the execution of all tasks in order to prevent the update from being executed while extracting the update part of the processing state (step S1401). Subsequently, the state matching unit 72 clears the update bitmap and the new LRU list (steps S1402 and S1403).

  Next, the state matching unit 72 examines the updated page by using, for example, the method described above, and obtains the PFN (step S1404). In general, detection of page update is performed on a task basis. The state matching unit 72 determines whether the task is an event-driven task designated in advance as “high priority” (step S1405).

  If the task is not designated as “high priority”, the state matching unit 72 sets the bit on the update bitmap corresponding to the PFN obtained as described above to 1 (step S1406). On the other hand, if the task is designated as “high priority”, the state matching unit 72 removes the PFN if it exists on the old update LRU list (step S1407), and removes the PFN from the new update LRU list. (Step S1408).

  The state matching unit 72 repeatedly executes steps S1404 to S1408 as described above until it is determined that scanning has been completed with respect to whether or not all pages in the memory area storing the processing state have been updated (step S1409).

  After the scanning of all pages is completed, the state matching unit 72 resets the update record of the processing state (step S1410), and cancels the suspension of the execution of all tasks (step S1411).

  Here, in step S1410, if the above-described update presence / absence detection method is used, the page where the dirty bit of the page table is set to 1 is the update location, and the update is performed by clearing this dirty bit to 0. The recording is reset. Since the temporary suspension period from step S1401 to step S1411 is sufficiently short, the periodic drive task does not lose its period, and the influence on the responsiveness degradation of the task designated as high priority can be suppressed to a small level.

  FIG. 13 shows an example of detailed contents of the updated process state transfer process (see step S1311 in FIG. 11) shown in FIG.

  First, the state matching unit 72 clears 0 the bit corresponding to the PFN on the new update LRU list from the update bitmap created as described above (step S1501). Thereafter, the state matching unit 72 transfers the PFN page corresponding to the bit set to 1 on the update bitmap from the operating computer 10 to the recovery target computer 11 to be resynchronized (step S110). S1502).

  Subsequently, the state matching unit 72 sequentially transfers the corresponding pages in the same manner as step S1502 from the end of the newly updated LRU list (step S1503). Finally, the state matching unit 72 connects the old update LRU list behind the new update LRU list and sets this as the old update LRU list (step S1504).

  Hereinafter, the third phase and the fourth phase of the state matching process will be described with reference to FIGS. 14 and 15.

  FIG. 14 shows an example of the third phase in the state matching process. First, the state matching unit 72 sets the resynchronization state to “third phase” (step S1601), and sets the resynchronization interruption timer (step S1602). The time for operating the resynchronization interruption timer is set before the time when the next periodic drive task is driven. This is because when the third phase and the fourth phase are not completed by the set time, the process is interrupted and the process can return to the second phase. Details of the resynchronization interruption timer will be described later.

  Next, the state matching unit 72 continues the waiting process until the active task is stopped (step S1603). This means that for all tasks to be synchronized, if the task is a periodically driven task, it means that the state of waiting processing (corresponding to step S403 in FIG. 6) is continued, while if it is an event driven task, event waiting processing (FIG. 7) (corresponding to step S502 of FIG. 7).

  After that, the state matching unit 72 extracts the update part of the task processing state (step S1604) and checks whether the update amount is zero (step S1605), similarly to step S1308 shown in FIG. ).

  If the update amount is not zero in step S1605, the state matching unit 72 transfers the processing state of the updated task (step S1606) and returns to step S1604 to execute it, as in step S1311 of FIG. To do. In other words, the state matching unit 72 transfers the processing state difference of each task from the operating computer 10 to the recovery target computer 11 during a resynchronization period that is a predetermined period immediately before the start times of a plurality of periodic drive tasks are aligned. Forward.

  On the other hand, if the update amount is zero in step S 1605, the state matching unit 72 sets the resynchronization state to “fourth phase” (step S 1607), and sets the remaining task states from the operating computer 10. The data is transferred to the recovery target computer 11 to be resynchronized (step S1608). In other words, the state matching unit 72 transfers the processing state difference of each task from the operating computer 10 to the recovery target computer 11 during a resynchronization period that is a predetermined period immediately before the start times of a plurality of periodic drive tasks are aligned. Forward. The task state here indicates a “state” other than the processing state of the task transferred in step S1311 or step S1606 and requiring matching. In general, this type of “state” information is small, and it can be expected that the transfer can be performed in a short time.

  After such transfer is completed, the state matching unit 72 stops the resynchronization interruption timer (step S1609), resets the resynchronization state to “stopped” (step S1610), and cancels the suppression of task execution. Is requested (step S1611), the process returns to the resynchronization request wait (step S1302 in FIG. 11) and executed. The task execution suppression will be described later.

  FIG. 15 shows an example of processing when the resynchronization interruption timer is activated. In the example shown in the figure, a state in which the third phase and the fourth phase in the state matching processing are interrupted is shown.

  The resynchronization interruption timer starts operating at an arbitrary timing in steps S1603 to S1608 in FIG. 14 after the time designated in step S1602 has elapsed.

  At this time, the state matching unit 72 resets the resynchronization state to “second phase” (step S1701), cancels the task execution inhibition (step S1702), and returns to step S1311 to execute it. That is, the state matching unit 72 interrupts the third phase and the fourth phase (step S1703), and executes again from the second phase.

  FIG. 16 shows an example of a task execution availability determination process. The task execution availability determination process is executed by the task execution suppression unit 71 of the resynchronization unit 70. This task execution availability determination process is called and executed in step S503 for the event-driven task shown in FIG.

  First, the task execution suppression unit 71 determines whether or not the resynchronization state is the fourth phase (step S1801).

  If the resynchronization state is the fourth phase in step S1801, the task execution suppression unit 71 sets the task execution suppression (step S1810). In this case, the task execution suppression unit 71 restricts the execution of the task until the execution suppression is canceled in step S1611 or step S1702.

  On the other hand, if the resynchronization state is not the fourth phase in step S1801, the task execution suppression unit 71 determines whether the task is a task designated as high priority (step S1802). If the task is a task designated as high priority, the task execution suppression unit 71 permits execution of the task (step S1820), and proceeds to step S504 to execute it. On the other hand, if the task is not a task designated as high priority, the task execution suppression unit 71 determines whether or not the resynchronization state is the third phase (step S1803).

  When the resynchronization state is the third phase, the task execution suppression unit 71 suppresses execution of the task (step S1810), whereas when the resynchronization state is not the third phase, the resynchronization state is the second phase. It is determined whether or not (step S1804).

  When the resynchronization state is not the second phase, that is, when the resynchronization state is the first phase or “stopped”, the task execution suppression unit 71 permits the execution of the task (step S1820). On the other hand, when the resynchronization state is the second phase, the task execution suppression unit 71 determines whether or not the expected completion time of the task is included in a predetermined period at the end of the resynchronization period (step S1805).

  When the expected completion time of the task is included in the predetermined period at the end, the task execution suppression unit 71 suppresses the execution of the task (step S1810), while the expected completion time of the task is the predetermined value at the end. If it is not included in the period, execution of the task is permitted (step S1820).

  Thereafter, after the task designated as high priority is executed, in the multi-system system 1, the state matching unit 72 again sets the processing state updated by the high priority task between the computers 10 and 11. Transfer to match.

  Here, step S1805 described above will be described in more detail. First, the expected completion time of the task corresponds to the time obtained by adding the expected maximum processing time of the event processing time to the current time (time at which the event processing step S504 of the task is started).

  If the maximum processing time is known in advance, the task execution suppression unit 71 sets the time for each event-driven task and refers to it in step S1805, while the maximum processing time is known in advance. If not, the time is predicted by a statistical method.

  Specifically, the task execution suppression unit 71 aggregates the event processing time in step S504 for each task, calculates the average and standard deviation, adds this average to the standard deviation, and predicts the maximum processing time. Is calculated. The end of the resynchronization period is calculated by the task execution suppression unit 71 obtaining the start time of the next resynchronization period based on the resynchronization period start time 602 and the resynchronization period 603 of the resynchronization period management table 600. can do.

  The “predetermined predetermined period” in step S1805 represents a time sufficient to complete the third phase and the fourth phase of the resynchronization unit 70, the update frequency of the task processing state, the communication bandwidth of the internal network 50 It is decided according to.

  Here, while the loop from step S1604 to step S1606 is being executed, the event-driven task designated as high priority is operable. On the contrary, the event-driven task designated as high priority becomes inoperable during the temporary suspension period from step S1401 to step S1411 and the period of the fourth phase from step S1607 to step S1610. However, these periods are short, and the influence on the responsiveness of the event-driven task designated as high priority can be reduced.

  Furthermore, by transferring the processing state frequently updated by the high priority task as much as possible, even if an event-driven task designated as high priority operates during the third phase, Can also reduce the probability of transferring the same processing state. In addition, the situation where the third phase and the fourth phase are not completed within the predetermined time at the end can be avoided. Therefore, according to the present embodiment, it is possible to further increase the possibility of completing the resynchronization process within the resynchronization period while maintaining the responsiveness of the event-driven task designated as high priority.

  When a plurality of periodic drive tasks having different periods are operating, the resynchronization period (corresponding to the value of the resynchronization period 603) may become long. In that case, at first glance, it is suitable for executing the third phase and the fourth phase of the resynchronization process, and waits for a long time until a period in which the plurality of periodic drive tasks do not operate for a certain period of time comes. It is possible that a need arises. In this case, when an event-driven task that continues to operate for a long time, such as batch processing, is driven each time at the timing when the preferred period arrives, resynchronization processing may be completed at any time. It will be impossible.

  Therefore, by executing the determination regarding the predicted completion time as in step S1805 described above and preliminarily suppressing the execution of the event-driven task that may be executed over the suitable period described above, a plurality of computers 10, Ensuring that the last differential transfer between 11 and the like is completed within the predetermined period at the end, and increasing the possibility of completing the resynchronization process among a plurality of computers 10 and 11 etc. in a short time Can do. Note that an event-driven task having a long processing time is generally set to have a relatively low priority, and therefore, even if its execution is suppressed for some time, the influence is small.

  As described above, the execution of the event-driven task is appropriately suppressed, so that the periodic drive task does not lose its cycle and the responsiveness of the task designated as high priority is not deteriorated. , 11 etc., resynchronization can be easily completed in a short time.

  In the present embodiment, the last difference transfer is performed by avoiding the resynchronization period in which the driving of the plurality of driving tasks described above is restricted in principle and the execution period of the task such as batch processing. Can be guaranteed to be completed by the end of the predetermined period.

(2) Second Embodiment A multiplex system 1A according to the second embodiment has substantially the same configuration as the multiplex system 1 according to the first embodiment and performs substantially the same operation. A description of the same configuration and operation in both of them will be omitted, and different points will be mainly described below.

  FIG. 17 shows an example of a periodic timer registration process in the second embodiment. Steps S901 to S904 are the same as steps S800 to 804 shown in FIG.

When the resynchronization cycle management table 600 is not empty in step S901, first, the timer unit 81 sets the resynchronization cycle T _R (corresponding to the value of the resynchronization cycle 603) and the cycle T (corresponding to the value of the cycle 704). The greatest common divisor G is calculated (step S905).

Next, the timer unit 81 calculates the minimum t satisfying t _req <t _R + n · G = t (n is an integer), and the minimum t is adjusted to the cycle start time t (value of the cycle start time 703). (Step S906).

Subsequently, the timer unit 81 _'calculates (step S907), the re-synchronization period start time t _R the next resynchronization period start time t _R' next resynchronization period start time t _R is updated by ( Step S908). Further timer unit 81 updates the resynchronization period T _R to the least common multiple of the periods of full-cycle driving task (step S909).

FIG. 18 shows an example of a method for calculating the next resynchronization cycle start time t _R ′ in FIG. First, the timer unit 81 is configured to set the _{t R} to _{t 0} as an initial state, it sets t to _{t 1} (step S1001). Here, the timer unit 81 compares the _{t 0} and _{t 1} (step S1002).

When t ₀ and t ₁ are equal, the timer unit 81 sets the next resynchronization cycle start time t _R ′ to t ₁ at this time (step S1003), and ends the processing (step S1004).

On the other hand, when t ₀ and t ₁ are different, the timer unit 81 compares the magnitudes (step S1005). Timer unit 81, _{t 0} is added to _{T R} to _{t 0} is smaller than _{t 1} (step S1006), while executing the process returns to step S1002, _{t 0} is added to T to _{t 1} is greater than _{t 1} (Step S1007), it returns to Step S1002 and executes.

  Hereinafter, the case where the cycle start time (corresponding to the value of the cycle start time 703) is adjusted according to the procedures of FIGS. 17 and 18 will be described using specific examples shown in FIGS. Assume that the resynchronization cycle management table 600 (see FIG. 9) and the cycle-driven task management table 700 (see FIG. 10) are empty as an initial state. Note that the request cycle start time (corresponding to the value of the request cycle start time 702) and the cycle (corresponding to the value of the cycle 704) of the periodic drive task are the same as those illustrated in FIG.

  The process when registering a periodic timer whose period (corresponding to the value of period 704) at time 100 is the same as the method using FIGS. 6 and 7 described in the first embodiment. Next, an example of registering a cycle timer whose request cycle start time (corresponding to the value of request cycle start time 702) is 104 and whose cycle (corresponding to the value of cycle 704) is 4 will be described.

  At this time, the greatest common divisor of the resynchronization period (value of resynchronization period 603) and the period (value of period 704) is 1 because it is the greatest common divisor of 3 and 4. Accordingly, the cycle start time t (corresponding to the value of the cycle start time 703) is 105 as a minimum value satisfying 104 <100 + n · 1 = t (n is an integer).

At time 109, since the start time of the resynchronization cycle and the start time of the cycle of the periodic drive task match, the task execution suppression unit 71 sets this matching time as a new resynchronization cycle start time t _R (re- It corresponds to the value of the synchronization cycle start time 602). The task execution suppression unit 71 updates the resynchronization period (corresponding to the value of the resynchronization period 603) with 12, which is the least common multiple of 3 and 4.

  Then, consider a case where a cycle timer having a request cycle start time 702 of 110 and a cycle (corresponding to the value of cycle 704) of 6 is registered. The greatest common divisor of the resynchronization period (corresponding to the value of resynchronization period 603) and the period (corresponding to the value of period 704) is 12, which is 6 because it is the greatest common divisor of 6. Therefore, the cycle start time t (corresponding to the value of the cycle start time 703) is 115 as the minimum value satisfying 110 <109 + n · 6 = t (n is an integer).

  For the resynchronization cycle 603, the least common multiple of 12 and 6 is 12, which is equal to the current value, so the task execution suppression unit 71 does not have to update the resynchronization cycle management table 600.

  As described above, the cycle start time of the task whose task identifier 701 is 2 (corresponding to the value of the cycle start time 703) was 106 in the first embodiment (see FIG. 8). In the embodiment, the period start time of the task having the task identifier 701 of 3 is shortened to 105, and the period start time of the task having the task identifier 701 of 3 is 118 in the first embodiment, but is shortened to 115 in the second embodiment.

  In the first embodiment described above, when the method shown in FIG. 8 is used, at first glance, the maximum time of the initial period of the periodic drive task to be executed from now on can be maximized in the resynchronization period management table 600. It seems that there may be a delay over the time set in the resynchronization period 603. However, according to the second embodiment, by using the method shown in FIG. 17 and FIG. 18, the delay amount of the start time of the initial period of the periodic drive task can be suppressed.

(3) Other Embodiments The above embodiment is an example for explaining the present invention, and is not intended to limit the present invention only to these embodiments. The present invention can be implemented in various forms without departing from the spirit of the present invention. For example, in the above-described embodiment, the processing of various programs is described sequentially, but this is not particularly concerned. Therefore, as long as there is no contradiction in the processing results, the processing order may be changed or the operations may be performed in parallel. Further, the program including each processing block in the above embodiment may be in a form stored in a non-transitory storage medium readable by a computer, for example.

  The present invention relates to a multi-system system and a multi-system that are configured to operate again in synchronism by matching the task processing state of a computer to be restored with the task processing state of a computer in operation. Can be widely applied to the resynchronization method.

  DESCRIPTION OF SYMBOLS 1 ... Multi-system, 10, 11, 12 ... Computer, 70 ... Resynchronization part, 71 ... Task execution suppression part, 72 ... State matching part, 80 ... Task scheduler, 81 ... Timer part , 90... Task, 600... Resynchronization cycle management table, 700.

Claims (10)

In a multi-system where each task executes the same process on multiple computers,
While all of the tasks are stopped in the plurality of computers, the processing state of the task of the computers to be restored among the plurality of computers is matched with the processing state of the task of the operating computer. A state matching unit that matches the processing state of each task between each task so that each task can execute the same processing in synchronization again,
A start time adjusting unit that adjusts the start times of the periods of the plurality of periodic drive tasks so that the start times of the periods of the plurality of periodic drive tasks that are periodically driven among the tasks are periodically aligned;
A task execution inhibiting unit that regulates execution of tasks other than the plurality of periodic drive tasks over a predetermined period immediately before the start times of the plurality of periodic drive tasks are aligned;
A multi-system system comprising: The state matching unit
The multiplex system according to claim 1, wherein, in the predetermined period immediately before, the difference in the processing state of each task is transferred from the operating computer to the recovery target computer. The start time adjustment unit
The start time of the initial period of any one of the plurality of periodic drive tasks is adjusted to match the start time of the period of another periodic drive task that is already in operation. Item 4. The multisystem according to Item 1. The start time adjustment unit
When determining a start time of an initial period of a predetermined periodic driving task among the plurality of periodic driving tasks, a first period of the predetermined periodic driving task and an already operating period of the plurality of periodic driving tasks A time obtained by adding an integer multiple of the greatest common divisor to the second cycle in which the start times of the drive task cycles are aligned, and the start time of the first cycle of the predetermined cycle drive task. The multiplex system according to claim 1, wherein the multiplex system is set. The state matching unit
When matching the processing state of each task in the immediately preceding predetermined period, the processing state updated by the high priority task that should be executed in preference to the periodic drive task among the tasks is matched as much as possible. And,
The task execution suppression unit
Exceptionally allowing the execution of the high priority task in the predetermined period immediately before,
The state matching unit
2. The multiplex system according to claim 1, wherein after the high-priority task is executed, the processing state further updated by the high-priority task is matched again among the plurality of computers. In a resynchronization method in a multi-system where each task executes the same processing in a plurality of computers,
The multi-system system adjusts the task processing state of the recovery target computer of the plurality of computers to the task processing state of the operating computer while all the tasks are stopped in the plurality of computers. A state matching step that matches the processing state of each task between the plurality of computers and sets each task to a state in which the same processing can be executed synchronously again;
The multi-system system adjusts the start time of the periods of the plurality of periodic drive tasks so that the start times of the periods of the plurality of periodic drive tasks that are driven periodically among the tasks are periodically aligned. Steps,
A task execution suppression step for restricting execution of tasks other than the plurality of periodic drive tasks over a predetermined period immediately before the multi-system system has start times of the plurality of periodic drive tasks; and
A resynchronization method in a multiplex system characterized by comprising: In the state matching step,
The multi-system system according to claim 6, wherein the multi-system system transfers a difference in processing state of each task from the operating computer to the recovery target computer in the predetermined period immediately before the multi-system system. Resynchronization method. In the start time adjustment step,
The multi-system adjusts the start time of the initial period of any one of the plurality of periodic drive tasks to the start time of the period of another periodic drive task that is already in operation The resynchronization method in a multi-system according to claim 6. In the start time adjustment step,
When the multi-system determines a start time of an initial period of a predetermined periodic driving task among the plurality of periodic driving tasks, a first period of the predetermined periodic driving task and a plurality of periodic driving tasks A time obtained by adding an integer multiple of the greatest common divisor to the second cycle in which the cycle start times of the already running cycle drive tasks are aligned is added to the start time of the second cycle. 7. The resynchronization method in a multiplex system according to claim 6, wherein the resynchronization method is set to a start time of an initial period. In the state matching step,
When the multiplex system matches the processing state of each task in the predetermined period immediately before, the processing state updated by a high priority task that should be executed with priority over the periodic drive task among the tasks Match as much as possible, and
In the task execution suppression step,
The multi-system system allows the execution of the high priority task exceptionally in the predetermined period immediately before,
In the state matching step,
The system according to claim 6, wherein after the high-priority task is executed, the multi-system system again matches the processing state further updated by the high-priority task among the plurality of computers. A resynchronization method in a multisystem.

Images