JP3232393B2 - Module operating state control method for distributed processing system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a technology for monitoring the failure of each module (distributed module) constituting a distributed processing system, and more particularly, to the performance of a large-scale intelligent network in which each module is redundantly configured for backup. The present invention relates to a method for controlling a module operation state of a distributed processing system suitable for monitoring a failure without lowering the module operation state.

[0002]

2. Description of the Related Art Conventionally, as a technique for monitoring the state of each module of a distributed processing system, a centralized management system using a centralized control module for centrally managing each module, and each module mutually checking the state of other modules. There is an autonomous distributed management method for monitoring, and the like. In the centralized management system, the health check of the centralized control module is executed to determine whether the operation of the subordinate modules is possible or not, and the restart of the own module of each module is started. Is notified to the centralized control module so that the centralized control module detects that a failure has occurred in a subordinate module. The central control module distributes the status change of each component module collected by each of these methods or both to other modules that are not faulty. Then, in each module, a processing request destination is selected according to the information of the failed module notified from the central control module.

In this centralized management system, if a failure occurs in the centralized control module, it becomes impossible to control the state of the entire system. For this reason, it is difficult to improve the reliability of the entire system by a certain amount or more. Furthermore, there is a delay until the centralized management module detects a failure that has occurred in the node, and the call that occurred before the failure occurred and before each module suppressed the processing request for the failed module terminated abnormally. It leads to quality deterioration.

In the autonomous decentralized management system, each module constituting the system is autonomously periodically assigned to a module within a predetermined range or to all other modules constituting the system. By executing the health check, the status of the failure of the other module is grasped, and the processing request destination is selected. For this reason, it is possible to avoid a state in which the state control of the entire system becomes impossible due to the occurrence of a failure in the centralized control module in the centralized management system, and a decrease in service quality due to a delay in failure detection.

However, in this autonomous decentralized management system, each module performs a health check and communication for guaranteeing consistency of individual module states in all distributed module groups. As a result, communication between modules for normal call processing is squeezed, leading to a decrease in service quality.

[0006]

The problem to be solved is that in the conventional technique, failure management of each module cannot be performed without deteriorating the service quality of the distributed module system. The purpose of the present invention is
An object of the present invention is to provide a method for controlling the operation state of a module of a distributed processing system which can solve the problems of the conventional technology and improve the reliability and performance of a large-scale intelligent network in which distributed modules are redundantly configured for backup. .

[0007]

To achieve the above object, according to an aspect of the module operation state control method of a distributed processing system of the present invention, in each of the modules constituting the distributed processing system, the monitoring of the operating state for or other modules A module operation state control method for a distributed processing system that performs
Access destination first module (load distribution module B
2) The response time to the processing request from the own module (load distribution module A1) is measured, and it is monitored whether or not this time exceeds a predetermined time (T0) for each access signal. If) exceeds the (time-out), either by setting registered as first an inoperable fault in status module (transient faults in), or the first
After setting and registering the module as faulty,
After the lapse of the time (T1) set in the first module, the first module
In the method for canceling the setting of the fault state of the module,
The first module is set and registered as faulty.
The retry process for the first module
Only the second module that can be replaced
Selected and the first module is specified in advance.
There is a backup relationship between other specified modules.
Function distribution module, the function distribution module
Function distribution module that has a backup relationship with
Selected as the second module and the second module
The first module corresponding to the retry processing is
Access to the first device based on the time (T0).
When the setting registration of the failure status of the module of
Activate the backup and execute the first module
To all connected modules that the
Each of the modules notified and notified of the
Register the setting of the above failure status to the
Further, the second module is separately set in advance.
After the elapsed time (T1), the operation availability of the first module
The first module is in an operable state.
Then, the setting registration of the faulty state for the first module is performed.
The recording is canceled and all the modules are
Cancels the registration of the faulty state setting for the module 1
Is notified .

[0008]

DESCRIPTION OF THE PREFERRED EMBODIMENTS In the present invention, a failure occurring in a distributed module is detected by monitoring a timeout (T0) for a communication service access performed by each module. When a timeout occurs, the communication service access to the module is immediately stopped. After a certain period of time has elapsed, the communication service access to the module in which the timeout has occurred is restored. If retry processing for access to the module is possible, access is made to a module of the same type as a substitute module.

In the case where update data required for realizing a communication service is managed in a function distribution module having a backup relationship between predetermined modules, the function distribution modules in the backup relationship are in a mutual operation state. When the communication service access to the other party times out, the management right of the update data managed by the function distribution module is taken over. Then, the backup of the operation of the module is started, and the other modules are notified that the operation state of the module has become inoperable. Further, after a lapse of a predetermined time (T1), an attempt is made to return the management right of the update data taken over from the module, and if successful, the status of the module becomes operable with respect to other modules. Notification that
In the case of failure, the backup operation is continued again until the above-mentioned fixed time (T1) elapses.

By doing so, there are the following advantages in the module operation state control processing of the distributed processing system as compared with the conventional technique. (A) Since it is not necessary to control the module state by the centralized control module, it is possible to eliminate factors such as failure of the centralized control module that hinder the improvement of the reliability of the entire system. (B) No centralized control module is required, and a delay until failure detection by the centralized control module can be avoided. (C) Since the health check signal is not issued,
There is no pressure on traffic. (D) Since there is no need for bidirectional communication between all modules for guaranteeing the state matching of other modules, the communication amount is not reduced.

[0011]

Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a communication sequence diagram showing a first embodiment of a process according to the present invention of a method for controlling a module operating state of a distributed processing system according to the present invention, and FIG. 2 is a method for controlling a module operating state of a distributed processing system according to the present invention. FIG. 3 is a communication sequence diagram showing a second embodiment of the process according to the present invention.
It is a block diagram showing the example of composition of the distributed processing system which performs module operation state control concerning the present invention.

FIG. 3 shows a configuration of a service control node that provides an intelligent network service using a distributed module configuration as a distributed processing system according to the present invention. 300 is a transmission node, 2
01 denotes a load distribution module group for controlling communication with the transmission node 300 (hereinafter, this type of module is referred to as module A), and 202 denotes a load distribution module group having service control logic (hereinafter, this type of module is referred to as module B). 203, a function distribution module group (hereinafter, referred to as a group of functions) that holds updated data updated by the service control logic on a real-time database.
This type of module is referred to as module C).

The service control node 100 is provided with these distributed modules (module A201, module B20
2, module C203). The transmission node 300 controls a communication path corresponding to a call between terminals. That is, upon detecting an intelligent network service call from a terminal such as a telephone, the transmission node 300 notifies the service control node 100 of the call.
The service control node 100 controls the call by cooperation of the distributed module groups 201 to 203.

FIG. 4 is a block diagram showing a detailed configuration example according to the present invention of the service control node in FIG. This example shows an example of function allocation conditions for module operation state control on each distributed module in the service control node 100 in FIG. 3. Modules A201 and B202 include another module state management mechanism 400 and an inter-module communication mechanism. 4
The module C203 includes a function distribution module / other module state management mechanism 401, a backup mechanism 402, and an inter-module communication mechanism 403.
Hereinafter, details of each mechanism will be described.

(A) Other module status management mechanism 400:
In the modules A201 and B202, the states of other modules other than the own module are managed by the other module state management mechanism 400. In the module C203, in addition to the status of each module, the IDs of the function distribution modules in a backup relationship are also managed. When a timeout notification is received from the inter-module communication mechanism 403, which will be described later, the status of the module is set to failure. If the module is a load balancing module, the state of the module is reset to an operable state after a lapse of a predetermined time (T1).

Further, when a failure notification of the backup module is received from a module C 203 described later,
The state of the notified function distribution module is set to failure, and thereafter, the state of the function distribution module is fixed to failure until the state restoration of the function distribution module is notified. In the service processing performed by the module, when access to another module is required, the status of the other module is always referred to in advance, and when the module status is not normal, access to the module is stopped. , Select an alternative module to access. As a method of selecting an alternative module, when the failed modules are the modules A and B, that is, in the case of the load distribution module, the same type of module is arbitrarily selected. On the other hand, when the type of the access module is the module C, that is, the function distribution module, the modules having a mutual backup relationship can be selected.

(B) Function distribution module / other module status management mechanism 401: The function distribution module / other module status management mechanism 401 provided in the module C has timed out in addition to the functions of the aforementioned other module status management mechanism 400. If the module is a function distribution module having a mutual backup relationship with its own module (hereinafter, such a module is referred to as a pair module), the status of the module is immediately set to “failed” and the backup mechanism 402 , The start of the backup process is notified, and all other modules are notified that the pair module has failed.
Thereafter, after a lapse of a predetermined time (T1), the backup mechanism 4
02, a backup switchback process (hereinafter, simply referred to as a switchback process) is instructed. When the switchback process is completed normally, the state of the pair module is returned to a normal state, and all the modules are restored. Broadcasts that the module has returned (return notification).

(C) Backup mechanism 402: The backup mechanism is started upon a backup start instruction from the function distribution module / other module state management mechanism 401 to take over the service processing of the pair module in the backup relationship and issue a switchback instruction. The switchback processing is started with the trigger. If the backup switchback processing is not successful because the failure of the pair module has not yet recovered, the processing is interrupted, and the switchback processing is performed on the function distribution module / other module state management mechanism 401 that issued the switchback instruction. Notify the processing failure and continue the backup operation.

(D) Inter-module communication mechanism 403: All distributed modules have an inter-module communication function in order to communicate with other modules. If no response is received after a predetermined time (T0) has elapsed for each signal with respect to access to another module, the inter-module communication mechanism 403 immediately notifies the other module that the access to the module has timed out. Notify the state management mechanism 400. In the case of module C, the function distribution module and other module state management mechanism 40
Notify 1.

FIG. 5 is an explanatory diagram showing a state transition model of another module managed by each distributed module of the service control node in FIG. In FIG. 5, 501 indicates a state of “operating”, and 502 indicates a state of “temporary failure”. Communication response time 601 in each state
And the monitoring time 602 are monitored. The transition between the operating state 501 and the temporary failure state 502 is performed through a transition detection point. The transition detection point 701 is a transition detection point that is satisfied when the communication response time 601 for the module in the operating state has expired a predetermined time-out time (T0). Is a transition detection point that is satisfied when the monitoring time 602 after the module in the state of failure has exceeded the monitoring expiration time (T1) defined separately.

FIG. 6 is an explanatory diagram showing a state transition model of a function distribution module managed by a distribution module other than the pair module of the service control node in FIG.
In FIG. 6, reference numerals 501 and 502 denote a “operating” state and a “temporary failure” state, similarly to the case shown in FIG. Reference numeral 503 indicates that the module C is in the “failure state”. The communication response time 601 that is the monitoring data in the “operating” state, the monitoring time 602 that is the monitoring data in the “temporary failure” state, and the transition detection points 701 and 702 are the same as those described in FIG. The transition detection point 703 is determined by receiving a failure notification from the pair module of the module C shown in the state transition diagram, and the transition detection point 704 is determined by passing a transition detection point passing by receiving a recovery notification from the failure. Each is shown.

FIG. 7 is an explanatory diagram showing a state transition model of a pair module managed by the function distribution module of the service control node in FIG. The operating state 501, the communication response time 601, and the monitoring time 602 are the same as those described with reference to FIGS. The state 504 indicates that the module is in the “temporary failure” state and is in the state of performing the backup operation of the failed module, similarly to the “temporary failure” state 502 in FIG. The transition detection point 705 indicates that the access to the pair module in the operating state has timed out (time T
0), which is a transition detection point that passes when
If this transition detection point has been passed, the fact that the state of the pair module has transitioned to "failure" is broadcast to all modules.

At the transition detection point 706, the monitoring time 602 after the state of the pair module transits to the temporary failure state 502 expires the predetermined monitoring expiration time (T1), and the backup operation is switched back. This is a detection point indicating that the original operation has become possible in the pair module due to success. When the transition detection point 706 is passed, the pair module returns to the “operating” state for all modules. Broadcast what you did. The transition detection point 707 is a transition detection point that passes when the backup operation is continuously performed because the switchback processing has not been completed normally.

Hereinafter, an example of a module state control procedure when a failure occurs in the load distribution module of the system in FIG. 3 will be described with reference to FIG. In the example shown in FIG. 1, the module A1 is a module belonging to the module A, and the modules B1 and B2 are modules belonging to the module B. Then, it is assumed that access to module B from module A is necessary to realize a certain communication service.

The module state control according to the present invention at the time of occurrence of a failure is performed by the procedures shown in (1) to (5) in FIG. That is, (1) From module A1, to realize a communication service,
An access is made to the module B2, which is one of the modules B. (2) At this time, if a failure has occurred in the module B2, a response to the access request from the module A1 cannot be issued. Therefore, in module A1, the above access results in a communication timeout. (3) The module A1 that has detected the communication timeout for the module B2 immediately sets the state of the module B2 to “temporary failure”, and thereafter does not select the module B2 as an access destination for the module B.

(4) If retry processing for the access is possible, it is also possible to access module B1, which is a module of the same kind, as a substitute module for module B2. (5) In the module A1, the time after setting the state of the module B2 to “temporary failure” is the monitoring time (T
When the value exceeds 1), the state of the module B2 is autonomously returned to "operating", and thereafter, the module B2 is added to the selection range as an access destination for the module B. When the module B2 is accessed for the first time after the processes (1) to (5), the module B2 is still accessed.
If the failure has not been recovered, the steps (1) to (5) are repeated again.

Next, an example of a module state control procedure when a failure occurs in the function distribution module of the system in FIG. 3 will be described with reference to FIG. In this example, the module A1 is one module belonging to the module A as in FIG. 1, and the modules C1 and C2 are:
Each of the modules belongs to the module C, and a backup relationship between the modules is defined. It is also assumed that the module A needs access to the update data managed by the module C2 in order to realize the communication service.

The module state control according to the present invention at the time of occurrence of a failure under such conditions is described in (1) to (1) in FIG.
The procedure shown in 3) is performed. That is, (1) The module A1 accesses the module C2 to realize a communication service. (2) At this time, if a failure has occurred in the module C2, a response to the access request from the module A1 cannot be issued. Therefore, the access from the module A1 results in a communication timeout. (3) The module A1, upon detecting a communication timeout for the module C2, immediately sets the state of the module C2 to "temporary failure", and thereafter, the access to the module C2 is restricted to the module C1 having a mutual backup relationship with the module C2. Perform for

(4) When the module C1 that has received the substitute processing request from the module A1 determines that the update data requested to be accessed is data managed by the module C2 in a mutual backup relationship, the module C1 once determines , And transfers the access to the module C2. (5) Since module C2 is out of order, module C1
Can not respond to access relayed from
Access from module C1 also times out.
During this time, at an appropriate timing, in order to prevent the alternative processing request from the module A1 from timing out,
An intermediate response may be returned from module C1 to module A1.

(6) The module C1, upon detecting a communication timeout for the module C2, immediately changes the state of the module C2 to "temporary failure (backup starting)".
And start backup processing. (7) The module C1 notifies all the modules that the module C2 has failed. (8) Access to the update data managed by the module C2 enabled by the start of the backup process is performed, and a response is returned to the module A1 that is the access request source. (9) All the modules that have received the failure notification of the module C2 from the module C1 set the state of the module C2 to “under failure”.

(10) In the module C1, when the monitoring expiration time (T1) elapses after the state of the module C2 is set to "temporary failure", the backup ending process is started, so that the module C2 Attempt to switch back to backup operation. At this time, if the failure in the module C2 has not been recovered, the switchback processing fails in the module C1. In this case, the backup operation is continued until the monitoring expiration time (T1) elapses again. (Case 1) in FIG. 2 shows a case where the first switchback processing has failed.

(11) If the switchback processing is successful, the module C1 sets the state of the module C2 to "operating". (Case 2) in FIG. 2 shows a case where the switchback processing is successful. (12) When the state of the module C2 is set to “operating”, the module C1 issues a recovery notification of the module C2 to all modules. (13) In all the modules that have received the notification of the recovery of the module C2 from the module C1, the state of the module C2 is set to “operating”, and thereafter, normal access is performed.

As described above with reference to FIGS. 1 to 7, in the method of controlling the module operation state of the distributed processing system according to the present embodiment, the service control node 100 adopting the distributed module configuration uses the call processing access signal. (Time T0 has elapsed), a failure of another module is detected. As a result, the occurrence of a failure can be quickly detected without suppressing communication for call processing using a dedicated signal for failure detection. Also, by setting the state of the failed module to a state in which access is autonomously suppressed,
Since the call loss due to the selection of the faulty module can be reduced and the control from the centralized control module in the prior art is not required, the centralized control module is particularly used because of the determinants of reliability in a large-scale distributed system. Can eliminate the influence of reliability.

The present invention is not limited to the embodiment described with reference to FIGS. 1 to 7, and can be variously modified without departing from the gist thereof. For example, in the example of FIG. 1, only the module B1 is described, and the access destination including the retry processing as the substitute module in the procedure (4) is performed for the module B1, but the access destination after the retry processing is performed. The access destination is not limited to the module B1, but may be each module of another load balancing module group having service control logic like the module B1.

[0035]

According to the present invention, failure management of each module can be performed without deteriorating the service quality of the distributed processing system. In particular, the reliability of a large-scale intelligent network in which distributed modules are redundantly configured for backup can be improved. It is possible to improve performance and performance.

[Brief description of the drawings]

FIG. 1 is a communication sequence diagram showing a first embodiment of a process according to the present invention of a method for controlling a module operating state of a distributed processing system according to the present invention.

FIG. 2 is a communication sequence diagram showing a second embodiment of the process according to the present invention of the module operating state control method of the distributed processing system of the present invention.

FIG. 3 is a block diagram illustrating a configuration example of a distributed processing system that performs module operation state control according to the present invention.

FIG. 4 is a block diagram showing a detailed configuration example according to the present invention of the service control node in FIG. 3;

FIG. 5 is an explanatory diagram showing a state transition model of another module managed by each distributed module of the service control node in FIG. 3;

FIG. 6 is an explanatory diagram showing a state transition model of a function distribution module managed by a distribution module other than the pair module of the service control node in FIG. 3;

FIG. 7 is an explanatory diagram showing a state transition model of a pair module managed by the function distribution module of the service control node in FIG. 3;

[Explanation of symbols]

100: Service control node, 201: Load distribution module A, 202: Load distribution module B, 203: Function distribution module C, 300: Transmission node, 400: Other module state management mechanism, 401: Function distribution module other module state management mechanism , 402: backup mechanism,
403: inter-module communication mechanism, 501: operating state,
502: Temporary failure state, 503: Failure state, 50
4: Temporary failure / backup operation, 601: Communication response time, 602: Monitoring time, 701 to 707: Transition detection point.

Continuation of the front page (56) References JP-A-55-8134 (JP, A) JP-A-2-277336 (JP, A) JP-A-6-187270 (JP, A) JP-A-56-122595 (JP) JP-A-55-97647 (JP, A) JP-A-55-37643 (JP, A) JP-A-54-115008 (JP, A) JP-A-63-102434 (JP, A) 60-89255 (JP, A) Japanese Utility Model Showa 62-71755 (JP, U) (58) Field surveyed (Int. Cl. ⁷ , DB name) H04M 3/22

Claims (1)

(57) [Claims] 1. A module operation state control method for a distributed processing system, in which each module constituting the distributed processing system monitors the operation availability of another module, comprising: The response time to the processing request is measured, and the time during the measurement is a predetermined time (T0) for each access signal.
Monitors whether or not exceeding, the case where the time during the measurement exceeds the time (T0), to set registers the first module as a state in impossible operation failure Luke, or the
After setting and registering the first module as a failure state,
After the elapse of a time (T1) set separately in advance, the first
How to cancel the setting of the module's fault status
The first module as a faulty state
While retrying the first module,
A second module that includes
And the first module comprises:
Backup functions between other predefined modules
If the function distribution module has a function
Function distribution module with backup relationship with module
Selected as the second module, and
The two modules correspond to the first module corresponding to the retry processing.
Access to Joule, based on the above time (T0)
Registered the setting of the failure status of the first module
In this case, start the backup and
That all modules to which the
Module that has received the notification,
Register the setting of the above-mentioned fault status for the module of
And the second module is separately set in advance.
After the set time (T1), the operation of the first module is performed.
Determining whether the first module is operable;
State, a faulty state for the first module
In addition to canceling the setting registration, all the above modules
Register the setting of the faulty state for the first module.
A method for controlling a module operation state of a distributed processing system, wherein a notification is given to cancel the operation.