JP3329602B2 - Standby redundant multiplexing processing system and method of changing checkpoint cycle used in the system - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a standby redundant multiplex processing system and a checkpoint cycle changing method used in the system.

[0002]

2. Description of the Related Art In a parallel / distributed processing system, there is a standby redundant type multiplex processing system as one of methods for improving the reliability of a computer processing system. This standby redundant type multiplex processing system multiplexes program modules, gives execution rights to any one of the program modules, executes processing, and when the program module given the execution right breaks down, The execution right is transferred to the other multiplexed other program modules to continue the execution. That is, if the program module having the execution right is the main system and the program module without the execution right is the standby system, the main system normally executes the processing,
When the main system fails, the standby system becomes a new main system and continues to execute the processing.

In such a standby redundant type multiplex processing system, since the standby system does not perform actual processing until a failure of the main system occurs, the processing load on each computer processing system is small, and the effective use of computer resources is reduced. While you can plan,
It is necessary to maintain the same internal state such as memory contents between the main system and the standby system.

For this reason, conventionally, a method for a system designer to consciously specify a checkpoint for maintaining the same internal state of a main system and a standby system in a program, and a method of setting a checkpoint in time. A method is known in which the internal state is periodically sent from the main system to the standby system at regular intervals.

[0005] However, in a method in which a system designer is conscious of specifying a checkpoint in a program,
Each time a program is changed, the checkpoint must be set anew after understanding the structure of the program, and there is a problem that the burden on the system designer increases. In the method of setting checkpoints at fixed intervals,
Although the system designer does not need to be aware of the checkpoint, the internal state is transferred irrespective of whether or not the internal state of the main system has changed, so that there has been a problem of inefficiency.

[0006]

As described above, in the method in which the system designer is consciously specifying the checkpoint in the program, the checkpoint must be set again every time the program is changed. There is a problem that the burden on the designer increases. Also, in the method of setting checkpoints at fixed intervals, the system designer does not need to be aware of checkpoints, but the internal state is transferred regardless of whether there is a change in the internal state of the main system, There was a problem that it was not efficient.

Thus, there has been a long-felt need for a method of setting an efficient checkpoint in a standby redundant multiplex processing system. Therefore, an object of the present invention is to provide a standby redundant multiplexing processing system that can reduce the load on the system due to the operation of maintaining the same internal state by efficiently taking checkpoints. .

[0008]

According to the present invention, in order to solve the above-mentioned problems, when a program module to which an execution right is given among multiplexed program modules fails, the program module is executed by another program module. In a standby redundant multiplexing processing system that gives execution rights and continues execution, a checkpoint cycle storage unit that stores a checkpoint cycle described as a temporal value, and the execution right is given according to the checkpoint cycle. Internal state monitoring means for determining whether or not the internal state of the program module has been changed, and the program module to which the execution right has been given and the other program module based on one determination result by the internal state monitoring means. Identity maintaining means for maintaining the identity of the internal state between
Based on another determination result by the internal state monitoring means,
A standby redundancy type multiplex processing system comprising: a checkpoint cycle changing means for changing a checkpoint cycle stored in the checkpoint cycle storage means.

Further, the present invention provides a standby redundant type multiplex that gives an execution right to another program module and continues execution when a program module to which an execution right is given among the multiplexed program modules fails. Checkpoint cycle storage means for storing a checkpoint cycle described as a temporal value, a checkpoint cycle change means for changing the checkpoint cycle stored in this means, An internal state monitoring means for determining whether or not the internal state of the program module to which the execution right has been given has been changed; and an internal state between the program module to which the execution right has been given and the other program module. The identity holding means for maintaining identity and the internal state monitoring means; When it is determined that the internal state has not been changed, the first activation unit that activates the checkpoint cycle changing unit, and when it is determined that the internal state has been changed by the internal state monitoring unit, A standby redundant multiplex processing system comprising: a second activation unit that activates the identity maintaining unit.

Further, the present invention is also configured from the viewpoint that one of the program module to which the execution right is given, ie, the main program module, or another program module, ie, the standby program module, manages the checkpoint cycle. Is done.

That is, according to the present invention, when a program module to which an execution right is given among the multiplexed program modules fails, the standby redundancy type multiplex that gives execution rights to other program modules and continues execution. In the conversion processing system, the program module to which the execution right is given includes a checkpoint cycle storage means for storing a checkpoint cycle described as a temporal value, and a check for changing the checkpoint cycle stored in the means. Point cycle changing means, sending means for sending its own internal state to the another program module, and determining whether or not the internal state of the program module to which the execution right has been given has been changed according to the checkpoint cycle. Internal state monitoring means, and an internal First activation means for activating the checkpoint cycle changing means when it is determined that the state has not been changed, and activating the sending means when it is determined that the internal state has been changed by this means. Second
The other program module comprises: an internal state storage unit for storing an internal state; and an internal unit for changing an internal state stored in the internal state storage unit in accordance with the internal state sent by the sending unit. This is a standby redundant multiplex processing system including a state changing unit.

Further, the present invention provides a standby redundant type multiplex that gives an execution right to another program module and continues execution when a program module to which an execution right is given among the multiplexed program modules fails. An internal state monitoring means for determining whether or not an internal state of the program module given the execution right is changed in response to an inquiry request from the another program module; and Sending means for sending a result of the determination to the other program module, wherein the other program module includes a checkpoint cycle storing means for storing a checkpoint cycle described as a temporal value, and Checkpoint cycle changing means for changing the stored checkpoint cycle; An internal state storage means for storing the internal state; an internal state change means for changing the internal state stored in the means; and a request for an internal state change status inquiry request to the internal state monitoring means in accordance with the checkpoint cycle. A first initiating means for activating the checkpoint cycle changing means when the judgment result from the sending means does not include the internal state, and a case in which the judgment result from the sending means includes the internal state. And a second activation means for activating the internal state changing means to change the internal state stored in the internal state storage means to the transmitted internal state. .

On the other hand, the present invention is also configured from the viewpoint of a method of changing a checkpoint cycle used in a standby redundant type multiprocessing system. In other words, the present invention provides a standby redundant multiplex processing system that, when a program module to which execution right is given among multiplexed program modules fails, gives execution rights to other program modules and continues execution. Determining whether or not the internal state of the program module to which the execution right has been given has been changed in accordance with the checkpoint cycle; and the execution right has been given by this step. If it is determined that the internal state of the program module has changed,
Transmitting the internal state of the program module to which the execution right has been given to the another program module, and changing the internal state of the other program module according to the internal state transmitted by this step; Changing the checkpoint period when the internal state of the program module to which the execution right has been granted is not changed by the determining step. This is how to change the point cycle.

Further, according to the present invention, when a program module to which the execution right is given among the multiplexed program modules fails, the standby redundancy type multiplex that gives execution rights to other program modules and continues execution. In the method of changing the checkpoint cycle used in the conversion processing system, the internal state of the program module to which the execution right is assigned is changed from the another program module to the program module to which the execution right is assigned according to the checkpoint. Transmitting an inquiry request for inquiring whether or not the program module to which the execution right has been given has been changed according to the inquiry request transmitted from the another program module. And this step Returning the determined determination result to the other program module; and changing the checkpoint cycle when the returned determination result does not include the internal state of the program module to which the execution right is assigned. And if the determination result returned in the response step includes the internal state of the program module to which the execution right has been given, the other program module is executed according to the internal state included in the determination result. This is a method of changing the checkpoint cycle used in the standby redundant multiplex processing system, which comprises the step of changing the internal state.

[0015]

According to the present invention, the following effects are obtained.
That is, it monitors whether or not the internal state has changed according to the checkpoint cycle, and when it is determined that the internal state has changed, guarantees the identity of the internal state with other program modules, and If it is determined that the internal state has not been changed, the checkpoint cycle is changed, so that the internal state can be monitored with an efficient checkpoint cycle. This makes it possible to reduce the load on the computer system involved in processing for maintaining the same internal state.

More specifically, it is monitored whether or not the internal state has been changed in accordance with the checkpoint cycle. When it is determined that the internal state has been changed, the identity of the internal state with another program module is determined. And the checkpoint cycle is changed to a value shorter than the current checkpoint cycle, so that it is possible to avoid a situation where the checkpoint cycle continues to be long.

On the other hand, when it is determined that the internal state has not been changed, the checkpoint cycle is changed to a value longer than the current checkpoint cycle. Therefore, the frequency of processing for maintaining the same internal state is reduced. Becomes possible.

This makes it possible to reduce the load on the computer system involved in processing for maintaining the same internal state. If it is determined that the internal state has been changed in the program module to which the execution right has been given, the internal state is sent from the program module to which the execution right has been given to another program module, and the other program module is sent to the other program module. The internal state is changed according to the internal state sent by the side to ensure the identity of the internal state.

At this time, when it is determined that the internal state has been changed, the identity of the internal state is maintained, and the checkpoint cycle changing means changes the checkpoint cycle to be shorter. It is possible to avoid a situation where the length becomes too long.

If it is determined that the internal state has not been changed, the checkpoint cycle is changed to be longer on the program module to which the execution right has been given, so that a process for maintaining the same internal state is performed. It is possible to reduce the frequency of performing.

This makes it possible to reduce the load on the computer system involved in processing for maintaining the same internal state. On the other hand, in response to an inquiry request from another program module to which the execution right has not been given, the program module to which the execution right has been given determines whether or not the internal state has been changed, and returns the determination result to the other program module. I do. On the other program module side, when the sent determination result includes the internal state, the internal state is changed to guarantee the internal state.

At this time, the checkpoint cycle changing means changes the checkpoint cycle so as to shorten the checkpoint cycle while maintaining the same internal state, so that it is possible to avoid a situation where the checkpoint cycle becomes too long. Become.

If the transmitted judgment result does not include the internal state, the checkpoint period changing means changes the checkpoint period so as to be longer. It is possible to reduce the frequency of performing.

Further, since the management of the checkpoint cycle is performed by another program module to which the execution right has not been given, the interruption of the original processing performed by the program module to which the execution right has been given is reduced. This makes it possible to reduce the load on the computer system involved in processing for maintaining the same internal state.

[0025]

An embodiment of the present invention will be described below with reference to the drawings. (First Embodiment) FIG. 1 is a diagram showing a schematic configuration of a standby redundant multiplex processing system according to the present invention. In this embodiment, the execution unit of the computer processing system is a program module. Referring to FIG.
a, 1b, 1c are registered program modules,
Interpret and execute the program module. In addition, the processing devices 1a, 1b, 1c include the message exchange devices 2a,
They are interconnected by a communication path 3 via 2b and 2c. The message exchange devices 2a, 2b, 2c are for controlling communication between program modules.

FIG. 2B is a diagram showing an example of the configuration of the processing apparatus 1. As shown in FIG. The processing apparatus 1 has a CPU (Cent
ral Processing Unit) 101, ROM (Read Only Me)
mory) 102, RAM (Random Access Memory) 103
And an I / O device (Input / Output unit), which are connected by a system bus 105.

In the present invention, the individual program modules are multiplexed and distributed to other main processing units for reasons such as improving reliability. FIG. 2 is a diagram for explaining the concept of a multiplexed program module.

Referring to FIG.
Are registered in the processing apparatuses 1a, 1b, and 1c, respectively. Here, for the program module A, the multiplexed program modules are denoted by A1, A, respectively.
2, A3. In addition, each of the main processing apparatuses 1a, 1
b, 1c,... registered in the program module A1,
Of A2 and A3, only the program module A1 is
The program modules to which the execution right has been given, and the remaining program modules A2 and A3 are the program modules to which the execution right has not been given. In other words, the program module A1 is a main system that operates in the normal state, and the remaining program modules A2 and A3 do not perform actual processing in the normal state, and only one of the two program modules A1 and A3 fails when the program module A1 fails for some reason. One is a standby system that is waiting to become a new main system. Thus, when there are two or more standby systems, one of the standby systems switches to the main system when the main system fails.

Similarly, the program module B is stored in the processing devices 1a and 1b, respectively.
1 and B2, the program module B1 of the processing apparatus 1b is a main system, and the program module B2 of the processing apparatus 1a is a standby system. Similarly, the program module C includes the processing devices 1a, 1b, and 1
c and program modules C1, C2 and C3, respectively.
The program module C1 of the main processing apparatus 1c is a main system, and the program modules C3 and C2 of the remaining main processing apparatuses 1a and 1b are a standby system.

As described above, a certain program module is multiplexed into the active execution unit group which is the main system and the standby execution unit group which is the standby system, and the main system normally executes the processing. In the event of a failure, a system in which the remaining standby system switches to the main system and continues processing is called a standby redundant multiplex processing system.

In such a standby redundant type multiplex processing system, it is necessary to maintain the same internal state between the main system and the corresponding standby system, and a mechanism for this is required.
For this reason, the standby redundant multiplexing processing system adopts a method of providing a point in time when a certain program module determines whether or not to transfer its internal state. In this embodiment, this “certain point” is referred to as a checkpoint, and the interval from one checkpoint to the next checkpoint is referred to as a checkpoint cycle.

There are two types of methods for maintaining the same internal state between the main system and the standby system. One is a method (main system initiative) of transferring the internal state of the main system to the corresponding standby system according to the checkpoint managed on the main system side. The other is a method in which a transfer request is sent from the standby system to a corresponding main system according to a check point managed by the standby system, and the internal state of the main system is transferred to the standby system in accordance with the transfer request (standby system initiative). is there.

FIG. 3 is a diagram for explaining the concept of such checkpoint management. FIG. 7A shows the execution of a program module in the case of the initiative of the main system, and FIG.

That is, as shown in FIG. 3A, at the check points Pn-1, Pn,... Managed on the main system side, the main system judges whether or not the internal state has been changed, and changes the internal state. If it is determined that there has been an error, the internal state is transferred to the standby system. That is, FIG. 7A shows that the internal state I has been transferred from the main system to the standby system because the internal state determined at the check point Pn has changed.

On the other hand, at the check points P _n−1 , P _n ,... Managed by the standby system, the standby system requests the main system to transfer the internal state, as shown in FIG. The system receives this and determines whether the internal state has been changed,
The result of the determination is transmitted to the standby system. Then, when the transmission result includes the internal state, the standby system updates the transmitted internal state. That is, in FIG. 6B, the main system determines the determination result D according to the request signal R from the standby system indicated by a broken line.
Is being transferred. In this case, the main system may uniformly transmit the internal state, and the standby system may determine whether or not the transmitted internal state has been changed.

Next, a checkpoint setting mechanism of the redundant standby type multiprocessing system according to the present invention will be described with reference to FIG. FIG. 4 is a diagram for explaining a checkpoint setting mechanism according to the present invention. In this embodiment, a checkpoint setting mechanism is provided in a main program module.

In FIG. 1, an operating system 4 controls the execution of program modules, communication between the main processing units 1, and the like. The execution processing unit 5 is a part that executes processing unique to the program module under the control of the operating system 4 when the target program module is registered.

The checkpoint cycle setting section 6 includes a checkpoint cycle storage section 6a, a checkpoint cycle change section 6b, and a checkpoint timing determination section 6c. The check point cycle storage unit 6a stores a check point cycle described as a temporal value (for example, 10 [ms]). The checkpoint cycle changing unit 6b initializes or changes the checkpoint cycle stored in the checkpoint cycle storage unit 6a. The checkpoint timing determination unit 6c determines whether or not the elapsed time counted by the built-in clock mechanism has reached the checkpoint cycle stored in the checkpoint cycle storage unit 6a.
The internal state monitoring unit 7 described later is activated.

The checkpoint cycle setting unit 6 is started by the operating system 4 at least before the execution processing unit 5 of the program module is started by the operating system 4. In this embodiment, when it is instructed that the target program module is registered as the main system, the operating system 4 activates the checkpoint cycle setting unit 6 after the registration of the program module.

The internal state monitoring unit 7 includes an internal state determination unit 7
a, a first starting unit 7b and a second starting unit 7c. The internal state determination unit 7a monitors whether or not the internal state of the program module in the execution processing unit 5 has changed.
Specifically, the internal state monitoring unit 7 determines the operating system 4 when the checkpoint timing determination unit 6c determines that the checkpoint cycle has been reached.
Launched via Then, the execution processing unit 5 determines whether or not the internal state has changed between the previous checkpoint and the current checkpoint. That is, when the time measured by the checkpoint timing determination unit 6c reaches the checkpoint cycle, the internal state determination unit 7a controls the checkpoint timing determination unit 6c under the control of the operating system 4.
Invoked by Then, the internal state determination unit 7a
Determines whether the internal state of the main program module has changed between the previous checkpoint and the current checkpoint. The determination as to whether or not the internal state has been changed is performed, for example, by referring to whether or not the data area of the internal state management table 8 has been accessed. This will be described with reference to FIG. As shown in FIG. 3A, the internal state management table 8 has three fields, namely, an access bit field 5
1, a data area start address field 52 and a data area size field 53. As shown in FIG. 3B, the data area start address field 52 holds the start address of the data area indicated by the data area size field 53, and the access bit field 51 stores the data area. When the data area specified by the first address field is accessed, the bit is rewritten to "1". The access bit field 51 is reset to “0” after the internal state monitoring unit 7 determines that the internal state has been changed.

The determination of the presence or absence of a change in the internal state is not limited to the above-described embodiment, and a method of referring to whether or not the execution processing unit 5 has been activated since the previous checkpoint cycle is also described in the present invention. Included in the abstract.

When the internal state determining unit 7a determines that there is no change in the internal state of the program module at the check point, the internal state determining unit 7a notifies the first activation unit 7b to that effect. Then, the first activation unit 7b notifies the check point cycle changing unit 6b of the fact in order to lengthen the check point cycle currently held in the check point cycle storage unit 6a. Checkpoint cycle change unit 6b
Then, upon receiving a notification that the checkpoint cycle is lengthened, the checkpoint cycle currently stored in the checkpoint cycle storage unit 6a is changed by a predetermined method,
Re-hold. As a method of changing the check point cycle, for example, there is a method of increasing the length by a certain ratio with respect to the currently set timing, or a method of increasing the check point period by a predetermined constant value.

In this embodiment, when the internal state determination unit 7a determines that the internal state of the program module has changed at the current checkpoint, the internal state determination unit 7a starts the first startup. It notifies both the unit 7b and the second activation unit 7c. Then, the first activation unit 7
b notifies the checkpoint cycle setting unit 6 to reset the checkpoint cycle to the initial value, while the second activation unit activates the internal state identity holding unit 9.

The started internal state identity holding unit 9 rewrites the internal state of the standby program module to the contents of the internal state of the main program module. That is, the internal state identity holding unit 9 updates the data area of the internal state management table 8 'according to the contents of the internal state management table 8 of the main program module and updates the register information.

Note that the internal state refers to each of the register information and the data area managed by the internal state management table 8 in the execution suspended state of the execution processing unit 5.

Thus, the internal states of the main program module and the standby program module can be made the same. Since the data area address used by the program module is known in the memory management table 8, it can be easily retrieved. Further, since the register information of the execution processing unit 5 is grasped by the operating system 4 or the like, it can be easily extracted and updated by using a system function prepared in the operating system 4 or the like.

In FIG. 4, the main program module and the standby program module are controlled by the same operating system 4, but there is no particular need to stick to this.

Next, the internal state identity holding unit of the standby redundant multiplex processing system according to the present embodiment will be described in more detail. FIG. 6 is a diagram showing a configuration of a standby redundant fire processing system according to the present invention. The configuration other than the internal state identity holding unit is the same as that of FIG.

The internal state transmitting section 10 is provided with an internal state monitoring section 7.
If we receive a notification from us that the internal state has changed,
It is started by the operating system 4 and transmits the internal state of the program module to the internal state receiving unit 11 of the corresponding standby program module via the message exchange device 2 and the communication path 3. The communication in the internal state can be realized by using a communication function between program modules supported by the operating system 4, for example, a message communication. However, there is no need to particularly stick to this, and the communication is provided independently of the operating system 4. It does not matter. The internal state receiving unit 11 of the standby system program module that has received the internal state updates the data area of the memory management table 8 ′ according to the received content and updates the register information.

Thus, the internal state between the main program module and the standby program module can be made the same. The standby redundant multiplex processing system according to the present invention configured as described above operates as follows.

FIG. 7 is a diagram for explaining the processing operation of the standby redundant multiplex processing system according to the present embodiment. More specifically, FIG. 7A is a diagram for explaining the processing operation of the main system program module, and FIG.
FIG. 8 is a diagram for explaining the processing operation of the standby program module.

After the registration of the program module by the operating system 4, the started checkpoint cycle setting unit 6 holds the preset initial value as the checkpoint cycle (S71a). That is, for example,
The initial value is 10 [ms]. The checkpoint cycle setting unit 6 determines whether or not the program module is being executed.
The internal state monitoring unit 7 is activated in accordance with the held check point cycle (S72a). The started internal state monitoring unit 7 checks whether the internal state of the program module has been changed (S73a). In this embodiment,
The internal state monitoring unit 7 performs this by referring to the presence or absence of a change in the access bit in the internal state management table 8 (S74a).

When the internal state monitoring unit 7 determines that the internal state has been changed, that is, when the value of the access bit field is 1, the internal state transmitting unit 10 is started, and the internal state of the program module is changed. Is transmitted to the internal state receiving unit 10 of the corresponding standby program module (S65a). On the other hand, the standby system program module changes its own internal state according to the content of the received internal state of the program module after the reception by the internal state receiving unit 11 (S61b) (S62b). After the transmission of the internal state, the main system program module returns to S61a, sets the checkpoint cycle to the initial value, holds it again, and repeats the above processing.

On the other hand, if the internal state monitoring unit 7 determines that the internal state has not been changed, that is, if the value of the access bit field remains 0, the currently held checkpoint period is set to the upper limit value. Is determined (S66a). If the checkpoint cycle does not exceed the upper limit value, the checkpoint cycle setting unit 6 is notified to increase the checkpoint cycle currently held (S67a).
In the present embodiment, the held check point cycle is increased by a fixed rate. For example, the currently held checkpoint cycle is 10 [ms].
In the case of, the value is re-held as 12 [ms], which is an additional 20%. After the check point cycle is updated by the check point cycle setting unit 6, the process returns to S62a,
The above process is repeated. If the current checkpoint cycle exceeds the upper limit, the process returns to S62a without changing the checkpoint cycle, and the above processing is repeated.

In the above-described operation processing, for example, regarding the program module A, the main module A1 sets a checkpoint cycle, and determines whether or not the internal state of A1 has changed at the checkpoint. If it has been changed, it notifies the standby program modules A2 and A3 of its own internal state. A2 and A3 change their own internal states according to the received internal state.

As described above, according to the present invention, when the execution processing unit 5 of the program module is not executing a process or when there is no change in its internal state, the checkpoint cycle becomes longer, and It is possible to reduce the frequency of performing processing for maintaining the same internal state with the standby system. Therefore, the processing time of the computer system is improved as a result of an increase in the CPU allocation time to other program modules registered in the same processing apparatus.

After the checkpoint cycle is lengthened based on the stop of the operation of the execution processing unit 5, the execution processing unit 5
When the operation is restarted and it is determined that the internal state has changed in the checkpoint cycle, the checkpoint cycle is returned to the initial value, so the standby program module when the main program module fails The transfer time of the process to the server does not become too long.

When the process is restarted after the operation of the execution processing unit 5 has been stopped for a very long time, the checkpoint cycle may be correspondingly longer. Therefore, if a failure occurs before the next checkpoint, the processing takeover time of the standby system program module becomes long. Therefore, in a system in which it is necessary to avoid such a situation, it is possible to set a maximum value of the checkpoint cycle in advance and prevent the checkpoint cycle from being longer than the maximum value. . (Modifications) The following various modifications are conceivable for the present invention.

First, an embodiment will be described in which the checkpoint cycle is shortened when it is determined that the internal state has changed, and the checkpoint cycle is returned to the initial value when it is determined that there is no change. I do.

FIG. 8 is a diagram for explaining the processing operation of the standby redundant multiplex processing system according to the first modification of the present embodiment. In this figure, the steps up to the step of determining whether or not there is a change (S81 to S83) are the same as in the above-described embodiment. Then, in step S84, when the internal state monitoring unit 7 determines that the internal state has been changed,
That is, when the value of the access bit field is 1, the internal state transmitting unit 10 is started, and the internal state of the program module is transmitted to the internal state receiving unit 11 of the corresponding standby program module (S85). On the other hand, the standby program module changes its own internal state according to the content of the internal state of the program module after the reception by the internal state receiving unit 11. This standby system program module is the same as in the above-described embodiment. Then, in the main program module, after the transmission of the internal state is completed, the internal state monitoring unit 7 determines whether or not the currently held check point cycle exceeds the lower limit (S86). If the checkpoint cycle exceeds the lower limit, the internal state monitoring unit 7
Notifies the checkpoint cycle currently held in the checkpoint cycle setting unit 6 to shorten the checkpoint cycle (S87). In the present embodiment, the held check point cycle is reduced by a fixed rate. For example, if the currently held check point cycle is 10 ms, the check point cycle is reduced by 20% and held again as 8 ms. After the update of the check point cycle, the process returns to S82 and the above processing is repeated.

Conversely, if the internal state monitoring unit 7 determines that there is no change in the access bit, it means that there is no change in the internal state. After setting the point cycle to the initial value, the above processing is repeated. If the currently held check point cycle exceeds the upper limit, the process returns to S82 without changing the check point cycle, and the above processing is repeated.

As described above, according to the present invention, when the execution processing unit 5 of the program module is executing a process, the checkpoint cycle is shortened, and the main system and the standby system have the same internal state. Can be performed more frequently. Therefore, the processing takeover time at the time of the main system failure is shortened, and the processing interruption time at the time of the main system failure is shortened.

After the checkpoint cycle is shortened based on the continuation of the operation of the execution processing unit 5, the execution processing unit 5
If the operation stops and it is determined that the internal state has not changed in the checkpoint cycle, the checkpoint cycle is returned to the initial value, so the main system does not process and the internal state is updated Although not performed, it is possible to prevent processing at checkpoints in a short cycle.

When the operation of the execution processing unit 5 continues for a very long time, the checkpoint cycle is correspondingly shortened, so that the original processing may not be performed sufficiently. . Therefore, in a system in which such a situation must be avoided, the minimum value of the checkpoint cycle is set in advance, and it can be avoided by preventing the checkpoint cycle from becoming shorter than the minimum value. .

Next, a second modification will be described. FIG. 9 is a diagram for explaining the processing operation of the standby redundant type multi-processing system according to the second modification of the present embodiment. In the figure, the step of determining whether or not there is a change (S91 to S91)
The steps up to 93) are the same as in the above-described embodiment. And
In step 94, when the internal state monitoring unit 7 determines that the internal state has been changed, that is, when the value of the access bit field is 1, the internal state transmitting unit 1
0 and activates the internal state of the corresponding program module to the internal state receiving unit 11 of the corresponding standby program module.
(S95). On the other hand, the standby program module changes its own internal state according to the content of the internal state of the program module after the reception by the internal state receiving unit 11. This standby system program module is the same as in the above-described embodiment. In the main program module, after the transmission of the internal state is completed, the internal state monitoring unit 7 determines whether or not the currently held checkpoint cycle exceeds the lower limit (S96). If the checkpoint cycle does not exceed the lower limit, the internal state monitoring unit 7 notifies the checkpoint cycle setting unit 6 to shorten the currently held checkpoint cycle (S96). . In the present embodiment, the held check point cycle is reduced by a fixed rate. For example, when the currently held check point cycle is 10 [ms], the check point cycle is reduced to 20 [ms] and held again as 8 [ms]. After the check point cycle is updated by the check point cycle setting unit 6, the process returns to S82 and the above processing is repeated.

Conversely, if the internal state monitoring unit 7 determines that there is no change in the access bit, it means that there has been no change in the internal state, so that the current checkpoint period exceeds the upper limit value. It is determined whether it is (S98).
If the checkpoint cycle does not exceed the upper limit, the internal state monitoring unit 7 notifies the checkpoint cycle setting unit 6 to lengthen the checkpoint cycle currently held (S99). . In the present embodiment, the held check point cycle is increased by a fixed rate. For example, if the currently held check point cycle is 10 [ms], the check point cycle is re-held as 12 [ms], which is an additional 20%. After the check point cycle is updated by the check point cycle setting unit 6, the process returns to S92 and the above processing is repeated. If the current checkpoint cycle exceeds the upper limit, the process returns to S92 without changing the checkpoint cycle, and the above processing is repeated.

As described above, according to the present invention, when the execution processing unit 5 of the program module is not executing the processing, the checkpoint cycle becomes longer, and the internal state is identical between the main system and the standby system. Can be reduced. Also, when there is a change in the internal state, the checkpoint cycle is shortened, and the processing takeover time of the standby system when the main system program module fails is shortened. Therefore, since the checkpoint cycle varies according to the activation state of the processing of the program module, the optimal checkpoint cycle can be set.

In addition to the above-described embodiment, the following manner can be applied to the method of changing the check point cycle. (a) A checkpoint cycle changeable range is set in advance based on the minimum value and the maximum value, and the checkpoint cycle is changed only within that range. In this case, only one of the minimum value and the maximum value may be set.

(B) As a modification of the above (a), the initial value is set to the minimum value or the maximum value, and the checkpoint cycle is changed. (Second Embodiment) Next, a standby redundant multiplex processing system according to a second embodiment will be described.

FIG. 10 is a diagram showing the configuration of a standby redundant multiplex processing system according to the present invention. In this embodiment, the checkpoint setting mechanism is provided in the standby program module, and requests the corresponding main program module to transmit its internal state.

In the figure, an operating system 4 controls execution of a program module and communication between the processing apparatuses 1. The execution processing unit 5 executes a process unique to the program module under the control of the operating system 4.

In the standby program module, the checkpoint cycle setting section 6 'is composed of a checkpoint cycle storage section 6a', a checkpoint cycle change section 6b ', and a checkpoint timing determination section 6c'. The check point cycle storage unit 6a 'stores a check point cycle described as a temporal value.
The checkpoint cycle changing unit 6b 'initializes or changes the checkpoint cycle stored in the checkpoint cycle storage unit 6a'. The checkpoint timing determination unit 6c 'stores the elapsed time counted by the built-in clock mechanism in the checkpoint cycle storage unit 6.
It is determined whether or not the check point cycle stored in a ′ has been reached. If the check point cycle has been reached, an internal state monitoring unit 7 described later is activated. Checkpoint cycle setting section 6 '
Is activated by the operating system 4 when the program module is registered as the standby system, and initializes or changes the checkpoint cycle time, as in the first invention. The checkpoint cycle setting unit 6 ′, upon reaching the currently held checkpoint timing, via the message exchange device 2 and the communication path 3, the internal state monitoring unit 7 ′ of the corresponding main program module. Start This activation can be realized by using a communication mechanism between program modules supported by the operating system 4.

The internal state monitoring section 7 'of the main program module checks in the execution processing section 5 whether or not the internal state has been changed. That is, the internal state monitoring unit 7 '
Is activated by the checkpoint timing determination unit 6c 'in the standby system program module via the operating system 4 when the time measured by the checkpoint timing determination unit 6c reaches the checkpoint cycle. Then, the internal state monitoring unit 7 'determines whether or not the internal state of the main program module has been changed between the previous checkpoint and the current checkpoint. The internal state monitoring unit 7 'refers to the internal state management table 8 to determine whether the internal state has been changed. Then, after the internal state monitoring unit 7 'determines that the internal state has been changed, the internal state monitoring unit 7' activates the determination result transmitting unit and the internal state transmitting unit 12, and waits for the internal state of the program module in the corresponding standby state. This is transmitted to the determination result receiving unit 13 of the system program module.

More specifically, when the internal state monitoring unit 7 'detects a change in the internal state of the main program module at the current check point, the internal state monitoring unit 7' activates the determination result transmission unit 12. I do. The determination result transmitting unit 12 transmits the determination result including the internal state of the main program module to the corresponding determination result receiving unit 13 of the standby program module.

On the other hand, when the internal state monitoring unit 7 'determines that the internal state has not been changed, that is, when the value of the access bit field remains 0, only the determination result not including the internal state is waited. It is transmitted to the internal state receiving unit of the system program module.

In the standby program module, the determination result receiving unit 13 receives the determination result, and performs the following processing according to the determination result. That is, when the determination result includes the internal state, the determination result receiving unit 1
3 updates the internal state of the internal state area of the internal state management table 8 'according to the received determination result. vice versa,
When the determination result does not include the internal state, the determination result receiving unit 13 notifies the check point cycle setting unit 6 ′ to lengthen the check point cycle. This change of the checkpoint cycle is the same as in the first embodiment.

In FIG. 10, the main and standby system program modules are controlled by separate operating systems 4 and 4 ', but may be controlled by one operating system.

The standby redundant type multiplex processing system according to the present invention configured as described above operates as follows.
FIG. 11 and FIG. 12 are diagrams for explaining the processing operation of the standby redundant multiplex processing system according to the present embodiment. More specifically, FIG. 11 shows a processing operation in the standby program module, and FIG. 12 shows a processing operation in the main program module.

The checkpoint cycle setting unit 6 'in the standby system module, when instructed to register the module as a standby system, operates the operating system 4
It is started by That is, when instructed to register the target program module as the standby program module, the operating system 4 'activates the checkpoint cycle setting unit 6' after the registration is completed. After activation, the checkpoint cycle setting unit 6 ′ sets a predetermined initial value as a checkpoint cycle (S
111). The check point cycle is previously determined as an initial value, for example, 10 [ms], and thereafter changed according to the processing situation. When the time reaches the set checkpoint cycle (S112), the checkpoint cycle setting unit 6 'sends the message exchange device 2',
The internal state monitoring unit 7 'of the corresponding main program module is activated via the communication path 3 (S113).

The internal state monitoring section 7 'of the main program module determines whether or not the processing has been executed and the internal state has been updated since the previous checkpoint timing in the execution processing section 5 in the program module (see FIG. 4). S121).

When the internal state monitoring unit 7 'determines that the internal state has been changed (S122), it activates the determination result transmitting unit 12 and responds to the determination result including the internal state of the module. The result is transmitted to the determination result receiving unit of the standby module (S123).

Conversely, when it is determined in S122 that the internal state has not been changed, a determination result that does not include the internal state is transmitted to the internal state receiving unit 11 of the corresponding standby program module (S124). In the present embodiment, the determination is made based on whether or not the determination result includes the internal state. However, the determination result may be that the internal state itself or the internal state has not been changed.

Upon receiving the determination result from the corresponding main program module (S114), the standby program module determines whether the determination result includes an internal state (S115). Thus, the standby program module can determine whether or not the internal state has been updated in the corresponding main program module.
That is, when the determination result includes the internal state, the determination result receiving unit 13 updates the content of the internal state currently held to the content of the received internal state (S11).
6). After the update of the internal state is completed, the process returns to S111, and the checkpoint cycle is reset to the initial value in the checkpoint cycle setting unit 6 ', and the above processing is repeated.

In step 115, if the determination result does not include the internal state, the determination result receiving section 13 activates the checkpoint cycle setting section 6 '. The checkpoint cycle setting unit 6 'determines whether the current checkpoint cycle exceeds the upper limit (S117). If the checkpoint cycle does not exceed the upper limit, the determination result receiving unit 13 notifies the checkpoint cycle setting unit 6 ′ to lengthen the checkpoint cycle interval, and receives the checkpoint cycle setting. The unit 6 'resets the checkpoint cycle to be longer (S118). After setting the checkpoint cycle, S1
Returning to step 12, the above process is repeated.

When the above-described operation processing is performed on, for example, the program module A, the standby module A2
And A3 each independently determine the checkpoint timing, and request the main program module A1 to transmit the internal state. Upon receiving the internal state transmission request, A1 determines whether or not its own internal state has been changed. And if the internal state has changed,
A1 transmits the determination result including its internal state to A2 and A3. Conversely, if the internal state has not been changed, the determination result that does not include the internal state of the own device is A2.
And A3. Upon receiving the determination result, A2 and A3 determine whether the internal state is included. If the determination result includes the internal state, A2 and A3 each update their own internal states according to the received internal state. Conversely, if the determination result does not include the internal state, the checkpoint cycle currently held is lengthened.

At this time, every time A1 receives a request from A2 and A3, A1 transmits a state to the requesting program module, and A1 responds to the request transmitted by A2 and A3 at the same timing. A method of responding only once and sending the internal state to both A2 and A3 may be used.

As described above, according to the present invention, when the execution processing section of the main program module is executing the processing, the processing for setting the checkpoint cycle is not performed. Interruptions are reduced, resulting in improved processing performance.

When the execution processing section of the main module is not executing a process and its internal state has not been updated, the checkpoint cycle becomes longer, and the internal state of the main module and the standby system is changed. It is possible to reduce the frequency of performing the processing for maintaining the same. Therefore, the processing time of the computer system is improved by increasing the CPU allocation time to other program modules registered in the same processing apparatus.

Further, if the operation of the execution processing unit is restarted after the checkpoint setting cycle is lengthened based on the stop of the operation of the execution processing unit and it is determined that the internal state has changed in the checkpoint cycle. In this case, the checkpoint cycle is returned to the initial value, so that the processing takeover time of the standby system at the time of failure of the main system program module does not continue to increase.

If the operation of the execution processing unit is stopped for a very long time and the processing is restarted, the checkpoint cycle is correspondingly long, so that a failure may have occurred before the next checkpoint. In such a case, the processing takeover time of the standby system program module becomes long.
Therefore, in a target system having a problem in such a situation, it is possible to avoid the problem by setting the maximum value of the checkpoint cycle in advance and making it longer than the maximum value.

In the first or second invention described above, each unit in the main system or the standby system may operate in parallel depending on the situation. For example, the processing of the main execution processing unit and the checkpoint cycle setting unit may be operated in parallel.

However, when the internal state transmission unit is extracting the internal state for transmission of the internal state, the execution processing unit must not operate to ensure the consistency of the internal state. Also, in the standby system, the execution processing unit does not operate, but other operations can of course be performed. These controls can be realized by, for example, determining the activation target by the operating system.

In the second embodiment, as in the first embodiment, the method of changing the checkpoint cycle is as follows.
Various aspects such as the following can be taken. (a) If it is determined that the internal state has changed, the checkpoint cycle is shortened, and if it is determined that there has been no change, the checkpoint cycle is returned to the initial value.

(B) If it is determined that there has been a change in the internal state, the checkpoint cycle is shortened, and if it is determined that there has been no change, the checkpoint cycle is lengthened.

(C) A checkpoint cycle changeable range is set in advance based on the minimum value and the maximum value, and the checkpoint cycle is changed only within that range.
In this case, only one of the minimum value and the maximum value may be set. (d) As a modification of the above (c), the initial value is set to the minimum value or the maximum value, and the checkpoint cycle is changed.

[0096]

As described above, according to the present invention, an efficient checkpoint can be set according to a change in the internal state of the main system. As a result, the time during which other program modules registered in the same main processing apparatus can operate is increased, and the processing performance of the system is also improved.

[Brief description of the drawings]

FIG. 1 is a diagram showing a schematic configuration of a standby redundant multiplex processing system according to the present invention.

FIG. 2 is a diagram for explaining the concept of a multiplexed program module.

FIG. 3 is a diagram for explaining the concept of a checkpoint cycle.

FIG. 4 is a diagram showing a configuration of a standby redundant multiplex processing system according to the first embodiment;

FIG. 5 is a diagram showing an example of an internal state management table.

FIG. 6 is a diagram showing details of the configuration of a standby redundant multiplex processing system shown in FIG. 4;

FIG. 7 is a diagram for explaining a processing operation of the standby redundant multiplex processing system shown in FIG. 4 or FIG. 6;

FIG. 8 is a diagram for explaining another modified example of the processing operation.

FIG. 9 is a diagram for explaining another modified example of the processing operation.

FIG. 10 is a diagram showing a configuration of a standby redundant multiplex processing system according to a second embodiment.

FIG. 11 is a view for explaining the processing operation of the standby redundant multiplex processing system shown in FIG. 10;

FIG. 12 is a view for explaining the processing operation of the standby redundant multiplex processing system shown in FIG. 10;

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... This processing apparatus 2 ... Message exchange apparatus 3 ... Communication path 4 ... Operating system 5 ... Execution processing part 6 ... Checkpoint cycle setting part 6a ... Checkpoint cycle storage part 6b ... Checkpoint cycle change part 6c ... Checkpoint timing determination Unit 7: Internal state monitoring unit 8: Internal state management table 9: Identity holding unit 10: Internal state transmitting unit 11: Internal state receiving unit 12: Determination result transmitting unit 13: Determination result transmitting unit

──────────────────────────────────────────────────続 き Continued on the front page (58) Field surveyed (Int.Cl. ⁷ , DB name) G06F 11/14-11/20 G06F 11/30 G06F 15/16-15/177

Claims (29)

(57) [Claims] 1. A standby redundant multiplexing processing system in which, when a program module to which an execution right is given among multiplexed program modules fails, another program module is given an execution right to continue execution. A checkpoint cycle storage unit that stores a checkpoint cycle described as a temporal value; and an internal unit that determines whether an internal state of the program module to which the execution right has been given has been changed according to the checkpoint cycle. State monitoring means, based on one determination result by the internal state monitoring means,
Based on another determination result by the internal state monitoring unit, and an identity holding unit that holds the identity of an internal state between the program module to which the execution right is given and the other program module;
And a checkpoint cycle changing means for changing a checkpoint cycle stored in the checkpoint cycle storage means. 2. A standby redundant type multiplex processing system in which, when a program module to which an execution right is given among the multiplexed program modules fails, another program module is given an execution right to continue execution. Checkpoint cycle storage means for storing a checkpoint cycle described as a temporal value; checkpoint cycle change means for changing the checkpoint cycle stored in the means; and the execution right according to the checkpoint cycle. Internal state monitoring means for determining whether the internal state of the given program module has been changed, and maintaining the same internal state between the program module to which the execution right has been given and the other program module Identity maintaining means, and an internal state by the internal state monitoring means. First activation means for activating the checkpoint cycle changing means when it is determined that the internal state has not been changed; and maintaining the identity when the internal state monitoring means determines that the internal state has been changed. Second activated means
Standby standby multiplex processing system, comprising: 3. The standby redundancy type multiplex processing system according to claim 2, wherein said second activation means activates said checkpoint cycle changing means together. 4. The apparatus according to claim 1, wherein said second activating means activates said checkpoint cycle changing means so as to change a current checkpoint cycle stored in said checkpoint cycle storage means to an initial value. Claim 2
The standby redundant multiplex processing system according to the above. 5. The first activating means activates the checkpoint cycle changing means so as to be longer than a current checkpoint cycle stored in the checkpoint cycle storage means, 3. The standby according to claim 2, wherein the activation unit activates the checkpoint period changing unit so as to initialize a current checkpoint period stored in the checkpoint period storage unit to an initial value. Redundant multiplex processing system. 6. The first activation unit activates the checkpoint period changing unit to initialize a current checkpoint period stored in the checkpoint period storage unit to an initial value. 3. The standby according to claim 2, wherein the second activating means activates the checkpoint cycle changing means so as to be shorter than a current checkpoint cycle stored in the checkpoint cycle storing means. Redundant multiplex processing system. 7. The first activating means activates the checkpoint cycle changing means so as to be longer than a current checkpoint cycle stored in the checkpoint cycle storage means, 3. The standby redundant type multiplexing device according to claim 2, wherein said activation means activates said checkpoint cycle changing means so as to be shorter than a current checkpoint cycle stored in said checkpoint cycle storage means. Processing system. 8. The checkpoint cycle changing means holds a changeable range of the checkpoint cycle represented by at least one limit value, and changes the checkpoint cycle within the changeable area. Claim 3
8. A standby redundant multiplex processing system according to any one of claims 7 to 7. 9. The standby redundant multiplex processing system according to claim 8, wherein said checkpoint cycle storage means holds one limit value of said changeable range as an initial value of said checkpoint cycle. . 10. The identity maintaining means copies at least a changed part of the internal state of the program module to which the execution right is given to a corresponding part of the internal state of the another program module. 3. The standby redundant multiplex processing system according to claim 1, wherein the same is maintained. 11. A standby redundant type multiplex processing system in which, when a program module to which an execution right is given out of a multiplexed program module fails, another program module is given an execution right to continue execution. The program module to which the execution right has been given includes: a checkpoint cycle storage means for storing a checkpoint cycle described as a temporal value; and a checkpoint cycle changing means for changing the checkpoint cycle stored in the means. Sending means for sending its own internal state to the other program module; and internal state monitoring means for determining whether or not the internal state of the program module to which the execution right has been given has been changed according to the checkpoint cycle. The internal state is changed by the internal state monitoring means. First activation means for activating the checkpoint cycle changing means when it is determined that there is no change, and second activation means for activating the sending means when it is determined that the internal state has been changed by this means. The other program module comprises: an internal state storage unit that stores an internal state; and an internal state change unit that changes an internal state stored in the internal state storage unit according to the internal state sent by the sending unit. And a standby redundant multiplex processing system comprising: 12. A standby redundant type multiplex processing system in which, when a program module to which an execution right is given among the multiplexed program modules fails, another program module is given an execution right to continue execution. The program module to which the execution right has been given includes: an internal state monitoring unit that determines whether or not its own internal state has been changed in response to an inquiry request from the another program module; Sending means for sending to the other program module, the other program module comprising: a checkpoint cycle storing means for storing a checkpoint cycle described as a temporal value; and a check stored in the means. Checkpoint cycle changing means for changing the point cycle Internal state storage means for storing; internal state change means for changing the internal state stored in the means; and inquiry means for sending an internal state change status inquiry request to the internal state monitoring means in accordance with the checkpoint cycle. And a first step of activating the checkpoint cycle changing means when the judgment result from the sending means does not include the internal state.
Starting means, and when the determination result from the sending means includes an internal state,
Standby multiplexing processing, comprising: a second activation unit that activates the internal state changing unit to change the internal state stored in the internal state storage unit to the transmitted internal state. system. 13. The standby redundant multiplex processing system according to claim 11, wherein said second activation means activates said checkpoint cycle changing means. 14. The second activation unit activates the checkpoint period changing unit to change a current checkpoint period stored in the checkpoint period storage unit to an initial value. The standby redundant multiplex processing system according to claim 11 or 12, wherein 15. The first activating means activates the checkpoint cycle changing means so as to be longer than a current checkpoint cycle stored in the checkpoint cycle storage means, 13. The activation unit according to claim 11, wherein the activation unit activates the checkpoint period changing unit so as to initialize a current checkpoint period stored in the checkpoint period storage unit to an initial value.
The standby redundant multiplex processing system according to the above. 16. The first activating means activates the checkpoint cycle changing means so as to initialize a current checkpoint cycle stored in the checkpoint cycle storage means to an initial value. 13. The apparatus according to claim 11, wherein the second activation unit activates the checkpoint cycle changing unit so as to be shorter than a current checkpoint cycle stored in the checkpoint cycle storage unit. Standby redundant multiplex processing system. 17. The first activating means activates the checkpoint cycle changing means so as to be longer than a current checkpoint cycle stored in the checkpoint cycle storage means, 13. The standby redundancy according to claim 11, wherein the activation unit activates the checkpoint period changing unit so as to be shorter than a current checkpoint period stored in the checkpoint period storage unit. Type multiplex processing system. 18. The checkpoint cycle changing means,
18. The standby redundant multiplexing according to claim 13, wherein a changeable range of the checkpoint cycle represented by at least one limit value is held, and the checkpoint cycle is changed within the changeable area. Processing system. 19. The checkpoint cycle storage means,
2. The method according to claim 1, wherein one limit value of the changeable range is held as an initial value of the check point cycle.
9. The standby redundant multiplex processing system according to 8. 20. The standby execution unit group when a main execution unit that multiplexes the execution unit group into a main execution unit group and a standby execution unit group and executes the main execution unit group fails. Storage means for storing checkpoint timing, and initialization for initializing the checkpoint timing stored in this means, in a standby redundant multiplexing processing system that switches to a standby execution entity that executes execution processing and continues execution processing. Means for changing a checkpoint timing stored in the storage means, and changing the changed checkpoint timing as a new checkpoint timing in the storage means; and an internal state of the main execution subject. Holding means for holding the same as the internal state of the standby execution subject, and the checkpoint timing Determining means for determining whether or not the internal state of the main execution subject has been changed in accordance with the status, and executing the identity maintaining means and the initialization means when the internal state has been changed by this means. Standby redundancy multiplexing provided with a checkpoint setting mechanism, comprising: means for executing the changing means when it is determined that the internal state has not been changed by the determining means. Processing system. 21. A standby execution unit group when a main execution unit that multiplexes an execution unit group into a main execution unit group and a standby execution unit group and executes processing of the main execution unit group fails. In a standby redundant multiplexing processing system that switches to a standby execution entity that performs execution processing and continues execution processing, the main execution entity includes a storage unit that stores checkpoint timing, and a checkpoint stored in this unit. Initializing means for initializing the timing; changing means for changing the checkpoint timing stored in the storage means, and re-storing the changed checkpoint timing as a new checkpoint timing in the storage means; Transmitting means for transmitting the internal state of the main execution body to the standby execution body; Determining means for determining whether or not the internal state of the main execution subject has been changed; and means for executing the transmitting means and the initialization means when the internal state has been changed by this means. And a means for executing the change means when it is determined that the internal state has not been changed by the determination means, wherein the standby execution body stores an internal state of the standby execution body. A standby redundant multiplex processing system comprising: a state storage unit; and an updating unit that updates an internal state stored in the internal state storage unit according to the internal state transmitted by the transmission unit. 22. The standby execution unit group, wherein the execution unit group is multiplexed into a main execution unit group and a standby execution unit group, and when the main execution unit executing the main execution unit group fails, In the standby redundant multiplexing processing system that switches to the standby execution entity that executes the execution process and continues the execution process, the main execution entity determines whether or not the internal state of the main execution entity has been changed. Means, transmitting means for transmitting to the standby system execution subject that the internal state or not changed according to the determination result by this means, the standby system execution subject, storage means for storing checkpoint timing, Initialization means for initializing the checkpoint timing stored in the means; and changing the checkpoint timing stored in the storage means, Changing means for re-storing the internal timing of the standby execution subject in the storage means; and Request means for requesting the determination result to the determination means; and if the transmission content transmitted from the transmission means based on the determination means is an internal state of the main execution subject, the internal state storage means Updating means for updating the stored internal state; means for executing the initializing means; and changing means when the transmission content transmitted from the transmitting means has not been changed based on the request means. And a means for executing a standby redundant multiplex processing system. 23. A standby redundant type multiplex processing system which, when a program module to which execution right is given among the multiplexed program modules fails, gives execution right to another program module and continues execution. A method for changing the checkpoint cycle used, comprising: determining whether or not the internal state of the program module to which the execution right has been given has been changed in accordance with the checkpoint cycle; and When it is determined that the internal state of the module has been changed, transmitting the internal state of the program module to which the execution right has been given to the another program module; and, according to the internal state transmitted by this step, Internal state of the other program module Changing the checkpoint cycle when it is determined in the determining step that the internal state of the program module to which the execution right has been granted is not changed. A method of changing a checkpoint cycle used in a standby redundant multiplex processing system. 24. A standby redundant multiplex processing system which, when a program module to which execution right is given among the multiplexed program modules fails, gives execution right to another program module and continues execution. In the method of changing the checkpoint cycle used, whether the internal state of the program module to which the execution right has been given has been changed from the another program module to the program module to which the execution right has been given according to the checkpoint. Transmitting an inquiry request for inquiring; and determining whether an internal state of the program module to which the execution right has been given has been changed in accordance with the inquiry request transmitted from the another program module. Discrimination determined by A step of replying a result to the other program modules, if the answer has been determined result, does not contain the internal state of program modules that the execution right is given,
Changing the checkpoint cycle; and if the determination result returned in the response step includes the internal state of the program module to which the execution right has been given, the internal state included in the determination result Changing the internal state of the other program module according to the following method: A method of changing a checkpoint cycle used in a standby redundant multiplex processing system. 25. The method according to claim 23, wherein the internal state changing step changes the checkpoint cycle together with the checkpoint cycle used in the standby redundant multiplex processing system. 26. The checkpoint cycle used in the standby redundant multiplex processing system according to claim 23, wherein said internal state changing step changes a current checkpoint cycle in accordance with an initial value. How to change. 27. The checkpoint cycle changing step changes the checkpoint cycle to be longer than a current value, and the internal state changing step changes the current checkpoint cycle according to an initial value. The method for changing a checkpoint cycle used in the standby redundant multiplexing processing system according to claim 23 or 24, characterized in that: 28. The checkpoint cycle changing step changes a current checkpoint cycle to an initial value, and the internal state changing step also changes the checkpoint cycle so as to be shorter than a current value. The method for changing a checkpoint cycle used in the standby redundant multiplexing processing system according to claim 23 or 24, characterized in that: 29. The checkpoint cycle changing step changes the checkpoint cycle to be longer than a current value, and the internal state changing step adjusts the checkpoint cycle to be shorter than a current value. 25. The method according to claim 23, wherein the checkpoint cycle is changed.