JP3483931B2 - Program execution control method and computer - Google Patents

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a multi-processing system and a program execution control method for executing the same processing or processing having the same function in parallel on a plurality of computers, and more particularly to all computers due to a program bug. The present invention relates to a multi-processing system and a program execution control method capable of preventing down.

[0002]

2. Description of the Related Art In a system for processing fluctuating data and transmitting the processing result to a controlled system such as an industrial system such as a chemical / steel plant, a traffic control system, or a power system such as a nuclear plant, Regardless of the circumstances, it is required to always control the system safely and reliably achieve the mission given to the system. In response to such a request, a multi-processing system has been conventionally used in which a plurality of computers execute the same processing or processing having the same function in parallel. There are various types of multiprocessing systems as shown below.

(1) A method of executing the same application process group on a plurality of computers.

In a multi-processing system that allows a plurality of computers to execute the same application process group,
Even if one of the computers goes down due to some failure, the other computers can continue the processing, so that the interruption of the processing can be avoided. The multiprocessing system of this system effectively utilizes the fact that the probability of hardware failure occurring in a plurality of computers at the same time is extremely lower than the probability of hardware failure occurring in any one computer.

However, there is no guarantee that the application process program is complete. When you run an application process that contains a program bug,
A computer fails, and this failure occurs on all computers. Therefore, the processing in the system is interrupted even if the parallel and multiple processing is performed.

For example, as shown in FIG. 15A, application processes P1 to P are provided for each time slice.
If 4 is thrown, and there is no program bug,
An application process is generated and executed at the timing shown in this figure. The number of time slices indicates how many time slices have occurred, which means the passage of time. In addition, in this example, P2 is generated by P1, and P3 and P4 are generated by P2. Here, if a computer fails due to a bug in the P3 process and the computer goes down,
When it is executed by the conventional parallel multiprocessing system or one computer, all the computers go down at the time of the number of time slices 4 shown in FIG. Therefore, even if the process P4 can move normally, the process P4 cannot be executed.

In a small-sized computer or a computer used for control that emphasizes high-speed response, a protection mechanism such as an OS (operating system) that manages the movement of the computer is weak, and a failure occurs due to a program bug of an application process. Probability is high. Therefore, there is a problem that the processing of the entire system is interrupted by the program bug of some application processes even if the parallel and multiple processing is performed.

(2) A method of executing application processes in parallel according to a plurality of versions of programs having the same function on a plurality of computers.

In a multi-processing system in which a plurality of computers execute in parallel application processes based on a plurality of versions of program structures having the same function, even if one computer goes down due to some kind of failure, or Even if the subsequent processing is interrupted in order to avoid adversely affecting the outside when a contradiction occurs in the state, the processing can be continued in another computer, so that the interruption of the processing can be avoided.

The multiprocessing system of this system has the same function in addition to the probability that a hardware failure will occur in any one computer at the same time as the probability that a hardware failure will occur in a plurality of computers at the same time. Even if a program bug with an application process has a program bug and a failure occurs, there is a possibility that the program bug does not exist with another version of the program having the same function and the failure does not occur. Make good use of high points.

In the parallel processing system of this system, in order for the processing of the entire system not to be interrupted, it is a condition that at least one version of the programs of a plurality of versions having the same function does not cause a failure. A so-called safe version program that is safe and hard to cause failures often takes extra execution time. As a result, if you execute processing according to such a safe version program,
There is a problem that the processing time of the entire system becomes slow.

The main reasons for the extra execution time of the safety version program are as follows. First, it is necessary to add abnormality detection processing to prevent the occurrence of failures everywhere in the program. Second, processing is added to prevent unnecessary searches in search processing, which is a representative of time-consuming processing. As described above, various methods for shortening the processing time have been devised. In general, extra processing is required to increase the processing speed, and program bugs are likely to occur correspondingly.

(3) A method in which the entire program running in a plurality of computers is multiplexed by the N version program method.

Since program multiplexing is a method in which a program is originally duplicated and executed by a plurality of computers, if a bug is inherent in the program, even if they are multiplexed, a common bug causes the calculation to stop. It will cause some functions of the system to stop and it will be impossible to accomplish the mission given to the system.

As one method for avoiding such a situation, there is an "N version program method". This method is similar to the method of (2), but is characterized in that different designers create programs of different versions (versions) that achieve the same function in an environment where they are isolated from each other by different procedures. Is. Then, the different program groups that have the same function created in this way are executed in parallel on multiple computers, and the output result obtained by matching the majority is selected as the correct output result. To do.

In this "N version program method", a plurality of designers who are isolated from each other create a group of program modules on a plurality of boards. Therefore, as the number of program modules increases, the cost of program creation greatly increases and maintenance management is performed. This will cause a significant increase in cost. For example, if three teams independently develop the same function program by different procedures, it requires three times as many development personnel to develop a program that guarantees the same level of quality as before, and three versions are also required from the viewpoint of maintenance. The cost of program maintenance and management is inevitable. Further, when the three versions of the program are operated in parallel and the result is determined, the system performance is determined by the processing performance of the slowest processing program.

[0017]

As described above, the conventional multiprocessing system can deal with a hardware failure, but is not sufficiently effective against a program bug.

It is an object of the present invention to provide a multi-processing system and a program execution system capable of continuing the processing of the entire system by avoiding all the computers from going down even if the computer fails due to a bug in the program as well as the hardware failure. It is to provide a control method.

[0019]

In order to achieve the above object, a multiprocessing system according to a first aspect of the present invention specifies a plurality of computers divided into an antecedent system and a follower system, and a computer of the antecedent system. Means for starting the execution of the application process group and starting the execution of the specific application process group in the tracking system computer from a time point delayed by a period satisfying a predetermined condition from the execution start time point of the preceding system computer; When the preceding system computer is down, the application process that was being executed by the preceding system computer when it is down is removed from the application process group of the following system computer, and the following system computer operates as the preceding system. And a means for causing it.

Further, in such a basic configuration, when the computer of the preceding system goes down, the application process executed by the computer of the preceding system that has gone down is removed from the application process group of the computer of the following system and the following system is removed. It is characterized in that means for reconfiguring the computer configuring the above into a new preceding system and a new following system and for starting execution of the remaining application processes from the computer side of the new preceding system.

A multiprocessing system according to a second aspect of the present invention is a plurality of computers divided into an antecedent system and a follower system which hold a plurality of versions of application process programs having the same function, and the antecedent computer. Then, the specific application process group is started to execute according to the program of the specific version, and the specific application is executed by the computer of the follow-up system from the time when the execution start point of the preceding computer is delayed by a period satisfying a predetermined condition. Means for starting execution of each process group according to the program for the specific version of the application process,
When the preceding system computer is down, a means for causing the following system computer to execute the application process that was being executed by the preceding system computer when the computer is down according to a program of a version different from the specific version. The basic feature is that.

Further, in such a basic configuration, when the computer of the preceding system goes down, the application process executed by the computer of the preceding system when the computer goes down is executed according to a program of a version different from the specific version. It is characterized in that it is executed by a computer of the follow-up system and that the computer forming the follow-up system is reconfigured into a new preceding system and a new following system, and the remaining application processes are started to be executed from the computer side of the new preceding system. And

A program execution control method according to a third aspect of the present invention is a program execution control method for controlling execution of a program in at least one computer equipped with a first program and an operating system for controlling execution of these first programs. In the above, the first program is activated or called with at least the program name of the program and the program name list information of the second program having lower capability and lower potential probability of bug than the first program. Is stopped, the second program is started or called according to the program name list information.

Further, in such a basic structure, the first
When controlling the execution of a program in a computer system including a plurality of computers each having an operating system for controlling the execution of the first program and the operating system for controlling the execution of the first program, the computer is installed in one of the plurality of computers. The activated first program with at least the program name of the first program and the program name list information of the second program having lower capability and lower probability of bug than the first program. When it is confirmed that the program name of the first program is not registered in the computer by the operating system in the one computer,
The operating system inquires of another computer whether the first program exists, and when the first program exists in the other computer, the operating system in the other computer is inquired. When the start or call control of the first program is requested and the first program does not exist in the other computer,
The second program is activated or called according to the program name list information.

Further, the first program installed in one of the plurality of computers has at least the program name of the first program, a capability lower than that of the first program, and a potential bug probability. When the program is started or called with the program name list information of the lower second program and the execution is abnormally terminated in the first programs registered in the plurality of computers, the program name of the first program Is registered in all operating systems in the plurality of computers, and the operating system activates or calls the second program according to the program name list information.

It is also effective to add execution priority information to the program name list information of the second program so that the second program is activated or called according to this execution priority information.

[0027]

In order to prevent all the computers from going down due to a program bug in the application process, it is necessary for at least one computer to avoid executing the application process.

Therefore, in the multiprocessing system according to the first aspect of the present invention, a part of the computer group is divided into a preceding system and the rest is divided into a follow-up system, and the application process generated in the follow-up computer group is stored in advance. The execution is postponed until there is a notification from the computer of the system that the specified condition (for example, the end of execution) has been met, so that it is confirmed that the application process does not include a program bug that brings down the computer, and then the program is executed. On the other hand, when it is detected that the preceding computer has gone down, the following computer removes the application process that caused the down from the saved application processes.
Prevents the follow-up computer from going down. As a result, it is possible to prevent all computers from going down due to a program bug in the application process, and it is possible to continue processing.

Further, if the computer constituting the follow-up system is reconfigured into the new precedent system and the new follow-up system when the computer of the preceding system goes down, there is always a computer of both the preceding system and the following system. Then, it becomes possible to deal with the case where the preceding computer goes down.

On the other hand, for each of the application process groups, there is a possibility that a high-speed version program that has a short processing time but is likely to contain a program bug and a program bug that has a long processing time but produces a problem. If a safe version program with a small number of programs is prepared, an application process in which it is clear that the high speed version program does not include a program bug can be executed on all computers according to the high speed version program. However, an application process that is likely to contain a program bug in the high-speed version program needs to execute the application process on at least one computer in accordance with the safe version program, and avoid all computers from going down.

Therefore, in the multiprocessing system according to the second aspect of the present invention, each computer has a high-speed version program and a secure version program having the same function for the application process group, and a part of the computer group is the preceding system and the rest. Is divided into the follower system, the application that has occurred on the preceding computer starts executing according to the high-speed version of the program, and the application process that has occurred is saved on the following computer and the conditions specified by the preceding computer (for example, Execution end) The execution is postponed until it is confirmed that the program of the high-speed version of the application process does not contain the program bug that causes the failure, by suspending the execution until it is notified. When it is detected that a failure has occurred in the preceding computer, the application process that caused the failure is executed according to the safe version program among the application processes saved in the following computer. , Prevent the follow-up computer from going down.

As a result, the application process that does not include a program bug in the high-speed version of the program is the preceding system,
By executing the high-speed version of both the follow-up computer group and the high-speed version of the computer group, the high-speed version of the application process that contains a program bug is executed by the follow-up computer group according to the safe version of the program. Prevents failures from occurring in the computer group of the tracking system.

Further, once a failure has occurred in the preceding system computer group, the following system computer group is re-classified into the preceding system and the following system, so that the computers of both the preceding system and the following system are always processed. It can be made to exist, and it is possible to deal with the case where the preceding computer goes down.

In the third invention, the program group for controlling the system is not created by the "N version program method", but the program for controlling each system function is designed so as to satisfy the required function and processing performance.・ Produced, and those programs usually run in the computer. Here, since there is a bug in the program that processes a certain system function, the program may be stopped during the process, and some or all of the functions of the system may be stopped.

In order to avoid this, in the third invention, when the first program is started, the program name list information of the second program as an alternative program that substitutes the function of the first program, and further, the list. Even if the first program has stopped its execution due to an internal bug, it is indicated by this program name list information by adding the execution priority information of these alternative programs to the information and starting it. When the OS starts the alternative program, the processing of the function of the first program is continued. That is, normally, the required function processing is executed by the first program having good processing performance, but if the program becomes abnormal due to some reason and the program is stopped, the performance is inferior to that of the first program. The second program, which is an alternative program having a lower probability of having a bug, substitutes the processing to realize the continuation of the system function.

By doing so, the first program created by the optimum procedure is operated before the program is stopped to create the mission required for the system without creating and managing the multiple versions of the program. When the first program is stopped, the OS installed in the computer starts the second program, which is an alternative program, from the program name list information, so that the performance is better than that of the first program. Although inferior, the mission can be continued.

[0037]

Embodiments will be described below with reference to the drawings.

FIG. 1 is a block diagram of a multiprocessing system according to an embodiment of the present invention.

This multiprocessing system is roughly divided into
It is composed of computers 1, 2, and 3, a shared memory 4, and a bus 5 connecting the shared memory 4 and the computers 1, 2, and 3.

Each of the computers 1, 2, and 3 has an arithmetic unit 11 or 2.
1, 31 and local memories 14, 24, 34 including the executing process queues 12, 22, 32 and the execution delaying process queues 13, 23, 33, and timers 15, 25 for generating time slices and informing each arithmetic unit. , 35 and. In the case of this example, the time slice intervals of each computer are set to be the same.

The shared memory 4 includes an execution state table 41,
It has an execution end process table 42 and a failure process table 43, which are connected to all the computers by the bus 5 and are accessed by all the computers.

The multiprocessing system configured as described above operates according to the flowcharts shown in FIGS.

Next, the operation of the multiprocessing system configured as described above will be described in the case where the application processes P1 to P4 that are generated and executed at the timing shown in FIG. 15A are input.

In this multiprocessing system, it is assumed that the computer 1 is initially classified as a preceding system and the computers 2 and 3 are classified as a follow-up system. The initial states of the queues and tables are all empty and nothing is registered, and the number of time slices starts from 0. Further, in the present embodiment, the end of execution of the application process is used as the specified condition (a condition for notifying the subsequent stage that no bug is included).

First, the contents of the execution state table 41 are shown in FIG.
It shall be in the state shown in (a). It is assumed that the process P1 is input to all the computers 1, 2 and 3 in this state.

When the process P1 is input, the computer 1 confirms from the contents of the execution state table 41, that is, the contents shown in FIG. 5 (a) that the own computer is the preceding system according to the flow chart shown in FIG. S1), the generated process P1 is put in the running process queue 12 (S2).

At the same time, the computer 2 also confirms that its own computer is a follow-up system according to the flow chart shown in FIG. 2 (S1), and confirms that the occurring process P1 is not in the failed process table 43 (S3). It is confirmed that the process is not in the end process queue (S4), and the generated process P1 is put in the execution delay process queue 23 (S6). The computer 3 also puts the generated process P1 in the execution delay process queue 33, just like the computer 2. As a result, the contents of the queue of each computer are as shown in FIGS. 5 (b) and 5 (c).
Note that the other queues are still empty.

<Start of Time Slice for Number 1> Here,
When the time slice occurs, the computer 1 confirms that there is no currently executing process according to the flowchart shown in FIG. 3 (S11), increments the number of time slices of the own computer 1 in the execution state table 41 by "1". (S12), and since the own computer is the preceding system (S13), the process P1 is taken out from the executing process queue 12, is registered in the execution state table 41 as the currently executing process, and the process P1 is activated (S21). .

On the other hand, at the same time, like the computer 1, the computer 2 confirms that there is no currently executing process according to the flowchart shown in FIG. 3 (S11), and the time slice of the own computer 2 of the execution state table 41 is confirmed. The number of times is incremented by 1 to "1" (S12), and it is confirmed that the own computer is the follower system (S13). Confirm that there is no computer (at this point, the number of timeslice of computer 1 should be 0 or 1) (S1
4), it is confirmed that nothing is entered in the terminated process table 42 (S19), and nothing is entered in the executing process queue 22, so nothing is done (S21). Calculator 3
Is the same as the computer 2. As a result, the contents of the execution state table 41 and each queue are as shown in FIGS.

In the computer 1, the process P1 creates the process P2 during the time slice of the number of times 1. Then, according to the flow chart shown in FIG. 2, the computer 1 puts the generated process P2 in the executing process queue 12 as shown in FIG. 6 (d) because its own computer 1 is the preceding system (S1) (S1).
2).

<Start of Time Slice of Number of Times 2> Next, when a time slice occurs again, the computer 1 puts the currently executing process P1 in the executing process queue 12 (S11) according to the flowchart shown in FIG. State table 4
Increment the number of time slices of the local computer 1 by 1 to “2”
(S12), and since the own computer is the leading system (S13),
The process P2 is taken out from the executing process queue 12, registered as the currently executing process in the execution state table 41, and activated (S21).

At the same time, the same procedure is performed in the computers 2 and 3 as in the time slice of the number of times 1. As a result, the contents of the execution state table 41 and each queue are as shown in FIGS.

In the computer 1, the process P2 creates the processes P3 and P4 during the time slice of the number of times 2.
Then, according to the flow chart shown in FIG. 2, the computer 1 puts the generated processes P3 and P4 in the executing process queue 12 (S2) as shown in FIG. 7D because the own computer is the leading system (S1).

Further, since the process P2 is terminated, the computer 1 enters the process P2 into the execution termination process table 42 as shown in FIG. 7 (e) because the computer 1 is the preceding system according to the flow chart of FIG. 4 (S31). (S32).

<Start of Time Slice of Number of Times 3> Next, when a time slice occurs again, the computer 1 confirms that there is no currently executing process according to the flowchart shown in FIG. 3 (S11), and the execution state table 41 Incrementing the number of times of time slice of own computer 1 to “3” (S12),
Since the own computer is the preceding system (S13), P1 shown in FIG. 7 (b) is taken out from the executing process queue 12 and registered in the execution state table 41 as the currently executing process and activated (S21).

At the same time, the same procedure as in the time slice of the number of times 1 is performed in the computers 2 and 3. In step S19, it is confirmed whether P2 stored in the execution end process table 42 is stored in the execution delay process keys 23 and 33 of each computer.
Nothing is done after all, because it only contains. As a result, the contents of the execution state table 41 and each queue are as shown in FIGS.

Further, the process P1 is completed in the computer 1 during the time slice of the number of times 3. Since the computer 1 has its own computer in advance according to the flow chart shown in FIG.
1), the process P1 is put in the execution end process table 42 as shown in FIG. 8D (S32).

<Start of Time Slice of Number of Times 4> Next, when a time slice occurs again, the computer 1 confirms that there is no currently executing process according to the flowchart shown in FIG. 3 (S11), and the execution state table 41 Incrementing the number of times of time slice of own computer 1 to “4” (S12),
Since the own computer is the preceding system (S13), P3 shown in FIG. 8B is taken out from the executing process queue 12, is registered as the currently executing process in the execution state table 41, and is activated (S21).

At the same time, the computer 2 confirms that there is no process currently being executed according to the flowchart of FIG. 3 (S11), and the number of time slices of the own computer 2 in the execution state table 41 is increased by 1 to "4". Then (S12), it is confirmed that the own computer is a follow-up system (S13), and that there is no preceding computer that is delayed by more than 2 timeslice than the timeslice number "4" of its own computer. Should have 3 or 4 time slices)
(S14), the process P1 stored in the execution end process table 42 as shown in FIG.
As shown in (c), since it is in the execution delay process queue 23 of the own computer (S19), it is moved to the executing process queue 22 (S20), and the executing process queue 22 contains only P1. Since it is not present, it is taken out and registered as the currently executing process in the execution status table 41 and activated (S21).

The computer 3 is also similar to the computer 2. As a result, the contents of the execution state table 41 and each queue are as shown in FIGS.

During the time slice of 4 times, a failure occurs in the computer 1 due to a bug of the process P3,
Is down. Therefore, thereafter, the processing in the computer 1 is interrupted.

On the other hand, the process P1 being executed by the computer 2 generates the process P2, the computer 2 is the follower system according to the flow chart shown in FIG. 2 (S1), and the occurring process P2 is stored in the failed process table 43. It is confirmed that it is not present (it is still empty) (S3), it is confirmed that there is P2 in the execution end process table 42 as shown in FIG. 8D (S4), and it is stored in the executing process queue 22 of the own computer. Figure 9
Register as shown in (e) (S5). The computer 3 also performs the same operation.

<Time Slice Start of Number of Times 5> Next, when another time slice occurs, the computer 1 is already down and nothing is done.

In Computer 2, according to the flow chart shown in FIG.
Process queue 22 currently executing process P1
(S11), and the computer 2 in the execution state table 41
Increase the number of time slices by 1 to “5” (S1
2) Confirm that the own computer is a follow-up system (S13), and that there is no preceding computer that is delayed by 2 or more time slices from the time slice number "5" of the own computer (at this point, the time The number of slices is 4) (S1
4) Since the execution delay process queue 23 is also empty as shown in FIG. 9 (d) (S19), P2 in the executing process queue 22 is taken out as shown in FIG. 9 (e) and is currently executed. It is registered in the execution state table 41 as a middle process and activated (S21).

The computer 3 is the same as the computer 2. As a result, the contents of the execution state table 41 and each queue become as shown in FIGS. 10A and 10B (the execution delay process queue becomes empty).

During the time slice of the number of times 5, the process P2 running on the computers 2 and 3 creates the processes P3 and 4. Then, according to the flow chart shown in FIG. 2, the computer 2 has its own computer as a follow-up system (S1) and the generation process P3.
Since P4 is not in the failure process table 43 (S3) and is not in the execution end process table 42 (S4), P3 and P4 are put in the execution delay process queue 23 of the own computer as shown in FIG. S6). The computer 3 is also the same.

<Start of Time Slice of Number of Times 6> Next, when a time slice occurs again, the computer 2 puts the currently executing process P2 in the executing process queue 22 according to the flowchart shown in FIG. 3 (S11), and executes it. State table 4
Increment the number of time slices of the local computer 2 of 1 by "6"
(S12), the computer itself is a follower system (S13), and the computer 1 of the preceding system which is delayed by 2 or more time slices from the time slice "6" of its own computer (is still "4" at this point). (S14), the computer 1 is set to “down” in the execution status table 41, and the process P currently being executed by the computer 1 is set.
3 is the execution delay process queue 2 shown in FIG.
3 is deleted, and is further added to the failure process table 43 (S15).

Further, since the site number "2" of the own computer 2 is the smallest between the follower computers 2 and 3 (S1
6) Then, the process P4 in the execution delay process queue 23 is moved to the executing process queue 22 (S17), and the execution state table 41 is rewritten by using the own computer as the preceding system (S).
18).

Subsequently, the processes P1 and P2 in the execution end process table 43 as shown in FIG.
Is not in the execution delay process queue 23 (S1
9), retrieve P1 from the running process queue 22,
The process is registered in the execution state table 41 as the currently executing process and activated (S21).

The computer 3 also has steps S16 to S1.
The computer other than 8 is the same as the computer 2. That is, since the site number "3" of the computer 3 is not the smallest in the tracking system, steps S17 to S18 are not executed. As a result, the contents of the execution state table 41, the failure process table 43, and each queue are as shown in FIGS.
It becomes like (f).

During the time slice of the number of times 6, the process P1 being executed by the computers 2 and 3 ends. Calculator 2
In accordance with the flow chart shown in FIG. 4, since the own computer 2 is the leading system (S31), the end process P1 is executed in the end table 42.
(S32). However, since P1 is already in the table, there is no change even if it is added. At this time, since the computer 3 is a follow-up system, nothing is done.

<Time Slice Start for 7 Times> Next, when a time slice occurs again, the computer 2 puts the currently executing process P1 in the executing process queue 22 (S11) according to the flowchart shown in FIG. ), The number of time slices of the own computer 2 in the execution state table 41 is incremented by 1 to "7" (S12), and since the own computer is the preceding system (S1
3) As shown in FIG. 11C, P4 in the running process queue 22 is taken out, registered as the currently running process in the running state table 41, and activated (S21).

At the same time, the computer 3 puts the currently executing process P1 in the executing process queue 32 (S11) according to the flowchart shown in FIG.
The number of time slices of the self-calculating computer 3 is increased by 1 to "7" (S12), and the self-calculating computer is the follower system (S1
3) It is confirmed that there is no preceding computer having a time slice count that is two or more times behind the time slice count "7" of its own computer (S14), and the execution end process table 4
Process P entered as shown in FIG. 8 (d) in FIG.
11 and P2 are not in the execution delay process queue 33 as shown in FIG. 11 (e) (S19), and the executing process queue 32 is empty as shown in FIG. 11 (f), so that nothing is done (S21). . As a result, the execution status table 4
1 and the contents of each queue are as shown in FIGS.

During the time slice of the number of times 7, the process P4 being executed by the computer 2 ends. Calculator 2 is shown in FIG.
According to the flow chart shown in, since the computer 2 is the leading system (S
31), the end process P4 is added to the execution end table 42 as shown in FIG. 12D (S32).

<Start of Time Slice of Number of Times 8> Next, when a time slice occurs again, the computer 2 confirms that there is no currently executing process according to the flow chart shown in FIG. 3 (S11), and the execution state table The number of time slices of the local computer 2 of 41 is increased by 1 to "8" (S12).
However, since the own computer is the preceding system (S13) and the running process queue 22 is empty as shown in FIG. 12B, nothing is done (S21).

At the same time, the computer 3 confirms that there is no currently executing process according to the flow chart shown in FIG. 3 (S11), increments the number of timeslice of the own computer 3 in the execution state table 41 by 1, 8 "(S12), the own computer is a follow-up system (S13), and it is confirmed that there is no preceding computer that is delayed by 2 or more time slices from the own computer's time slice number" 8 "(S14). The process P4 as shown in FIG. 12 (d) in the execution end process table 42 is in the execution delay process queue 33 of the own computer 2 as shown in FIG. 12 (c) (S19). Is moved to the executing process queue 32 (S21), but P4 is added to the executing process queue 32.
Since only P4 is included, P4 is taken out, and this is registered as the currently executing process in the execution state table 41 and activated (S21). As a result, the execution state table 41
And the contents of each queue are as shown in FIGS.

During the time slice of the number of times 8, the process P4 being executed by the computer 3 ends. Since the computer 3 is a follow-up system, nothing is done in step S31 of FIG.

FIG. 14 shows a list of processes executed by each computer up to the time slice up to this point.

Since the multiprocessing system according to the present embodiment operates in the above procedure, it is possible to execute the process P4 which was not executed in the conventional parallel multiprocessing system.

Although the execution delay process queues 13, 23 and 33 are used as means for suppressing the execution of the application process of the follow-up system in the above-mentioned embodiment, the follow-up system is not used. Even if the application process itself executed on this computer executes a routine waiting for a notification from the preceding computer, the same process flow as in this embodiment can be obtained. Further, in the above-described embodiment, when the preceding system computer is down, the following system computer is reconfigured into a new preceding system and a new following system. It is also possible to continue processing.

Next, an embodiment according to the second invention will be described. FIG. 16 is a block diagram of a multiprocessing system according to another embodiment of the present invention. The portions corresponding to those in FIG. 1 are designated by the same reference numerals, and the description will focus on the differences.

In this embodiment, each computer 1, 2, 3
In the local memory 14, 24, 34 inside the high-speed program storage area 15, which stores the high-speed version program of the application, in addition to the executing process queues 12, 22, 32 and the execution delay process queues 13, 23, 33, 25, 35 and a safe version program storage area 16, 2 for storing a safe version program of an application
6 and 36 are provided, which is different from the embodiment shown in FIG.

Next, the operation of the multiprocessing system configured as described above will be described with reference to the flow charts shown in FIGS. In the following description, if there is no bug in the high-speed program of each application process P1 to P3, P1 to P3 should be generated and executed at the timing shown in FIG. This section describes the behavior when there is a bug in the high-speed version program. Also, it is assumed that the execution of each application process according to the safe version program requires twice as long as the execution time according to the high speed version program. For comparison, FIG. 20B shows the timing when all application processes are executed according to the safety version program.

In the multiprocessing system of this embodiment, it is assumed that the computer 1 is initially classified as the preceding system and the computers 2 and 3 are classified as the following systems. The initial state of each queue or table is empty and nothing is registered, and the number of time slices starts from 0. The high-reliability version program storage areas 15, 25, and 35 store high-speed versions of programs P1 to P3, respectively, and the safe version program storage areas 16, 26 and 36 have the same functions as the high-speed versions P1 to P3, respectively. Contains a secure version program. Further, in the present embodiment, the termination of the execution of the application process is used as the designated condition (a condition for notifying the subsequent stage that no failure has occurred).

First, the contents of the execution state table 41 are shown in FIG.
It is assumed to be in the state shown in 1 (a). It is assumed that the process P1 is input to all computers in this state. Process P1
21 is input, the computer 1 confirms from the execution state table 41 shown in FIG. 21 (a) that the own computer is the preceding system, and then, according to the flow chart shown in FIG. 17, first, the occurring process is not in the failed process table. Confirm that (S4
1) The generation process P1 is put in the running process queue 12 by using the program address of the process as the address of the high-speed version program of P1 stored in the high-speed version program storage area 14 (S42).

On the other hand, at the same time, in the computer 2, according to the flow chart shown in FIG. 17, the own computer is the follow-up system and the generated process P1 is not in the fault process table 43.
Confirm that it is not in the end process queue (S43),
The generation process P1 is put into the execution delay process queue 23 (S45). The computer 3 also puts the process P1 in the execution delay process queue 33 in the same manner as the computer 2. As a result, the contents of the queue of each computer 1, 2 and 3 are as shown in FIGS.

21 to 33 used in the following description.
Then, a process having the address of the high-speed version program as the program address of the application process stored in the running queue is represented by Pn (high), and a process having the address of the safe version program is similarly represented as Pn. Notated as (cheap). However, n = 1 to 3. Suppose the other queues were previously empty.

<Start of Time Slice of Number of Times 1> Here,
Time slice occurs. Then, according to the flowchart shown in FIG. 18, the computer 1 confirms that there is no process currently being executed, and does nothing (S51).
Incrementing the number of time slices of the local computer 1 part by 1 to "1" (S52), confirming that the local computer is the preceding system (S53), extracting the process P1 from the running process queue 12, It is registered in the execution state table 41 as the process currently being executed and the process P1 is activated (S61). Since P1 has the program address of the high-speed version program, it is executed in accordance with the high-speed version program.

On the other hand, at the same time, in the computer 2, as in the case of the computer 1, according to the flow chart shown in FIG. 18, since there is no process currently being executed, nothing is done in S51, and the time of the own computer 2 portion of the execution state table 41 is changed. 1 slice
It is further increased to "1" (S52), the own computer is confirmed to be the follower system (S53), and the number of time slices of the own computer is delayed by 2 or more from the time slice number "1". (The number of time slices in the computer 1 portion should be 0 or 1 at this point) (S54), and it is confirmed that there is nothing in the termination process queue 42 (S59). Further, since nothing is entered in the process queue 22 being executed, nothing is done (S51). The computer 3 is also the same as the computer 2. As a result, the contents of the execution state table 41 and each queue are shown in FIG.
2 (a) to (c).

In the computer 1, the process P1 creates the process P2 during the time slice of the number of times 1. Then, the computer 1 confirms that the generated process P2 is not in the faulty process table 43 which is still empty according to the flowchart shown in FIG. 17 (S41), and further confirms that the own computer is the preceding system (S43). ), The generation process P2 is put in the running process queue 12 by using the program address of the process as the address of the high-speed version program of P2 stored in the high-speed version program storage area 14 (S44). This state is shown in FIG.

<Start of Time Slice of Number of Times 2> Next, when time slice occurs again, the computer 1 puts the currently executing process P1 in the executing process queue 12 (S51) according to the flowchart shown in FIG. Table 4
The number of time slices of the local computer 1 part of 1 is incremented by 1 to "2" (S52), it is confirmed that the local computer is the preceding system (S53), and the running process queue shown in FIG. The P2 is taken out from 12, and this is registered as the currently executing process in the execution state table 41 and activated (S61). Since this P2 has a program address of the high-speed version program, it is executed in accordance with the high-speed version program. At the same time, the computer 2 and the computer 3 also perform the same procedure as in the time slice of the number of times 1. As a result, the contents of the execution state table 41 and each queue are as shown in FIGS.

During the time slice of the number of times 2, in the computer 1, the process P2 according to the high-speed version program fails due to a program bug, and the computer 1 goes down.

<Time Slice Start of Number 3> Next, when a time slice occurs again, since the computer 1 is already down, nothing is done, and in the computer 2, according to the flow chart shown in FIG. Since it does not exist, nothing is done in S51, and the number of time slices of the computer 2 portion of the execution state table 41 is increased by 1 to "3" (S52),
The self-computer is a follow-up system (S53), and there is no preceding system computer whose time slice number is 2 or more times behind the time slice number "3" of the self-computer portion (the time slice number of the computer 1 is 2 at this point). (S5), the execution delay process queue 23 is empty (S5), and there is nothing in the executing process queue, so nothing is done in S61. As a result, the contents of the execution state table 41 and each queue are as shown in FIGS.

<Start of Time Slice of Number of Times 4> Next, when another time slice occurs, the computer 2 follows the flowchart shown in FIG.
1 does nothing, and increments the number of times sliced in the portion of the own computer 2 in the execution state table 41 to "4" (S5
2) There is an antecedent computer 1 (which is still "2" at this point) in which the own computer is a follow-up system (S53) and the number of time slices is "2" or more behind the number of time slices "4" of the own computer. Therefore (S54), the computer 1 is set to "down" in the execution state table 41, and the process P2 currently being executed by the computer 1 is added to the failed process table. Since there is no P2 in the execution delay process queue 23 shown in FIG. 24 (c), there is no processing to move from the execution delay queue to the execution queue) (S55).

Further, the site number "2" of the own computer 2 is the smallest among the follower computers 2 and 3 (S56),
The process P1 of the execution delay process queue 23 shown in FIG. 24C is taken out, and the program address of the process is stored in the high-speed version program storage area 26.
The address of the high-speed version program of No. 1 is set in the running process queue 22 (S57), and the execution state table 41 is rewritten by using the own computer as the preceding system (S58). The execution end process table 42 is still empty (S
59), P1 is taken out from the executing process queue 22, registered in the execution state table 41, and activated (S6).
1). Since P1 has the program address of the high-speed version program, it is executed in accordance with the high-speed version program.

On the other hand, according to the flow chart shown in FIG. 18, the computer 3 operates exactly the same as the computer 2 up to S55, but the site number "3" of its own computer 3 is the follower computer 2,
It is not the minimum during 3 (S56), the execution end process table 42 is still empty (S59), and the executing process queue 32 is empty, so nothing is done in S61. As a result, the queues and tables of the computers 1, 2 and 3 are as shown in FIGS.

In the computer 2, the process P1 creates the process P2 during the time slice of the number of times 4. Then, the computer 2 follows the flow chart shown in FIG. 17, and the generated process P2 exists in the failed process table shown in FIG. 25 (e). Therefore, the program address of the process P2 is stored in the safe program storage area 25. The address of the safe version program is put in the running process queue 22 (S42). As a result, the running process queue of the computer 2 is as shown in FIG.

<Time Slice Start for Number 5> Next, when a time slice occurs again, the computer 2 puts the currently executing process P1 in the executing process queue (S51) according to the flowchart shown in FIG. Table 41
26, the number of time slices of the own computer 2 is incremented by 1 to "5" (S52), and since the own computer is the preceding system (S53), P2 is taken out from the executing process queue 22 in FIG. 26 and is currently being executed. The process is registered in the execution state table 41 and activated as a process (S61). Since the program address of this P2 is that of the safe version program, it is executed in accordance with the safe version program.

At the same time, the computer 3 follows the flow chart shown in FIG. 18, and there is no process currently being executed.
Then, nothing is done and the number of times sliced in the computer 3 portion of the execution state table 41 is incremented by 1 to "5" (S5
2) There is no preceding computer in which the own computer is a follow-up system (S53), and the number of time slices is 2 or more times behind the time slice number "5" of the own computer (S54), and the end process process queue 42 is empty. (S59) Further, since nothing is entered in the process queue being executed, nothing is done also in S61. As a result, the contents of the execution state table 41 and each queue are as shown in FIGS.

During the time slice of the number of times 5, the process P2 of the computer 2 creates the process P3. Then, the computer 2 has no occurrence process P3 in the failure process table 43 according to the flowchart shown in FIG. 17 (S4).
1) Since the own computer is the preceding system (S43), the program address of the generated process P3 is set as the address of the high-speed version program of P3 stored in the high-speed version program storage area 24, and the running process queue 22
(S44). This state is shown in FIG.

<Time Slice Start of Number 6> Next, when a time slice occurs again, the computer 2 puts the currently executing process P2 in the executing process queue (S51) according to the flowchart shown in FIG. Table 41
In this case, the number of times sliced by the self-calculating computer 2 is increased by 1 to "6" (S52), and since the self-calculating computer is the preceding system (S5
3), P1 is taken out from the executing process queue 22 shown in FIG. 27D, registered as P1 in the execution state table 41 as the currently executing process, and activated (S61). This P1 is executed according to the high-speed version program because the program address is that of the high-speed version program. Calculator 3
Is exactly the same as when the number of time slices is 5.

As a result, the contents of the execution state table 41 and each queue are as shown in FIGS.

During the time slice of the number of times 6, the process P1 being executed on the computer 2 ends, so that the computer 2
Confirms that the own computer 2 is the preceding system according to the flowchart shown in FIG. 19 (S71), and adds the end process P1 to the execution end table 42 (S72). Figure 2
7 (e).

<Time Slice Start of Number 7> Next, when a time slice occurs again, the computer 2 has no process currently executing according to the flow chart shown in FIG. 18 (P1 ends in the middle of the time slice). Therefore, nothing is done in S51, and the number of time slices of the computer 2 portion of the execution state table 41 is increased by 1 to "7" (S52),
Since the own computer is the preceding system (S53), the process P3 is taken out from the executing process queue 22 shown in FIG. 27 (b), registered as the currently executing process in the execution state table 41, and activated (S61). Since this P3 has a program address of the high-speed version program, it is executed in accordance with the high-speed version program.

On the other hand, in accordance with the flow chart shown in FIG. 18, the computer 3 does not perform any process in S51, and does nothing in S51, and increments the number of time slices of the own computer 3 portion of the execution state table 41 by "7". (S52), the self-computer is a follow-up system (S53), and there is no preceding system computer in which the number of time slices is delayed by 2 or more from the time slice number "7" of the own computer (S54), but FIG. 27 (e). Process P1 in the end process process queue 42 shown in
27 in the execution delay process queue 33 shown in FIG. 27D (S59), the program address of the process is stored in the high-speed version program storage area 34.
The address of the high-speed version program of No. 1 is set in the running process queue 32 (S60). Further, the process P1 that has just been put in is taken out from the running process queue 32, this is registered in the execution status table 41 as a process that is currently being executed, and the process P1 is activated (S61).
Since P1 has the program address of the high-speed version program, it is executed in accordance with the high-speed version program.

As a result, the contents of the execution state table 41 and each queue are as shown in FIGS. 28 (a) to 28 (d).

Since the process P3 being executed by the computer 2 is terminated during the time slice of the number of times 7, the computer 2 follows the flow chart shown in FIG. 19 and, since the computer 2 is the preceding system (S71), terminates the process P3. Execution end table 42
(S72). This state is shown in FIG.

On the other hand, in the computer 3, the process P1 creates the process P2 during the time slice of the number of times 7. Then, the computer 3 stores the program address of the process P2 in the safe program storage area 35 because the occurring process P2 exists in the failed process table shown in FIG. 26 (e) according to the flowchart shown in FIG. 18 (S41). The address of the safety version program of P2 is set to the running process queue 32 (S42). As a result,
The running process queue of the computer 3 is as shown in FIG.

<Start of Time Slice of Number of Times 8> Next, when a time slice occurs again, the computer 2 has no process currently executing according to the flowchart shown in FIG. 18 (P3 ends in the middle of the time slice). ), Nothing is done in S51, and the time slice count of the portion of the own computer 2 in the execution state table 41 is increased by 1 to "8" (S52),
Since the own computer is the preceding system (S53), the process P2 is taken out from the executing process queue 22 (FIG. 36), registered in the execution state table 41 as the currently executing process, and activated (S61). This P2 is executed according to the safe version program because the program address is that of the safe version program.

On the other hand, the computer 3 places the currently executing process P1 in the in-progress queue 32 (S51) according to the flowchart shown in FIG. 18, and increments the number of timeslices of the portion of the own computer 3 in the execution state table 41 by 1. Set to "8" (S5
2), the own computer is a follow-up system (S53), and there is no preceding system computer in which the number of time slices is delayed by 2 or more from the time slice number "8" of the own computer (S54), as shown in FIG. 27 (e). Since the processes P1 and P3 in the execution end process process queue 42 are not in the execution delay process queue shown in FIG. 27 (d) (S59), the process P2 is taken out from the executing process queue 32 and is currently being executed. Is registered in the execution state table 41 and activated (S61). Since the program address of this P2 is that of the safe version program, it is executed in accordance with the safe version program.

As a result, the contents of the execution state table 41 and each queue are as shown in FIGS. 29 (a) to 29 (d).

Since the process P3 being executed by the computer 2 ends during the time slice of the number of times 8, the computer 2 follows the flow chart shown in FIG. 19 because its own computer 2 is the preceding system (step 71). It is added to the execution end table 42 (step 72). This state is shown in FIG.
It shows in (e).

On the other hand, in the computer 3, the process P2 creates the process P3 during the time slice of 8 times.
Then, the computer 3 follows the flow chart shown in FIG. 18, and the generation process P3 does not exist in the failure process table shown in FIG. 26 (e) (S41), and the generation process P3 exists in the execution end process table 42 (S43). The program address of the process is stored in the high-speed version program storage area 3
The address of the high-speed version program of P3 stored in 6 is put in the running process queue 32 (S4
2). As a result, the running process queue of the computer 3 becomes as shown in FIG.

<Time Slice Start of Number 9> Next, when a time slice occurs again, the computer 2 has no process currently executing according to the flowchart shown in FIG. 18 (P2 ends in the middle of the time slice). Therefore, nothing is done in S51, and the number of time slices of the computer 2 portion of the execution state table 41 is increased by 1 to "9" (S52),
Since the own computer is the preceding system (S53) and the running process queue 22 shown in FIG. 29 (b) is empty, S61 does nothing. After that, the computer 2 does nothing except for increasing the number of time slices by 1 in S52 according to the flowchart shown in FIG. 18 at the start of each time slice, and hence the description of the movement is omitted.

On the other hand, the computer 3 places the currently executing process P2 in the executing queue 32 (S51) according to the flowchart shown in FIG. 18, and increments the number of time slices of the own computer 3 portion of the execution state table 41 by 1. Set to "9" (S5
2) Since the own computer is a follow-up system (S53), there is no preceding computer whose time slice number is delayed by 2 or more than the time slice number "9" of the own computer (S54), and the execution delay process queue 33 is empty. Running process queue 3
The process P1 is taken out from step 2, is registered in the execution state table 41 as the process currently being executed, and is activated (S61). Since the program address of this P1 is that of the safe version program, it is executed in accordance with the high speed version program.

As a result, the contents of the execution state table 41 and each queue are as shown in FIGS.

Although the process P1 being executed by the computer 3 ends during the time slice of 9 times, the computer 3 does nothing because the computer 3 itself is the follow-up system according to the flowchart shown in FIG. 19 (S71).

<Start of Time Slice of Number of Times 10> Next,
When the time slice occurs again, the computer 3 follows the flow chart shown in FIG. 18 because there is no process currently being executed (P1 ends during the time slice of the number 9) S
In 51, nothing is done and the own computer 3 in the execution state table 41
The number of time slices in the section is increased by 1 to "10" (S52), the self-computer is the follow-up system (S53), and the time-slice number is delayed by 2 or more from the self-computer's time slice number "10". There is no calculator (S54),
Since the execution delay process queue 33 is also empty, the process P3 is taken out from the executing process queue 32, registered in the execution state table 41 as the currently executing process, and activated (S61). Since this P3 has a program address of the high-speed version program, it is executed in accordance with the high-speed version program.

As a result, the contents of the execution state table 41 and each queue are as shown in FIGS. 31 (a) to 31 (c).

During the time slice of 10 times, the process P3 running on the computer 3 ends, but the computer 3
Does nothing because the computer 3 is following system according to the flowchart shown in FIG. 19 (S71).

<Start of Time Slice for Number 11> Next,
When the time slice occurs again, the computer 3 follows the flow chart shown in FIG. 18 and there is no process currently being executed (P3 ends during the time slice of the number of times 10).
In S51, nothing is done, the number of times sliced in the computer 3 portion of the execution state table 41 is increased by 1 to "10" (S52), the computer is a follower system (S53), and the number of times sliced in the computer itself is "11". There is no computer of the preceding system in which the number of time slices is delayed by more than 2 (S54),
Since the execution delay process queue 33 is also empty, the process P2 is taken out from the executing process queue 32, registered as the currently executing process in the execution state table 41, and activated (S61). Since the program address of this P2 is that of the safe version program, it is executed in accordance with the high speed version program.

As a result, the contents of the execution state table 41 and each queue are as shown in FIGS. 32 (a) and 32 (b).

During the time slice of 11 times, the process P2 running on the computer 2 ends, but the computer 3
Does nothing because the computer 3 is following system according to the flowchart shown in FIG. 19 (S71).

FIG. 334 shows a list of processes executed by each computer up to each time slice up to this point.

With the above operation, even if the high-speed version program of the application process P2 generated according to the system of this embodiment includes a program bug, the system continues processing without stopping, and the preceding system and the follow-up system continue. It can be seen that the application processes P1 and P3 in which no program bug is included in the program are executed according to the high-speed version of the program in both the system computers and the processing time of the entire system is not delayed.

As described above, according to the present embodiment, by preparing a high-speed version program and a safe version program that takes time but does not have a program bug for the application process, the high-speed version program is free from program bugs. Other than the included application process, the processing time can be avoided with the same processing time as in the case of only the high-speed version.

The embodiments according to the first and second inventions described above can be modified as shown in FIGS. 34 and 35. In the embodiment shown in FIG. 34, in the multi-processing system shown in FIG. 1 or 16, the copy machines 18, 28 and 38c are attached to the computers 1, 2 and 3, respectively, and the execution state table 41 and the execution end process table 42 are shown. The failure process table 43 is installed in the local memory 14, 24, 34 of each computer, and the contents of the local memory 14, 24, 34 (in particular, the tables 41, 4
The contents (2, 43) can be transferred and copied at any time. The embodiment shown in FIG. 35 uses a shared timer 6 connected to a bus 5 in place of the timers 15, 25, 35 shown in FIG. 1 or 16.

Next, an embodiment according to the third invention will be described. FIG. 36 is a block diagram of the multiprocessing system according to the present embodiment. The computers 1, 2 and 3 are connected to each other via a bus 5 (eg LAN).
Communication devices 101, 202 and 301, arithmetic devices 102, 202 and 302, OS storage areas 103 and 2
03, 303 and program storage areas 105, 20
5, 305 are provided and OS storage areas 103, 20
3, 303 are provided with program management tables 104, 204, 304 showing the correspondence between program names and their start addresses as shown in FIG.

FIG. 37 shows the OS storage area 1 in the computer 1.
.. in program storage areas 105, 205, 305 whose execution is controlled by the OS stored in 03, 203, 303 are operating. The OS controls the information exchange between the programs P001, P002, ..., And when data is transferred to the program of another computer, the data transmission / reception process is controlled via the bus 5. In addition, hereinafter, the OS stored in the OS storage area 103 is the OS in the computer 1, the OS stored in the OS storage area 203 is the OS in the computer 2, and the OS stored in the OS storage area 303 is in the computer 3. OS of.

FIG. 38 shows the processing function of each program. The program P001 is a program for obtaining the sum of two vectors and calculating the square value of the absolute value thereof.
It is running on Calculator 1. The program P002 is a program for calculating the sum of two vectors,
Running at. The program P003 is a program for calculating the absolute value (magnitude) of a vector, and the computer 2
Running at. The program P004 is a program for calculating the square of a numerical value (scalar amount), and is running on the computer 3. The program P005 is a program for calculating the integral value of the input numerical value, and the computer 3
Running at.

Here, the process when a user who wants to find the sum of two vectors using the program P001 and calculates the squared value of the absolute value of the user calls the program P001 from the keyboard 6 and inputs two vector quantities 40 will be described with reference to FIG.

First, when the user calls the program P001 from the keyboard 6, the program name "P001"
Along with the execution priority information, the alternative program name list of "P001" [P002 (1), P003
(2), P004 (3)] is input (S101). Explaining P002 (1) in the list as an example, P002 indicates an alternative program name, and (1) indicates that the execution priority of the program P002 is 1.

Next, the OS in the computer 1 is the keyboard 6
The boot program name “P001” indicating the boot target program input from and the alternative program list [P0
02 (1), P003 (2), P004 (3)] is stored (S102).

Next, the OS in the computer 1 checks whether the input boot program name is registered in the computer 1 (S103). In the case of this example, the startup program name is the program "P001", and since it is confirmed that this is registered, the program "P001" is started (S105). If the startup program name is not registered in the computer 1, the process proceeds to S104.

In this way, the program "P001" is started, and the user is requested to input two vector quantity values in accordance with the program procedure. In response to this request, when the user inputs data from the keyboard 6 (S106), "program P001" calculates the sum of two vectors, calculates the square value of the absolute value, and outputs the resulting value on a CRT (not shown). Is output (S107).

Here, it is assumed that the program "P001" running on the computer 1 is stopped. For example,
Assuming that the data entered from the keyboard 6 is entered in a format other than numerical values, the program "P001"
Since no exception processing is performed on the foreign input data, the OS terminates the execution of the program as an abnormal end due to a program error.

In this case, since the program “P001” is not registered in the computer 1 of the OS in the computer 1, when the input data required by the program “P001” is received from the user via the keyboard 6, Inquiries are made to the OSs in the other computers 2 and 3 whether the program "P001" is registered in the program storage areas 205 and 305 (S104). In this example, since the program “P001” does not exist in the program storage areas 205 and 305 in the computers 2 and 3, the program “P002” in the alternative program list is first activated (S108).

The program "P002" is started by, for example, the OS in the computer 1 requesting the OSs in the other computers 2 and 3 the alternative list, the result reply destination information from the final alternative program, and the request to start the program "P002". It can be realized by broadcasting a message consisting of input data and input data. In this example, the program “P002” is computer 2
Since it exists in the program storage area 205 inside,
The OS in the computer 2 receives the activation request from the OS in the computer 1 and activates the program “P002”. When the program "P002" is started, it reads the input data of two vector quantities in the message, calculates the sum of the two vectors, and outputs it to the CRT. OS in computer 2
Reads the output value from the storage area in which the value of the vector sum calculated by the program "P002" is stored. Then, the OS in the computer 2 deletes the program "P002" from the alternative list, and broadcasts the remaining list information, final reply destination information, the activation request of the program "P003", and the result of vector sum as a message.

Since the program "P003" exists in the computer 2, the OS in the computer 2 uses the program "P003".
To start. When the program “P003” receives a vector amount from the OS in the computer 2, it calculates the absolute value and outputs it to the CRT. The OS in the computer 2 reads the output value from the storage area in which the absolute value of the vector calculated by the program “P003” is stored, and passes the value as input data to the program “P004” which is the next alternative program. .

That is, the OS in the computer 2 deletes the program "P003" from the alternative list, and broadcasts the remaining list information, the activation request of the program "P004", and the absolute value (scalar value) of the vector as a message.
Since the program “P004” exists in the computer 3, the OS in the computer 3 activates “P004”. When the scalar value is input from the OS in the computer 3, the program “P004” calculates the square of the scalar value and outputs it to the CRT. Since the program "P004" is the final alternative program in the alternative list, the result is returned to the OS in the computer 1 which is the reply destination information added to the message (S11).
0).

Then, the OS in the computer 1 outputs the final result included in the message returned from the OS in the computer 3 to the CRT of its own computer (S111).

As described above, according to this embodiment, the program "P00" created by the optimum procedure is prepared before the program is stopped without creating and managing a plurality of versions of the program.
2 ”can be operated to achieve the mission required for the system. And the program“ P00
2 "is stopped, the OSs installed in the other computers 2 and 3 sequentially start the alternative programs from the alternative program list information, and the performance is inferior to that of the program" P002 ". It is possible to continue the initial mission of "calculating the sum of the above and calculating the square value of the absolute value."

[0143]

As described above, according to the present invention, not only hardware failures but also computer failures due to program bugs prevent all computers from going down and continue processing of the entire system. can do.

That is, according to the first aspect of the present invention, even if the computer goes down due to a failure due to a program bug in the application process, the processing can be continued without stopping the entire system.

According to the second aspect of the invention, the high-speed version program and the safe version program that takes time but does not have a program bug are prepared for the application process, so that the application including the program bug in the high-speed version program is prepared. Except for processes, the safety version program can avoid interruption of processing in the same processing time as in the case of only the high speed version program.

Further, according to the third aspect of the invention, the mission required for the system is performed by operating the first program created by the optimum procedure before the program is stopped without creating and managing the programs of plural versions. When the first program stops, the OS installed in the computer starts the second program, which is the alternative program, from the program name list information. Although the performance is poor, it is possible to continue the mission.

[Brief description of drawings]

FIG. 1 is a block diagram showing an embodiment of a multiprocessing system according to the first invention.

FIG. 2 is a flowchart showing an operation when an application process occurs in the system of the embodiment.

FIG. 3 is a flowchart showing an operation at the time of starting a time slice in the system of the embodiment.

FIG. 4 is a flowchart showing an operation at the end of an application process in the system of the embodiment.

FIG. 5 is a diagram showing an execution state table and contents of each queue in an initial state of the system of the embodiment.

FIG. 6 is a diagram showing the contents of each queue and the execution state table after the time slice start processing of the number of times 1 in the system of the embodiment.

FIG. 7 is a diagram showing the contents of each queue and the execution state table after the time slice start processing of the number of times 2 in the system of the embodiment.

FIG. 8 is a diagram showing the contents of each execution queue and the execution state table after the processing at the time slice start time 3 times in the system of the embodiment.

FIG. 9 is a diagram showing the content of each queue and the execution state table after the time slice start processing of the number of times 4 in the system of the embodiment.

FIG. 10 is a diagram showing the execution state table and the contents of each queue after the time slice start processing of the number of times 5 in the system of the embodiment.

FIG. 11 is a diagram showing the contents of each queue and the execution state table after the time slice start processing of the number of times 6 in the system of the embodiment.

FIG. 12 is a diagram showing the execution state table and the contents of each queue after the processing at the time slice start time 7 times in the system of the embodiment.

FIG. 13 is a diagram showing the execution state table and the contents of each queue after the time slice start processing of the number of times 8 in the system of the embodiment.

FIG. 14 is a diagram showing a list of processes executed by each computer in the system of the embodiment.

FIG. 15 is a diagram showing an expected execution example (a) when an application process is executed in a conventional parallel multiprocessing system and an example (b) in which a machine is down due to a bug.

FIG. 16 is a block configuration diagram showing an embodiment of a multiprocessing system according to the second invention.

FIG. 17 is a flowchart showing an operation when an application process occurs in the system of the embodiment.

FIG. 18 is a flowchart showing an operation at the time of starting a time slice in the system of the embodiment.

FIG. 19 is a flowchart showing an operation at the end of the application process in the system of the embodiment.

FIG. 20 is a diagram showing an expected execution example (a) when an application process is executed in the system of the embodiment and an example (b) when the high-speed version program has a bug.

FIG. 21 is a diagram showing an execution state table and contents of each queue in the initial state of the system of the example.

FIG. 22 is a diagram showing the contents of each queue and the execution state table after the time slice start processing of the number of times 1 in the system of the embodiment.

FIG. 23 is a diagram showing the contents of each execution queue and the execution state table after the time slice start processing of the number of times 2 in the system of the embodiment.

FIG. 24 is a diagram showing the execution state table and the contents of each queue after the time slice start processing of the number of times 3 in the system of the embodiment.

FIG. 25 is a diagram showing the execution state table and the contents of each queue after the processing at the time slice start time 4 times in the system of the embodiment.

FIG. 26 is a diagram showing the contents of each queue and the execution state table after the time slice start processing of the number of times 5 in the system of the embodiment.

FIG. 27 is a diagram showing the execution state table and the contents of each queue after time slice start processing of the number of times 6 in the system of the embodiment.

FIG. 28 is a diagram showing the execution state table and the contents of each queue after time slice start processing of the number of times 7 in the system of the embodiment.

FIG. 29 is a diagram showing the execution state table and the contents of each queue after the time slice start processing of the number of times 8 in the system of the embodiment.

FIG. 30 is a diagram showing the execution state table and the contents of each queue after the processing at the time slice start time of 9 times in the system of the embodiment.

FIG. 31 is a diagram showing the execution state table and the contents of each queue after time slice start processing of 10 times in the system of the embodiment.

FIG. 32 is a diagram showing the contents of each queue and the execution state table after the processing at the time slice start time of 11 times in the system of the embodiment.

FIG. 33 is a diagram showing a list of processes executed by each computer in the system of the embodiment.

FIG. 34 is a block diagram showing another embodiment of the multiprocessing system according to the second invention.

FIG. 35 is a block diagram showing another embodiment of the multiprocessing system according to the second invention.

FIG. 36 is a block diagram showing an embodiment of a multiprocessing system according to the third invention.

FIG. 37 is a view showing program names stored in each computer in the system of the same example.

FIG. 38 is a diagram showing a processing example of each program in the system of the embodiment.

FIG. 39 is a diagram showing the contents of a program management table in the system of the embodiment.

FIG. 40 is a flowchart showing a processing procedure in the system of the embodiment.

[Explanation of symbols]

1, 2, 3 ... Calculator 4 ... shared memory 5 ... bus 6 ... Shared timer 7 ... Keyboard 11, 21, 31 ... Arithmetic device 12, 22, 32 ... Executing process queue 13, 23, 33 ... Execution delay process queue 14, 24, 34 ... Local memory 15, 25, 35 ... Timer 16, 26, 36 ... High-speed version program storage area 17, 27, 37 ... Safe version program storage area 18, 28, 38 ... Copying device 41 ... Execution status table 42 ... Execution end process table 43 ... Failure process table 101, 201, 301 ... Communication device 102, 202, 302 ... Arithmetic device 103, 203, 303 ... OS storage area 104, 204, 304 ... Program management table 105, 205, 305 ... Program storage area

Front page continuation (58) Fields surveyed (Int.Cl. ⁷ , DB name) G06F 15/16-15/177 G06F 9/06 G06F 11/14

Claims (6)

(57) [Claims] 1. A program execution control method in one of the plurality of computers in a multiprocessing system comprising a plurality of computers for controlling the execution of the program, the method comprising: A first set of programs that substitutes the function of the first program by sequentially executing different programs according to a predetermined execution priority, and a program name list that specifies the execution priority of each program of the first set of programs
A second step of activating the first program when the first program is stored in a storage unit that stores a program to be executed by the computer; When there is no computer that stores the first program, or when the execution of the first program started in the second step ends abnormally, each of the programs in the set of programs is based on the program name list. A third step of causing a program to be sequentially executed according to the execution priority on any of the plurality of computers that store any program of the set of programs, the program execution control method comprising: 2. A fourth step of activating a program selected from the set of programs according to the execution priority order based on the program name list in the storage means, the fourth step of activating the program. When the execution result of the program started in step 4 is obtained, the program to be executed next selected from the set of programs according to the execution priority order based on the program name list is stored in the storage means. If not, at least the program name list, the execution result, and the selected program are requested in order to request any of the plurality of computers storing the selected program to start the selected program. And a fifth step of broadcasting a start request of the program. -Time execution control method. 3. When the first program requested to be activated by the activation request received in the first step is not stored in the storage means, an inquiry is made to another computer of the plurality of computers. 2. The program execution control method according to claim 1, further comprising a sixth step of requesting one of the plurality of computers storing the first program to start the first program. . 4. A storage means, which is one of the plurality of computers in a multiprocessing system including a plurality of computers for controlling the execution of the program, and which stores a program executed by the computer. A program set that substitutes the function of the first program by sequentially executing different programs in accordance with a predetermined execution priority together with the activation request of the first program, and the execution priority order of each program of the program set. First to receive a list of specified program names
A second means for activating the first program when the first program is stored in the storage means; and a computer for storing the first program in the plurality of computers. When not executing, or when the execution of the first program started by the second means ends abnormally, each program of the set of programs is executed according to the execution priority order based on the program name list. A third means for sequentially executing one of the plurality of computers that stores any one of a set of programs, the computer comprising: 5. A fourth means for activating a program selected from the set of programs according to the execution priority order based on the program name list when the storage means stores the program, When the execution result of the program started by the means of 4 is obtained, the program to be executed next selected from the set of programs based on the program name list according to the execution priority is stored in the storage means. If not, the program name list, the execution result, and the selected program activation request are issued to request activation of the selected program to any of the plurality of computers that store the selected program. 5. The computer according to claim 4, further comprising: a fifth means for broadcasting. 6. When the first program requested to be activated by the activation request received by the first means is not stored in the storage means, an inquiry is made to another computer of the plurality of computers. 5. The computer according to claim 4, further comprising sixth means for requesting activation of the first program to any of the plurality of computers storing the first program.