JPH04127754A - External supervisory and controlling system - Google Patents

Abstract

PURPOSE:To prevent system down by automatically switching system configuration so as to obtain normal system configuration when a fault is generated in the duplex system. CONSTITUTION:By executing emergency control activation (EMA activation) from an activation control part 6 when both response signals can not be received in respect to supervisory signals from supervisory parts 5-1 and 5-2 of an external supervisory device 4, the system configuration is switched and when the new system configuration is normal, a processing is started again. Since the supervisory signals are transmitted in a prescribed cycle from the supervisory parts 5-1 and 5-2 of the external supervisory device 4 when the new system configuration is abnormal, the both response signals to the supervisory signals can not be received, and the EMA activation is executed again. Therefore, the EMA activation is repeated until switching to the normal system configuration. Thus, system down can be prevented.

Description

[Detailed Description of the Invention] [Summary] This invention relates to an external monitoring control method that monitors a system with a multiplexed configuration and controls system configuration switching in the event of a failure, and that enables sequential system configuration switching in the event of a failure to prevent system downtime. In an external monitoring control method in which a system consisting of a central control unit and a main storage device in a multiplexed configuration is monitored by an external monitoring device in a system monitoring and control device, two of the external monitoring devices are Each of the monitoring units sends a monitoring signal to the central control unit of the active system at different timings in a predetermined period, and when both of the two monitoring units cannot receive a response signal to the monitoring signal, the monitoring unit of the active system It is determined that there is a failure in V5.
The configuration is such that an emergency control start is performed, the system is reconfigured by the emergency control start, and the monitoring signals are sent from the two monitoring units after a predetermined period.

[Industrial Field of Application] The present invention relates to an external monitoring control method for monitoring a system with a multiplexed configuration and controlling switching of the system configuration when a failure occurs.

BACKGROUND ART In systems such as electronic exchanges, a configuration is adopted in which a central control unit and a main storage device are duplicated, and when a failure occurs in the active system, the system configuration is switched and reconfigured to avoid system failure. In such a system with a redundant configuration, it is desired that the system configuration be automatically switched to a normal system configuration when a failure occurs.

(Prior Art) A conventional system with a redundant configuration has, for example, the configuration shown in FIG. -1 and the main storage device (MMO, MM,) 42-0. 0 and the main storage device 420, the central control device 41-O, which has become the active system, has the main storage device 42-O, which has become the active system.
Various types of processing are performed by sequentially outputting data from the main storage device 42-0 to the main storage device 42-1 of the active system and the main storage device 42-1 of the backup system at the same time. Control is performed so that the stored contents of the device 42-0.421 are the same.

In addition, the external monitoring device 44 of the system monitoring and control device 43 sends a monitoring signal to the central control device 41-0 of the active system at regular intervals, receives a response signal thereto, and verifies the normality of the active system. There is.

If this response signal cannot be received, it will be determined that there is a failure in the active system and the HMA will be activated, thereby switching the system configuration.
The above-mentioned active system configuration, a system configuration including the 1-system central controller 41-1 and the main storage device 42-1, and a central controller 41-0 and main storage device 42 that combine the 0-system and 1-system. -1 system configuration, central control device 41-1 and main storage device 42-0
There is a system configuration of That is, in the case of a duplex configuration, there are four types of system configurations.

As mentioned above, the external monitoring device 44 sends a monitoring signal to the active central control device, receives the response signal, and confirms the normality of the central control device. In order to improve reliability of confirmation and prevent frequent switching of system configurations, this configuration sends out monitoring signals from each monitoring unit in a duplex configuration, and receives response signals to each monitoring signal to confirm normality. It has been known.

In that case, as shown in FIG. 5, the duplex monitoring unit will send a signal of "1" when the response signal can be received, and a signal of '0' when the response signal cannot be received, as shown in (a) and (b), respectively. '' signal, and when both signals become ``O°'', the EMA is activated and the system configuration is switched, and the system restart process is completed and normal operation is resumed. When the system is configured, the central control unit sends out a response signal. As a result, the monitoring unit outputs a signal of "1", indicating that the switched system configuration is normal.

[Problem to be solved by the invention]

In the conventional example described above, after starting the EMA and switching the system configuration, the system waits for a response signal from the central control unit, and then the system configuration is switched to a normal operating system configuration, and the system restart process is started. Upon completion of the process, the central control device sends out a response signal, so that the monitoring section of the external monitoring device 44 outputs a signal indicating "work" as shown by the dotted lines in FIG. 5 (a) and (b). Become.

However, even after switching the system configuration, if the system configuration does not operate normally and the system cannot be restarted, the monitoring unit cannot receive the response signal from the central control unit.
O” signal will be output continuously, and EMA will be activated again.
This means that startup will not be possible. Therefore, the system goes down due to a timeout or the like.

An object of the present invention is to avoid system failure by enabling sequential system configuration switching when a failure occurs.

[Means for solving the problem: The external monitoring control method of the present invention transmits a monitoring signal from an external monitoring device at a predetermined period even after EMA activation, and
This makes it possible to confirm the normality after switching the system configuration, and will be explained with reference to FIG.

In an external monitoring control method in which a system consisting of a central control device 1 and a main storage device 2 in a multiplexed configuration is monitored by an external monitoring device 4 in a system monitoring and control device 3, two monitoring devices of the external monitoring device 4 are used. Each of the sections 5-1.5-2 sends a monitoring signal to the active system central control unit 1 at a predetermined period and at different timing, and a response signal to this monitoring signal is sent to the two monitoring sections 5-1.5-. In step 2, when both cannot be received, it is determined that there is a failure in the active system, and the activation control unit 6 performs an emergency control activation (EMA activation), and this emergency and control activation causes the system to be reconfigured. Monitoring section 5-1.5
-2, the monitoring signals are sent out at predetermined cycles and at different timings.

[Effect]

When response signals to the monitoring signals from the monitoring units 5-1 and 5-2 of the external monitoring device 4 cannot be received, the system configuration is switched by starting the EMA from the startup control unit 6, and a new system is started. If the configuration is normal, processing will resume. However, if the new system configuration is abnormal, restart processing will not be possible. Neither response signal to the monitoring signal can be received, and EMA activation is performed again.

Therefore, EMA startup will be repeated until the system configuration is switched to a normal system configuration, and in the case of a system with an n-duplex configuration, if a normal system configuration cannot be obtained even after n2-1 HMA startups, the system will go down. However, since there is a high probability that the system configuration will be normal before that happens, system failure can be avoided.

[Examples] Examples of the present invention will be described in detail below with reference to the drawings.

FIG. 2 is a block diagram of an embodiment of the present invention, 110.
111 is the central control unit for the 0 and 1 systems (cc,, cc,)
, 12-0.12-1 is 0 series.

1 main storage device (MM, MM,), 13 is a system monitoring control device, 14 is an external monitoring device (ESE), 15-
1.15-2 is the first. a second monitoring unit, 16 a startup control unit, 17-0.17. -1 is O system.

1 system signal reception distribution unit (SRD, 5RDI), 18
19 is a transmitting/receiving scanning section, 19 is a display section for displaying faults, etc., 20
is an alarm control unit, and shows the case of a system with a redundant configuration.

Further, 21 to 24 indicate system configurations, 21 is a system configuration consisting of the 0-system central control unit 11-0 and the main storage device 12-0, and 22
23 is a system configuration consisting of the 1-system central controller 11-1 and the main storage device 12-1, and 23 is the 1-system central controller 11-1 and 0.
24 shows a system configuration including a main storage device 120 of the 0-system and a main storage device 12-1 of the 0-system.

The first external monitoring device 14. Second monitoring unit 151 15-
2, supervisory signals are sent from the transmitting/receiving scanning unit 18 to the active system central control unit via the signal receiving distribution unit at different timings asynchronously. For example, if the 0-system central control unit 11-0 is the active system, the 0-system
The central control unit 11 via the signal reception distribution unit 17-0 of the system.
-0, and a response signal from the central control unit 11-0 to this monitoring signal is sent to the signal receiving and distributing unit 11-0.
7-0 to the first monitoring unit 1 via the transmission/reception scanning unit 18.
A response signal to the monitoring signal from 5-1 is sent to the first monitoring unit 15-1, and a response signal to the monitoring signal from the second monitoring unit 15-2 is sent to the second monitoring unit 15-2. distributed to each.

1st. The second monitoring unit 15-1, 15-2 applies a signal of “'1” to the activation control unit 16 by receiving the response signal, and also outputs a signal of “0” when the response signal cannot be received. Added to the startup control section 16. The startup control unit 16 is
This first. When the signals from the second monitoring unit 15-1 and 15-2 are both “0”, it is determined that there is a failure in the active system and the EMA is activated.In this case, the display unit 19 indicates that a failure has occurred. Is displayed.

Also, by starting this HMA, for example, from the system configuration 21 of the 0-system central control unit 11-0 and the main storage device 12-0, the 0-system
system central control unit 11-0 and system 1 main storage device 12-1
The system configuration 24 is switched to 24, and system restart processing is performed.

Also, number 1. The second monitoring unit 15-1.15-2 sends out a monitoring signal at a period of time that is long enough to complete the system reconfiguration process after EMA activation and movement, and before sending out the monitoring signal, the second monitoring unit 15-1. The output signal of the second monitoring unit 151.15-2 is set to “1”.
'', if the system configuration becomes normal by switching the system configuration, it will be possible to receive the response signal, but if normal restart processing cannot be performed, the response signal will not be received. 1. Second monitoring unit 15-1
．． The signals of 15-2 both become "'0", and the start control section 1
6 will perform EMA activation again. This second H
By starting the MA, for example, the system central controller 11-1
and the main storage device 12-1.

If the system configuration is not normal in this case, try EMA again.
The activation takes place, and from the 3rd day of the EMA activation, for example,
1 system central control unit 11-1 and O system main storage device 12-
The system configuration is switched to system configuration 23 with 0. In this case as well, if the system configuration is not normal, the alarm control section 20 will display a system down alarm on the display section 19.

That is, in a system with an n-layer configuration, (n
The startup control unit 1 indicates that the system configuration has been switched ``-1) times.
If the system configuration is identified by the counter etc. in 6 and does not operate normally even after switching the system configuration, switching the system configuration n2 times will return to the first system configuration, so there is no need to switch the system configuration. When the system is down, an alarm signal is added to the alarm control section 20, and the display section 19
An alarm will be displayed indicating that the system is down.

FIG. 3 is an explanatory diagram of the operation of the embodiment of the present invention, (a),
[Yes]) is the first. The output signals of the second monitoring units 15-1 and 15-2 are shown, and since the monitoring signals are sent out at different timings, response signals can be received at different timings. If both response signals cannot be received due to a failure in the active system, the first. Second monitoring unit 15-1.15-2
Since the output signals of both become "0", for example, the output signal via the NOR circuit becomes "1", the HMA activation is performed at the rising edge of "1°".

1st. The second monitoring unit 15-1.15-2 operates for a fixed period of time
After outputting a signal of ``0'', it changes to ``1'' and then sends out a monitoring signal after a certain period of time, and the first EMA
If the system configuration does not become normal even if the system configuration is switched by startup, the monitoring units 15-1 and 15-2 will not be able to receive a response signal to the monitoring signal, and will output a 0'' signal again. When both become “0”, E
MA activation is performed. As a result, the system configuration is switched for the second time.

(C) of FIG. 3 shows a case where the time relationship is opposite to that of (a). That is, 1st. Second monitoring unit 151.1
When the monitoring signals 5-2 have the same period, as shown in (a), the first monitoring unit 15-1 cannot receive a response signal to the monitoring signal, so after outputting a "0" signal, , when it reaches "1" after a certain period of time, the second monitoring section 15
-2, as shown in (C), when a "0" signal is output due to failure to receive a response signal to the monitoring signal, the output signal of the first and second monitoring sections 15-1, 15-2 is Since both will no longer become "°0", EMA activation will not be possible.

In order to avoid this kind of problem, first. Second monitoring unit 1
5-1.15-2: Change the sending cycle of the monitoring signal, or make the time for returning to PA1'' after outputting a "0" signal longer than 1/2 of the sending cycle of the monitoring signal. Alternatively, the monitoring signal may be sent out asynchronously.

[Effects of the Invention] As explained above, the present invention provides the first
．． The second monitoring units 5-1 and 5-2 send monitoring signals to the active system central control unit 1 at different timings in predetermined cycles, and the first and second monitoring units 5-1 and 5-2 send a response signal to the monitoring signal. When the second monitoring units 5-1 and 5-2 cannot receive both signals, they determine that there is a failure in the active system, activate the EMA, switch the system configuration, and after a predetermined period, the first... It causes the second monitoring unit 5-1.5-2 to send out a monitoring signal,
If a normal operating system configuration cannot be obtained even after switching the system configuration by starting HMA, EMA startup will be performed again.
2-1) Since the system configuration can be switched automatically, the system configuration is often in normal operation during that time.

Therefore, there is an advantage that the probability of system failure is reduced and the reliability of systems such as electronic exchanges can be improved.

[Brief explanation of drawings]

FIG. 1 is an explanatory diagram of the principle of the present invention, FIG. 2 is a block diagram of an embodiment of the present invention, and FIG. 3 is an explanatory diagram of the operation of an embodiment of the present invention.
FIG. 4 is an explanatory diagram of the conventional example, and FIG. 5 is an explanatory diagram of the operation of the conventional example. 1 is a central control unit (CC), 2 is a main memory (MM),
3 is a system monitoring control device, 4 is an external monitoring device, 5-1
．． 5-2 is a monitoring section, and 6 is an activation control section.

Claims (1)

[Claims] External monitoring control in which a system consisting of a central control device (1) and a main storage device (2) in a multiplexed configuration is monitored by an external monitoring device (4) in a system monitoring and control device (3). In this method, two monitoring units (5-1, 5-
2) sends a monitoring signal to the central control unit (1) of the active system at different timings in a predetermined cycle, and sends a response signal to the monitoring signal to the two monitoring units (5-1, 5-1, 2).
In 5-2), when both signals cannot be received, it is determined that there is a failure in the active system, and an emergency control start is performed from the start control unit (6), and the system is reconfigured by the emergency control start, and after a predetermined period. An external monitoring control system characterized in that the monitoring signal is sent from the two monitoring units (5-1, 5-2).