JPH0449429A - Failure informing system for redundant system - Google Patents

Abstract

PURPOSE:To inform whether a stand-by system is failed or not before the stand-by system is turned to a main system by providing the failure informing system with a storage means for storing failure information obtained by a retrieving means and an informing means for giving the failure information to a master device when a prescribed status information instruction is sent from the master device. CONSTITUTION:The failure informing system is provided with an inspecting means for inspecting the existence of a failure for each of two duplicated internal systems, the storing means for storing the failure information obtained by the inspection means and the informing means for giving the failure information of the storing means to the master information when the prescribed status information instruction is sent from the master device. When power is supplied to the device, the inspecting means inspects whether a failure occurs in each of the two internal devices or not and writes failure information obtained as the inspected result in a storing means. When the prescribed status information instruction is sent from the master device, the informing means gives the failure information of the storing means to the master device. Consequently, the failure system can immediately repaired and the generation of system down can be prevented.

Description

[Detailed Description of the Invention] [Summary] Regarding a failure notification method in a redundant system, a failure notification in a redundant system that makes it possible to know whether or not a standby system has failed before the standby system becomes the main system. Although it is recognized as a single device by the host device, it physically has duplicated internal devices, and is one of the two duplicated internal devices. In a device where one internal device is designated as the main system and the other internal device is designated as the standby system, when the power of the above device is turned on, whether or not there is a failure in each of the two duplicated internal devices. an inspection means for inspecting the inspection means; a storage means for storing failure information obtained by the inspection means; and a storage means for storing failure information obtained by the inspection means;
and notification means for notifying the host device of the failure information of the storage means.

[Industrial application field]

The present invention relates to a failure notification system in a redundant system having two duplicated internal devices, one of which is the main system and the other is a standby system.

[Conventional technology]

In highly reliable systems, each system component is duplicated to make it difficult for the system to go down.

One component is the main system (Primary:
) The other is the standby system (Secondary: 5secondary)
), and normally only the main system is used, and only when the main system fails, the system switches to the standby system for operation.

[Problem to be solved by the invention]

In the above-mentioned operation format, even if there is a failure in an unused standby system, it is not notified in advance, and when the main system fails and the system is switched to the standby system, the system immediately goes down. .

The present invention was created in view of this point, and is based on a failure notification method in a redundant system that allows notification of whether or not a standby system has failed before the standby system becomes the main system. The purpose is to provide

[Means to solve the problem]

FIG. 1 is a diagram explaining the principle of the present invention. Although the present invention is recognized as one device by the host device, it is physically recognized as two devices.
Assuming a device that has duplicated internal devices, one of the two duplicated internal devices is designated as the main system, and the other internal device is designated as the standby system. It is said that

The present invention provides, in the above-mentioned apparatus, a test means for inspecting each of the two duplicated internal devices for the presence or absence of a failure when the power of the apparatus is turned on; A storage means for storing information, and when a predetermined status notification instruction is sent from a host device,
and notification means for notifying the host device of failure information of the storage means.

[Effect]

When the device is powered on, the inspection means inspects each of the two duplicated internal devices to see if a failure has occurred, and writes the resulting failure information into the storage means.

The notification means notifies the host device of the failure information in the storage device when a predetermined status notification instruction is sent from the host device.

〔Example〕

FIG. 2 is a diagram showing an example of a redundant system. In the same figure, HO3TO and ll05TI are host computers, DIR
O and DIRI are director, ΔRCO and ARCI are accessor controllers, AMCO and AMCI are accessor mechanism controllers, MEM is shared memory, ACC is accessor device, A and B are accessor controller ports, respectively. There is. Figure 2 shows the magnetic tape
It shows part of the electrical circuit of the library device. Magnetic tape library devices are well known.

The director DIRO is a microprogrammed control device that controls CC to the magnetic tape unit (not shown) and the accessor device that are lower-level devices, and exchanges commands etc. with the host computer (10STO, ll03TI). The data will be left behind. Director DIRI performs the same processing as director DIRO.

The accessor device ACC is the accessor controller A
It has an RCO accessor controller ARCI, an accessor mechanism controller AMCO, an MCI to the accessor mechanism controller, a shared memory MEM, and two accessor mechanism units (not shown).

Although the accessor controller ^RCO is not shown,
It has a director interface section, an MPU peripheral circuit consisting of a microprocessor and memory, and a device interface section. Accessor controller A
Upon receiving a movement command from the director DIRO or DIRI, the RCO sends the two accessor mechanism controllers ΔMCO based on the model code and the target cell.
, one of the eight MCIs, and issues a cartridge movement command to the selected accessor mechanism controller AMCO or AMCI. In addition, the accessor controller AIC0 is an accessor mechanism controller A that controls the accessor mechanism that needs to be evacuated.
Issue an evacuation command to the MCO or AMCI.

Furthermore, the accessor controllers 1 to roller ^RCO collect sense information and log information, and send them to the director DIR.
Report to O, DIRI. Accessor controller A
The RCI performs similar processing to the accessor controller ARCO.

The accessor mechanism controller AMCO controls the accessor mechanism section. The accessor mechanism section transports cartridges and tapes. The accessor mechanism controller AMCI performs the same processing as the accessor mechanism controller AMCO. The accessor mechanism controller AMCO controls the right accessor mechanism, and the accessor mechanism controller AMCI controls the left accessor mechanism.

Primary information and failure information are stored in the shared memory MEH. Accessor controller 8RCO
, ARCI can read/write the shared memory 1. Director DIRO, DII? The same applies to 1.

The present invention will be described in detail with reference to FIG.

When the power is turned on, DIRO-ARCO-AMCO in Figure 2
/ Focusing on the AMCI connection bus, ・DIRO-ARCO
Interface diagnosis between ARCO, ARCO internal self-diagnosis, ARCO-AMCO interface diagnosis, ARCO
- Performs AMCI interface diagnosis, and if a failure is detected in DIRO, the ARC is stored in the DIRO's internal memory.
A flag indicating that O is out of order is set to ON. A.R.
ARCO internal space below CO is ARCO-AMCO/
If a failure is detected between AMCI, ARCO and ARC
A flag indicating that ARCO is out of order is set to ON in the shared memory HEM between 1 and 1.

Also, D I R0-ARC1-AMCO/AMCI,
DIRI-ARCO-AMCO/AMCI.

D I R1-ARC1-AMCO/AMCI (7)
Perform a similar diagnosis focusing on the path.

Furthermore, when a failure occurs in the ARC on the primary side during operation and the switch is made to the secondary side, the corresponding flag is turned ON.
shall be.

When the accessor device status recognition command is issued from the HO3T, the failure status of ARCO and ARCl is recognized from the flag in the DIR and the flag in the shared memory, and is notified to the HO3T as status information.

HO3T displays the operational/inoperative status of ARCO/1, and if there is an ARC in a faulty state, preventive maintenance can be performed to prevent the system from going down.

FIG. 3 is a diagram showing primary information and failure information in the shared memory. At address 0, primary information indicating whether the accessor controller ARCO is primary is stored. In the primary information, 1 indicates primary, and 0 indicates secondary.

At address 1, primary information indicating whether the accessor controller ARCI is primary is stored.

Address 2 stores failure information indicating whether or not the accelerator controller ARCO is operable. In the failure information, 0 indicates operation, and ■ indicates failure. At address 3, failure information indicating whether the accessor controller ARC1 is operable or not is stored. Director DI+20 and D
Each IRI has internal memory for storing information as shown in FIG.

FIG. 4 is a diagram showing data sent in the state recognition command. When the director DIRO receives a status recognition command from the host computer, it sends out data as shown in FIG. Bit 0 in this data indicates whether the accessor controller ARCO is operable or not, and bit I indicates whether the accessor controller 8RC1 is operable or not. When the bit value is 0, it indicates operation, and when it is 1, it indicates failure.

The present invention will be described in detail with reference to FIG.

One of the accessor controllers RCO and ARCI is the primary (main system), and the other is the secondary (standby system). Normally, the one that is powered on first becomes the primary, and which one is the primary is registered in the shared memory MEH. The interface between DIR and AR0 is the RC from the director to the accessor controller.
O, recognizes the RCI as an address and selects it.

The operation when the accessor controller ARCO is powered on before the accessor controller ARCI will be described.

■ Accessor controller AI? When the values of address 0.1 in Figure 3 are both O, CO sets the accessor controller ARCO as the primary and sets the value of address O to 1), self-diagnosis of accessor controller ARCO, and ARCO-AMCO interface. - Test the path and ARCOAMCI interface path, and if both are normal, set the value of address 2 of the shared memory MEM to 0, and if a failure is detected in any of them, set the value of address 2 of the shared memory MEM to 0. Let the value of be 1. When the above operation is completed, the accessor controller ARC
O is the director old RO and DI from port A/B in Figure 2.
The director DIRO sends a Power On Alert signal to the RI (a signal indicating that the power has been turned on). Upon receiving and receiving this signal, the director DIRO performs a test of the DIRO-ARCO interface path. The director DTRO also issues a shared memory read command and reads the contents of the shared memory MEM. Director DIRI also performs similar processing. FIG. 5 (al indicates the processing when the accessor controller ARCO is powered on.

■ Accessor controller ARC under the condition where accessor controller ARCO is the primary
When I is powered on, accessor controller A
After RCI conducted a self-diagnosis, P.

wer On Alert signal to director old RO,D
Send a call to IRI.

The director DIRO tests the DIRO-ARCI interface path and sets the test result in its own internal memory. If the interface path is normal, the director DII? 0 issues a 12~Set Primary command to the accessor controller ARCI. Director A
The RCI also performs similar processing to the director ^RCO.

Upon receiving the Set Primary command, the accessor controller ARCI sets the value of the address O of the shared memory MEH to 0. Accessor with the value of address 1 as 1
Make controller ARCI the primary. Accessor controller ARCI then ARCI-AMC
O, Perform ARCI-AMCI interface path test. The above 9-cut result is set at address 3 of the shared memory MEM. FIG. 5(b) shows the processing when the accessor controller ARCI is powered on.

■ If no failure is detected in the above tests, the accessor controller 8RCI becomes the primary and the subsystem starts up. Accessor device AC in Figure 2
A command from the host computer to C is issued via the director DTRO or DIRI, and the director DIRO or old R1 that receives the command selects the accessor controller ARCI and issues the command to the accessor device ACC.

If a failure of the accessor controller ARCI is detected during the execution of an instruction to the accessor device ACC, SetPrimary is sent to the accessor controller ARCO.
Issues a command to make the accessor controller ARCO the primary, and updates the primary information/failure information in the director's internal memory and the shared memory MUM.

■ When the host computer +103TO,) IO5TI uses the accessor device ACC, it issues a status recognition command. Upon receiving this command, the director DrRO or DIRI selects the primary accessor controller ARCO or ARCI and sends the failure information of the accessor controller ^RCO and ARCI in the shared memory liver H to the accessor controller ^ using a shared memory read command.
Soak from RCO or ARCI.

Also, the ARC stored in the director's internal memory
The failure information of the O/ARCI and the failure information sucked from the accessor/controller are logically summed, and the result of the logical sum is sent to boss i as the state information of the accessor/controller.
・Send to computer. This sent data is shown in FIG.

- Each time the host computers HO5TO and HO3TI use the accessor device ACC, they can learn the status of the accessor controllers ARCO and ARCI, and if they are notified of a failure, they display a message urging preventive maintenance.

〔Effect of the invention〕

Conventionally, the secondary side was not diagnosed, so it was unclear whether the secondary side was operable or not, and there was no means to notify of a failure on the secondary side. Therefore, if the standby system in a redundant system has already failed, the main system can operate normally without any problems, but when the main system fails, the system immediately goes down and the redundant system The system makes no sense. In order to prevent this drawback, the present invention performs diagnostics on the standby system and notifies the failure state, so that repairs can be carried out immediately in the event of a failure.
You can prevent the system from going down.

[Brief explanation of drawings]

Fig. 1 is a diagram explaining the principle of the present invention, Fig. 2 is a diagram showing an example of a redundant system, Fig. 3 is a diagram showing an example of primary information and failure information in memory, and Fig. 4 is a diagram showing an example of the primary information and failure information in the memory. FIG. 5, which is a diagram showing an example of sending data, is a diagram illustrating processing when the access controller is powered on. HO3TO and ll03TI...host computer, DIR
O and DIRI...Director, ARCO and A11CI
...Accessor controller, eight MCOs and AMCI
...Accessor mechanism controller, MEM...Shared memory, ACC...Accessor device. Patent Applicant Fujitsu Limited Patent Attorney Kyotani 4 Department Address 1 Primary O 5 Secondary 0 5 Secondary 2nd appearance in man F' 4th plan

Claims (1)

[Claims] Although it is recognized as one device by the host device, it physically has duplicated internal devices, and one of the two duplicated internal devices In a device where one device is the main system and another internal device is the standby system, when the device is powered on, each of the two duplicated internal devices is inspected for failures. a storage means for storing failure information obtained by the testing means; and a storage means for storing failure information obtained by the testing means;
A failure notification method in a redundant system, comprising notification means for notifying a host device of failure information of the storage means.