JPH07121449A - Duplexed system device - Google Patents

Abstract

PURPOSE:To detect that the contents of duplexed information part is inadequate without obtaining the check sum of duplexed information in the case of a sub- unit for which the duplexed information part is not set yet after media format or when all the contents of the duplexed information part are inadequate. CONSTITUTION:This device consists of plural auxiliary storage devices 20 and 21 of a duplex system, a main memory 70 having control tables holding the online/offline states of the respective information devices and duplexed information parts 30 and 31 consisting of status information parts 40 and 41 which are respectively provided for a part of the specified storage unit area of the respective auxiliary storage devices, status information certifying parts 50 and 51 provided at the specified areas of specified storage unit areas excepting for the status information parts and stored with predetermined data and duplexed information recognition parts 130 and 131 to which the value peculiar to the duplex system is always set at the time of setting duplexed information.

Description

Detailed Description of the Invention

[0001]

FIELD OF THE INVENTION The present invention relates to a duplex or multiplex system.

[0002]

2. Description of the Related Art In recent years, a dual system has been increasingly used as an auxiliary storage system. This duplex system generally has two auxiliary storage devices (each called a subunit), and basically the contents of each of these subunits are kept the same. Then, the sub-units are theoretically regarded as one auxiliary storage device, and as long as either one of the sub-units is normal, the entire system is regarded as normal. Therefore, by adopting such a redundant system, a highly reliable auxiliary storage system can be realized.

By the way, in the duplex system, it is necessary to hold the state of each subunit, that is, the online state or the offline state. Here, the online state is a state in which the subunit is operating normally, and reading and writing are performed. However, when both subunits are online, the write operation is performed for both subunits (the same data is written), but the read operation is performed only for one of the subunits. Is common. Also,
The offline status is a status in which the subsystem is disconnected from the duplex system due to an instruction from the failure program of the subunit, and reading and writing are not performed for the offline subunit.

[0004] Here, conventionally, the following three methods are used as the status holding method of each sub-unit in the duplex system.
There are two methods. That is, (1) method of holding only by software (method 1) (2) method of holding by hardware (state holding hardware) other than the duplication system (method 2) (3) hardware in duplication system (duplication This is a method (method 3) of holding in the state holding part in the system.

In the method 1, the subunit is separated from the duplex system (that is, from the online state to the offline state) or installed (that is, from the offline state to the online state). The status is held by updating the duplexing control table indicating the status. Since this duplication control table is referred to when reading and reading / writing the duplication system, it is usually placed in the main memory. On the other hand, in the method 2, the state holding hardware is also updated when the above-mentioned duplex control table is updated. Further, in the method 3, the state holding unit in the duplex system is also updated when the above-mentioned duplex control table is updated.

[0006]

However, the duplex system to which the method 1, method 2 or method 3 is applied has the following problems. That is, the main memory is normally initialized when the system is restarted. Therefore, the above-mentioned duplex control table placed on the main memory is also initialized. As a result, when the previous online / offline state of the subunit is required in the system to which the method 1 is applied, there is a problem that the consistency of information as a duplex system is lacked.

In addition, in the system to which the method 2 is applied, although the trouble in the method 1 that occurs when the system is restarted can be solved, special information that does not disappear even if the system is restarted as state holding hardware is used. However, there was a drawback that various hardware such as a latch type relay was required.

Further, in the system to which the method 3 is applied,
There is no need to use special state-holding hardware, the state of each sub-unit before the stop can be correctly reproduced even when the system is restarted after the system is stopped, and it is equipped as a redundant information part on the sub-unit. Even if some or all of them are updated inappropriately, the invalidity can be detected and the malfunction of the system can be prevented.

[0009] However, in the above-mentioned method, the newly introduced media format has just been performed in the sub-units, and the sub-units in which the duplication information section has not been clearly set yet and all of the duplication information sections have been set. There was also the problem that the checksum had to be obtained even for the subunit whose contents were random.

Further, conventionally, the version number of the duplicated information section is given to the version management section in the duplicated information section, so that it is different in the situation where the duplicated information section having different specifications exists due to the change of use of the duplicated information section. When subsystems having the redundant information section of the specifications were illegally mixed in the same redundant system, the subsystem having the redundant information section that was not used was unconditionally taken offline. Although it cannot support some functions of the duplicated information part of the higher version, there is no problem even if the subsystem is brought online to support the rest of the functions except for that function and the operation as a duplicated system is performed. In some cases, the conventional version control cannot handle this.

Further, in the redundant system, the write operation is performed for all subsystems in the online state, but the write operations for a plurality of subsystems are not performed at the same time, and in many cases, the write operation is performed. Is performed sequentially for multiple subsystems. This means that if the redundant system goes down (stops) due to an error in the power supply unit for the redundant system during the writing process to multiple subsystems, the data consistency between the subsystems will be lost. It will disappear, and the operation as a redundant system after that cannot be guaranteed. Conventionally, a flag indicating that is set in the non-volatile memory immediately before the writing process for a plurality of subsystems is performed, and the process of clearing the flag is performed after the writing for all subsystems is completed. If the system goes down during the process, the system detects that the inconsistency between subsystems has occurred because the flag in the non-volatile memory remains unclear at the next system startup. However, this method requires the provision of a non-volatile storage device such as a non-volatile memory, which causes a problem that the system becomes expensive.

Further, without using the above-mentioned non-volatile memory device, a flag indicating that is written in the subsystem at the start of application processing after system startup, and the flag is cleared in the subsystem at the end of application processing. There was also a method to detect the possibility of inconsistency between subsystems due to the remaining, but this method has the problem that it cannot detect inconsistency in duplex processing other than during application processing. It was

The present invention has been made in view of the above points, and verifies whether or not the contents of the duplicated information portion of each subunit (auxiliary storage device) constituting the duplicated system have been changed by an improper operation. As a method of doing so, when the duplication information section has not been set after media formatting, or when all the contents of the duplication information section are incorrect, the checksum of the duplication information is summed up. It is an object of the present invention to provide a duplication system which detects that the contents of the duplication information section are not appropriate without requiring

Further, by providing the version management section with a major version section and a minor version section of the duplicated information section in the duplicated information section, there is a situation where a duplicated information section with different specifications exists due to a change in the specification of the duplicated information section. When subsystems with different specifications of redundant information coexist in the same redundant system, if upward compatibility can be maintained, even subunits with different specifications of redundant information parts will both operate online. The purpose is to provide a redundant system.

Further, without using an expensive non-volatile recording device such as a non-volatile memory, the duplication system during duplication processing due to an abnormality of the power supply device to the duplication system, which occurs between the simultaneous operation of the system machines and the working hours, It is an object of the present invention to provide a redundant system that detects the possibility of inconsistency between subsystems of the redundant system due to a down.

[0016]

DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described with reference to FIG. FIG. 1 shows a system having a duplicated system 10. Reference numerals 20 and 21 are auxiliary storage devices (hereinafter referred to as subunits). 30, 31 are subunits 20, 2
It is a specific storage area in 1 and corresponds to a redundant storage unit. Here, the storage unit area is a unit of block transfer in the subunit, and in a magnetic disk device, for example, a sector corresponds to this. Reference numerals 40 and 41 are status information sections provided in a predetermined part of the duplicated information sections 30 and 31. A time stamp or the like is recorded in the status information units 40 and 41, and the time stamp is written when the duplex system is set. When the partner subunit 20, 21 is separated from the duplex system, the time stamp at that time is written and updated, and the corresponding subunit 20, 2
When 1 is incorporated in the duplication system 10, the time stamp at that time is written and updated. Reference numerals 50 and 51 are status information verification units provided in areas other than the status information units 40 and 41 of the redundant information units 30 and 31. The status information verification units 50 and 51 are used to verify the validity of the corresponding status information units 40 and 41, and the status information verification units 50 and 51 store predetermined data.

Reference numeral 60 is a central processing unit (hereinafter referred to as CPU) for controlling the entire system, 70 is a main memory, and 80 is a duplex control table. The duplication control table 80 is provided on the main memory 70, and is for holding the state (online / offline state) of each of the subunits 20 and 21 constituting the duplication system 10. 9
Reference numerals 0 and 91 are channel devices for transferring data between the main memory 70 in the CPU 60 and the subunits 20 and 21.

Next, the operation of the embodiment of the present invention will be described. The duplication information identification unit 1 is included in the duplication information units 30 and 31.
30 and 131 are provided. Redundant information identification unit 130, 1
A value unique to the duplication system is always set in 31 when the duplication information sections 30 and 31 are set. Therefore, the media is formatted, and the duplicated information parts 30 and 31 are still formed.
Subsystems 20 and 21 that have not been set,
If the contents of the duplicated information 30 and 31 have been improperly rewritten due to a malfunction of the system, the duplicated information identification units 130 and 131 need to be assigned to the duplicated system before the inspection by the status information verification units 50 and 51. The validity of the duplicated information sections 30 and 31 can be easily verified only by checking whether the value of is set.

Next, another embodiment of the present invention will be described with reference to FIG. Each subunit 2 when starting the redundant system
When the duplicated information sections 50 and 51 are read from 0 and 21, the processing related to the version management sections 140 and 141 is performed.

Next, an example of the processing flow will be described with reference to FIG. Here, in FIG. 3, <maj> is the major version of the version management unit on the subsystem, <min> is the minor version of the version management unit on the subsystem, and <MAJ> is the corresponding version designation unit. It is a major version, and <MIN> is a minor version in the corresponding version designation part.
The major version units 150 and 151 of the version management units 140 and 141 and the major version unit 121 of the corresponding version establishing unit 120 are compared (S1). If the major version numbers of the version management units 140 and 141 and the major version number of the corresponding version designating unit 120 are not equal, the target subsystem is taken offline (S5). When the major version numbers of the version management units 140 and 141 are equal to the major version numbers of the corresponding version designation unit 120, the minor version units 160 and 1 of the version management units 140 and 141
61 is compared with the minor version part 122 of the corresponding version designating part 120 (S2). Version management unit 14
If the minor version number of 0, 141 is smaller than the minor version number of the corresponding version designating unit 120, the duplication process is performed by using only a partial function that the target subsystem can support (S4). When the minor version number of the version management units 140 and 141 is smaller than the minor version number of the corresponding version designating unit 120, the target subsystem is taken offline (S5). If the minor version numbers of the version management units 140 and 141 are the same, duplication processing is performed using all the functions of the duplication system (S
3).

Next, another embodiment of the present invention will be described with reference to FIG. The duplication system flag is written in the system operation status management units 170 and 171 immediately before the duplication system is started and the writing process to the subsystem is started, and the duplication process is executed in the system operation state management units 170 and 171 immediately before the duplication system is closed. Clear the flag. Immediately before the duplication system is started and the writing process to the subsystem is started, and before the duplication processing flag is written to the system operation state management units 170 and 171, the contents of the system operation state management units 170 and 171 are checked and the duplication processing is performed. If the medium flag is not cleared and the duplication processing in progress flag remains set, it is determined by normal procedures that the end-of-day processing of the duplication system was not performed when the system was used immediately before, and the duplication system It was judged that there was a possibility that data misbehavior (mismatch) occurred between the subsystems 20 and 21 in 10 and the specific 1
All subsystems except one subsystem offline, or using one specific subsystem as a source, copying the contents of the source subsystem to the remaining subsystems, and then starting the duplication processing. Take appropriate action.

[0022]

As described above, according to the present invention, it is verified whether or not the contents of the duplicated information portion of each subunit (auxiliary storage device) constituting the duplicated system have been changed by an improper operation. As a method to do so, if the duplicated information section has not been set after the media format, or if all the contents of the duplicated information section are incorrect, the duplication information section is purposely checked. A quick process can be performed only by inspecting the contents of the duplicated information section identification section without obtaining the sum.

Further, by providing the version management section with the major version number of the duplicated information section in the duplicated information, different specifications of the duplicated information section exist in the situation where the duplicated information section with different specifications exists due to the change of the specification of the duplicated information section. Even if subsystems having the redundant information section are mixed in the same redundant system, it is possible to operate the redundant system without taking the subsystem offline while maintaining the upward compatibility if possible.

Further, a method for detecting the possibility of inconsistency between subsystems of the redundant system due to the down of the redundant system during the redundant processing due to an abnormality in the power supply to the redundant system that occurs between the system startup and the end of the day It can be realized without using an expensive nonvolatile storage device such as a nonvolatile memory.

[Brief description of drawings]

FIG. 1 is a system configuration diagram showing an embodiment of a computer system to which the present invention is applied.

FIG. 2 is a system configuration diagram showing another embodiment of a computer system to which the present invention is applied.

FIG. 3 is a flowchart showing a processing flow of another embodiment of the computer system to which the present invention is applied.

FIG. 4 is a system configuration diagram showing still another embodiment of a computer system to which the present invention is applied.

[Explanation of symbols]

10 Duplication system 20,21 Auxiliary storage device (subunit) 30,31 Duplication information part 40,41 Status information part 50,51 Status information verification part 60 Central processing unit (CPU) 70 Main memory 80 Duplication control table 90,91 Channel Device 110,111 Time stamp part 120 Corresponding version designation part 121 Corresponding version designation part Major version part 122 Corresponding version designation part Minor version part 130,131 Duplex information identification part 140,141 Version management part 150,151 Version management part Major version part 160,161 Version management section Minor version section 170,171 System operating status management section

Claims (3)

[Claims] 1. A plurality of auxiliary storage means forming at least a redundant system, a main memory means having a control table for holding the online / offline status of each of these information devices, and a specific storage unit area of each auxiliary storage means. A status information section provided in each part, a status information verification section in which predetermined data is stored in a predetermined area of the specific storage unit area excluding this status information section, and duplication information are set A duplexing system device comprising: a duplexing information means, which sometimes comprises a duplexing information identifying section in which a value unique to the duplexing system is always set. 2. A plurality of auxiliary storage means forming at least a redundant system, a main memory means having a control table for holding the online / offline status of each of these information devices, and a specific storage unit area of each auxiliary storage means. A status information section provided in each part, a status information verification section provided in a predetermined area of the specific storage unit area excluding this status information section and storing predetermined data, and a major version section The duplexing information means including the version management unit including the minor version unit is provided, and when the system is set to duplex, the control method of the duplexing system is determined based on the version number of the version management unit in the duplexing information unit. A redundant system device characterized by the above. 3. A plurality of auxiliary storage means forming at least a redundant system, a main memory means having a control table for holding the online / offline status of each of these information devices, and a specific storage unit area of each auxiliary storage means. A status information section provided in each part, a status information verification section provided in a predetermined area of the specific storage unit area excluding this status information section and storing predetermined data, and a system operating state management A duplexing system device comprising: a duplexing information means consisting of a unit, and setting the contents of the system operating state management unit to a system stop state before writing the first duplexed data after the system starts.