JPH07225698A - Standby redundant multiplex processing system and changing method for check point cycle used therefor - Google Patents

Abstract

PURPOSE:To reduce the loads of a system accompanying the identity of an internal state by guaranteeing the identity of the internal state with other program modules when it is judged that the internal state is changed and changing a check point cycle when the internal state is not changed. CONSTITUTION:An internal state monitoring part 7 judges whether or not the internal state is changed by an execution processing part 5 during a period from a previous check point to the check point at present. Then, when it is judged that the internal state of the program module is not changed, the cycle of the check point held at present is prolonged. On the other hand, when an internal state judgement part 7 judges that the internal state is changed, a check point cycle setting part 6 is informed so as to reset the check point cycle to a initial value, an internal state identity holding part 9 is activated and the internal state of a standby system program module is rewritten with the contents of the internal state of a main system program module.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a standby redundant type multiplex processing system and a checkpoint cycle changing method used therein.

[0002]

2. Description of the Related Art In a parallel / distributed processing system, a standby redundant type multiplex processing system is one of those that improve the reliability of a computer processing system. This standby redundancy type multiplex processing system is a method of multiplexing program modules, giving an execution right to any of the program modules to execute processing, and when a program module given the execution right fails, The execution right is transferred to the remaining other multiplexed program modules to continue the execution. That is, if the program module that has the execution right is the main system and the program module that does not have the execution right is the standby system, the main system normally executes the process,
When the main system fails, the standby system becomes a new main system and continues to execute processing.

In such a standby redundant type multiple processing system, the standby system does not perform actual processing until a failure of the main system occurs. Therefore, the processing load of each computer processing system is small, and effective use of computer resources is required. While it can be planned,
It is necessary to maintain the identity of internal states such as memory contents between the main system and the standby system.

Therefore, conventionally, a method in which a system designer intentionally specifies a checkpoint for maintaining the same internal state of the main system and a standby system in a program, and the checkpoint is time-consuming. A method is known in which the internal state is periodically provided from the main system to the standby system by periodically providing them at equal intervals.

However, in the method in which the system designer consciously specifies the checkpoint in the program,
Each time the program was changed, the structure of the program had to be understood and checkpoints had to be set again, which increased the burden on the system designer. In addition, in the method of setting checkpoints in a fixed cycle,
The system designer no longer needs to be aware of checkpoints, but the internal state is transferred regardless of whether or not the internal state of the main system has changed, which is not efficient.

[0006]

As described above, in the method in which the system designer consciously specifies the checkpoint in the program, the checkpoint must be set again each time the program is changed. There is a problem that the burden on the designer increases. Also, with the method of setting checkpoints in a fixed cycle, the system designer does not need to be aware of checkpoints, but since the internal state is transferred regardless of whether the internal state of the main system changes, There was a problem that it was not efficient.

As described above, there has been a strong demand for a method of setting an efficient checkpoint in the standby redundant multiplex processing system. Therefore, it is an object of the present invention to provide a standby redundant multiplex processing system capable of reducing the system load associated with the operation of maintaining the identity of internal states by efficiently taking checkpoints. .

[0008]

According to the present invention, in order to solve the above problems, when a program module to which an execution right is given out of a multiplexed program module fails, it is executed by another program module. In a standby redundant multiplex processing system for giving a right to continue execution, a checkpoint cycle storing means for storing a checkpoint cycle described as a time value, and the execution right is given according to the checkpoint cycle. Internal state monitoring means for determining whether or not the internal state of the program module has been changed, and the program module to which the execution right has been given and the other program module based on one determination result by the internal state monitoring means. Identity maintaining means for maintaining the identity of the internal state between and,
Based on other determination results by the internal state monitoring means,
A standby redundant type multiplexing processing system comprising: a checkpoint cycle changing means for changing the checkpoint cycle stored in the checkpoint cycle storing means.

Further, according to the present invention, in the case of a program module to which an execution right is given out of the multiplexed program modules, a standby redundancy type multiplex is given in which the execution right is given to another program module to continue the execution. In the chemical processing system, a checkpoint cycle storage means for storing a checkpoint cycle described as a temporal value, a checkpoint cycle changing means for changing the checkpoint cycle stored in this means, and a checkpoint cycle according to the checkpoint cycle. , An internal state monitoring unit that determines whether the internal state of the program module to which the execution right is given is changed, and an internal state between the program module to which the execution right is given and the other program module. The identity retention means for retaining identity and the internal state monitoring means When it is determined that the internal state has not been changed, the checkpoint cycle changing means is activated, and the internal state monitoring means determines that the internal state has been changed. A standby redundancy type multiplex processing system comprising: a second starting unit for starting the identity maintaining unit.

Further, the present invention is configured from the viewpoint that either the program module to which the execution right is given, that is, the main system program module, or the other program module, that is, the standby system program module manages the checkpoint cycle. To be done.

That is, according to the present invention, in the case of a program module to which an execution right is given out of the multiplexed program modules, a standby redundancy type multiplex is given in which the execution right is given to another program module to continue the execution. In the computerized processing system, the program module to which the execution right is given has a checkpoint cycle storing means for storing a checkpoint cycle described as a temporal value, and a check for changing the checkpoint cycle stored in this means. Point cycle changing means, sending means for sending its own internal state to the other program module, and determining whether or not the internal state of the program module to which the execution right has been given has been changed according to the checkpoint cycle. The internal state monitoring means and the internal state monitoring means First activating means for activating the checkpoint cycle changing means when it is determined that the state has not been changed, and activating the sending means when it is determined that the internal state has been changed by this means. Second
And an internal state changing means for storing an internal state, and an internal state changing means for changing the internal state stored in the internal state storing means according to the internal state sent by the sending means. A standby redundant type multiplex processing system including a state changing unit.

Further, according to the present invention, when a program module to which an execution right is given out of the multiplexed program modules fails, the standby redundancy type multiplex is given in which the execution right is given to another program module to continue the execution. In the computerized processing system, the program module to which the execution right is given determines whether or not its internal status is changed in response to an inquiry request from the other program module, and this means. And a checkpoint cycle storage means for storing a checkpoint cycle described as a temporal value, and a sending means for sending the determination result according to the above to the other program module. Checkpoint cycle changing means for changing the stored checkpoint cycle, Internal state storage means for storing the internal state, internal state change means for changing the internal state stored in this means, and an inquiry request for the internal state change status to the internal state monitoring means according to the checkpoint cycle. And a first starting means for activating the checkpoint cycle changing means when the judgment result from the sending means does not include the internal state, and a judgment result from the sending means includes the internal state. And a second activation means for activating the internal state changing means to change the internal state stored in the internal state storage means to the transmitted internal state. .

On the other hand, the present invention is also configured from the viewpoint of a checkpoint cycle changing method used in a standby redundant multiprocessing system. That is, the present invention provides a standby redundant type multiplex processing system which, when a program module to which an execution right is given out of the multiplexed program modules fails, gives the execution right to another program module and continues the execution. In the method of changing the checkpoint cycle used for, the step of determining whether the internal state of the program module to which the execution right is given is changed according to the checkpoint cycle, and the execution right is given by this step. If it is determined that the internal state of the program module has changed,
Transmitting the internal state of the program module to which the execution right is given to the other program module, and changing the internal state of the other program module according to the internal state transmitted by this step, When the determination step determines that the internal state of the program module to which the execution right has been given has not been changed, the check used in the standby redundant type multiplex processing system comprising the step of changing the checkpoint cycle. This is a method of changing the point cycle.

Further, according to the present invention, when a program module to which an execution right is given out of the multiplexed program modules fails, a standby redundancy type multiplex is given in which the execution right is given to another program module to continue the execution. In a method of changing a checkpoint cycle used in a computerized processing system, an internal state of a program module given the execution right is changed to a program module given the execution right from the other program module according to the checkpoint. Sending an inquiry request for inquiring whether or not there is a case, and determining whether the internal state of the program module to which the execution right is given is changed according to the inquiry request sent from the other program module. And this step Returning the determined judgment result to the other program module, and changing the checkpoint cycle when the returned judgment result does not include the internal state of the program module to which the execution right is given. And the determination result returned by the response step includes the internal state of the program module to which the execution right has been given, the other program module according to the internal state included in the determination result. It is a method of changing a checkpoint cycle used in a standby redundant type multiplex processing system, which comprises a step of changing an internal state.

[0015]

According to the present invention, the following actions occur.
That is, whether or not the internal state has changed according to the checkpoint cycle is monitored, and when it is determined that the internal state has changed, the identity of the internal state with other program modules is guaranteed, and When it is determined that the internal state has not changed, the checkpoint cycle is changed, so that the internal state can be monitored with an efficient checkpoint cycle. This makes it possible to reduce the load on the computer system that accompanies the processing for maintaining the identity of the internal states.

More specifically, whether or not the internal state is changed according to the checkpoint cycle is monitored, and when it is determined that the internal state is changed, the internal state is the same as that of another program module. And the checkpoint cycle is changed to a value shorter than the current checkpoint cycle, it is possible to avoid a situation where the checkpoint cycle continues to be long.

On the other hand, when it is determined that the internal state has not changed, the checkpoint cycle is changed to a value longer than the current checkpoint cycle, so the frequency of performing the processing for keeping the internal state the same is reduced. Will be possible.

As a result, it is possible to reduce the load on the computer system associated with the processing for maintaining the identity of the internal states. Further, when it is determined that the program module to which the execution right is given changes the internal state, the program module side to which the execution right is given sends the internal state to another program module, and the other program module The internal state is changed according to the internal state sent by the side to ensure the identity of the internal state.

At this time, when it is determined that the internal state has been changed, the internal state is kept the same, and the checkpoint cycle changing means changes the checkpoint cycle so that the checkpoint cycle becomes shorter. It will be possible to avoid the situation of becoming too long.

If it is determined that the internal state has not changed, the checkpoint cycle is changed on the side of the program module to which the execution right is given, so that the process for maintaining the same internal state is performed. It is possible to reduce the frequency of doing it.

As a result, it is possible to reduce the load on the computer system associated with the processing for maintaining the identity of the internal states. On the other hand, in response to an inquiry request from another program module to which the execution right has not been given, the program module to which the execution right has been given judges whether or not the internal state has changed, and returns the judgment result to the other program module. To do. On the other program module side, when the sent determination result includes the internal state, the internal state of itself is changed to guarantee the internal state.

At this time, since the checkpoint cycle changing means changes the checkpoint cycle so that the internal state remains the same, the checkpoint cycle can be avoided from being too long. Become.

If the sent determination result does not include the internal state, the checkpoint cycle changing means changes the checkpoint cycle so that the checkpoint cycle becomes longer. Therefore, the processing for keeping the internal state the same is performed. It is possible to reduce the frequency of doing it.

Furthermore, since the management of the checkpoint cycle is performed by the other program module that is not given the execution right, it is possible to reduce the interruption of the original processing performed by the program module to which the execution right is given. This makes it possible to reduce the load on the computer system that accompanies the processing for maintaining the identity of the internal states.

[0025]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings. (First Embodiment) FIG. 1 is a diagram showing a schematic configuration of a standby redundant type multiplexing processing system according to the present invention. In this embodiment, the execution unit of the computer processing system is a program module. In FIG. 1A, this processing device 1
a, 1b, 1c have program modules registered,
Interpret and execute the program module. Further, the processing devices 1a, 1b, 1c include message exchange devices 2a,
The communication paths 3 are connected to each other via 2b and 2c. The message exchange devices 2a, 2b, 2c are for controlling communication between program modules.

Further, FIG. 2B is a diagram showing an example of the configuration of the processing apparatus 1. The processing device 1 includes a CPU (Cent
ral Processing Unit) 101, ROM (Read Only Me)
mory) 102, RAM (Random Access Memory) 103
And an I / O device (Input / Output unit), which are connected by a system bus 105.

Further, in the present invention, for the reason of improving reliability, individual program modules are multiplexed and distributed in other main processing units. FIG. 2 is a diagram for explaining the concept of multiplexed program modules.

In the figure, program module A
Are registered in the present processing devices 1a, 1b, 1c, respectively. Here, for the program module A, the multiplexed program modules are A1 and A, respectively.
2, A3. In addition, each of the main processing devices 1a, 1
program modules A1, registered in b, 1c, ...
Of A2 and A3, only program module A1
Execution rights are given to the program modules, and the remaining program modules A2 and A3 are program modules to which the execution rights are not given. That is, the program module A1 is the main system that operates normally, and the remaining program modules A2 and A3 do not perform actual processing during normal operation. Only when the program module A1 fails for some reason, One is a standby system that is waiting for the new main system. Thus, when there are two or more standby systems, any one of the standby systems will switch to the main system when the main system fails.

Similarly, the program module B is provided in each of the processors 1a and 1b.
1 and B2 are registered, the program module B1 of the main processing unit 1b is the main system, and the program module B2 of the main processing unit 1a is the standby system. Similarly, the program module C includes the processing devices 1a, 1b and 1
c and program modules C1, C2 and C3, respectively
The program module C1 of the main processing unit 1c is the main system, and the program modules C3 and C2 of the remaining main processing units 1a and 1b are the standby system.

In this way, a certain program module is multiplexed into the active execution unit group which is the main system and the standby execution unit group which is the standby system. In the event of a failure, the system in which the remaining standby system switches to the main system and continues processing is called a standby redundant multiplex processing system.

In such a standby redundant type multiplex processing system, it is necessary to maintain the same internal state between the main system and the corresponding standby system, and a mechanism therefor is required.
For this reason, the standby redundancy type multiplex processing system employs a method of providing a time point when a certain program module determines whether or not to transfer its internal state. In this embodiment, this "some point" is called a checkpoint, and the interval from one checkpoint to the next checkpoint is called a checkpoint cycle.

By the way, two types are conceivable as a method of maintaining the identity of the internal state between the main system and the standby system. One is a method of transferring the internal state of the main system to the corresponding standby system (main system initiative) according to a checkpoint managed by the main system side. The other is a method of sending a transfer request from the standby system to the corresponding main system according to the checkpoints managed by the standby system side, and transferring the internal state of the main system to the standby system according to the transfer request (standby system initiative). is there.

FIG. 3 is a diagram for explaining the concept of such checkpoint management. The figure (a) shows the execution of the program module in the case of the main system initiative, and the figure (b) shows the execution of the program module over time.

That is, as shown in FIG. 7A, at the check points Pn-1, Pn, ... Managed on the main system side, the main system judges whether or not the internal state has been changed, and changes the internal state. If it is determined that there is, the internal state is transferred to the standby system. That is, FIG. 9A shows that the internal state I was transferred from the main system to the standby system because the internal state determined at the check point Pn was changed.

On the other hand, as shown in FIG. 7B, at the check points P _n-1 , P _n , ... Managed on the standby system side, the standby system requests the main system to transfer the internal state, The system receives this and determines whether the internal state has changed,
The judgment result is transmitted to the standby system. Then, in the standby system, when the transmission result includes the internal state, it is updated to the transmitted internal state. That is, in the same figure (b), the main system determines the determination result D according to the request signal R from the standby system indicated by the broken line.
Is being transferred. In this case, the main system may uniformly transmit the internal state and the standby system may determine whether or not the transmitted internal state is changed.

Next, the checkpoint setting mechanism of the redundant standby multiprocessing system according to the present invention will be described with reference to FIG. FIG. 4 is a diagram for explaining the checkpoint setting mechanism according to the present invention. In this embodiment, a checkpoint setting mechanism is provided in the main system program module.

In FIG. 1, the operating system 4 controls the execution of program modules and the communication between the main processing units 1 in a centralized manner. The execution processing unit 5 is a unit that, under the control of the operating system 4, executes processing unique to the program module when the target program module is registered.

The checkpoint cycle setting section 6 is composed of a checkpoint cycle storage section 6a, a checkpoint cycle changing section 6b and a checkpoint timing determining section 6c. The checkpoint cycle storage unit 6a stores the checkpoint cycle described as a temporal value (for example, 10 [ms]). The checkpoint cycle changing unit 6b initializes or changes the checkpoint cycle stored in the checkpoint cycle storage unit 6a. The checkpoint timing determination unit 6c determines whether or not the elapsed time counted by the built-in clock mechanism has reached the checkpoint cycle stored in the checkpoint cycle storage unit 6a.
The internal state monitoring unit 7 described later is activated.

The checkpoint cycle setting unit 6 is activated by the operating system 4 at least before the execution processing unit 5 of the program module is activated by the operating system 4. In this embodiment, when instructed to register the target program module as the master system, the operating system 4 activates the checkpoint cycle setting unit 6 after registering the program module.

The internal state monitoring section 7 is an internal state determining section 7
a, a first starting unit 7b and a second starting unit 7c. The internal state determination unit 7a monitors whether the internal state of the program module in the execution processing unit 5 has changed.
Specifically, when the checkpoint timing determination unit 6c determines that the checkpoint cycle has been reached, the internal state monitoring unit 7 operates the operating system 4
Is launched via. Then, the execution processing unit 5 determines whether or not the internal state has been changed from the previous checkpoint to the current checkpoint. That is, when the time measured by the checkpoint timing determination unit 6c reaches the checkpoint cycle, the internal state determination unit 7a, under the control of the operating system 4, checks the checkpoint timing determination unit 6c.
Is started by. Then, the internal state determination unit 7a
Determines whether the internal state of the main system program module has been changed from the previous checkpoint to the current checkpoint. Whether or not the internal state has been changed is determined, for example, by referring to whether or not the data area of the internal state management table 8 has been accessed. This will be described with reference to FIG. As shown in FIG. 9A, the internal state management table 8 has three fields, that is, the access bit field 5
1, a data area start address field 52, and a data area size field 53. Further, as shown in FIG. 7B, the data area start address field 52 holds the start address of the data area indicated by the data area size field 53, and the access bit field 51 indicates the data area. When the data area designated by the head address field is accessed, the bit is rewritten to "1". The access bit field 51 will be reset to "0" after the internal state monitoring unit 7 determines that the internal state has been changed.

The determination of whether or not the internal state has been changed is not limited to the above embodiment, and a method of referring to whether or not the execution processing unit 5 has been activated after the last checkpoint cycle is also the present invention. Included in the summary of.

When the internal state determination unit 7a determines that the internal state of the program module has not changed at the checkpoint, it notifies the first activation unit 7b to that effect. Then, the first activation unit 7b notifies the checkpoint cycle changing unit 6b of the fact in order to lengthen the checkpoint cycle currently held in the checkpoint cycle storage unit 6a. Checkpoint cycle changing unit 6b
Then, when the notification that the checkpoint cycle is lengthened is received, the checkpoint cycle currently held in the checkpoint cycle storage unit 6a is changed by a predetermined method,
Re-hold. As a method of changing the checkpoint cycle, for example, a method of lengthening the current set timing by a fixed rate or a method of increasing it by a predetermined constant value can be cited.

In the present embodiment, if the internal state determination unit 7a determines that the internal state of the program module has changed at the current checkpoint, the internal state determination unit 7a executes the first activation. Notify both the unit 7b and the second activation unit 7c. And the 1st starting part 7
b notifies the checkpoint cycle setting unit 6 of the fact that the checkpoint cycle should be reset to the initial value, while the second activation unit activates the internal state identity retention unit 9.

The activated internal state identity holding unit 9 rewrites the internal state of the standby system program module with the contents of the internal state of the main system program module. That is, the internal state identity maintaining unit 9 updates the data area of the internal state management table 8'according to the contents of the internal state management table 8 of the main system program module and the register information.

The internal state means each of the register information in the execution suspended state of the execution processing unit 5 and the data area managed by the internal state management table 8.

As a result, the internal states of the main system program module and the standby system program module can be made the same. Since the data area address used by the program module is known in the memory management table 8, it can be easily retrieved. Further, since the register information of the execution processing unit 5 is known to the operating system 4 or the like, it can be easily retrieved and updated by using the system function prepared in the operating system 4 or the like.

In FIG. 4, the main system program module and the standby system program module are controlled by the same operating system 4, but it is not necessary to pay particular attention to this.

Next, the internal state identity maintaining unit of the standby redundant multiplex processing system according to this embodiment will be described in more detail. FIG. 6 is a diagram showing a configuration of a standby redundant type fire treatment system according to the present invention. Since the configuration other than the internal state identity maintaining unit is the same as that in FIG. 4, description thereof will be omitted.

The internal state transmitting section 10 includes an internal state monitoring section 7
If you receive a notification from the
It is activated by the operating system 4 and transmits the internal state of the program module to the internal state receiving unit 11 of the corresponding standby system program module via the message exchange device 2 and the communication path 3. The communication of the internal state can be realized by using a communication function between program modules supported by the operating system 4, for example, a message communication, but it is not necessary to be particular about this and provided independently of the operating system 4. You may do so. Upon receiving the internal state, the internal state receiving unit 11 of the standby system program module updates the data area of the memory management table 8'according to the received content and updates the register information.

As a result, the internal states of the main system program module and the standby system program module can be made the same. The standby redundant multiplex processing system according to the present invention configured as described above operates as follows.

FIG. 7 is a diagram for explaining the processing operation of the standby redundant type multiplex processing system according to this embodiment. More specifically, FIG. 9A is a diagram for explaining the processing operation of the main system program module, and FIG.
FIG. 6 is a diagram for explaining a processing operation of a standby system program module.

After the program module is registered by the operating system 4, the activated checkpoint cycle setting unit 6 holds a preset initial value as a checkpoint cycle (S71a). That is, for example,
The initial value is set to 10 [ms]. The checkpoint cycle setting unit 6 is
The internal state monitoring unit 7 is activated according to the held checkpoint cycle (S72a). The activated internal state monitoring unit 7 checks whether the internal state of the program module has changed (S73a). In this embodiment,
The internal state monitoring unit 7 refers to whether or not the access bit is changed in the internal state management table 8 (S74a).

When the internal state monitoring unit 7 determines that the internal state has been changed, that is, when the value of the access bit field is 1, the internal state transmission unit 10 is activated to start the internal state of the program module. Is transmitted to the internal state receiving unit 10 of the corresponding standby program module (S65a). On the other hand, the standby program module changes its own internal state according to the received contents of the internal state of the program module (S62b) after receiving by the internal state receiving unit 11 (S61b). After transmitting the internal state, the main system program module returns to S61a, sets the checkpoint cycle to the initial value, holds it again, and repeats the above processing.

On the other hand, when the internal state monitoring unit 7 determines that the internal state has not been changed, that is, when the value of the access bit field remains 0, the checkpoint cycle currently held is the upper limit value. It is determined whether or not (S66a). If the checkpoint cycle does not exceed the upper limit value, the checkpoint cycle currently set in the checkpoint cycle setting unit 6 is lengthened, and the fact is notified (S67a).
In this embodiment, the held checkpoint cycle is increased by a fixed rate. For example, the currently held checkpoint cycle is 10 [ms]
If it is, it is held again as 12 [ms], which is an increase of 20%. After updating the checkpoint cycle by the checkpoint cycle setting unit 6, the process returns to S62a,
The above process is repeated. If the current checkpoint cycle exceeds the upper limit value, the checkpoint cycle is not changed, the process returns to S62a, and the above process is repeated.

With respect to the above-described operation processing, for example, with respect to the program module A, the main system module A1 sets a checkpoint cycle, and it is determined whether or not the internal state of A1 is changed at the checkpoint. If it has been changed, it notifies its own internal state to the standby program modules A2 and A3. A2 and A3 will change their internal state according to the internal state they receive.

As described above, according to the present invention, when the execution processing section 5 of the program module is not executing the processing or when the internal state thereof is not changed, the checkpoint cycle becomes long and the It is possible to reduce the frequency of performing processing for maintaining the same internal state with the standby system. Therefore, the CPU allocation time for other program modules registered in the same processing apparatus increases, resulting in improvement of the processing performance of the computer system.

Further, after the checkpoint cycle becomes long based on the stop of the operation of the execution processing unit 5, the execution processing unit 5
If it is determined that the internal state has changed in the checkpoint cycle after restarting the operation of, the checkpoint cycle is set back to the initial value, so the standby system program module at the time of failure of the main system program module The process take-over time to the system does not become too long.

When the operation of the execution processing unit 5 is stopped for a very long time and then the processing is restarted, it is conceivable that the checkpoint cycle becomes correspondingly long. Therefore, if a failure occurs before the next checkpoint, the processing takeover time of the standby system program module becomes long. Therefore, in a system in which it is necessary to avoid falling into such a situation, it is possible to avoid by setting a maximum value of the checkpoint period in advance and preventing it from becoming longer than the maximum value. . (Modification) The following various modifications can be considered regarding the present invention.

First, an embodiment will be described in which the checkpoint cycle is shortened when it is determined that the internal state has been changed, and the checkpoint cycle is returned to the initial value when it is determined that there is no change. To do.

FIG. 8 is a diagram for explaining the processing operation of the standby redundant multiplex processing system according to the first modification of the embodiment. In the figure, the steps up to the step of determining the presence / absence of a change (S81 to 83) are the same as in the above-described embodiment. Then, in step S84, when the internal state monitoring unit 7 determines that the internal state is changed,
That is, when the value of the access bit field is 1, the internal state transmission unit 10 is activated and the internal state of the program module is transmitted to the internal state reception unit 11 of the corresponding standby program module (S85). On the other hand, the standby system program module changes its own internal state in accordance with the received content of the internal state of the program module after being received by the internal state receiving unit 11. This standby system program module is the same as that of the above-mentioned embodiment. Then, in the main system program module, after transmitting the internal state, the internal state monitoring unit 7 determines whether the currently held checkpoint cycle exceeds the lower limit value (S86). If the checkpoint cycle exceeds the lower limit, the internal state monitoring unit 7
Informs that the checkpoint cycle currently held in the checkpoint cycle setting unit 6 is shortened (S87). In this embodiment, the held checkpoint cycle is reduced by a fixed rate. For example, if the currently held checkpoint period is 10 ms, it is re-held as a 20% reduction of 8 ms. After updating the checkpoint cycle, the process returns to S82 to repeat the above process.

On the contrary, if the internal state monitoring unit 7 determines that the access bit has not been changed, it means that the internal state has not changed. Therefore, the process returns to S81 and is checked by the checkpoint cycle setting unit 6. After setting the point cycle to the initial value, the above process is repeated. If the currently held checkpoint cycle exceeds the upper limit value, the checkpoint cycle is not changed and the process returns to S82 and the above processing is repeated.

As described above, according to the present invention, when the execution processing unit 5 of the program module is executing processing, the checkpoint cycle becomes short, and the internal states of the main system and the standby system are the same. It is possible to increase the frequency of performing the processing for holding the. Therefore, the processing takeover time at the time of main system failure is shortened and the processing interruption time at the time of main system failure is shortened.

Further, after the checkpoint cycle is shortened based on the continuation of the operation of the execution processing unit 5, the execution processing unit 5
If it is determined that the internal state has not changed in the checkpoint cycle after stopping the operation of, the checkpoint cycle is reset to the initial value, so the main system does not process and the internal state is updated. Although not done, it is possible to prevent processing at the checkpoint in a short cycle.

When the operation of the execution processing section 5 continues for a very long time, the checkpoint cycle is correspondingly shortened, so that the original processing may not be sufficiently performed. . Therefore, in a system where it is necessary to avoid falling into such a situation, it is possible to avoid it by setting a minimum value of the checkpoint period in advance and preventing it from becoming shorter than the minimum value. .

Next, a second modification will be described. FIG. 9 is a diagram for explaining the processing operation of the standby redundant multiprocessing system according to the second modification of the embodiment. In the figure, the step of determining whether or not there is a change (S91-
Up to 93), it is the same as the above-mentioned embodiment. And
In step 94, when the internal state monitoring unit 7 determines that the internal state has changed, that is, when the value of the access bit field is 1, the internal state transmitting unit 1
0, and the internal state of the program module is changed to the internal state receiving unit 11 of the corresponding standby program module.
(S95). On the other hand, the standby system program module changes its own internal state in accordance with the received content of the internal state of the program module after being received by the internal state receiving unit 11. This standby system program module is the same as that of the above-mentioned embodiment. In the main system program module, after transmitting the internal state, the internal state monitoring unit 7 determines whether the currently held checkpoint cycle exceeds the lower limit value (S96). If the checkpoint cycle does not exceed the lower limit value, the internal state monitoring unit 7 notifies the checkpoint cycle setting unit 6 to shorten the checkpoint cycle currently held (S96). . In this embodiment, the held checkpoint cycle is reduced by a fixed rate. For example, if the currently held checkpoint cycle is 10 [ms], it is held again as 8 [ms], which is a 20% reduction. After updating the checkpoint cycle by the checkpoint cycle setting unit 6, the process returns to S82 and the above processing is repeated.

On the contrary, if the internal state monitoring unit 7 determines that the access bit has not been changed, it means that the internal state has not changed, so whether the current checkpoint cycle exceeds the upper limit value. It is determined (S98).
Then, if the checkpoint cycle does not exceed the upper limit value, the internal state monitoring unit 7 notifies the checkpoint cycle setting unit 6 in order to lengthen the checkpoint cycle currently held (S99). . In this embodiment, the held checkpoint cycle is increased by a fixed rate. For example, if the currently held checkpoint cycle is 10 [ms], it is held again as 12 [ms], which is an increase of 20%. After updating the checkpoint cycle by the checkpoint cycle setting unit 6, the process returns to S92 and the above processing is repeated. If the current checkpoint cycle exceeds the upper limit value, the checkpoint cycle is not changed, the process returns to S92, and the above processing is repeated.

As described above, according to the present invention, when the execution processing unit 5 of the program module is not executing the processing, the checkpoint cycle becomes long, and the internal states of the main system and the standby system are the same. It is possible to reduce the frequency of performing the processing for holding the. Also, if there is a change in the internal state, the checkpoint cycle becomes shorter, and the processing takeover time of the standby system at the time of the main system program module failure becomes shorter. Therefore, the checkpoint cycle fluctuates according to the activation state of the processing of the program module, so that the optimum checkpoint cycle can be set.

In addition to the above-mentioned embodiment, the following method can be adopted as a method of changing the checkpoint cycle. (a) The checkpoint cycle changeable range is set in advance by the minimum value and the maximum value, and the checkpoint cycle is changed only within that range. In this case, only one of the minimum value and the maximum value may be set.

(B) As a modification of (a) above, the initial value is set to the minimum value or the maximum value, and the checkpoint cycle is changed. (Second Embodiment) Next, a standby redundant type multiplexing processing system according to the second embodiment will be described.

FIG. 10 is a diagram showing the structure of a standby redundant type multiplex processing system according to the present invention. In this embodiment, the checkpointing mechanism is provided in the standby system program module and requests the corresponding main system program module to transmit its internal state.

In the figure, the operating system 4 controls the execution of program modules and communication between the processors 1. The execution processing unit 5 executes processing unique to the program module under the control of the operating system 4.

In the standby system program module, the checkpoint cycle setting section 6'is composed of a checkpoint cycle storage section 6a ', a checkpoint cycle changing section 6b' and a checkpoint timing determining section 6c '. The checkpoint cycle storage unit 6a 'stores the checkpoint cycle described as a temporal value.
The checkpoint cycle changing unit 6b 'initializes or changes the checkpoint cycle stored in the checkpoint cycle storage unit 6a'. The checkpoint timing determination unit 6c ′ has a checkpoint cycle storage unit 6 which measures the elapsed time counted by the built-in clock mechanism.
It is determined whether or not the checkpoint cycle stored in a'has been reached, and if it has, the internal state monitoring unit 7 to be described later is activated. Checkpoint cycle setting part 6 '
Is activated by the operating system 4 when the program module is registered as a standby system, and initializes or changes the checkpoint cycle time. Further, the checkpoint cycle setting unit 6 ', when reaching the currently held checkpoint timing, the internal state monitoring unit 7'of the corresponding main system program module via the message switching device 2 and the communication path 3. To start. This activation can be realized by using the inter-program module communication mechanism supported by the operating system 4.

The internal state monitoring unit 7'of the main system program module checks whether or not the internal state is changed in the execution processing unit 5. That is, this internal state monitoring unit 7 '
Is activated by the checkpoint timing determination unit 6c ′ in the standby system program module via the operating system 4 when the time measured by the checkpoint timing determination unit 6c reaches the checkpoint cycle. Then, the internal state monitoring unit 7'determines whether or not the internal state of the main system program module has been changed from the previous checkpoint to the current checkpoint. The internal state monitoring unit 7'refers to the internal state management table 8 to determine whether the internal state has been changed. Then, after the internal state monitoring unit 7'determines the change of the internal state, the internal state monitoring unit 7'starts the determination result transmitting unit and the internal state transmitting unit 12, and waits for the internal state of the program module to correspond to the standby state. It is transmitted to the discrimination result receiving unit 13 of the system program module.

More specifically, when the internal state monitoring unit 7'detects a change in the internal state of the main system program module at the current checkpoint, the internal state monitoring unit 7'starts the discrimination result transmitting unit 12. To do. The discrimination result transmitting unit 12 transmits the discrimination result including the internal state of the main system program module to the discrimination result receiving unit 13 of the corresponding standby system program module.

On the other hand, when the internal state monitoring unit 7'determines that the internal state has not been changed, that is, when the value of the access bit field remains 0, it waits only for the determination result that does not include the internal state. It is sent to the internal status receiving unit of the system program module.

In the standby system program module, the discrimination result receiving unit 13 receives the discrimination result, and performs the following processing according to the discrimination result. That is, when the determination result includes the internal state, the determination result receiving unit 1
3 updates the internal state of the internal state area of the internal state management table 8'according to the received determination result. vice versa,
When the determination result does not include the internal state, the determination result receiving unit 13 notifies the checkpoint cycle setting unit 6 ′ to lengthen the checkpoint cycle. The change of the checkpoint cycle is the same as in the first embodiment.

Although the main system and standby system program modules are controlled by the separate operating systems 4 and 4'in FIG. 10, they may be controlled by one operating system.

The standby redundant type multiplex processing system according to the present invention configured as described above operates as follows.
11 and 12 are diagrams for explaining the processing operation of the standby redundant type multiplex processing system according to the present embodiment. More specifically, FIG. 11 shows the processing operation in the standby system program module, and FIG. 12 shows the processing operation in the main system program module.

When the checkpoint cycle setting unit 6'in the standby system module is instructed to register the module as a standby system, the operating system 4
It is started by. That is, when the operating system 4 ′ is instructed to register the target program module as a standby system program module, the operating system 4 ′ activates the checkpoint cycle setting unit 6 ′ after the registration is completed. The checkpoint cycle setting unit 6'sets a predetermined initial value as a checkpoint cycle after starting (S
111). The checkpoint cycle is predetermined as an initial value, for example, 10 [ms], and is changed depending on the processing situation thereafter. The checkpoint cycle setting unit 6 ', when the clock time reaches the set checkpoint cycle (S112), the message exchange device 2',
The internal state monitoring unit 7'of the corresponding main system program module is activated via the communication path 3 (S113).

In the internal state monitoring unit 7'of the main system program module, it is determined whether or not the process has been executed and the internal state has been updated since the last checkpoint timing in the execution processing unit 5 in the program module (( S121).

When the internal state monitoring unit 7'determines that the internal state has been changed (S122), the discrimination result transmitting unit 12 is activated to respond the discrimination result including the internal state of the module. The result is transmitted to the determination result receiving unit of the standby module (S123).

On the contrary, if it is determined in S122 that the internal state has not been changed, the determination result that does not include the internal state is transmitted to the internal state receiving section 11 of the corresponding standby system program module (S124). In the present embodiment, the determination is made based on whether or not the determination result includes the internal state, but the determination result may be the internal state itself or the fact that the internal state has not been changed.

When the standby program module receives the determination result from the corresponding main program module (S114), it determines whether the determination result includes the internal state (S115). As a result, the standby system program module can know whether or not the internal state has been updated in the corresponding main system program module.
That is, when the determination result includes the internal state, the determination result receiving unit 13 updates the content of the internal state of the current storage which is currently held to the content of the received internal state (S11).
6). After updating the internal state, the process returns to S111, and the checkpoint cycle setting unit 6 ′ resets the checkpoint cycle to the initial value and repeats the above processing.

In step 115, when the determination result does not include the internal state, the determination result receiving section 13 activates the checkpoint cycle setting section 6 '. The checkpoint cycle setting unit 6 ′ determines whether the current checkpoint cycle exceeds the upper limit value (S117). Then, when the checkpoint cycle does not exceed the upper limit value, the determination result receiving unit 13 notifies the checkpoint cycle setting unit 6 ′ to lengthen the interval of the checkpoint cycle, and receives the notification. The unit 6 ′ resets the checkpoint cycle so as to be longer (S118). After setting the checkpoint cycle, S1
Returning to 12, the above process is repeated.

For the above-mentioned operation processing, for example, in the case of the program module A, the standby module A2
And A3 independently determine the checkpoint timing and request the internal program module A1 to transmit the internal state. When A1 receives the internal state transmission request, it determines whether or not its internal state has been changed. And if the internal state has changed,
A1 transmits the determination result including its own internal state to A2 and A3. Conversely, if the internal state has not been changed, the determination result that does not include the internal state of itself is A2.
And A3. Upon receiving the determination result, A2 and A3 determine whether or not the internal state is included. If the determination result includes the internal state, each of A2 and A3 updates its own internal state according to the received internal state. Conversely, if the determination result does not include the internal state, the checkpoint cycle currently held is lengthened.

At this time, A1 sends a status to the request source program module each time it receives a request from A2 and A3, and A1 sends 1 to the request sent by A2 and A3 at the same timing. A method of responding only once and sending the internal state to both A2 and A3 may be used.

As described above, according to the present invention, when the execution processing unit of the main system program module is executing the processing, the processing for setting the checkpoint cycle is not performed, so the execution processing unit executes the processing. Interruptions are reduced, resulting in improved processing performance.

If the execution processing unit of the main system module is not executing processing and its internal state is not updated, the checkpoint cycle becomes long and the internal state of the main system and the standby system is changed. It is possible to reduce the frequency of performing the processing for keeping the same. Therefore, the processing time of the computer system is improved by increasing the CPU allocation time for other program modules registered in the same processing apparatus.

Further, when it is determined that the operation of the execution processing unit is restarted after the checkpoint setting cycle is lengthened based on the stop of the operation of the execution processing unit and the internal state changes in the checkpoint cycle. Since the checkpoint cycle is returned to the initial value, the process takeover time of the standby system does not continue to be long when the main system program module fails.

When the operation of the execution processing unit is stopped for a very long time and the post-processing is restarted, the checkpoint cycle is correspondingly long, so that a failure may occur before the next checkpoint. In this case, the processing takeover time of the standby system program module becomes long.
Therefore, in a target system having a problem in such a situation, it is possible to avoid it by setting the maximum value of the checkpoint cycle in advance and preventing it from becoming longer than the maximum value.

In the above-mentioned first invention or second invention, the respective parts in the main system or the standby system may operate in parallel depending on the situation. For example, the processing of the main processing unit and the checkpoint cycle setting unit may be operated in parallel.

However, when the internal state is fetched by the internal state transmission unit for transmission of the internal state, the execution processing unit must not operate in order to guarantee the consistency of the internal state. Further, in the standby system, the execution processing unit does not operate, but it is of course possible to operate other units. These controls can be realized by determining the activation target by the operating system.

In the second embodiment, as in the first embodiment, the checkpoint cycle changing method is as follows.
Various aspects such as the following can be adopted. (a) When it is determined that the internal state has changed, the checkpoint cycle is shortened, and when it is determined that the internal state has not changed, the checkpoint cycle is returned to the initial value.

(B) If it is determined that the internal state has changed, the checkpoint cycle is shortened, and if it is determined that the internal state has not changed, the checkpoint cycle is lengthened.

(C) The checkpoint cycle changeable range is set in advance by the minimum value and the maximum value, and the checkpoint cycle is changed only within that range.
In this case, only one of the minimum value and the maximum value may be set. (d) As a modification of (c) above, the initial value is set to the minimum value or the maximum value, and the checkpoint cycle is changed.

[0096]

As described above, according to the present invention, an efficient checkpoint can be set according to the change of the internal state of the main system. As a result, the time during which other program modules registered in the same processing apparatus can operate increases, and the processing performance of the system also improves.

[Brief description of drawings]

FIG. 1 is a diagram showing a schematic configuration of a standby redundant type multiplexing processing system according to the present invention.

FIG. 2 is a diagram for explaining the concept of multiplexed program modules.

FIG. 3 is a diagram for explaining the concept of a checkpoint cycle.

FIG. 4 is a diagram showing a configuration of a standby redundant type multiplexing processing system according to the first embodiment.

FIG. 5 is a diagram showing an example of an internal state management table.

FIG. 6 is a diagram showing details of the configuration of the standby redundancy type multiplexing processing system shown in FIG. 4;

FIG. 7 is a diagram for explaining the processing operation of the standby redundant type multiplex processing system shown in FIG. 4 or FIG. 6;

FIG. 8 is a diagram for explaining another modification of the processing operation.

FIG. 9 is a diagram for explaining another modification of the processing operation.

FIG. 10 is a diagram showing a configuration of a standby redundancy type multiplexing processing system according to a second embodiment.

FIG. 11 is a diagram for explaining the processing operation of the standby redundant type multiplex processing system shown in FIG.

FIG. 12 is a diagram for explaining the processing operation of the standby redundant type multiplex processing system shown in FIG.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 ... This processing apparatus 2 ... Message exchange apparatus 3 ... Communication path 4 ... Operating system 5 ... Execution processing section 6 ... Checkpoint cycle setting section 6a ... Checkpoint cycle storage section 6b ... Checkpoint cycle changing section 6c ... Checkpoint timing determination Part 7 ... Internal state monitoring unit 8 ... Internal state management table 9 ... Identity holding unit 10 ... Internal state transmitting unit 11 ... Internal state receiving unit 12 ... Discrimination result transmitting unit 13 ... Discrimination result transmitting unit

Claims (29)

[Claims] 1. A standby redundancy type multiplex processing system which, when a program module to which an execution right is given out of a plurality of multiplexed program modules fails, gives the execution right to another program module and continues the execution. Checkpoint cycle storage means for storing a checkpoint cycle described as a temporal value, and an internal section for judging whether or not the internal state of the program module to which the execution right is given is changed according to the checkpoint cycle. Based on the one determination result by the state monitoring means and the internal state monitoring means,
On the basis of another determination result by the internal state monitoring unit, an identity holding unit that holds the internal state identity between the program module to which the execution right is given and the other program module,
And a checkpoint cycle changing unit for changing the checkpoint cycle stored in the checkpoint cycle storage unit. 2. A standby redundant multiplex processing system which, when a program module to which an execution right is given out of the multiplexed program modules fails, gives the execution right to another program module and continues the execution. Checkpoint cycle storing means for storing the checkpoint cycle described as a temporal value, checkpoint cycle changing means for changing the checkpoint cycle stored in this means, and the execution right according to the checkpoint cycle. Holds the identity of the internal state between the program module to which the execution right is given and the other program module, and an internal state monitoring means for determining whether or not the internal state of the given program module has been changed. Identity maintaining means and the internal state monitoring means The first maintaining means for activating the checkpoint cycle changing means when it is determined that the internal state has not been changed, and the identity retention when the internal state has been changed by the internal state monitoring means. Second activated means
And a standby redundant type multiplex processing system. 3. The standby redundant multiplex processing system according to claim 2, wherein the second activating means also activates the checkpoint cycle changing means. 4. The second activating means activates the checkpoint cycle changing means so as to change the current checkpoint cycle stored in the checkpoint cycle storing means to an initial value. Claim 2
The described standby redundant type multiplex processing system. 5. The first activating means activates the checkpoint cycle changing means so as to be longer than the current checkpoint cycle stored in the checkpoint cycle storing means, The standby means according to claim 2, wherein the starting means starts the checkpoint cycle changing means so as to initialize the current checkpoint cycle stored in the checkpoint cycle storage means to an initial value. Redundant multiplexing processing system. 6. The first activating means activates the checkpoint cycle changing means so as to initialize the current checkpoint cycle stored in the checkpoint cycle storing means to an initial value, 3. The standby according to claim 2, wherein the second activating means activates the checkpoint cycle changing means so as to be shorter than the current checkpoint cycle stored in the checkpoint cycle storing means. Redundant multiplexing processing system. 7. The first activating means activates the checkpoint cycle changing means so that the checkpoint cycle changing means becomes longer than the current checkpoint cycle stored in the checkpoint cycle storing means, 3. The standby redundancy type multiplex according to claim 2, wherein the activation means activates the checkpoint cycle changing means so as to be shorter than the current checkpoint cycle stored in the checkpoint cycle storage means. Processing system. 8. The checkpoint cycle changing means holds a changeable range of the checkpoint cycle represented by at least one limit value, and changes the checkpoint cycle within the changeable area. Claim 3
8. A standby redundant type multiplex processing system according to any one of items 1 to 7. 9. The standby redundant multiplex processing system according to claim 8, wherein the checkpoint cycle storage means holds one limit value of the changeable range as an initial value of the checkpoint cycle. . 10. The identity maintaining means copies at least a changed portion of the internal state of the program module to which the execution right is given to a corresponding portion of the internal state of the other program module. 3. The standby redundant multiplex processing system according to claim 1 or 2, which maintains the sameness. 11. A standby redundancy type multiplex processing system which, when a program module to which an execution right is given out of the multiplexed program modules fails, gives the execution right to another program module and continues the execution. The program module to which the execution right is given has a checkpoint cycle storing means for storing a checkpoint cycle described as a temporal value, and a checkpoint cycle changing means for changing the checkpoint cycle stored in this means. A sending means for sending its own internal status to the other program module; and an internal status monitoring means for judging whether or not the internal status of the program module to which the execution right is given is changed according to the checkpoint cycle. And the internal state is changed by the internal state monitoring means. First activating means for activating the checkpoint cycle changing means when it is determined that there is not any, and second activating means for activating the sending means when it is determined that the internal state is changed by this means The other program module includes an internal state storage unit that stores an internal state, and an internal state change unit that changes the internal state stored in the internal state storage unit according to the internal state sent by the sending unit. And a standby redundant-type multiplex processing system. 12. A standby redundant type multiplex processing system which, when a program module to which an execution right is given out of the multiplexed program modules fails, gives the execution right to another program module and continues the execution. The program module to which the execution right is given, an internal state monitoring unit that determines whether or not its internal state is changed in response to an inquiry request from the other program module, and a determination result by this unit. The other program module comprises a sending means for sending to the other program module, wherein the other program module stores a checkpoint cycle storage means for storing a checkpoint cycle described as a temporal value, and a check stored in this means. Checkpoint cycle changing means to change the point cycle and internal state Internal state storage means for storing, internal state changing means for changing the internal state stored in this means, and inquiring means for sending out an inquiry request for the change status of the internal state to the internal state monitoring means in accordance with the checkpoint cycle. And a first point for starting the checkpoint cycle changing unit when the judgment result from the sending unit does not include an internal state.
In the case where the determination result from the starting means and the sending means includes the internal state,
Standby redundancy type multiplexing processing, comprising: second activation means for activating the internal state changing means to change the internal state stored in the internal state storage means to the transmitted internal state. system. 13. The standby redundant multiplex processing system according to claim 11 or 12, wherein said second activating means activates said checkpoint cycle changing means. 14. The second activating means activates the checkpoint cycle changing means so as to change the current checkpoint cycle stored in the checkpoint cycle storing means to an initial value. The standby redundant multiplex processing system according to claim 11 or 12. 15. The first activating means activates the checkpoint cycle changing means so that the checkpoint cycle changing means becomes longer than the current checkpoint cycle stored in the checkpoint cycle storing means. 13. The activating means activates the checkpoint cycle changing means so as to initialize the current checkpoint cycle stored in the checkpoint cycle storing means to an initial value.
The described standby redundant type multiplex processing system. 16. The first activating means activates the checkpoint cycle changing means so as to initialize the current checkpoint cycle stored in the checkpoint cycle storing means to an initial value, 13. The second activating means activates the checkpoint cycle changing means so as to be shorter than the current checkpoint cycle stored in the checkpoint cycle storing means. Standby redundant type multiplex processing system. 17. The first activating means activates the checkpoint cycle changing means such that the checkpoint cycle changing means becomes longer than the current checkpoint cycle stored in the checkpoint cycle storing means. 13. The standby redundancy according to claim 11 or 12, wherein the activation means activates the checkpoint cycle changing means so as to be shorter than the current checkpoint cycle stored in the checkpoint cycle storage means. Type multiplex processing system. 18. The checkpoint cycle changing means comprises:
18. The standby redundancy type multiplexing according to claim 13, wherein a changeable range of the checkpoint cycle represented by at least one limit value is held, and the checkpoint cycle is changed within the changeable area. Processing system. 19. The checkpoint cycle storage means,
The limit value of the changeable range is held as an initial value of the checkpoint cycle.
8. The standby redundant type multiplex processing system described in 8. 20. The execution unit group is multiplexed into a main system execution unit group and a standby system execution unit group, and when the main system execution subject executing the main system execution unit group fails, the standby system execution unit group In a standby redundant type multiplexing processing system that switches to a standby system executing entity and continues execution processing, storage means for storing checkpoint timing and initialization for initializing checkpoint timing stored in this means Means, changing means for changing the checkpoint timing stored in the storage means, and re-storing the changed checkpoint timing in the storage means as a new checkpoint timing; and an internal state of the main system execution subject. And an identity maintaining unit that maintains the identity between the internal state of the standby system execution subject and the checkpoint timer. Determining means for determining whether or not the internal state of the main system execution subject has been changed according to the operation, and executing the identity maintaining means and the initialization means when the internal state is changed by this means. Standby redundancy type multiplexing having a checkpoint setting mechanism, and a means for executing the changing means when the judging means judges that the internal state has not been changed. Processing system. 21. An execution unit group is multiplexed into a main system execution unit group and a standby system execution unit group, and when the main system execution subject executing the main system execution unit group fails, the standby system execution unit group In a standby redundancy type multiple processing system that switches to a standby system executing entity for executing the execution process and continues the executing process, the main system executing entity includes a storage unit for storing checkpoint timing, and a checkpoint stored in this unit. Initialization means for initializing the timing; changing means for changing the checkpoint timing stored in the storage means, and re-storing the changed checkpoint timing in the storage means as a new checkpoint timing; Transmitting means for transmitting the internal state of the main system execution subject to the standby system execution subject; Determining means for determining whether the internal state of the main system executing entity has been changed, and means for executing the transmitting means and the initializing means when the internal state is changed by this means. And a means for executing the changing means when the determining means determines that the internal state has not been changed, wherein the standby system executing entity stores the internal state of the standby system executing entity. A standby redundancy type multiplex processing system comprising: a state storage means; and an updating means for updating the internal state stored in the internal state storage means according to the internal state transmitted by the transmitting means. 22. The standby system execution unit group is multiplexed when a main system execution unit group and a standby system execution unit group are multiplexed, and when a main system execution subject executing the main system execution unit group fails. In the standby redundancy type multiplex processing system that switches to the standby system executing entity for executing the execution process and continues the executing process, the main system executing entity determines whether the internal state of the main system executing entity is changed. Means for transmitting the information indicating that the internal state or the status has not been changed to the standby system executing body according to the determination result by the means, and the standby system executing body stores the checkpoint timing; Initialization means for initializing the checkpoint timing stored in this means; and a checkpoint timing modified by changing the checkpoint timing stored in the storage means. Changing means for re-storing the checkpoint timing as a new checkpoint timing in the storage means, an internal state storing means for storing the internal state of the standby system execution subject, and the checkpoint timing stored in the storing means according to the checkpoint timing. If the request means for requesting the determination result to the determination means, and the transmission content transmitted from the transmission means based on this means is the internal state of the main system execution subject, the internal state storage means stores the internal state according to the internal state. Updating means for updating the stored internal state and means for executing the initialization means, and the changing means when the transmission content transmitted from the transmitting means based on the requesting means has not been changed. A standby redundant type multiplex processing system, comprising: 23. A standby redundant type multiplexing processing system which, when a program module to which an execution right is given out of a plurality of multiplexed program modules fails, gives the execution right to another program module and continues execution. In the checkpoint cycle changing method used, a step of determining whether the internal state of the program module to which the execution right is given is changed according to the checkpoint cycle, and the program to which the execution right is given in this step When it is determined that the internal state of the module has been changed, a step of transmitting the internal state of the program module to which the execution right is given to the other program module, and according to the internal state transmitted by this step, Internal state of the other program module And a step of changing the checkpoint cycle when it is determined by the determination step that the internal state of the program module to which the execution right is given is not changed. A checkpoint cycle changing method used in a standby redundant multiplex processing system. 24. A standby redundant type multiplexing processing system which, when a program module to which an execution right is given out of a plurality of multiplexed program modules fails, gives the execution right to another program module and continues execution. In the checkpoint cycle changing method used, whether the internal state of the program module to which the execution right is given is changed to the program module to which the execution right is given from the other program module according to the checkpoint. Transmitting an inquiry request for inquiring, determining whether the internal state of the execution-granted program module has been changed according to the inquiry request sent from the other program module, Judgment determined by A step of replying a result to the other program modules, if the answer has been determined result, does not contain the internal state of program modules that the execution right is given,
If the determination result returned by the step of changing the checkpoint cycle and the response step includes the internal state of the program module to which the execution right is given, the internal state included in the determination result. And a step of changing the internal state of the other program module in accordance with the above method. 25. The method of changing the checkpoint cycle used in the standby redundant multiplex processing system according to claim 23, wherein the internal state changing step also changes the checkpoint cycle. 26. The checkpoint cycle used in the standby redundant multiplex processing system according to claim 23, wherein the internal state changing step changes the current checkpoint cycle in accordance with an initial value. How to change. 27. The checkpoint cycle changing step changes the checkpoint cycle to be longer than a current value, and the internal state changing step changes the current checkpoint cycle according to an initial value. 25. The method of changing a checkpoint cycle used in the standby redundant type multiplex processing system according to claim 23 or 24. 28. The checkpoint cycle changing step changes the current checkpoint cycle to an initial value, and the internal state changing step also changes the checkpoint cycle to be shorter than the current value. 25. The method of changing a checkpoint cycle used in the standby redundant type multiplex processing system according to claim 23 or 24. 29. The checkpoint cycle changing step changes the checkpoint cycle to be longer than a current value, and the internal state changing step also adjusts the checkpoint cycle to be shorter than a current value. 25. The method of changing the checkpoint cycle used in the standby redundant multiplex processing system according to claim 23 or 24, wherein the checkpoint cycle is changed.