JPH0973401A - Fault-tolerant system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable another computer unit to substitute and perform processing if one of computer units in the system gets out of order. SOLUTION: Of a data management system which has a plurality of computer units 1-4, the respective computer units 1-4 have >=2 communication ports A and B, which can be connected to the respective computer units; and adjacent computer units in the system constituted by connecting all the computer units 1-4 are connected electrically to each other through their communication ports.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a multiprocessor type fault tolerant computer.

[0002]

2. Description of the Related Art FIG. 2 is an example of a conceptual diagram of a conventional multiprocessor type fault tolerant computer. Here, the multiprocessor is configured such that a plurality of computer units having exactly the same configuration are independently provided and are connected via a common area of each unit.

Further, the respective units asynchronously execute different tasks with different clocks. In this multiprocessor, fault tolerance is realized by three steps: mutual monitoring, separation of faulty parts, and backup.

In this mutual monitoring step, each unit periodically monitors the operating state of another unit while executing an individual task, and outputs the monitoring result to the backup processing circuit. Such monitoring is mutually performed between the units. In the next step, the backup processing circuit determines a normal unit and an abnormal unit based on the monitoring result from each unit, outputs a stop signal for disconnecting from the system to the abnormal unit, and notifies the normal unit. On the other hand, it outputs operation information indicating which unit is currently in operation.

Subsequently, the normal unit determines and executes the task to be executed based on the operation information received from the backup processing circuit. At this time, tasks are determined so that the tasks of each unit are not duplicated or leaked. The task of the unit that was found to be abnormal and disconnected from the system is backed up by the normal unit.
Therefore, the normal unit will execute a plurality of tasks depending on the situation.

As shown in FIG. 3, each computer unit is electrically connected to a device controlled by itself.

[0007]

As described above, in the prior art, each computer unit performs mutual monitoring. Therefore, as the number of computer units increases, the mutual monitoring logic becomes complicated. There is a problem that the load of the CPU power used increases and the time for processing that the computer system should originally perform decreases.

Further, as shown in FIG. 3, when a computer unit connecting the device fails, there is a problem that the device cannot be controlled and the device cannot operate.

[0009]

In order to solve the above-mentioned problems, the system according to the present invention, as shown in FIG. 4, has a plurality of computer units having at least two communication ports, a communication port A44 and a communication port B45. The communication port of the computer unit is connected to another computer unit so that all the computer units are electrically connected to each other via the respective communication ports, as shown in FIG. Have a configuration that is connected.

All the computer units in the system have at least one computer unit that can perform the same processing as each other, and if any of the computer units in the system fails. In this case, until the recovery processing of the failed computer unit is performed, the processing to be performed by the failed computer unit is performed by another computer unit in the system.

Further, the present configuration has a reference computer unit that detects and manages failure information of the entire system, and a sub computer unit that supports this reference computer unit. As shown in FIG. 6, the reference computer unit or the sub-computer unit stores header information 61 including the management number and computer unit address of the failure detection command, failure information 62 of each computer unit and failure information 63 of the entire system. A fault in the system is detected by using the fault detection command that it has.

On the other hand, the device connected to the system is also connected to at least two or more computer units that can control the device, as shown in FIG. 1, and one computer to operate the device. When the unit is out of order and out of control, the device is operated by the other computer unit that can act on its behalf.

[0013]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Preferred embodiments of the present invention will be described in detail below with reference to the drawings. FIG. 1 is a schematic explanatory diagram of a fault tolerant system according to the present invention. In this figure, the reference computer unit 1 is, for example, C
PU41, ROM42, RAM43, communication port A4
4 and a communication port B45. The two communication ports of the computer unit 1 are connected to the sub computer unit 2 and the device control computer unit A3, respectively. The sub computer unit 2 also has the same configuration as the reference computer unit 1, and the sub computer unit 2
The two communication ports are connected to the reference computer unit 1 and the device control computer unit B4, respectively.

The device controlling computer unit A3 connected to the communication port of the reference computer unit 1 is connected to the device controlling computer unit B4 connected to the sub computer unit 2. The reference computer unit 1 and the sub computer unit 2 mainly perform data processing, and these computer units can perform their functions on behalf of each other.

That is, when a failure occurs in the reference computer unit 1, until the failure is recovered,
The sub-computer unit 2 replaces the reference computer unit 1 and processes the entire system. The device control computer unit A3 and the device control computer unit B4 mainly control the device 5, and the device 5 connected to these computer units is simultaneously connected to both computer units as shown in FIG. It is possible to control the device from either computer unit.

Further, when a failure occurs in the device controlling computer unit A3, the device controlling computer unit B4 substitutes the processing to be performed by the device controlling computer unit A3 until the failure is recovered. The reference computer unit 1 detects a fault in the system in addition to the original system processing.

Further, as shown in FIG. 6, the system failure detection command is composed of a header portion 61, failure information 62 managed by each computer unit, and failure information 63 managed by a reference computer unit, The header section 61 is composed of the address of the computer unit that issued the failure detection command, the frame management number of the failure detection command, and the like.

Next, the processing when a computer unit other than the reference computer unit shown in FIG. 7 receives a failure detection command will be described with reference to FIG. When a computer unit other than the reference computer unit receives the failure detection command in step 71, it writes the failure information managed by itself in the failure detection command received in step 72, and in step 73, writes the failure detection command for which this writing process has ended. Write to a communication port different from the reception communication port and send to another computer unit. Next, in step 74, it is confirmed whether or not the transmission is successful, and if the transmission is successful, the reception of the failure detection command is waited again.

After confirming that no failure has occurred via all the computer units in the computer system, the failure detection command sent from the reference computer unit returns to the reference computer unit again. However, when a computer unit other than the reference computer unit fails in the transmission processing of the failure detection command, the computer unit writes the transmission failure information to the target failure detection command in step 75, and first, in step 76, the failure. The failure detection command in which the transmission failure information is written is transmitted to the communication port that has received the detection command.

As a result, the failure detection command carries failure information of each computer unit and is fed back to the reference computer unit again. Next, the operation related to the failure detection command of the reference computer unit 1 will be described based on the flowchart of FIG.

First, the reference computer unit writes the information necessary for failure detection in the failure detection command in step 81, transmits the failure detection command to its own communication port A3 in step 82, and each computer in the system. Send the units in sequence. In step 83, the failure detection command is received again from the reference computer unit that has cycled through the system. Step 8
When there is no failure information in the failure detection command received in 4, the reception of the failure detection command is waited again.

On the other hand, if failure information is present in the received failure detection command, it is checked in step 85 whether the failure location can be identified. If the failure point can be specified, the process proceeds to step 90, the failure point is specified, and the failure process is performed in step 91.

If the failure location cannot be identified from the received failure information, another failure detection command having another failure detection command management number is prepared in step 86,
In step 87, the failure detection command is transmitted to a communication port different from the communication port transmitted last time, and after making one round in the system, the failure detection command is received again in step 88.

In step 89, if there is no failure information in the failure detection command, it is determined that the failure has already been resolved,
The first failure detection command is again prepared periodically and transmitted to the communication port A of the reference computer unit. On the other hand, if the failure detection command received in step 88 includes failure information again, the failure location is specified in step 90, and failure processing is performed in step 91.

Next, the operation relating to the failure detection command of the sub computer unit 1 will be described with reference to the flowchart of FIG. The sub computer unit 2 constantly monitors the reception of the failure detection command at step 92, and when the sub computer unit 2 has not received the failure detection command for a predetermined time or longer,
In step 94, the sub computer unit 2 transmits a confirmation command to the reference computer unit 1 to confirm whether the reference computer unit 1 is normal.

When the response from the reference computer unit 1 to the confirmation command is not received for the specified time, the sub computer unit judges that the reference computer unit 1 has failed, and in step 98 the sub computer unit 2 outputs the reference signal. Performs processing when the computer unit 1 fails.

On the other hand, when the sub computer unit receives the confirmation command, the received data is analyzed in step 96, and then the reference computer unit 1 is analyzed from the information of the received data in step 97.
Is normal, and if the reference computer unit 1 is normal, it waits for the reception of the failure detection command again.

If the content of the received data indicates a failure of the reference computer unit 1 at step 97, the sub computer unit 2 performs the same step as when the sub computer unit 2 does not respond within the specified time of the reference computer unit. At 98, processing is performed when the reference computer unit 1 fails.

Further, before the reference computer unit 1 transmits the failure detection command, the failure of the computer system managed by the reference computer unit is included in the area of "failure information managed by the reference computer unit" 63 included in the failure detection command. Write information.

Computer units other than the reference computer unit can always refer to the "fault information managed by the reference computer unit" 63 of the fault detection command and the information managed by itself, and if the "reference computer unit manages" If the "information about failure" 63 is different from the information managed by itself, the computer unit can perform failure processing or recovery processing.

As described above, the computer system can automatically detect a failure in the computer system, and when a failure in the computer system is detected, until the failure is recovered. A fault-tolerant system can be realized by substituting a process that cannot be executed by another computer unit that can substitute the function of the faulty computer unit due to the fault.

Next, a second embodiment of the present invention will be described in detail with reference to FIG. In FIG. 10, all computer units constituting the computer system include at least a CPU 41 and a ROM 4 as shown in FIG.
2, RAM43, communication port A44, communication port B45
The two communication ports of the reference computer unit 101 are the sub computer unit 102 and the computer unit A 103, respectively.
And the sub-computer unit 10 as well.
Two communication ports 2 are connected to the reference computer unit 101 and the computer unit a104.

The computer unit A 103 connected to the reference computer unit 101 is further connected to the computer unit B 105, and the computer unit B 105 is further connected to the computer unit C 107.
, The computer unit C107 is connected to the computer unit c108, the computer unit c108 is connected to the computer unit b106,
The computer unit b106 is connected to the computer unit a104.

The reference computer unit 101 and the sub computer unit 102 have the capability of substituting for the processing of each other, and the computer unit A 103.
And the computer unit a104, the computer unit B105 and the computer unit b10
6. The computer unit C107 and the computer unit c108 also have the ability to substitute each other's processing.

The reference computer unit 101 performs fault detection in the system in addition to the original processing of the system. As shown in FIG. 6, the failure detection command in the system comprises a header section 61, failure information 62 managed by each computer unit, and failure information 63 managed by a reference computer unit. Reference numeral 61 includes an address of the computer unit that issued the failure detection command, a frame management number of the failure detection command, and the like.

Each computer unit other than the reference computer unit 101 receives a failure detection command from the reference computer unit in step 71, as shown in the flowchart of FIG.
In step 73, the failure information managed by itself is written in the failure detection command, the failure information is written in a communication port different from the communication port receiving the failure detection command, and the failure is written in another computer unit in step 73. Send a detect command.

When this transmission is successful, the system goes back to receiving the failure detection command from the reference computer unit. Similarly, when it is confirmed that all the computer units have no failure, the failure detection command issued by the reference computer unit is fed back to the reference computer unit after passing through all the computer units in the computer system. It

However, when a computer unit other than the reference computer unit 101 fails in the transmission processing of the failure detection command, the transmission failure information is written in the failure detection command which failed in step 75, and the failure detection is performed in step 76. Send the command to the communication port that was just received.

As a result, the failure detection command carries failure information of each computer unit and returns to the reference computer unit again. FIG. 8 is a flowchart showing the operation relating to the failure detection command of the reference computer unit 101.

In this flowchart, step 8
In No. 1, information necessary for failure detection is written in the failure detection command. Next, in step 82, the failure detection command is transmitted to the communication port A3.

Then, in step 83, the transmitted fault detection command carries the fault information in the system and is received again by the reference computer unit. When there is no fault information in the received fault detection command, the fault detection command is sent again. Wait for reception. On the other hand, if there is failure information in the received failure detection command in step 84,
In step 85, it is checked whether the failure location of the failure can be identified.

If the failure point can be specified, the failure point is specified in step 90, and the failure process is executed in step 91. If the location of the failure cannot be identified by the information up to that point, another failure detection command having another failure detection command management number is prepared in step 86, and this failure detection command is sent last in step 87. The communication port different from the communication port that has been used is transmitted, and in step 89, the failure detection command is received again.

If there is no failure information in the failure detection command, it is determined that the failure has already been resolved, and the failure detection command is periodically prepared again and transmitted to the communication port A. If the received fault detection command has fault information again, the fault location is specified in step 90, and fault processing is performed in step 91.

On the other hand, as shown in the flow chart of FIG. 9, in step 92, the sub computer unit 1
02 monitors the reception of the failure detection command at regular intervals. In step 94, if the failure detection command is not received by the sub computer unit 2 for a certain time or more, the sub computer unit 102 receives the failure detection command. A command for confirming that the reference computer unit 101 is normal is transmitted to the reference computer unit 101.

If the response to the confirmation command is not received for the specified time, the sub computer unit 2 judges that the reference computer unit 1 is out of order, and in step 98, the process when the reference computer unit 1 is out of order is performed. To do. When the confirmation command is received, the received data is analyzed in step 96, and it is determined in step 97 whether the reference computer unit 1 is normal or not from the information of the received data. Then, if the reference computer unit 101 is normal, it waits for the reception of the failure detection command again.

If the content of the received data indicates a failure of the reference computer unit 101, step 9
In step 8, the sub-computer unit 102 performs a failure process on the reference computer unit 101. Further, the reference computer unit 101 includes “failure information managed by the reference computer unit” included in the failure detection command before transmitting the failure detection command.
The failure information of the computer system managed by the reference computer unit 101 is written in the area of.

The computer units other than the reference computer unit can always refer to the “fault information managed by the reference computer unit” of the fault detection command and the information managed by itself, and if “the reference computer unit manages”. When the "fault information" and the information managed by itself are different, the computer unit can perform the failure process or the recovery process.

As described above, according to the computer system, it is possible to automatically detect the failure of each computer unit in the computer system. If the failure in the computer system is detected, the failure can be detected. A fault tolerant system was realized by another computer unit, which can substitute the function of the faulty computer unit, for the rest of the fault until the faulty computer unit can no longer execute the process.

FIG. 11 is a schematic explanatory view of a third embodiment of a fault tolerant system to which the present invention is applied. This embodiment is used for an in-store system of the restaurant industry or the like, and all the computer units constituting the system are configured at least as shown in FIG. The communication ports are the sub computer units 112, respectively.
It is configured to be connected to the two communication ports.

The device 113 connected to the computer system is connected within the connection line of each computer unit and can be controlled by either the reference computer unit 111 or the sub computer unit 112. Further, the reference computer unit 111 and the sub computer unit 11
The reference numeral 2 has a capability of substituting for each other's processing, and is configured so that the sub-computer unit can perform the processing of the reference computer unit 113 even if a failure occurs in the reference computer unit 113.

Then, the reference computer unit 1
Reference numeral 11 detects the failure in the system as well as the original processing of the system. In this embodiment, there are two computer units constituting the system, a reference computer unit and a sub computer unit.
As shown in 2, the failure detection command is composed of at least a header section including information indicating that the command is a failure detection command, and a section including failure information not included in the header section.

The sub computer unit 112 is
When a failure detection command is received from the reference computer unit 111, the reference computer unit 111 is sent via the communication port A44 or the communication port B45.
To send a response signal to. If either transmission fails, the transmission failure information is transmitted to the reference computer unit 112 via another communication port of the two communication ports.

When the reference computer unit 111 receives the transmission failure information from the sub computer unit 112, or the sub computer unit 11
When the response from 2 includes failure information, or when these responses do not come back within the specified time, or when failure information is received separately, the failure processing is performed.

At the same time, the sub computer unit 1
Reference numeral 12 regularly monitors the reception of the failure detection command from the reference computer unit 111, and when the failure detection command cannot be received by the sub computer unit 112 for a certain predetermined time or longer, the sub computer The unit 112 sends a command to the reference computer unit 111 to check whether the reference computer unit 111 is normal.

If the response from the reference computer unit to the confirmation command transmitted by the sub computer unit cannot be received within the specified time,
The sub computer unit determines that the reference computer unit 111 is out of order, and the sub computer unit 112 performs processing when the reference computer unit 111 is out of order.

On the other hand, when the confirmation command is received,
The data received in step 96 in the flow chart shown in FIG. 4 is analyzed, and in step 97 it is judged from the information of the received data whether the reference computer unit 111 is normal.
If 1 is determined to be normal, the reception of the failure detection command is awaited again.

If the analysis content of the received data indicates the failure of the reference computer unit 111, the sub computer unit 112 performs the processing when the reference computer unit 111 fails. As described above, according to the present invention, it is possible to automatically detect a failure in a computer system, and if a failure is detected in the system, the failed computer is restored until the failure is recovered. A fault-tolerant system was realized by the other computer unit acting as a substitute for the function that became inexecutable by the unit.

[0058]

As described above, according to the present invention, since the load of the CPU necessary for detecting the system failure does not depend on the number of computer units constituting the computer system, the number of computer units increases. Also, due to the mutual monitoring, a fault-tolerant system can be realized without lowering the processing capacity of the original computer system.

Further, even if the computer unit that controls the device in the system fails, there is another computer unit that can perform the processing on behalf of the computer unit, so that it is possible to prevent the system function from being stopped due to the failure of the computer unit. Have the effect of.

[Brief description of drawings]

FIG. 1 is a diagram showing a fault tolerant system configuration 1.

FIG. 2 is a conceptual diagram of a conventional fault tolerant computer.

FIG. 3 is a connection diagram of a conventional device.

FIG. 4 is a functional block diagram of a computer unit.

FIG. 5 is a system block diagram.

FIG. 6 is a diagram showing a format 1 of a failure detection command.

FIG. 7 is a diagram showing processing of a failure detection command in a computer unit other than the reference computer unit.

FIG. 8 is a flow chart of a failure detection method in a reference computer unit.

FIG. 9 is a flowchart of failure detection of a reference computer unit in a sub computer unit.

FIG. 10 is a diagram showing a fault tolerant system configuration 2;

FIG. 11 is a diagram showing a fault tolerant system configuration 3;

FIG. 12 is a diagram showing a format 2 of a failure detection command.

[Explanation of symbols]

 1 Reference Computer Unit 2 Sub Computer Unit 3 Device Control Computer Unit A 4 Device Control Computer Unit B 5 Device 21 Computer A 22 Computer B 23 Computer C 24 Computer D 25 Backup Processing Circuit 31 Reference Computer Unit 32 Device Control Computer Unit 33 device 41 CPU 42 ROM 43 RAM 44 communication port A 45 communication port B 61 header part 62 failure information managed by each computer unit 63 failure information managed by a reference computer unit 101 reference computer unit 102 sub computer unit 103 computer unit A 104 computer unit a 105 computer unit B 106 Computer unit b 107 Computer unit C 108 Computer unit c 111 Reference computer unit 112 Sub computer unit 113 Device 121 Header section 122 Other information

 ─────────────────────────────────────────────────── ─── Continuation of front page (72) Inventor Atsushi Funayama 1-8 Nakase, Nakase, Mihama-ku, Chiba-shi, Chiba Seiko Electronic Industry Co., Ltd.

Claims (9)

[Claims] 1. In a data management system having a plurality of computer units, each computer unit has two or more communication ports, and the communication ports can be connected to each computer unit, and all computer units are connected. A fault tolerant system configured such that adjacent computer units in the system configured by connecting the units are electrically connected to each other through the respective communication ports. 2. In the computer system, the function of at least one computer unit is configured so that another one or more computer units can substitute for it.
The fault tolerant system according to claim 1, wherein when one computer unit fails, another computer unit takes over the same processing function as that of the failed computer unit so that the processing of the entire system is not stopped. 3. The computer system according to claim 1, further comprising a reference computer unit that detects and manages failure information of the entire system, and a sub computer unit that supports the reference computer unit. Fault tolerant system. 4. In the computer system, a management number of a failure detection command managed by a reference or sub computer unit, header information including a computer unit address, failure information of each computer unit, and failure information of the entire system are displayed. The fault tolerant system according to claim 1, wherein a fault of the system is detected by using a fault detection command that the fault tolerant system has. 5. The communication port that receives the failure information managed by itself, when the computer units other than the reference computer unit receive the failure detection command transmitted by the reference computer unit, and write the failure information managed by itself into the failure detection command. By sending to a communication port different from the above, the failure detection command sent by the reference computer unit returns to the reference computer unit again via all the computer units, and the reference computer unit outputs the failure information of all the computer units. A fault tolerant system according to claim 1, characterized in that it is obtainable. 6. When a computer unit different from the reference computer unit receives a failure detection command and transmission to another computer unit fails, the transmission source computer unit writes transmission failure information in the failure detection command. , The failure detection command is sent back to the computer unit that sent the failure detection command immediately before,
The reference computer unit that receives this failure detection command is required to detect the failure of the communication line inside the system and each computer unit and specify the failure location from the transmission failure information of the failure detection command received from each communication port. The fault tolerant system of claim 1 characterized. 7. The sub-computer unit constantly monitors reception of a failure detection command from a reference computer unit within a predetermined time, and if the failure detection command cannot be received within the predetermined time, the reference computer The reference computer unit transmits a failure detection command for confirming the normality of the reference computer unit itself to the unit, and the reference computer unit which receives the failure detection command from the sub-computer unit detects its own failure, and the sub-computer unit has a predetermined operation. By again monitoring whether the failure detection command is sent from the reference computer unit within the time, and when receiving the failure detection command from the reference computer unit, by checking the failure information in the failure detection command. ,
2. The fault tolerant system according to claim 1, wherein when the sub computer unit detects a failure of the reference computer unit, the sub computer unit sends fault information of the reference computer unit into the system. 8. A device connected to the computer system is similarly connected to at least two or more computer units having the same function, and even if one computer unit fails, the device is connected to another computer unit by the other computer unit. The fault tolerant system according to claim 1, wherein the fault tolerant system is operable. 9. In the computer system, when a system failure occurs, a failure detection command is transmitted in the system, and information of each computer unit and the entire system is monitored by each computer unit, thereby recovering system recovery information. The fault tolerant system according to claim 1, which is obtainable.