JPH10198574A - Backup device/method for duplex system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To suppress the frequency of the system switch of an operation system owing to the occurrence of abnormality, to suppress the stop time of a whole duplex system and to improve the job processing efficiency of the whole duplex system by dissolving simple abnormality occurred in the operation system and a designated system in a self-system. SOLUTION: When abnormality occurred in a process where the application program of a designated job is executed can be dissolved in the self-system 1a (1b) in the system 1a (1b) designated to be the operation system, the system of the operation system is not switched but an abnormality restoration processing is automatically executed in the self-system 1a (1b). In such a case, abnormality which can be dissolved in the self-system 1a (1b) is discriminated to be the partial abnormality of software, the abnormality of whole software and the local abnormality of hardware, and the optimum abnormality restoration processing corresponding to the type of abnormality van be executed. Thus, the type of abnormality that cannot be dissolved in the self-system can finally be reduced.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a redundant system in which, when an abnormality occurs in an operating system, a standby system shifts to an operating system and an operating system in which an abnormality occurs shifts to a standby system. The present invention relates to a backup device for a redundant system and a backup method for a redundant system in which the conditions when the operating system is shifted to the standby system are improved.

[0002]

2. Description of the Related Art For example, in a system in which a stop state such as a manufacturing plant in a large-scale factory, an online operation in a financial institution, a train monitoring control system in a transportation system, a POS system in a distribution industry, etc. is not allowed to continue for a certain time or more, A duplex system having two systems is adopted.

As is well known, this duplex system is composed of a pair of systems capable of executing the same business, one of which is designated as the active system and the other of which is designated as the standby system. The standby system shifts to the active system, and the active system in which the abnormality has occurred shifts to the standby system.

In order to smoothly move the operating system when this abnormality occurs, the OS (operating system) of each system has a built-in monitoring and control function for business operations.

That is, the monitoring control function incorporated in the OS monitors the operation of the application program of the running business, and when any abnormality occurs in the operation of the program, immediately detects the occurrence of the abnormality, and Of the application program is stopped, a transition notification to the active system is sent to the standby system, and the operation mode of the own system is shifted to the standby system. As a result, the system newly designated as the active system starts the business using the business application program stored therein.

[0006]

However, in the conventional redundant system, even if a slight abnormality occurs during the period when the active system is executing a given task, the active system is not operated. System moves to the other system.

[0007] When the system of the operating system moves to the other system due to the occurrence of the abnormality, for example, the operator confirms the initial state of the system newly designated as the operating system and then starts the actual operation. Has started. Therefore, since the operator is involved in the system switching, the time required for the system switching becomes longer. Naturally, the workload of the operator also increases.

Further, even if the system switching is automatically performed, a preparation process for matching the state of the system newly designated as the active system to the state immediately before the occurrence of the abnormality in the system in which the abnormality has occurred is required. Also, a predetermined system switching time is required.

As described above, if the system is frequently switched, there is a concern that the business processing efficiency of the entire redundant system is reduced. The present invention has been made in view of such circumstances, and a simple abnormality is eliminated in its own system, so that the frequency of system switching of an operating system is suppressed as much as possible due to the occurrence of an abnormality. An object of the present invention is to provide a backup device and a backup method for a redundant system that can minimize the occurrence of downtime of the entire redundant system due to switching and improve the business processing efficiency of the entire redundant system.

[0010]

The present invention comprises a pair of systems capable of executing the same job, one of which is designated as an active system and the other of which is designated as a standby system. Is applied to a redundant system in which an error occurs and the operating system in which an error occurs shifts to a standby system.

[0011] In the backup apparatus for a redundant system according to the first aspect, an abnormality detecting means for detecting an abnormality in the service with respect to the system designated as the active system, and the abnormality detected by the abnormality detecting means is self-contained. An abnormality type determination unit that determines whether the abnormality can be resolved or an unresolvable abnormality in the system, and an abnormality recovery unit that executes a predetermined abnormality recovery process when the abnormality type determination unit determines that the abnormality can be resolved, When the abnormality type determination stage determines that the abnormality cannot be resolved,
An operating system transfer unit that sends an operating system transfer notification to the standby system and transfers the own system to the standby system is provided.

Further, in the backup method for a redundant system according to the second aspect, the system designated as the active system includes:
Detects a business abnormality and determines whether the detected abnormality is an irresolvable abnormality or a resolvable abnormality in its own system. When it is determined that the abnormality is not possible, an operating system shift notification is sent to the standby system and the own system is shifted to the standby system.

In the thus configured backup device for a redundant system and the backup method for a redundant system, if the generated error is an error that can be resolved in the own system, the system is not switched and the system is not switched. Error recovery processing is automatically performed. as a result,
The frequency of occurrence of system switching is reduced, and the downtime of the entire redundant system due to system switching is reduced. It should be noted that the time required for the abnormality recovery processing is naturally shorter than the time required for system switching involving a human system.

[0014] In the backup method of the redundant system according to the third aspect, the system designated as the active system includes:
Detects an error in the business and can resolve the detected error if it is a local software error for the relevant business, an entire software error, a local hardware error, or an error that cannot be resolved in its own system. Is determined to be abnormal.

Next, when the determination result is a local software error, the relevant service is restarted. When the entire software is abnormal, the memory resources used by the relevant service are initialized, and then the relevant service is restarted. In the event of a local hardware error, initialize the memory resources used for the task, restart the task, and if the same error occurs again, initialize the hardware to unusable and apply again. Start the business.

In the event of an unresolvable abnormality, an operating system shift notification is sent to the standby system and the own system is shifted to the standby system. In the backup method of the redundant system having such a configuration, abnormalities that can be resolved in the self-system are determined as local software abnormalities, overall software abnormalities, and local hardware abnormalities. Optimum error recovery processing corresponding to the type of is performed.

Therefore, it is possible to reduce the types of abnormalities that cannot be eliminated in the self-system, and to further reduce the probability of system switching caused by the abnormalities. According to a fourth aspect of the present invention, in a duplex system configured with a pair of systems capable of executing the same task, one of which is designated as the active system and the other of which is designated as the standby system, the standby system is activated when an abnormality occurs in the active system. This is a recording medium that stores a machine-readable program for causing the operating system in which an abnormality has occurred to shift to the standby system while shifting to the standby system.

The program causes a system designated as an active system to detect an abnormality in the business, and determines whether the detected abnormality is a local software abnormality of the business or an abnormality of the entire software. Determine whether the error is a local hardware error, an error that cannot be resolved in the own system, or an error that can be resolved.If a local software error occurs, restart the relevant task. After initializing the memory resources used by the relevant business, restart the relevant business.If there is a local hardware error, initialize the memory resources used by the relevant business, restart the relevant business, and then restart If the same error occurs, the relevant hardware is initialized to be unusable, the relevant service is restarted again, and if the error cannot be resolved, the standby system is Shifts the self-system to the standby system sends out a line notification.

By using a recording medium on which a program configured as described above is recorded, the above-described function can be easily provided even in a conventional duplex system having no abnormality type determining function and abnormality eliminating function. Can be added.

[0020]

DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a schematic diagram showing a schematic configuration of a duplex system in which a backup device adopting the backup method of the embodiment is incorporated.

This duplex system is a pair of systems 1 each comprising a computer capable of executing the same business.
a, 1b, a plurality of operation terminals 2 commonly connected to the respective systems 1a, 1b,
a, 1b and a database 3 commonly connected to them.

The duplex system of this embodiment is incorporated in a financial system such as an insurance company or a bank. Then, each operation terminal 2 is arranged at the window of each branch or business office,
The clerk inputs various information from the operation terminal 2 while interviewing the customer, and reads out and displays the information of the customer from the database 3. The database 3 stores, for example, a deposit balance and contract contents for each customer.

Each of the systems 1a and 1b executes various tasks based on an operation command from each operation terminal 2. This operation naturally includes a process of reading and writing data to and from the database 3.

Then, one system 1a (1b) is designated as the active system, and the other system 1b (1a) is designated as the standby system. FIG. 2 shows each system 1a, 1b having the same configuration.
FIG. 2 is a block diagram showing a schematic configuration of the embodiment. An input / output interface 5 that receives an operation command from each operation terminal 2 and sends a processing result to each operation terminal 2 to the system bus 4, a recording medium on which coefficients and fixed data used for various programs and calculations are recorded A floppy disk drive 7 into which an FD (floppy disk) 6 is inserted, a program memory 8 for storing an OS program, a program memory 10 for storing a plurality of application programs (AP) 9 corresponding to each task, A shared memory 7 for storing data common to each task, a main memory 13 having a plurality of local memories 12 for storing unique data corresponding to each task, and the like are connected.

Further, the system bus 4
DD 14, database interface 15 for accessing database 3, display device 16, printer 1
7. Interface 18 for sending an active system movement notification to the other system, CPU for executing various processes
19 etc. are connected.

The OS program and the application programs 9 stored in the program memories 8 and 10 are stored in the FD 6 before the systems 1a and 1b operate.
Supplied from That is, the system 1a or 1b is started, and the OS program is read from the FD 6 by the FDD 7 and written into the program memory 8. Next, the OS program in the program memory 8 is started, and the FD 6
And reads each application program 9 and writes it to the program memory 10. Further, a coefficient and fixed data necessary for each task are read from the FD 6 and written into each local memory 12 of the main memory 13.

Each educational task executed by each application program (AP) 9 stored in the program memory 10 is, for example, a database in the case of an inquiry of a contract designating a customer input from each operation terminal 2. 3 and reads out the contract contents of the customer concerned, transmits it to the operation terminal 2 of the inquiry destination, and causes this operation terminal 2 to display and output. In the case of a new contract, the contract contents of each customer input and operated are newly registered in the database 3. Further, in the case of a change in the contract contents, the contract contents of the corresponding customer stored in the database 3 are changed.

The main memory 13 includes, in addition to the common memory 11 and the plurality of local memories 12 described above,
An operation mode indicating whether the own system is currently designated as the active system or the standby system is stored.

In the duplex system configured as described above, one of the systems is designated as the active system and the other is designated as the standby system, and the duplicate system is started. Then
The system 1a (1b) designated as the active system is activated. Then, the application program 9 for various tasks specified based on the operation instruction of each operation terminal 2 is activated to execute a predetermined task.

Then, the CPU 19 of the active system 1a (1b) performs monitoring control for the running task shown in FIG. 3 according to the OS program stored in the program memory 8. That is, the OS program constantly monitors whether or not an abnormality has occurred in the operation during operation.
In step (1), when an abnormality is detected in a running task, the type of the abnormality is determined (S2).

This abnormality is shown in (a) to (d) below.
Determine the type. (A) Local software abnormality Specifically, when an inappropriate instruction is executed or an inappropriate memory access occurs when the application program 9 is executed, the local memory of the business in the main memory 13 is used. Twelve destructions and the like correspond. In other words, this corresponds to a temporary error occurrence in which a program execution instruction is temporarily erroneous due to noise or an execution environment.

To deal with this abnormality, simply re-executing the application program 9 again executes a normal instruction, and the abnormality described above is often resolved. (B) Abnormality of the entire software Specifically, this corresponds to insufficient capacity of the common memory 11 of the main memory 13, destruction of the common memory 11 itself, or insufficient capacity of the output buffers of various other output devices. In this case, new writing or access to the shared memory 11 becomes impossible.

This abnormality is often caused by improper allocation of the used area of the memory resources. Therefore, the allocation of the used area to the memory is redone, that is, the memory is initialized and the corresponding application is executed again. When the program 9 is redone, the abnormality is often resolved. (C) Partial abnormality / failure of hardware Failure of access to the main memory 13, display device 18,
This corresponds to a partial failure of peripheral terminals such as the printer 17, the HDD 14, the FDD 7, and the like.

In the event of this abnormality, the application program 9 is restarted after executing the above-described initialization processing for the main memory 13 for the time being. If the same abnormality or failure occurs again, the memory or the peripheral terminal in which the failure or abnormality has occurred is initially set to be unusable, and the application program 9 is re-executed to resolve the abnormality. There are many. (E) Other software abnormalities and hardware abnormalities In this case, as in the case of (c), after executing the above-described initialization processing for the main memory 13, the corresponding application program 9 is restarted. Then, when a similar abnormality or failure occurs again, the execution of the task in the corresponding application program 9 is abandoned, and the process of switching the active system to the standby system is executed.

If the type of the abnormality is a local software abnormality shown in (a) in S3, the process proceeds to S4, where the execution of the corresponding application program (AP) 9 in operation is stopped, and the corresponding application program (AP) is again executed. AP) 9
Is started (S5).

In S6, when the type of the abnormality is the abnormality of the entire software shown in (b), the process proceeds to S7, and the execution of the corresponding application program (AP) 9 in operation is stopped. Then, after initializing the common memory 11 of the main memory 13 (S8), the application program (AP) 9 is started again (S9).

In S10, if the type of abnormality is a partial abnormality or failure of the hardware shown in (c), the process proceeds to S11, and if the hardware abnormality flag of the hardware is not set to 1, the corresponding hardware Since this is the first time that the wear is partially abnormal or faulty, the process proceeds to S12.

In S12, the execution of the corresponding application program (AP) 9 in operation is stopped.
The common memory 11 of the main memory 13 is initialized. afterwards,
The application program (AP) 9 is started again (S13). Then, the hardware abnormality flag of the corresponding hardware is set to 1 (S14).

In S11, if the hardware abnormality flag of the corresponding hardware has already been set to 1, it is determined that the same failure / abnormality has occurred again. Then, the process proceeds to S15, in which the corresponding application program (A
P) Execution of 9 is stopped, and use inhibition of the corresponding hardware is initialized. Thereafter, the application program (AP) 9 is started again (S16). Then, the hardware abnormality flag of the hardware is reset to 0 (S1).
7).

In S18 of FIG. 4, if the type of abnormality is another software abnormality or hardware abnormality shown in (d), the process proceeds to S19, and if the system abnormality flag is not set to 1, the own system operates. It is determined that an unresolvable abnormality has occurred for the first time, and the process proceeds to S20.

In S20, the execution of the corresponding application program (AP) 9 in operation is stopped.
The application program (AP) 9 is started again (S21). Then, the system abnormality flag is set to 1 (S22).

At S19, the system abnormality flag is already 1
If it is set to, it is determined that an unresolvable abnormality has occurred twice consecutively in its own system, and the process proceeds to S23,
The execution of the corresponding application program (AP) 9 in operation is stopped. Then, the system abnormality flag is reset to 0 (S24).

Then, an active system transfer notification is sent to the standby system 1b (1a) via the interface 18 (S25). Then, its own operation mode is set to the standby system mode (S26), and a predetermined system stop process is executed (S27). Then, it waits until the power supply of the system is cut off.

In the backup apparatus adopting the redundant system backup method configured as described above, in the system 1 (1b) designated as the active system,
An abnormality that occurs during the execution of the application program 9 for the designated business is determined by the self system 1a (1
In the case of an abnormality that can be resolved in b), as shown in the flowcharts of FIGS. 3 and 4, the abnormality recovery processing is automatically performed in the own system without switching the active system.

As a result, the frequency of occurrence of system switching between the systems 1a and 1b is reduced, and the downtime of business operations in the entire redundant system due to system switching is reduced.

The time required for the error recovery processing such as the restart of the corresponding application program 9 in the self-system 1a (1b), the memory initialization processing, and the abnormal hardware use prohibition initial setting processing in the OS program is as follows. Naturally, it is shorter than the time required for system switching that involves a human system.

Further, in the embodiment, abnormalities that can be resolved in the own system are defined as (a) a local software abnormality, (b) an overall software abnormality, and (c) a local hardware abnormality. By making a determination, the above-described optimal abnormality recovery processing corresponding to each abnormality type is performed.

Therefore, the types of abnormalities that cannot be eliminated in the own system can be reduced finally, and the probability of system switching caused by the abnormalities can be further reduced. In the embodiment, the present invention is applied to a duplex system used in insurance, a bank, and the like, but can be applied to a manufacturing plant in a large-scale factory, a train monitoring control system in transportation, a POS system in the distribution industry, and the like.

In the above-described embodiment, the FD (floppy disk) 6 is adopted as the recording medium on which the program is recorded. However, the present invention is not limited to this FD 6, and for example, a hard disk, an optical disk (CD-
ROM, DVD, etc.), a semiconductor memory, or the like, and can be applied to each system 1a, 1b, or transmitted by a communication medium and operated in each system 1a, 1b.

[0050]

As described above, in the backup apparatus and the backup method of the redundant system according to the present invention, a simple abnormality occurring in the system designated as the active system is eliminated in the own system.

Therefore, the frequency of system switching of the operating system due to the occurrence of an abnormality is suppressed as much as possible, the occurrence of downtime of the entire redundant system due to the system switching is minimized, and the business processing efficiency of the entire redundant system is reduced. Can be improved.

[Brief description of the drawings]

FIG. 1 is a schematic configuration diagram of a duplex system in which a backup device adopting a backup method according to an embodiment of the present invention is embedded.

FIG. 2 is a block diagram showing a schematic configuration of each system in the duplex system;

FIG. 3 is a flowchart showing a monitoring control operation of a system designated as an active system;

FIG. 4 is a flowchart showing the monitoring control operation of a system also designated as an active system.

[Explanation of symbols]

 1a, 1b System 2 Operation terminal 3 Database 6 FD 7 FDD 8, 10 Program memory 13 Main memory 14 HDD 19 CPU

Claims (4)

[Claims] 1. A system comprising a pair of systems capable of executing the same business, one of which is designated as an active system and the other of which is designated as a standby system. In the backup device of the redundant system in which the active system in which the error occurs is shifted to the standby system, the system designated as the active system is provided with an abnormality detecting means for detecting the abnormality in the business, and an abnormality detected by the abnormality detecting means. An abnormality type determining unit that determines whether the abnormality can be resolved in the system or an unresolvable abnormality, and an abnormality recovery unit that executes a predetermined abnormality recovery process when the abnormality type determination unit determines that the abnormality can be resolved, When the abnormality type determination stage determines that the abnormality cannot be resolved,
A backup system for a duplex system, comprising: an active system transfer unit that sends an active system transfer notification to a standby system and transfers the own system to a standby system. 2. A system comprising a pair of systems capable of executing the same business, one of which is designated as the active system and the other of which is designated as the standby system. In the backup method for a redundant system in which the active system that has occurred is shifted to the standby system, the system designated as the active system detects the abnormality in the business, and determines whether the detected abnormality is an error that cannot be resolved in its own system. Judgment is made as to whether the error can be resolved, and when it is determined that the error can be resolved, a predetermined error recovery process is executed. When it is determined that the error cannot be resolved, an operating system transition notification is sent to the standby system. A backup method for a redundant system that shifts its own system to a standby system. 3. A system comprising a pair of systems capable of executing the same business, one of which is designated as an active system and the other of which is designated as a standby system. In the backup method for a redundant system in which the active system that has failed is transferred to the standby system, the system designated as the active system detects the abnormality of the business, and the detected abnormality detects the local software abnormality of the relevant business. The software, the entire software, a local hardware error, an error that cannot be resolved in the own system, or a resolvable error. In the event of an error in the entire software, initialize the memory resources used in the application, restart the application, and in the event of a local hardware error, use the application in the application. If the same error occurs again after initializing the memory resources to be used, if the same error occurs again, the relevant hardware is initialized to be unusable, the relevant job is started again, and if the error cannot be resolved, the system waits. A backup method for a redundant system in which an active system transfer notification is sent to a system and a self system is transferred to a standby system. 4. In a duplex system composed of a pair of systems capable of executing the same job, one of which is designated as the active system and the other of which is designated as the standby system, if an abnormality occurs in the active system, the standby system is switched to the active system. A recording medium that stores a machine-readable program for causing an active system to transition to a standby system while transitioning to a standby system, the program comprising: Is detected, whether the detected error is a local software error of the relevant business, an entire software error, a local hardware error, an error that cannot be resolved in the own system, or an error that can be resolved. After a local software error, restart the application, and in the case of a software error, initialize the memory resources used by the application. Restart the application, and in the event of a local hardware error, initialize the memory resources used by the application, restart the application, and if the same error occurs again, disable the hardware. The program is characterized by sending an active system transition notification to the standby system and transitioning its own system to the standby system in the event of an unresolvable abnormality. The recording medium on which it was recorded.