JPS6119060B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to an improvement of a redundant standby computer system. More specifically, the present invention relates to a redundant computer system with improved memory transfer means.

A standby redundant duplex system is used as one method to increase the reliability of computer systems. This type of computer system uses two computers and a redundant control device that monitors and controls the operations of these computers. The redundant control device monitors the operation of the computers, keeps one of them engaged in actual work, and the other in standby mode, and when a failure is discovered in the computer on the actual work side, the responsibility for the actual work is transferred to the computer on the standby side. let While the computer taking over is engaged in actual work, the broken computer is repaired, and once the repair is completed, the dual system of computers is restored. The reliability of a redundant computer system is determined by the probability of simultaneous failure of two computers and the probability of failure of the redundant control device, but since the former is much smaller than the latter, it is virtually impossible to predict the failure of the redundant control device. Determined by probability. Therefore, it is necessary to make the duplex control device as reliable as possible.

In such a redundant computer system,
In order to maintain continuity in handing over actual work, the contents of the memories of the two computers must be made consistent. As a conventional example of matching the memory contents of two computers, a common memory that can be accessed from either of the two computers is provided in the duplex control device, and the type of data necessary to perform the actual work is stored in this memory. There's something I tried to remember.
However, in this conventional example, if the common memory is destroyed due to a runaway program on the computer on the actual work side, the problem is inherited by the standby side and both of them are destroyed. This makes the configuration complicated and reduces reliability.

Other conventional examples of matching memory contents include:
There is a system in which the contents of the memory are transferred from the actual work side to the standby side using a redundant control device prior to taking over the actual work. In this case, the redundant control device does not need to have memory, so it can increase reliability, but when there is a lot of data and it takes time to transfer, the time required cannot be ignored, and the real-time nature of the computer work is reduced. be damaged. Furthermore, in the case of a failure in the computer on the actual work side that makes memory access impossible, such as a power outage, data cannot be transferred and the work cannot be correctly taken over by the standby side.

Another conventional example of matching memory contents is to periodically transfer data from the actual work side to the standby side, regardless of the time of handover, to increase the probability that the memory contents of the two computers match. There is something like this. In this case, the probability of memory coincidence increases as the data transfer cycle becomes shorter, but since the overhead increases accordingly, there is a limit to the cycle and amount of data.

In addition, in the conventional examples of these transcription methods, even if erroneous data is transcribed due to an abnormality in the transcription function, it cannot be detected, so the computer that was replaced will eventually go down if the computer is replaced while the data is abnormal. There may also be situations where this happens.

An object of the present invention is to provide a redundant computer system that can perform memory transfer between two computers while maintaining good real-time performance.

Another object of the present invention is to provide a redundant computer system that does not affect the standby side even if the memory is destroyed due to program runaway on the actual computer.

Hereinafter, the present invention will be explained in detail with reference to the drawings.
FIG. 1 is a conceptual block diagram of an embodiment of the present invention.
In FIG. 1, 1 and 2 are computers, 3 is a redundant control device, 41 and 42 are input/output buses of the computers 1 and 2, respectively, 5 is an input/output bus switch, and 6 is an input/output device. The redundant control device 3 has two computers 1,
2 by a memory bus, a monitoring signal line, a control signal line, etc., and performs operation monitoring of both computers, input/output bus usage permission control, and memory transfer control. The duplex control device 3 also provides a control signal to the input/output bus switch 5 to control its switching.

The duplication control device 3 determines the status of the two computers 1 and 2, gives an input/output bus usage permission signal to one of the normal computers, and turns on the input/output bus switch 5 to that side. two calculators 1,
Of the two computers, the one to which the input/output bus usage permission signal is given is engaged in actual work, while the other computer is on standby.

The detailed connection relationship between the computers 1 and 2 and the duplication control device 3 is shown in FIG. 2, focusing on the memory transfer means. However, to avoid complexity, Figure 2 only shows the configuration of the memory transfer system from computer 1 to computer 2 when computer 1 is on the actual work side and computer 2 is on the standby side. The memory transfer system from computer 2 to computer 1 is constructed in exactly the same manner. Computers 1 and 2 are each processor 1
1 and 21 and main memories 12 and 22. The duplication control device 3 has an address monitor section 31, a monitoring section 32, a database equalization section 33, and a database copy section 34.

The address monitor unit 31 includes a first-in, first-out memory (FIFO), intercepts the address when the computer 1 accesses the memory, and stores it in the FIFO when it receives an address accompanied by an equalization request signal. . The monitoring section 32 monitors the ready signals of the computers 1 and 2 and the data ready signal of the address monitor section 31, and controls the operations of the database equalization section 33 and the database copying section 34. The database equalization unit 33 reads out the main memory of the computer 1 according to the control signal of the monitoring unit 32 and the address given from the FIFO of the address monitoring unit 31, and writes the read data to the same address in the main memory of the computer 2. It's crowded. As a result, the data requested by the computer 1 is transferred to the computer 2 and equalized. The FIFO buffers the timing difference between the memory access of the computer 1 and the equalization operation of the duplication control unit 3. The equalization request by the computer 1 is issued when the computer 1 writes certain data in the database in the main memory 12. This type of data is commonly used when the computers 1 and 2 perform actual work. Therefore, each time this type of shared data changes due to writing by computer 1, the changed data is transferred to the database of computer 2. On the other hand, the database copying section 34 writes the entire database of the computer 1 to the computer 2 according to the control signal from the monitoring section 32 . The operation of the database copying unit 34 is performed as one of the initialization tasks for the computer 2 when the computer 2 is put into the duplex system. The database equalization section 33 and the database copying section 34 are designed to operate in parallel. Therefore, during database copying, computer 1
Each time shared data is rewritten, equalization is performed on that data.

These address monitor section 31, monitoring section 32, database equalization section 33, and database copy section 34 are preferably realized by, for example, a microprocessor program, but of course they may also be realized by dedicated hardware. good.

With such a memory transfer mechanism, the database of the computer 2 on the standby side is transferred to the database copying unit 3.
4, the database is initialized to match the database of the computer 1 on the actual work side, and the shared data in the database is equalized each time the computer 1 rewrites it. Therefore, once initialized, it is only necessary to copy the shared data that has been rewritten.
The overall memory transfer speed is greatly improved compared to the conventional method, in which a series of shared data is transferred periodically or every time a computer is switched. In other words, memory transfer between two computers can be performed while maintaining good real-time performance.

In addition, when equalizing the database, we intercepted only the address signal of the part that was rewritten and read and transcribed the data anew from that address, so there is no possibility that the address signal may be received incorrectly. However, there is no problem because the data is only transferred between different parts and the data is correct for that part. However, although the data of the original part remains without being equalized, it is common for this type of data to be rewritten frequently in actual work, so it will be equalized at the next opportunity. In other words, there is less risk of erroneous data being transferred.

FIG. 3 shows the information arrangement in the main memories 12 and 22 of the computers 1 and 2. However, in FIG. 3, the two main memories are made relative to each other in the form of an actual work side and a standby side. Main memory 12, 2
The information arrangement in No. 2 is a monitor, an I/O control program, a database, an equalization request program, and a standby program in descending order of address number. The I/O control program is a collection of various programs for the computers 1 and 2 to perform actual work by making full use of the input/output device 6. The database is a collection of various data used by the I/O control program, and includes data that is commonly used by computers 1 and 2 when performing actual work, that is, data that requires equalization. It can be done. Access to data requiring equalization is performed through an equalization request program. Therefore, when the I/O control program reads or writes such data during its execution, it will access it using the equalization request program.

When data is written by the equalization request program, an equalization request signal is automatically generated. Since the equalization request program is placed in an area on the opposite side of the database area from the I/O control program, the fact that the program in this area has been executed and the data write operation has been performed is indicated by the program counter. It can be detected mechanically by decoding the content and instruction code together. That is, the equalization request signal can be automatically issued by hardware without any special command or program. In response to this equalization request signal, the duplication control device 3 transfers the data to the standby side memory as described above.

Information is arranged in the main memory so that the database is interposed, the I/O control program comes first, and the equalization request program comes after, and the equalization request signal is not generated unless the equalization request program is executed. So, if I/
Even if the O control program goes out of control and destroys the database, the destroyed database is prevented from being transferred to the standby side. In other words, even if the I/O control program runs out of control, it will reach the database before reaching the equalization request program, so an abnormality such as execution of an undefined instruction or access to an undefined address will occur and the computer will have to be switched. The condition is met. Therefore, since the computer is switched before the equalization request program is executed, abnormal data in the destroyed database will not be transferred to the standby side. Therefore, two computers will not fail together due to abnormal data being transferred.

The I/O control program on the actual work side is
As shown in FIG. 4, the check data at a specific address in the database area is periodically updated in a predetermined manner. This update is of course performed through the equalization request program, and for example, the value is updated by incrementing the value by 1 at a cycle of 1 second. Since the data updated in this way is transferred one by one to the standby side by the duplication control device 3, the data at the specific address changes in the same way on the standby side. On the standby side, a standby program checks the state of change in this data and determines whether it is changing as specified in advance. If the data transfer function of the duplication control device 3 is normal, this data on the standby side should also change as specified in advance, so that it is possible to detect whether there is an abnormality in the data transfer function. When an abnormality in the data transcription function is detected, the operator is notified of this fact. When the operator receives this notification, he repairs the duplex control device during the regular inspection period of the computer system or, if possible, during the operation period to restore its functionality. Even if the data transfer function becomes abnormal, there will be no problem with input/output control unless the computer on the actual work side breaks down, so the system will not go down immediately.

Note that the redundant control device 3 is equipped with a self-diagnosis function, which detects and notifies most abnormalities in the redundant control device 3 so that the operator can take appropriate measures. Functionality is one area where self-diagnosis is not possible. However, since an abnormality in the data transfer function is detected and reported by the standby computer as described above, the computer system can be prevented from going down if the operator takes appropriate measures in response to the abnormality.

As described above, according to the present invention, by improving the memory transfer means, memory transfer between two computers can be performed while maintaining good real-time performance, and the memory can be prevented from being destroyed due to program runaway on the computer on the actual operation side. It is possible to realize a redundant computer system that does not affect the computers on the standby side.

[Brief explanation of the drawing]

Figure 1 is a conceptual configuration diagram of an embodiment of the present invention;
The figure is a detailed view of the main parts of the apparatus shown in FIG. 1, and FIGS. 3 and 4 are information layout diagrams and operation explanatory diagrams in the memories of two computers. 1, 2... Computer, 3... Redundant control device, 4
1, 42... Input/output bus, 5... Input/output bus switch, 6... Input/output device, 11, 21... Processor, 12, 22... Memory, 31... Address monitor unit, 32... Monitoring part, 33...database equalization part, 34...database copying part.

Claims (1)

[Claims] 1. In a standby redundant type duplex computer system having two computers that share an input/output device and a duplex control device that monitors and controls the operations of these computers, each of the two computers has its own It is equipped with a memory device, and information is placed in each memory device in the order of the I/O control program, database, and equalization request program from the smallest address number, so that it can be commonly used by both computers during actual work. Access to the data is done through the equalization request program.
Further, when the above type of data is written by this equalization request program, an equalization request signal is issued to the duplexing control device, and the duplexing control device writes the data to be transferred. An address monitor unit that includes a buffer memory that monitors and temporarily stores address information and receives the equalization request signal, and a standby unit that uses the temporarily stored address information to read data to be transferred from the internal memory device of the computer on the actual work side. A database equalization unit that writes the data into the memory device in the side computer, a database copy unit that transfers the entire database from the actual working side computer to the standby side computer, and a status and address monitor unit that monitors the status and address of the two computers. A monitoring unit that controls the operations of the database equalization unit and the database copying unit is provided, and the data written based on the equalization request signal is transferred from the memory device of the computer on the actual work side to the memory of the computer on the standby side. A redundant computer system characterized in that data is transferred to a device.