JPS6385859A - Intersystem exclusive control system in case of generating abnormality - Google Patents

Abstract

PURPOSE:To allow a normal system to maintain an access right to a shared data base and to attain the continuous operation of a data base by recording the system status at every system on a shared system file, and analyzing the cause of an intersystem communication interruption in case of generating system abnormality. CONSTITUTION:In case of detecting communication interruption, a status setting part 15 writes a sound mark indicating that respective systems are normal in a system status storing part 18. After a prescribed time lapses, the system status of the other system is read out and whether the cause of the communication interruption is the system down of the opposite system or a fault in a communication line between system can be recognized by checking whether the read system status if kept at the initial mark or turned to a sound mark. Consequently, the reconstitution (reassignment of access right) of a control network preventing access to the shared data base from being disabled can be attained.

Description

[Detailed Description of the Invention] [Summary] In a loosely coupled computer system having a shared database, the system status of each system is recorded in a shared system file, and the cause of communication interruption between systems can be automatically detected when a system abnormality occurs. By analyzing the information in detail, a normal system can maintain access rights to the shared database, allowing continued operation of the database.

[Industrial application field]

The present invention relates to an inter-system exclusive control method when a system abnormality occurs in a loosely coupled computer system.

In particular, the present invention relates to an exclusive control method between systems when an abnormality occurs, which improves the availability of a shared database when an abnormality occurs in the system.

In a loosely coupled computer system that has a shared database, if an abnormal situation occurs such as a failure in the communication path between the systems or a system down, and communication between the systems is interrupted,
Limiting the systems that have access rights to the shared database becomes untenable. In this case, depending on the cause of the communication breakdown between the systems, 31 databases can be efficiently used! It is necessary to determine which systems can be used so that they can continue to operate.

[Conventional technology]

FIG. 5 is a diagram for explaining the conventional method.

In FIG. 5, 10-1 to 10-4 are systems each having an independent processor, 11 is a communication path, and 30
represents a shared database.

In a loosely coupled computer system, a shared database 30
In order to perform exclusive control of the shared database 30, exclusive control information is exchanged between systems through intersystem communication.In order to perform exclusive control of the shared database 30, a group of computers (hereinafter referred to as In the control network, when a communication interruption is detected for a predetermined period of time due to a failure in the communication path between systems or a system down of some computer systems, the system subject to the communication interruption is excluded from the control network (hereinafter referred to as the control network). (referred to as separation).

When disconnecting, each computer system.

It is recognized that the control network has been split into two control networks: a control network composed of a group of computers that can communicate, including the own system, and a control network composed of a group of computers that have lost one communication.

Is there a system for having access rights to guarantee the integrity of a shared database after a control network splits? [It is necessary to limit M to be unique. For example, according to the conventional method, regardless of the cause of control network splitting, the number of systems in each control network after one split is
Based on the priority order of access to the shared database 30 (hereinafter referred to as system priority) predetermined for each system, the 4B network that has access rights is determined.

For example, as shown in FIG. 5(a), it is assumed that a communication breakdown occurs between system #1 and system #2 and between system #2 and system #4. Control network is control! Although it is divided into i1A and control I network B, since the number of systems in control network A is large, the systems belonging to control network A maintain access rights to the shared database 30.

For example, as shown in FIG. 5(b), it is assumed that communication is interrupted between system #1 and system #2 and between system #3 and system #4. In this case, a system consisting of the same number of systems? [MA splits into control M4B. Here, if the system priorities for the shared database 30 are #1>#2>93>#4, the control mA that includes system #l with the highest priority maintains access rights to the shared database. , the control network B system loses access rights to the shared database 30.

[Problem that the invention seeks to solve]

When inter-system communication using a communication channel is interrupted, there are two possible causes:

■ Failure in the communication path between systems ■ System down of the communication partner system By the way, if a system abnormality occurs and the system is divided into two control J1i1A and control YJB as shown in Figure 5 (b), 9. , access permission to the shared database 30 is determined as follows.

i) If the cause of communication disruption is a failure in the intersystem communication path, controller 1BH4A can access the shared database 30. control! iB loses access rights.

ii) If the cause of communication loss is a system down of Control 4A, Control 14A has access rights.

Unable to continue operation due to system down. Control network B has no access rights.

iii) If the cause of the communication disruption is the control mB system down, what is the control? H4A can access the shared database 30. Control mB cannot be accessed.
−゛As described above, according to the conventional method, in case i;) above, is there actually a control? 111B can use the shared database 30, there is no longer a system that has access rights to the shared database 30, and there is a problem that the operation of the shared database 30 cannot be continued.

The present invention aims to solve the above problems, and when a system abnormality such as a communication breakdown occurs between computer systems in a control network, each computer system automatically analyzes the abnormal situation.
The purpose is to identify a normal computer system and provide a method to guarantee continued operation of a shared database even after an abnormal order is placed.

[Means for solving problems]

FIG. 1 shows an example of the basic configuration of the present invention.

In Figure 1, 10-1 and 10-2 are CPUs, respectively.
and a loosely coupled system having memory and a shared database; 11 is an inter-system communication path; 12 is a system monitoring message transmitting/receiving unit that sends and receives one system monitoring message to and from another system; 13 is a timer for managing time in the system; 14 is a communication loss detection unit that detects communication loss with the other system; 15 is a status setting unit that sets the status information of the own system on the shared system file; and 16 is a control network reconfiguration unit (access rights control) according to the cause of the abnormality. 17 is a shared system file commonly connected to each system; 1 is a system status storage unit in which the system status of each system is recorded; 19 is a system diagnosis block; represents.

In the present invention, on the shared system file 17.

A system status storage section is provided with an area for one day, in which the status information of each system is set in a system diagnosis block 19. Information indicating the system status includes: 1. For example, an initial mark that is set when the system enters the control network and indicates that it is in the initial state, a healthy mark that indicates that the system is in a normal state when an abnormality occurs, and a health mark that indicates that the system is in a normal state when an error occurs. There is a maintenance mark that indicates that access rights to the shared database are maintained.

Each system in the control network has a system monitoring message transmitting/receiving unit 1.
2 sends and receives system monitoring messages to and from each other at predetermined time intervals via the 9 communication path 11.

As a result, the communication interruption detection unit 14 mutually confirms that the partner systems are operating normally.

When a communication interruption for a predetermined period of time is detected, the status setting unit 15 is called. The status setting section 15 stores the system status storage section of the shared system file 17 on the first day.

Writes a healthy mark indicating that the local system is in a normal state.

Thereafter, the iI4 reconfiguration unit 16 reads the system status of the other system from the system status storage unit 18, and determines whether the cause of the communication interruption is a failure in the communication path 11 or a system down of the other system. Determine.

When the network reconfiguration unit 16 recognizes that the cause of the communication interruption is a system down of the other party's system.

Performs processing to maintain access rights to the shared database of its own system.If the other system is operating normally and recognizes that the cause of communication interruption is a communication path failure, the system with higher system priority accesses the shared database. awf4 is reconfigured so that the lower system loses the access right by itself.

[Effect]

In conventional technology, if half of the systems including the system with the highest system priority go down at the same time, the other half of the systems that are operating normally give up access rights to the shared database. operation will no longer be possible.

In the case of the present invention, when a communication interruption is detected, the status setting unit 15 writes a health mark indicating that each system is normal in the system status storage unit 18. After a predetermined period of time, the system status of the other system is read and checked to see if it remains at the initial mark or has become a healthy mark to determine whether the cause of the communication interruption is the system down of the other system, and to determine if the communication between the systems is It is possible to recognize obstacles on the road.

This makes it possible to reconfigure the 4B network (reassign access rights) so that access to the shared database is not disabled.

Regarding 1ffi signal path failure, even if the communication path between systems is configured with a unidirectional bus and a failure occurs on only one of the sending or receiving sides and intersystem communication is interrupted, depending on the system status, .

Exclusive control between systems can be performed.

〔Example〕

FIG. 2 is an example of processing when a system failure occurs in an embodiment of the present invention, FIG. 3 is an example of processing when a communication path failure occurs in an embodiment of the present invention, and FIG. 4 is an example of processing in an embodiment of the present invention. An example of processing when a unidirectional path failure occurs is shown.

Hereinafter, in order to simplify the explanation, two computer systems (system #1 and system #2) will be used.

An example of configuring a control network will be explained. The same applies to the case of three or more units. It is assumed that between system #1 and system #2, system #1 has a higher system priority.

Figure 2 shows an example where system #1 goes down. #2 is.

At the time of entry, "initial mark (#1) J, r initial mark (#2)" indicating the initial state is placed in the shared system file 17 in the TO.
Record each J. Here, "participating" means becoming part of a control network system.

This means that the shared database is subject to exclusive control.

From time To to T1, system #1. A control network is made up of the two systems #2, each having access rights to the shared database.

When a system down occurs in system #l at time T1, system #2 does not receive the system monitoring message or the response message, so the system #1 returns after a predetermined period of time from time T1 (T
2) Detect communication disruption.

When system #2 detects a loss of communication, it displays a "healthy mark (#2) J" indicating that the system is normal.

It is recorded in the shared system file 17.

Then, after a predetermined time has passed (T3).

System #2 reads the system status of system #l. At this time, the system status is "Initial mark (#1) J
Since it remains the same, we recognize that the cause of the abnormality is system #1 going down.

System #2, which performs the separation process for system #1, maintains access rights to the shared database and displays a "maintenance mark (#2) J" indicating that the access rights are maintained.
is recorded in the shared system file 17. Even if system #1, which has experienced a system failure, has a high system priority, the normal system #2 can continue to operate the shared database.

Next, an example when a failure occurs in one communication path will be described with reference to FIG.

As in the case of FIG. 2, system #1. #2 is.

At the time of entry, an "initial mark (#1) J" is placed in the shared system file 17 to indicate the initial state.

“Record initial mark (#2) J.

When a communication path failure occurs at time T1, after a predetermined time has elapsed (T2) from time TI, system #1 and system #2
detect communication loss.

At this time, each system #1. #2 indicates the “healthy mark (#1) J, r” indicating that the respective systems are normal.
Record the healthy mark (#2) J.

After that, after a further predetermined period of time has elapsed (T3), both systems #1 and 12 read out the system status of the other system.
This confirms that both systems are working properly. In this case, since the system #1 has a higher system priority than the partner system #2, it maintains the access right to the shared database and records a "maintenance mark (#1) J" indicating that the access right is maintained.

On the other hand, system #2 is the system file of its own system.

Since the priority is low, it voluntarily relinquishes access to the shared database. Perform separation processing and reconfigure the control network.

FIG. 4 shows an example in which a unidirectional path is used for the intersystem communication path and a failure occurs in only one path on the transmitting side or the receiving side. .

Both systems #1. #2 is at the time of entry (TO).

Record "initial mark (#1) J, r initial mark (#2)".

After that (TI), assume that a communication path failure occurs on the transmission side path of system #l. In system #l.

Receive system monitoring message from system #2.

Since it recognizes that the response message to system #2 has also been sent, no abnormality can be detected at this point. System #2 does not receive the response message from system #l, so after a predetermined period of time (T2) 9 communication loss was detected. Therefore, system #2 records a "healthy mark (#2) J" in the shared system file 17, indicating that the system is normal.

After that, after a predetermined time has elapsed (T3), system #2 reads the system status of partner system #l, and as a result, it is found that the "initial mark (#1) J" remains. Detects an abnormality in the system status and performs disconnection processing.

System #2 maintains the access right to the shared data cache, records the "maintenance mark (#2) J," and continues operation.

In system #1, since system #2 has performed the disconnection process, 9 communication interruptions are detected after a predetermined time has elapsed (T4). Therefore, a "healthy mark (#1)" indicating that the own system is normal is recorded. After that (T5
), when I check the system status of the other system #2, I get "
Recognize that maintenance mark (#2) J is recorded. In this case, system #1 recognizes that system #2 maintains the access right as a result of the network reconfiguration first, and loses the access right to the shared database.

In this way, even if a failure in one unidirectional path causes a difference in the time at which communication interruption between systems is detected.

It is possible to perform exclusive control between systems over a shared database.

Above, we have explained an example in which a control network is configured by two computer systems.1 For example, when there are four computer systems and an equal number division of two computers occurs, for example, on each side my, A system with high system priority.

It is also possible to perform exclusive control in the same way by checking the system status of the other system as a representative.

〔Effect of the invention〕

As explained above, according to one aspect of the present invention, in a loosely coupled computer system having a shared database, even if an abnormal situation occurs such as a failure in a communication path between systems or a system failure of some computer systems.

Operate a shared database with a normal system! lr
, 1, and it becomes possible to realize high reliability of the entire loosely coupled computer system.

[Brief explanation of the drawing]

FIG. 1 is an example of the basic configuration of the present invention, FIG. 2 is an example of processing when a system down occurs in an embodiment of the present invention, and FIG. 3 is an example of processing when a communication path failure occurs in an embodiment of the present invention. FIG. 4 shows an example of processing when a unidirectional path failure occurs in an embodiment of the present invention, and FIG. 5 shows a diagram for explaining a conventional method. In the figure, 10-1 and 10-2 are the system, 11 is the communication path,
12 is a system monitoring message transmission/reception unit, 13 is a timer, 14
15 is a communication interruption detection unit, 15 is a status setting unit, 16 is a network reconfiguration unit, 17 is a shared system file, 18 is a system status storage unit, and 19 is a system diagnosis block.

Claims (1)

[Claims] In a loosely coupled computer system that has a shared database and performs exclusive control of access to the shared database through intersystem communication, a shared system file (
17) A system status storage means (18) for recording the system status of each system, and a system monitoring message transmitting/receiving means (12) for transmitting and receiving system monitoring messages to and from other systems via the communication path (11). ), communication interruption detection means (14) for detecting communication interruption by not receiving a system monitoring message for a predetermined period of time or more; A status setting means (
15), and network reconfiguration means (16) that checks the status of other systems in the system status storage means (18) after a predetermined period of time has elapsed since the communication interruption is detected, and reconfigures the control network based on the status. ). A method for exclusive control between systems when an abnormality occurs.