KR20050097015A - Method of resilience for fault tolerant function - Google Patents

Abstract

According to the present invention, when a processor fails in one processor, a dual processor is configured to perform the same function in a large system requiring high reliability, and another processor takes over the function to maintain data consistency and operate without interruption. It is implemented to provide a software algorithm for redundancy that makes it possible. Accordingly, in the present invention, one processor operates as a master in a large system to perform a function required by the system, and the other processor operates as a slave in a standby state so that a failure occurs in the master. When it is done, it switches to the master and performs the function without interruption. Through this, the present invention can be equipped with a fault tolerance function simply by using a software technique, and maintains the function without interruption, thereby maintaining data consistency and realizing quick reconfiguration and restart in the event of a failure.

Description

Redundancy Method for Implementing Fault Tolerance in Large Systems {METHOD OF RESILIENCE FOR FAULT TOLERANT FUNCTION}

The present invention relates to a software algorithm for redundancy in a large system, and more particularly, to a software algorithm for redundancy in a large system that enables the implementation of a high fault tolerance function capable of pursuing stability of an operation service.

All systems are always inherently susceptible to failure by designers, failures of electronic components and other causes. Such failures can cause serious problems if failures occur in large systems that do not allow failure, such as weapon systems, electronic switchgear, medical equipment, flight control systems, or satellites, and fail to perform normal operation.

Therefore, large systems have a high level of fault tolerance and high speed real-time processing, which are highly demanded, unlike conventional computer systems. The fault tolerance technique refers to a function for improving the reliability of the output value provided to the system through rapid detection and processing when a fault occurs in the system.

In particular, the design goal for large systems that require high reliability is to achieve high fault tolerance and minimize performance degradation in its implementation, while maintaining data consistency and fast reconfiguration and recovery in the event of a failure. What can be realized is desired. To meet these requirements, large systems adopt the asynchronous redundancy system as a basic premise. In this case, the asynchronous redundancy system is a method in which one of the two processors is substantially inoperable, that is, in a standby state and continues to operate when a failure occurs in the active processor. to be.

On the other hand, the conventional techniques for securing fault tolerance in the system can be divided into two types, one is to add fault tolerance through the addition of additional hardware, the other is the technique of software This is how to ensure fault tolerance in the system. That is, it can be divided into two methods, hardware based or software based.

However, the fault tolerant function through the addition of the conventional hardware has a problem that the system implementation is difficult and the additional cost of hardware is generated separately. On the other hand, the software-based asynchronous redundancy system has difficulty in maintaining data consistency and realizing fast reconfiguration and restart in case of failure. To this end, commercial middleware currently supports fault tolerance techniques, but related companies do not own their own products because fault detection time and take-over time do not meet the performance requirements of large systems that require high reliability. The situation is developing and using.

Therefore, in the current technical field, there is a need for a method that can easily improve the fault tolerance system, efficiently improve the fixed tolerance capability in system application, and reduce the cost increase in implementing the fault tolerance system.

As described above, there is a commercially available middleware product that detects a failure in one hardware in a redundant system and continuously performs its function without interruption. However, there is no commercial product that guarantees a continuity of data and a fault detection time of less than 1 second.

Therefore, an object of the present invention is to implement a high fault tolerance function in a large system, while maintaining the data consistency by performing functions without interruption based on software in the implementation for redundancy that can realize fast reconfiguration and restart in the event of a failure In providing a software algorithm.

In order to achieve the above object, the present invention provides a redundant method for implementing a fault tolerance function in a large system having a plurality of application processors and a monitoring processor connected to the plurality of application processors to monitor the operation of the application processor, Determining a master processor and a slave processor for at least two application processors performing the same function among the plurality of application processors, and data in which the master processor is to maintain the same between the master processor and the slave processor; The master processor transmits the changed data to the slave processor and synchronizes the data whenever there is a change in the data; And transmitting a message indicating a non-operation of the master processor to a slave processor when a failure occurs in the master processor, and performing the same function as the master processor after the slave processor analyzes the message. It is done.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. It should be noted that the same elements in the figures are represented by the same numerals wherever possible. In addition, detailed descriptions of well-known functions and configurations that may unnecessarily obscure the subject matter of the present invention will be omitted.

The present invention is configured to dually configure an application processor that performs the same function in a large system having a plurality of application processors and a monitoring processor connected to the plurality of application processors to monitor the operation of the application processor. In the event of a failure, another processor can take over the function and provide a software algorithm for redundancy that ensures data consistency and operation without interruption. Accordingly, in the present invention, in one large system requiring high reliability, one application processor operates as a master to perform a function required by the system, and the other application processor as a slave in a standby state. When a failure occurs in the master, it switches to the master to perform the function without interruption.

On the other hand, for the fault tolerance function of the application processor, the present invention uses active-standby processor redundancy in order to increase the reliability of the application processor in a large system whose priority is to secure stability.

This structure gives the two application processors the same structure and prepares for the switchover, the take-over stage where the actual active-switching takes place, and waits for the switchover to the preparation stage. It goes through a re-ready step of recovering the processor.

Next, a configuration diagram of a system for implementing redundancy between application processors in a large system according to an exemplary embodiment of the present invention is illustrated in FIG. 1. The system according to an embodiment of the present invention is largely composed of a monitoring processor and a plurality of application processors.

First, the supervisor processor 100 connects communication between each of the application processors 110, 120, and 130, serves as an administrator of each application processor, and also enables communication with other supervisory processors 140. Here, the communication between the application processor (110, 120, 130) (160, 170, 180) or the communication between the monitoring processor (100, 140) 150 can be made using a commercial TCP / IP or UDP / IP format protocol, but to minimize and manage the detection time of fault tolerance In order to be efficient, the protocol is made using UDP format. Here, the communication between the monitoring processor (100, 140) is made using a protocol of the UDP format, but the function to ensure the stability of the transmitted and received messages will have to be reinforced. The monitoring processor 100 manages the state of an activated application processor connected to its node, that is, the connection state of the application processor, a processor ID for identifying the application processor, and the communication between the application processors 110, 120, and 130. It provides a communication means for.

Next, to describe the structure of the application processor (110, 120, 130) according to the present invention in detail with reference to FIG. Hereinafter, the structure will be described based on the application processor 110, and the structure of the remaining application processors 120 and 130 are the same, and thus description thereof will be omitted.

As shown in FIG. 2, the user framework of the application processor 110 may effectively support a task control module 250 and redundancy for communicating with the application area 200 and the monitoring processor 100. It is composed of a redundancy (Resilience) control module 220 for. Here, the task control module 250 and the redundancy control module 220 are made into classes, and the application developer inherits these two classes so that all processor components have the same structure.

First, the task control module 250 is a reception task (260) for receiving a message through the message queue 270 in the monitoring processor 100 and each component of the processor 110 is operating. An alerting active task 280 is operating internally. The redundancy control module 220 performs a redundancy operation through an input buffer 230 for temporarily storing data received through the monitoring processor 100 and an update buffer 240 for storing data for redundancy. Done.

In addition, in the application area 200 of the application processor 110, recovery data 210 to be maintained between the master processor and the slave processor is defined, and the redundancy control module 220 when the processor object is created. Notify and manage it in the redundancy control module 220.

Hereinafter, referring to FIG. 3 to describe a duplication method in a master processor according to an exemplary embodiment of the present invention. 3 is a flowchart illustrating a duplication method in a master processor according to an embodiment of the present invention.

As shown in FIG. 3, the master processor 110 receives an external message from the monitoring processor 100 in operation 300. Then, the master processor 110 proceeds to step 310 to process a message in each corresponding application block of the master processor 110, for example, the application area 200. Thereafter, the master processor 110 proceeds to step 320 and determines whether there is a change in restart data in the application area 200. If there is a change in the restart data, the master processor 110 proceeds to step 330 and transmits the changed data to the slave processor. In contrast, if there is no change in restart data as a result of the determination, the master processor 110 returns to step 300 of receiving the external message of the monitoring processor 100.

That is, the master processor 110 performs data synchronization to maintain the same data between the master processor and the slave processor by transmitting the changed data to the slave processor when the restart data is changed, thereby performing redundancy for implementing fault tolerance. do.

As described above, one of each dually configured application processor operates as a master processor to perform an assigned function in a large system, and the other operates as a slave processor. If a failure occurs in the master processor, the slave processor performs the functions inherited from the master processor without interruption so that there is no problem in a large system.

On the other hand, in order to take over the function of the master processor in the slave processor to operate without interruption, an operation mode decision to make the slave processor perform the same operation as the master processor in case of failure of the master processor should be made quickly. In addition, in order for the slave processor to inherit the functions of the master processor and operate without interruption, the slave processor must maintain the same data as the master processor regardless of when the master processor fails. Finally, in addition to the foregoing, a more accurate and easier synchronization requires a method of quickly detecting a failure point of the master processor and reducing the time for take-over.

Hereinafter, an operation determination process of a master processor and a slave processor for operating without interruption of a function of a master processor in a slave processor will be described.

According to an embodiment of the present invention, two processors connected to the supervisor processor and performing the same function are paired with each other so that the first activated processor operates as a master processor and the activated processor operates as a slave processor.

First, a master processor and a slave processor are determined for at least two application processors performing the same function among a plurality of application processors. To this end, when performing the function of any one of the plurality of application processors, for example, after the initialization is completed, the information on the application processor itself by accessing the monitoring processor to perform the communication and redundancy function with another application processor Is sent to the monitoring processor. The supervisor processor then checks the received information of the application processor and transmits it to another supervisor processor connected through the communication line. The other supervisor then checks if there is an application processor with the same application processor ID that enables the identification of the application processor. If the result of the check is that there is the same application processor, the other application processor determines whether the application processor with the same ID is already running and delivers it to the first application processor that requests the connection.

That is, when an application processor requests a registration for a supervisor, the supervisor accepts the request and determines whether another application processor with the same ID is operating through a communication channel for communication with the other supervisor. Determine whether or not. According to the result of this determination, the application processor plays the role of either a master or a slave.

The determination of the master or slave is made in the redundant control module of the application processor, and the redundant control module of the application processor that has completed the initial initialization checks the application processor information transmitted from another supervisory processor. As a result of the check, if the processor having the same application processor ID as the other processor is already running, the redundancy control module causes the initialized application processor to operate as the slave processor. On the contrary, when an application processor having the same application processor ID as its own is not operating, the initialized processor is operated as a master processor through the redundant control module.

As described above, the monitoring processor checks each other's state in the initial state, and when the counterpart application processor is active, it operates as a slave slave processor and if the counterpart application processor is standby, it is the master of the active state. Runs as a processor As such, when the operation as the master processor and the slave processor is determined, the master processor and the slave processor perform the fault tolerance function through the redundant control module according to the present invention. At this time, the redundancy control module synchronizes data between the master processor and the slave processor, and when a failure occurs in the master processor, core functions for performing the role of the master processor in the slave processor are performed.

As described above, after the master processor and the slave processor are determined, a process of synchronizing and performing data without interruption through duplication in each processor according to an embodiment of the present invention will be described with reference to FIGS. 4 and 5. .

4 is a configuration diagram for redundancy between the master processor and the slave processor according to an embodiment of the present invention, Figure 5 is a flow diagram for message transmission for redundancy between the master processor and the slave processor according to an embodiment of the present invention.

First, the operation process of the master processor and the slave processor for data synchronization is mainly determined by the redundancy control module, and in order to facilitate the development of the processor, there is no difference in operation between the master processor and the slave processor. Will contain the same data.

As shown in FIG. 4, a processor that performs the same function in a large system requiring high reliability is dually configured. First, when a failure occurs in the master processor 110, another processor, that is, the slave processor 120 takes over its function to maintain data consistency and operate without interruption. To this end, a large system implemented to provide a software algorithm for redundancy includes a master processor 110, a slave processor 120, and supervisory processors 100 and 140 connecting the respective processors.

First, referring to FIG. 4 and FIG. 5, the data synchronization process between the master processor 110 and the slave processor 120 will be described. The redundant control module 220 of the master processor 110 may be configured through the task control module 250. In step 500, a message is received from the monitoring processor 100. On the other hand, the slave processor 120 receives a message from the monitoring processor 100 in step 505 and proceeds to step 510 and stores in the input buffer implemented in the redundancy control module 410.

On the other hand, when the redundancy control module 220 in the master processor 110 receives a message from the monitoring processor 100 in step 515 notifies the slave processor 120 that the message is received. In response, the redundancy control module 410 in the slave processor 120 compares the received message with the message stored in the input buffer in step 525 when receiving the message information transmitted from the master processor 110, In step 530, the master processor 110 tracks which input is processed through the message comparison.

In operation 520, the redundancy control module 220 of the master processor 110 provides the message to the application area 200. Then, the application area 200 receives the message and performs a process for performing the corresponding function. However, the application area 200 determines whether there is a change in restart data in the process of processing the message in step 535.

If the application area 200 detects that there is a change in restart data, in operation 540, the change message information is transmitted to the slave processor 120 through the task control module 420 connected to the monitoring processor 140. Done. At this time, if the redundancy control module 410 in the slave processor 120 receives the changed message information, it is temporarily stored in the update buffer.

Then, the master processor 110 determines whether the message processing is completed in step 550, and transmits the completion message information to the slave processor 120 in step 550 when the message processing is completed. Then, the slave processor 120 updates the restart data of the application area 400 by using the information stored in the update buffer. In this case, the process of processing the received message is not performed in the application area 400 on the slave processor 120 side.

As such, data synchronization between the master processor 110 and the slave processor 120 is achieved through a redundancy control module. In particular, data synchronization according to the present invention is achieved by updating the data of the slave processor 120 whenever there is a data change in the master processor 110. By doing so, even if a failure occurs in the master processor 110, since the same data is obtained through data synchronization, the slave processor 120 may continuously perform the same function as the master processor 110 without interruption. That is, the reason why the slave processor 120 can be operated without interruption by inheriting the functions of the master processor 110 is because the slave processor 110 and the master processor 110 are independent of the failure time of the master processor 110. This is because the same data is maintained.

In addition to the foregoing, a method for enabling a slave processor to operate without interruption in the event of a master processor failure is a method of quickly detecting the failure time of the master processor and reducing the take-over time. There is this. This will be described with reference to FIG. 6. 6 is a flowchart illustrating a fault tolerance method according to an embodiment of the present invention.

Hereinafter, a case in which a failure occurs in the entire monitoring processor connected to each processor will be described with reference to FIG. 6. The failure here may occur throughout the supervisory processor but may occur in any module or region of the master processor.

First, referring to FIG. 6, a description will be given of an operation process between monitoring processors in a fault tolerance method according to the present invention. Exchange heart-beat with each other. Then, the monitoring processor proceeds to step 610 to determine whether the heart-beat is received within a predetermined time. If the heart-beat is received within a predetermined time, one supervisor processor returns to step 600 and performs the above-described process periodically by exchanging a heart-beat with another supervisor processor.

On the contrary, when one surveillance processor does not receive a heartbeat in step 610, the one surveillance processor determines that a failure occurs in the other surveillance processor. Accordingly, the one supervisor processor proceeds to step 620 to convert the slave processor into a master processor. That is, the one supervisor processor causes the slaves connected to it to perform the same functions as the master processor without interruption.

On the other hand, one of the fault tolerance method according to the present invention detects that a failure occurred when the master processor abnormally terminated, that is, when the active message is not received for the time defined in the active task through the task control module of the master processor Can be. The failure may be detected at the normal termination of the master processor, that is, the master processor terminates the connection by sending a disconnect request message to the monitoring processor.

After that, when a specific processor fails, the supervisor processor connected to the non-failing processor sends a message indicating the non-operation of the specific processor to all the processors connected to the slave processor so that the slave processor can take over the function of the specific processor. Allow the function to be performed without interruption. If a failure occurs in one master processor, only the slave processor having the same processor ID as the master processor is notified through the supervisory processor so that only the slave processor takes over the function of the master processor and operates as a master.

As described above, the redundancy control module in the slave processor that is notified that the master processor has failed may check the input buffer and transmit a message not processed by the master processor to the slave processor to complete the processing. It takes over from the master processor and performs its functions without interruption.

As described above, the present invention develops a software algorithm for redundancy that is commonly applicable to a system requiring redundancy, thereby maintaining development efficiency and consistency. In addition, since the redundancy method for implementing the fault tolerance function proposed in the present invention is based on a software method, it does not require any modification of hardware or the addition of new hardware, and thus it is possible to have a fault tolerance function simply by using a software technique. Maintaining functionality without compromises maintains data consistency and enables fast reconfiguration and restart in the event of a failure. In addition, through this, the present invention can reduce the risk of development and have the advantage of providing a framework for self-development by developing core software owned only by some advanced companies.

1 is a block diagram for redundancy between processors in a large system according to an embodiment of the present invention;

2 is a structural diagram of a processor according to an embodiment of the present invention;

3 is a flowchart illustrating a duplication method in a master processor according to an embodiment of the present invention;

4 is a configuration diagram for redundancy between a master processor and a slave processor according to an embodiment of the present invention;

5 is a flowchart illustrating message transmission for redundancy between a master processor and a slave processor according to an embodiment of the present invention;

6 is a flowchart illustrating a fault tolerance method according to an embodiment of the present invention.

Claims (3)

A redundancy method for implementing a fault tolerance function in a large system having a plurality of application processors and a monitoring processor connected to the plurality of application processors to monitor the operation of the application processor, Determining a master processor and a slave processor for at least two application processors performing the same function among the plurality of application processors;  When there is a change in data that the master processor should keep the same between the master processor and the slave processor, the master processor transmits the changed data to the slave processor whenever there is a change in the data, thereby synchronizing data. Process, Transmitting, by the monitoring processor, a message notifying the non-operation of the master processor to a slave processor when a failure occurs in the master processor; And the slave processor performing the same function as the master processor after analyzing the message. The method of claim 1, wherein the determining of the master processor and the slave processor comprises: Requesting registration through the monitoring processor when a function of any one of the plurality of application processors is performed; In response to the registration request, determining whether another processor having the same ID for identifying the processor is operating in the supervisor processor through a communication channel for communication with the other supervisor processor; And operating the one processor as one of a master processor and a slave processor in response to the determination result. The method of claim 1, wherein synchronizing the data comprises: Transmitting, by the master processor, change message information according to a change of data to the slave processor; Temporarily storing the variation message received by the slave processor; If the slave processor receives the completion message information according to the completion of the message processing from the master processor, updating the data of the slave processor to be identical to the data of the master processor by using the temporarily stored message. Characterized by the above.