WO2010135966A1

WO2010135966A1 - Upgrade method and device for components in paired redundancy structure

Info

Publication number: WO2010135966A1
Application number: PCT/CN2010/073032
Authority: WO
Inventors: 李晓初
Original assignee: 成都市华为赛门铁克科技有限公司
Priority date: 2009-05-25
Filing date: 2010-05-21
Publication date: 2010-12-02
Also published as: CN101556542A; CN101556542B

Abstract

An upgrade method and device for components in a paired redundancy structure are provided in the embodiment of the present invention. The method includes: using the second redundancy unit of the redundancy pair structure to write an upgrade code into a target component of the first redundancy unit, which is paired redundantly with said second redundancy unit, and notifying the first redundancy unit to restart; checking whether the target component of the first redundancy unit is upgraded successfully; if unsuccessful, rewriting the code of the pre-upgrade version of the target component into the target component to restore same. The embodiment of the present invention separates the service function assignment from the maintenance function assignment of the component in the paired redundancy structure, thereby improving the reliability of the component upgrade without additional cost.

Description

Method and device for upgrading a device in a paired redundant structure This application claims to be filed on May 25, 2009, the Chinese Patent Office, the application number is 200910141658.3, and the invention is entitled "A method and device for upgrading a device in a paired redundant structure" The priority of the Chinese Patent Application, the entire contents of which is incorporated herein by reference. Technical field

The present invention relates to the field of electronic technologies, and in particular to a method and apparatus for upgrading devices in a pair of redundant structures. Background technique

In the field of communication or storage, which requires high system availability and reliability, a system consisting of many working nodes generally includes mutually redundant pairs of nodes. The number of working nodes in the system is generally even, and there are communication channels between the nodes to support user services. In some systems, there are high-availability low-data-rate channels between the two nodes in the redundant pair. The underlying data channel has a simple structure and low implementation complexity, such as a common RS-232 serial port and a JTAG debug port.

During the system, the working node may be upgraded on the hardware. For example, a higher-performance board is used to replace the existing working board. This type of upgrade is called hard upgrade. The other is a soft upgrade of the node, that is, after the working node is put into use, it will need to upgrade the code during its working period. The upgraded code may be the program code of the system running, or the logic code of various programmable devices. . This article covers the soft upgrade of nodes.

For a system consisting of multiple redundant pairs as described above, if all the systems need to be upgraded, the paired nodes in the system cannot be upgraded at the same time, but there are sequential, because in the fields of communication or storage. This kind of redundancy can not be interrupted or can not be interrupted at all. If the upgrade of the first node in the redundant pair fails, the second node can no longer "adventure," and upgrades.

Each working node in the redundant pair is a microcontroller system, which generally includes but is not limited to the following parts: CPU for processing data, various memories for storing system running code, communication interface for transmitting and receiving data, basic input/output system BIOS (Basic Input Output System), a management interface for interacting with user terminals, and various programmable logic devices (PLDs, Programmable Logic Devices) for collecting board information and processing underlying reset interrupt signals.

For a node in a redundant pair, the existing upgrade method is: The user will upgrade through the management interface. The code is sent to the CPU and an upgrade command is issued. The CPU parses the user commands and writes the code to the storage or logic device through the corresponding programming interface in a format acceptable to the particular device.

As can be seen from this process, the node upgrade is done by the node's own CPU.

In the above node upgrade method, if the CPU confirms that the code has been written due to some problem of the target device such as the memory or the programmable device, the code actually written is not complete or contains an error, which will result in one time. The CPU considers that the board hangs after a normal restart after the upgrade. Moreover, because such target devices play an important role in the system, such as PLD devices generally have to play a key role in controlling the power-on and reset of the entire board, the upgrade failure of such target devices will result in the failure of the entire board. Respond to user commands again.

The failure of this node upgrade causes the other node of the redundant pair to no longer "adventure" the upgrade, otherwise it will cause the entire redundancy pair to hang and interrupt the user's business.

In order to solve the above problem, another existing technique adds an error recovery controller to the board. The node upgrade method of this technology is the same as the previous technology, but if the problem of hanging after the node restarts is encountered, the error recovery controller will be transferred to the system repair mode, the target device is refreshed with the default value, and the board is restarted again. Back to normal. Although the prior art solves the problem that the board upgrade cannot be self-repaired due to the underlying fault, it introduces a new controller module, which increases the cost of the system and increases the complexity of the system. Summary of the invention

The invention provides a method and a device for upgrading a device in a paired redundant structure, so as to reduce the problem that the prior art cannot be softly repaired and the upgrade cost is high.

In order to achieve the above object, an embodiment of the present invention provides a method for upgrading a device in a paired redundant structure, the method comprising:

Writing, by the second redundant unit in the structure, the upgrade code to the target device of the first redundant unit that is a redundant pair, and notifying the first redundant unit to restart;

Checking whether the target device of the first redundant unit is successfully upgraded;

If the upgrade is unsuccessful, the version code of the target device before the upgrade is rewritten to the target device for recovery of the target device.

The present invention also provides an upgrade device for a target device, where the target device and the upgrade device are respectively located In the first redundant unit and the second redundant unit of the redundant pair, the upgrading device includes: a code writing unit, configured to write an upgrade code to the target device, and notify the first redundancy Unit restart

An checking unit, configured to check whether the target device is successfully upgraded;

And a recovery unit, configured to rewrite the version code of the target device before the upgrade of the target device to the target device to perform recovery of the target device when the target device is unsuccessfully upgraded.

In the embodiment of the present invention, the target device in the redundant unit is upgraded by another redundant unit of the redundant pair structure, which not only improves the reliability of the device upgrade but also reduces the additional upgrade cost. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a flow chart of upgrading a device in Embodiment 1 of the present invention;

2 is a schematic diagram of interaction between a board and a pair of boards in a redundant pair according to an embodiment of the present invention; FIG. 3 is a flowchart of upgrading a device in Embodiment 2 of the present invention;

4 is a structural block diagram of an upgrade device of a target device according to an embodiment of the present invention;

FIG. 5 is a structural block diagram of an upgrade device of a target device according to another embodiment of the present invention; FIG.

Figure 6 is a block diagram showing the structure of the inspection unit of Figure 5. detailed description

In order to make the objects, technical solutions and advantages of the present invention more comprehensible, the specific embodiments of the present invention will be described in detail below. The illustrative embodiments of the present invention and the description thereof are intended to be illustrative of the invention, but are not intended to limit the invention. Embodiment 1

Embodiments of the present invention provide a method for upgrading a device in a paired redundant structure. As shown in Figure 1, the method includes the following steps:

Step 110: The second redundant unit in the redundant pair structure is the first redundant list that is mutually redundant pair The upgrade code is written in the target device of the element, and the first redundant unit is notified to restart.

In the embodiment of the present invention, the first redundant unit and the second redundant unit are redundant pairs, and the first redundant unit and the second redundant unit may be a single board forming a working node, or may be a single A redundant module in a board or node.

After the second redundancy unit writes the entire upgrade code to the target device of the first redundancy unit, it notifies the first redundant unit to restart to make the upgrade take effect.

In this embodiment, the target device may be a system module such as a BIOS, or may be a programmable logic device (PLD), and the programmable logic device includes a complex programmable logic device (CPLD).

Step 120: Check whether the target device of the first redundant unit is successfully upgraded.

Normally, the first redundant unit is restarted and runs with the new version code. However, if there is a problem that the written code mentioned in the prior art is incomplete or contains errors, the second redundant unit thinks that the upgrade is successful and the target device is not upgraded successfully, that is, when the first redundancy is successful. After the unit is restarted, it hangs. Therefore, after the first redundant unit is notified to restart, it is necessary to check whether the target device of the first redundant unit is successfully upgraded within a set time, and the set time may be a maximum time for the system to restart normally, but The invention is not limited to this.

Step 130: If the upgrade is unsuccessful, the second redundant unit rewrites the version code before the target device upgrade to the target device of the first redundant unit, and performs recovery of the target device.

The service function attribution and maintenance function assignment of the devices in the paired redundant structure are divided by the above method for upgrading the target device. In the prior art, the service function and the maintenance function of the device in the redundant unit are generally attributed to the controller of the redundant unit, and the service function of the device in each redundant unit belongs to the redundancy in the embodiment of the present invention. The controller of the unit, while the maintenance function of the device is attributed to another redundant unit that is a redundant pair, for example on the controller of the other redundant unit. The device located in the first redundant unit only serves the service of the redundant unit. If the system is abnormal due to the soft fault of these devices, the second redundant unit can perform maintenance functions on the device of the first redundant unit. . This not only improves the reliability of the system upgrade, but also reduces the implementation complexity without adding additional costs. Embodiment 2

This embodiment further proposes a method for upgrading a device in a paired redundant structure. In this embodiment, the paired redundant structure is a pair of boards, which are respectively called node A and node B. The board to be upgraded is called the board. That is, node A, another board is called a pair board, that is, node B.

FIG. 2 is a schematic structural diagram of the board of the redundant centering board for upgrading the board in the embodiment. The directional arrows in the nodes and the nodes in Figure 2 represent the data flow when the board is upgraded. The data flow when the board is working normally is not shown in the figure. It can be seen from Fig. 2 that the programming channels of the BIOS, PLD and other devices located on node A are actually provided and controlled by node B, but in the normal state, the BIOS, PLD and other devices serve node A. Therefore, from the perspective of service functions, devices such as PLDs on node A belong to node A, and these devices belong to node B in terms of soft upgrade function, that is, maintenance function.

As shown in FIG. 3, the soft upgrade process of the target device in the node A in this embodiment includes the following steps:

Step 310: The Node B remotely receives the code data packet used for upgrading the target device of the node A. The code data packet may include the code of the current version of the target device and the code of the new version, that is, the upgrade code.

This step is performed when the code data of the target device of the node A to be upgraded is not stored on the node B. At this time, the user can remotely access through the management interface of the node B, and upload the code data packet of the upgrade target device to the node B through the FTP method or other methods.

If the code data of the target device of the node A to be upgraded is previously stored on the node B, this step is omitted.

Step 320, optionally, when the target device of the node A is to be upgraded, the user can remotely access the node A to issue a notification for the node A to close the service.

In step 330, the node B sends a message of upgrading the target device to the node A through the communication interface with the node A, to notify the node A that the target device on the node A, such as a PLD device (including the CPLD device), is to be upgraded.

When the target device of the node A is upgraded, the user can issue a command of the target device of the upgrade A to the node B through the management interface, and the command is sent by the communication interface between the node B and the node A to the node A, and the node A is notified that the node is to be upgraded. Target device on A.

In step 340, the node A responds to the message from the node B, closes the running service, and sends an acknowledgement (ACK) message to the node B after all the services are closed. Node A sends an ACK message to Node B, indicating that it is ready before the upgrade.

Step 350: After receiving the ready ACK message of the node A, the node B writes the upgrade code to the target device of the node A, and notifies the node A to restart.

Node B can write the upgrade code to the target device according to the data format accepted by the target device through the programming channel of Node A. For example, Node B writes the upgrade code data to the CPLD device of Node A through the JTAG programming channel according to the data format specified by JTAG.

After confirming that the upgrade code is completely written to the target device of node A, node B notifies node A to restart for the upgrade to take effect. For example, Node B can verify whether the upgraded code is written through a programming channel, such as the JTAG programming channel. After confirming that the write is completed, the node A is restarted through the communication interface to make the upgrade take effect.

Step 360: Check whether node A is successfully upgraded.

Under normal circumstances, Node A restarts and runs with the new version code. However, if the upgrade code that is written is incomplete or contains errors, the node B thinks that the node A upgrade is successful and the node A is not upgraded successfully. That is, when the node A restarts, it hangs. Therefore, after notifying the set time after the node A restarts, the node B checks whether the node A is successfully upgraded.

The step of checking whether the node A upgrade is successful within the set time may be: Node B uses a timeout timing policy, that is, starts a board upgrade timeout timer, for example, 5 minutes, and sends to node A every few seconds. A query command to query the status of node A. If node A is running, node A will return an acknowledgement (ACK) message to node B upon receiving a query command from node B. Under normal circumstances, Node A will send an ACK response message to Node B before the time set by the timeout timer expires, which proves that the upgrade is successful. If node A does not answer within the timeout period set by the timeout timer, it can be proved that node A hangs after rebooting.

Therefore, in this step, the node B checks whether the node A is successfully upgraded as follows: If the response message returned by the node A is received within the time set by the timeout timer (for example, 5 minutes), it is proved that the node A has been successfully upgraded. If Node A does not respond within this time, it proves that the upgrade to the target device on Node A was not successful. The timeout timer can be set to the maximum time for the system to shut down normally and restart to normal operation.

Step 380, if the upgrade of the target device on the node A is unsuccessful, the node B rewrites the version before the target device upgrade to the target device of the node A, and performs recovery of the target device. For example, if Node B confirms that the upgrade of the target device on Node A is unsuccessful, it directly enters the forced recovery target device program, rewrites the old code before the upgrade to the target device, and then forcibly restarts Node A.

Step 390, optionally, after restarting the node A, the timeout timing policy may be used, that is, the timeout timer is started to check whether the target device is successfully restored.

Step 400, if the recovery is unsuccessful, step 380 may be performed again to perform recovery of the target device. If node A still does not respond after recovering several times (e.g., 2 times), step 410 is performed.

Step 410: Node B can alert the user through the management interface.

In the foregoing step 390, if the check target device is successfully restored, the node B may perform step 350 again to perform the upgrade of the target device in the node A again. Step 380 is further included before step 380 to limit the number of upgrades.

Step 370, determining whether the number of upgrades is greater than a set value, such as 2. If the value is greater than 2, it indicates that the upgrade is not successful. The system may have a fault that cannot be repaired. In this case, Node B can send alarm information to the user through the management interface to notify the technician to go to the maintenance.

If node A is successfully upgraded, you can upgrade node B in the same way as above, except that this version is node B and the board is node A. I will not repeat them here.

In the embodiment of the present invention, the method for upgrading the board in the redundant pairing board is to divide the service function attribution and the maintenance function attribution of the redundant centering device, and assign the usual to a controller (such as the CPU of the node A). The two functions are now assigned to the redundant board and the two independent controllers of the board (such as the controllers belonging to Node A and Node B respectively). The devices located on this board are only Board business service, if the board system is abnormal due to the soft failure of these devices, the controller on the other working board can perform maintenance functions on the board. This greatly increases the reliability of the redundancy for the upgrade, reducing the implementation complexity without adding additional costs.

Moreover, the method for upgrading the device in the embodiment of the present invention is not limited to being between the redundant board and the board, and is also applicable to the interoperation between the module and the module in a redundant pair on a single board. This will greatly improve the robustness of modules and modules.

It will be understood by those skilled in the art that all or part of the steps of implementing the above embodiments may be performed by a program to instruct related hardware, and the program may be stored in a computer readable storage medium such as a ROM/RAM or a disk. , CD, etc. Example 3

The embodiment provides an upgrade device of the target device, where the target device and the upgrade device are respectively located in the first redundant unit and the second redundant unit of the redundant pair. As shown in FIG. 4, the upgrade device 400 includes :

The code writing unit 410 is configured to write an upgrade code to the target device, and notify the first redundant unit to restart.

The checking unit 420 is configured to check whether the target device is successfully upgraded within a set time after the restarting of the first redundant unit.

The recovery unit 430 is configured to rewrite the version code before the target device is upgraded to the target device to perform recovery of the target device when the target device is unsuccessfully upgraded.

In another embodiment of the present invention, as shown in FIG. 5, the upgrade device 400 further includes:

The obtaining unit 440 is configured to obtain a pre-upgrade version code and the upgrade code of the target device before the code writing unit writes the upgrade code to the target device.

The sending unit 450 is configured to send a command for upgrading the target device to the first redundant unit before the code writing unit writes the upgrade code to the target device.

In another embodiment of the present invention, the upgrading device further includes:

The calling unit 460 is configured to invoke the recovery unit to perform recovery of the target device when the recovery of the target device is unsuccessful, until the recovery is successful or the recovery reaches a set number of times;

The alarm unit 470 is configured to issue an alarm message when the recovery has not been successful after the set number of times has elapsed. In the embodiment of the present invention, the alarm unit may also be connected to the first checking unit, and is configured to issue an alarm message when the target device of the first redundant unit is not successfully upgraded several times.

In another embodiment of the present invention, as shown in FIG. 6, the checking unit 420 includes:

The query unit 610 is configured to periodically send a query message to the first redundant unit after the first redundant unit is restarted;

The confirmation unit 620 confirms that the upgrade is successful if the response message of the first redundant unit is received within the set time, otherwise the upgrade fails.

The upgrade device for the target device in the embodiment of the present invention divides the service function attribution and the maintenance function attribution of the devices in the paired redundant structure. In the prior art, the service function and the maintenance function of the device in the redundant unit are generally attributed to the controller of the redundant unit, and in each redundant unit in the embodiment of the present invention The service function of the device belongs to the controller of the redundant unit, and the maintenance function of the device belongs to another redundant unit of the redundant pair, for example, the controller of the other redundant unit. The device located in the first redundant unit only serves the service of the redundant unit. If the system is abnormal due to the soft fault of these devices, the second redundant unit can perform maintenance functions on the device of the first redundant unit. . This reduces implementation complexity and significantly increases redundancy for upgrade reliability without adding additional cost.

The above described specific embodiments of the present invention are further described in detail, and it is to be understood that the foregoing description is only All modifications, equivalents, improvements, etc., made within the spirit and scope of the invention are intended to be included within the scope of the invention.

A person skilled in the art can understand that all or part of the process of implementing the above embodiment method can be completed by a computer program to instruct related hardware, and the program can be stored in a computer readable storage medium, the program When executed, the flow of an embodiment of the methods as described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

In summary, the above description is only a preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

Rights request

A method for upgrading a device in a paired redundant structure, comprising:

Writing, by the second redundant unit in the pair of redundant structures, an upgrade code to the target device of the first redundant unit that is a redundant pair, and notifying the first redundant unit to restart;

If the upgrade is unsuccessful, the second redundant unit is used to rewrite the version code before the target device upgrade to the target device to perform recovery of the target device.

2. The method according to claim 1, wherein the second redundant unit in the redundant pair is configured to include an upgrade code in the target device of the first redundant unit that is a redundant pair :

A command to upgrade its target device is sent to the first redundant unit.

3. The method according to claim 1, wherein the second redundant unit in the redundant pair is used to write the upgrade code to the target device of the first redundant unit that is a redundant pair :

The second redundancy unit acquires the pre-upgrade version code of the target device and the upgrade code.

4. The method according to claim 1, further comprising:

Checking whether the recovery of the target device is successful;

If it is unsuccessful, repeat the recovery of the target device until the recovery is successful or the recovery reaches the set number of times;

If the recovery is not successful after reaching the set number of times, the second redundant unit sends an alarm message.

The method according to claim 1, wherein checking whether the target device of the first redundant unit is upgraded successfully means:

After the first redundant unit is restarted, the query message is periodically sent to the first redundant unit. If the response message of the first redundant unit is received within the set time, the upgrade is confirmed to be successful; otherwise, the upgrade fails.

An upgrade device of the target device, wherein the target device and the upgrade device are respectively located in a first redundant unit and a second redundant unit that are redundant pairs, and the upgrade device includes:

a code writing unit, configured to write an upgrade code to the target device, and notify the first redundancy The remaining unit is restarted;

7. The device according to claim 6, further comprising:

And a sending unit, configured to send a command to upgrade the target device to the first redundant unit before the code writing unit writes the upgrade code to the target device.

8. The device according to claim 6, further comprising:

And an obtaining unit, configured to obtain a pre-upgrade version code and the upgrade code of the target device before the code writing unit writes the upgrade code to the target device.

9. The device according to claim 8, further comprising:

a calling unit, configured to invoke the recovery unit to perform recovery of the target device when the recovery of the target device is unsuccessful, until the recovery is successful or the recovery reaches a set number of times;

The alarm unit is used to send an alarm message when the recovery has not been successful after the set number of times has elapsed.

The device according to claim 8, wherein the checking unit comprises: a query unit, configured to periodically send a query message to the first redundant unit after the first redundant unit is restarted;

The confirmation unit confirms that the upgrade is successful if the response message of the first redundant unit is received within the set time, otherwise the upgrade fails.