JPS6334492B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Application of the Invention] The present invention relates to a fault handling method, and more particularly to a processing method when a hardware fault is detected in a processor section within an information processing device.

[Prior art]

FIG. 1 shows an example of the configuration of an information processing device. In the figure, reference numerals 1a and 1b denote processor units (CPUs), which respectively fetch and execute programs from the memory unit 2 through a bus 75, and read or write data to the memory unit 2. Further, the processor units 1a and 1b instruct the input/output operations of the data channel units (DCH) 3a and 3b through interfaces 73 and 74, respectively, as necessary, and upon receiving the instructions, the data channel units 3
a and 3b are the memory section 2 and the input/output devices 6a and 6b, or the processor sections 1a and 1b and the input/output device 6.
Controls input/output operations between a and 6b. 4 is a service processor unit (SVP) that performs maintenance and operational control of the information processing device; 5 is an input/output unit that inputs instructions to the service processor unit 4 or displays information from the service processor unit 4; It is a device.

FIG. 2 shows an example of hardware related to conventional failure handling in the processor section of such an information processing apparatus. For convenience, FIG. 2 shows the configuration of the processor section 1a in FIG.
10 is a failure detection circuit; 11 is an indicator indicating whether retry is possible (turns on when retry is not possible); 17
is an indicator indicating retrying, 12 is an OR circuit, 13
14 is an AND circuit, 14 is an interrupt control circuit, 15 is an inverter, 16 is a retry control circuit, 18 is an interface control circuit with the service processor section 4 or the processor section 1b, and 20 is a program execution section.

The status of the indicator 11 indicating whether retry is possible is as follows:
It changes every moment according to the execution status of instructions on the processor section 1a (instruction reading, instruction decoding, operation execution, result storage, etc.). When a fault is detected by the fault detection circuit 10, if the indicator 11 is off and a retry is possible, and the indicator 17 is off and a retry operation is not in progress, the output of the AND circuit 13 is off,
The output of the inverter 15 is on, and at this time, the retry control circuit 16 retries the instruction that was being executed at the time the failure occurred (during the retry, the indicator 17 is on). If the retry is successful, the retry control circuit 16 or the interrupt control circuit 14 is notified, and the interrupt control circuit 14 generates an internal machine check interrupt indicating that a failure in the successful retry has occurred, and the self-processor section The program on 1a records the retry success and failure occurrence.

On the other hand, when a failure is detected by the failure detection circuit 10, if the indicator 11 is on and retry is impossible, or the indicator 17 is on and retry fails, the output of the OR circuit 12 is on, and the output of the AND circuit 13 is on. The output of An external machine check interrupt signal is sent to section 1b, and the program on processor section 1b is also notified of the occurrence of the fault. Furthermore, the interface control circuit 18
The service processor unit 4 is also notified of the occurrence of the failure via the service processor unit 4. The programs on the processor units 1a and 1b that have been notified of the failure by the interrupt display messages reporting the failure of the processor unit 1a on the input/output devices 6a and 6b independently via the data channel units 3a and 3b, respectively. Further, the service processor section 4 that has received the fault notification from the processor section 1a processes the processor section 1a or 1.
A message indicating a failure of the processor section 1a is displayed on the input/output device 5 in addition to the program on the processor section 1a.

FIG. 3 is a flowchart showing the hardware operation of the processor section 1a, the program operations on the processor sections 1a and 1b, and the operation of the service processor section 4 when a fault is detected in the processor section 1a. be.

However, such conventional fault handling methods have the following problems.

(1) Even though a failure that cannot be retried or a failure that results in a retry failure is detected in the processor unit, program execution continues in the processor unit.
This may disturb program processing in other processors or destroy files essential to the system.

(2) When a fault that cannot be retried or a fault that results in a failed retry is detected in the processor, even if system operation can be continued by another processor, the program on the faulty processor or the service processor The same report as when operation cannot be continued is sent to the operator, which causes confusion for the operator.

[Purpose of the invention]

The purpose of the present invention is to prevent disturbance to the system caused by the failure when a failure that cannot be retried is detected in the processor section, or when a retry attempt fails, and to handle the failure without causing confusion to the operator. The goal is to provide a method.

[Summary of the invention]

The present invention provides a stop instruction circuit for stopping the operation of the processor section in response to a signal from a fault detection circuit in the processor section, and a fault handling instruction circuit in the service processor section to prevent the processor section from retrying. When a hardware failure is detected or when retrying the failure fails, program execution in the processor is stopped to prevent disturbance to the system due to the failure, and if there are programs running on other processors, The service processor is entrusted with fault handling, such as whether or not to report a fault to the operator, to the program, and the service processor This allows the department to report failures to the operator.

[Embodiments of the invention]

An embodiment of the present invention will be described below, with the information processing apparatus assuming the configuration shown in FIG.

An embodiment of the present invention of the hardware configuration related to failure handling of the processor 1a in FIG.
As shown in the figure. In FIG. 4, 10 is a failure detection circuit, 11 is an indicator indicating whether retry is possible, and 17
is an indicator indicating that retrying is in progress; 14 is an interrupt control circuit;
16 is a retry control circuit, 18 is an interface control circuit with the service processor section 4, 19 is a circuit for instructing the operation of the processor section to stop, and 20 is a program execution section. FIG. 5 shows an embodiment of the present invention of a hardware configuration related to failure handling in the service processor section 4 shown in FIG. A retry instructing circuit that determines whether or not a trial is possible and instructs the processor section to retry; 42 a circuit that checks the status of other processor sections and instructs other processors to handle a failure; 43 a circuit that instructs the input/output device 5 This is a display control circuit that displays faults.

Now, when a fault is detected by the fault detection circuit 10 of the processor section 1a, the interface control circuit 18
This notifies the service processor 4 of the occurrence of the failure, and causes the stop instruction circuit 19 to stop the program execution operation on the processor section 1a.

The notification of the occurrence of a failure from the processor section 1a is passed to the retry instruction circuit 41 via the interface control section 40 of the service processor 4.
The retry instruction circuit 41 receives the notification of the occurrence of a failure from the processor unit 1a, and the interface control unit 40
First, the internal information of the processor section 1a is read out via the processor section 1a, and it is determined whether a retry in the processor section 1a is possible. If the indicators 11 and 17 are both off and the processor section 1a can retry, the retry instruction circuit 41 instructs the processor section 1a to retry.

A retry instruction from the service processor 4 is passed to the retry control circuit 16 of the processor section 1a via the interface control circuit 18. The retry control circuit 16, which receives a retry instruction from the service processor section 4, retries the instruction whose execution was interrupted due to the occurrence of a failure, and when the retry is successful, it notifies the interrupt control circuit 14 and issues an interrupt. The control circuit 14 generates an internal machine check interrupt to the program on its own processor section 1a indicating that a retry success failure has occurred. The program on the processor section 1a that has accepted the interrupt learns the cause of the interrupt from the interrupt level and interrupt code, records in the memory section or external storage device that a retry success failure has occurred in the processor section 1a, and then executes the program. Continue operation. This record of successful retry failures is used during hardware maintenance diagnosis.

When the processor section 1a receives a retry from the service processor section 4 and fails to retry the command,
The processor unit 1a notifies the service processor unit 4 of the retry failure via the interface 71,
itself becomes stationary again.

Upon receiving notification of the occurrence of a failure from the processor unit 1a,
The failure is a failure that cannot be retried (processor unit 1a
When the retry instruction circuit 41 of the service processor section 4 instructs the failure processing instruction circuit 42 to control the service hand over.
At this time, the processor section 1a remains in a stopped state. The failure processing instruction circuit 42 that took over the control is
First, the status of the other processor section 1b is checked, and if the program is being executed in the processor section 1b, the instruction circuit 42 displays the cause of an external machine check interrupt in the processor section 1b via the interface control circuit 40 and interface 71. A fault indication bit corresponding to the processor section 1a of a register (not shown) is set (scanned in as "1"), and a fault occurrence message is not displayed from the display control circuit 43 to the input/output device 5. When the external machine check interrupt cause display register is set, the processor section 1b generates an external machine check interrupt,
The program on the processor section 1b is notified of the occurrence of a hardware failure in the processor section 1a. The program on the processor unit 1b that received the interrupt is
When the interrupt level and interrupt code indicate that a hardware failure has occurred in another processor unit 1a, it is determined whether or not to continue system operation, whether or not to notify the operator of the failure in the processor unit 1a, and so on. If so, a message indicating a failure in the processor section 1a is displayed on the input/output device 6b via the data channel section 3b.

When the processor section 1b is in a stopped state and no program is being executed, or when the processor section 1b is not connected in a single processor configuration, the fault handling instruction circuit 42 instructs the processor section 1b to perform a scan-in operation. Instead, it instructs the display control circuit 43 to display a failure report message on the input/output device 5. The display control circuit 43 displays a message reporting the occurrence of a failure on the input/output device 5 based on instructions from the failure handling instruction circuit 42 .

FIG. 6 is a flowchart showing the operations of the processor section and service processor section when a failure occurs in the processor section 1a, where a indicates the operation of the service processor section 4, b indicates the operation of the processor section 1a, c is the operation of the processor section 1b.

In this embodiment, the failure report to the operator is carried out by the input/output devices 5, 6a, and 6b, but failures can be reported by sending a message to a remote location via a line or by ringing an alarm (bell, etc.). It can also be displayed.

Furthermore, when a fault is detected in the processor section 1a, the hardware of the processor section 1a distinguishes between a fault that can be retried and a fault that cannot be retried, and when a fault that cannot be retried is detected. Alternatively, a method may be considered in which the processor section 1a notifies the service processor section 4 when the retry fails, but does not notify the service processor 4 when the retry is successful.

Furthermore, when a failure that cannot be retried is detected in the processor unit 1a or a retry failure occurs, the processor unit 1a notifies the service processor unit 4 of the failure, and also directly sends a message from the processor unit 1a to the processor unit 1b. Another possible method is to send an external machine check interrupt request signal and prevent scan-in from the service processor section 4 to the processor section 1b (setting the fault indication bit to 1).

In addition, if there are three or more processor units in the information processing device, the priority order of the processor units to which the service processor will notify failures is determined in advance, and any hardware failure that cannot be retried by any one of the processor units is determined in advance. is detected or a hardware failure retry fails.
This can be done in the same way as in this embodiment by notifying the processor unit that is executing the program and has the highest priority of the failure occurrence. Alternatively, the program determines the priority by turning on/off the external machine check interrupt mask, and when a non-retryable failure in the processor is detected or a retry failure occurs, all other processors are Another possible method is to notify the

〔Effect of the invention〕

As described above, according to the present invention, the following effects can be obtained.

(1) When a failure that cannot be retried is detected in a certain processor section, or when a retry attempt fails, program execution in the faulty processor section is halted, so there is no negative impact on program execution in other processor sections. It is possible to prevent disturbances to the system due to such failures.

(2) If the program is being executed in another processor and the system can continue to operate, the operator will be informed of the failure, etc. by the program of the other processor. It is possible to report failures in accordance with the requirements, and there is no confusion for operators.

(3) If the program is not being executed in another processor, or if there is no other processor, the service processor will report the failure to the operator, so system operation may be interrupted due to a failure in the processor. Even in the event of an outage, failures will be reported to the operator without fail.

[Brief explanation of the drawing]

Figure 1 is a diagram showing an example of the configuration of an information processing device;
The figure shows an example of the hardware configuration of the conventional fault handling method, FIG. 3 shows the processing flow of FIG. 2, and FIGS. 4 and 5 show the hardware configuration of the fault handling method according to the present invention. Diagram showing one embodiment, No. 6
The figure is a diagram showing a processing flow according to the present invention. 1a, 1b...processor section (CPU), 2...
Memory section (MEM), 3a, 3b...data channel section (DCH), 4...service processor section (SVP), 5, 6a, 6b...input/output device, 10
... Failure detection circuit, 11 ... Retry possible/impossible indicator, 12 ... OR circuit, 13 ... AND circuit,
14...Interrupt control circuit, 15...Inverter, 1
6... Retry control circuit, 17... Retrying indicator, 18... Interface control circuit, 19...
Stop instruction circuit, 40...Interface control circuit, 41...Retry instruction circuit, 42...Fault processing instruction circuit, 43...Display control circuit.

Claims (1)

[Scope of Claims] 1. In an information processing device comprising one or more processor sections that execute programs and a service processor section that maintains and controls the operation of the processor sections, the processor section comprises: When the processor detects a hardware failure that cannot be retried, or when the processor fails to retry the hardware failure, it stops program execution on its own processor and also services the failure. A means for notifying the processor section, and a means for notifying the operator of the occurrence of a failure when the service processor section receives a notification of a failure in another processor section during program execution. When the service processor section receives a notification of the occurrence of a failure from the processor section, the service processor section checks the status of the other processor sections, and if any other processor section is executing the program, the service processor section sends a message to the processor section. If a failure is notified and the program is not executed in any other processor section,
Or, if there is no other processor unit, a failure handling method characterized by having means for notifying an operator of the occurrence of a failure through the input/output device of the service processor.