JPH0350304B2 - - Google Patents

Description

[Detailed Description of the Invention] [Industrial Field of Application] The present invention is directed to the use of a redundant information processing system.
When a system that has gone down due to a failure is restored to operating condition by performing an initial program load,
Regarding system recovery control method.

In one type of duplex information processing system, when both systems are operating normally, one is the master system and the other is the slave system, and both systems are operated in parallel, and the output of the master system is the normal output. Operated in dual operational status.

In this state, if for some reason one system cannot operate normally, that is, goes down, the other system becomes the master (or maintains the master state) and switches to a so-called single operation state. , continue business operations with a single master-only system.

In a single operating state, if the operating system goes down further and both systems go down, this is a so-called system down state, and business processing will naturally stop.

In particular, when recovering from such a system down state and restarting the system, recent various files such as so-called checkpoint files that should have been retained in the system that was running until the end are saved. It is necessary to use the data to restore the business processing state to the state immediately before the system went down and to continue the interrupted business.

[Problems to be solved by conventional technology and invention]

FIG. 2 is a block diagram showing an example of the configuration of a duplex information processing system.

The A system 1a and the B system 1b have the same configuration and consist of peripheral devices such as processing units 2a and 2b, main storage devices 3a and 3b, and auxiliary storage devices 4a and 4b.

Input from the outside is input to both systems A and B, as shown by input line 5, and if both systems are operational, the same processing is executed in parallel, but the output to the outside is , as shown in output line 6,
One system that is considered the master (in the diagram, A
system).

For example, a signal line 7 is connected between both systems 1a and 1b.
, and can monitor the status of each other's systems.

At the start of system operation, when an initial program load (hereinafter referred to as IPL) is specified from each system console 8a, 8b, IPL processing is performed according to the processing flow shown in FIG. 3, for example.

First, in step 10 of the process, a diagnostic program runs and diagnoses the state of the own system. If the result is normal in step 11, the process proceeds to the subsequent steps, but if it is not normal, it can be performed in step 12, for example. If so, it is displayed on the system console 8a or 8b and stopped.

If normal, the required program is loaded in step 13.

In the next step 14, for example, by the signal line 7,
By sending and receiving necessary signals, it is checked whether the other party's system is in an operational state (hereinafter referred to as a ready state).

If the partner system is not in the ready state, in step 15, the system determines whether it has recovered from the down state by making the own system the master and reading out a so-called checkpoint file stored in the auxiliary storage device 4a or 4b, for example. After performing necessary recovery processing if necessary, normal business processing is started.

If the partner system is already ready, the process advances to step 16, where it becomes a slave, performs processing to enter a parallel operation state with the partner's master system, and then starts business processing in synchronization with the partner system.

As described above, in order to properly recover from a system down state, the system that was the master at the time of the system down needs to enter the operating state as the master.

For this reason, in the past, when recovering from a system down, the operator would first decide which system should be the master and then perform an IPL on only that one system.
do. Thereby, that system can start acting as the master, as described in the process flow above.

Next, if necessary, by activating the IPL process of the other system, that system becomes a slave and the Dell operational state is configured.

Therefore, if the operator makes a mistake in selecting the first system to IPL, an incorrect recovery process may occur, resulting in
For example, there was a problem in that a situation occurred that disrupted business processing after a system went down.

[Means for solving problems]

The problem mentioned above is that the two systems each have a signal line that sends and receives signals to and from the other system, and in the case of a dual operation state in which both systems operate, one of the systems is the master. state, the other system operates as a slave state, and in the case of a single operation state in which only one system operates, the operating system operates in a master state,
A redundant information processing system configured to maintain a predetermined status record indicating the operating status of each system, wherein each system is identify the state of the other system, and if the state of the other system is identified as not being operational, operate the own system as the master state;
If the state of the partner system is identified as operating as a master state, the host system operates as a slave state, and the state of the partner system is changed to a master state even though it is in an operable state. If it is determined that the system is not in the master state, the state record held in the own system is inspected, and if the state record does not record that the most recent operating state was the master state, the system is set to the slave state. If the system is running as the master state and the state record records that the most recent operating state was the master state, the system is operating as the master state and the operating state is the single operation state. The problem is solved by a system recovery control method characterized in that, if the problem is recorded, a signal is sent via the signal line to interrupt the processing of the partner system.

[Effect]

In other words, a system that has started IPL processing determines whether or not it will master its own system by referring to the ready state of the other system and the display of the previous master/slave state stored in a checkpoint file, etc. Configure recovery control to automatically determine whether

This allows the operator to IPL both systems.
If the processes are started at the same time, the master/slave will be automatically determined correctly and the system will be recovered.

〔Example〕

FIG. 1 is a flowchart of processing in an embodiment of the present invention.

As in the past, in step 10 of the process, a diagnostic program runs to diagnose the state of the own system.
If the result is normal, the process proceeds to step 13.

In step 20, the status of the partner system is checked by exchanging signals with the partner system.

If it is detected that the partner system is not in the ready state, the process proceeds to step 15, where the own system is made the master, and after performing necessary recovery processing if necessary, normal business processing is started.

If it is determined in step 20 that the other system is already operating as a master, the process proceeds to step 16, where the own system is made a slave, processes are performed to enter a dual operation state with the other party's master system, and the system is synchronized with the other system. Start business processing in this state.

At step 20, the opponent system is ready and IPL
If it is determined that the process is in progress, the process proceeds to step 22, where the previous system status record (in the case of recovery from a down state, immediately before the recent down state) is retrieved from the checkpoint file stored in the auxiliary storage device 4a or 4b, for example. read out. This status record is used to indicate the master status or slave status when the operating status of the own system is determined, or when the operating status changes due to the occurrence of a failure, etc., during the process to enter the operating status. recorded in

In step 23, it is checked whether the own system is the master based on the read status record, and if it is not the master (in this case, it is either the slave or the status is not displayed). (including cases), proceed to step 16, set the own system as a slave, and enter into a dual operation state with the other party's master system.

If it is determined in step 23 that the own system is the master, then in step 24 it is further checked from the record of the previous system state whether it was in the single operating state.

If it was in a single operation state, the other system may have gone down first in the master state, and the other system may still have a recent record of that system state. In this case, the partner system will also start acting as the master.

In this way, in order to prevent both systems from becoming masters, the IPL processing being executed in the partner system is stopped by sending a truncation signal to the partner system in step 25, and then the IPL processing being executed in the partner system is stopped in step 15.
Proceed to the recovery process. In this case, the other system is
After that, by starting the IPL process again,
Becomes a slave in dual operation mode.

If it is determined in step 24 that the previous single operation state is not present, the process immediately proceeds to step 15 since the above process is not necessary.

〔Effect of the invention〕

As is clear from the above description, according to the present invention, when recovering a redundant information processing system from a system failure, unauthorized recovery processing due to operator error is eliminated, thereby improving the reliability and availability of the information processing system. This has a significant industrial effect.

[Brief explanation of drawings]

FIG. 1 is a flowchart of processing according to an embodiment of the present invention, FIG. 2 is a block diagram of an example of a system configuration, and FIG. 3 is a flowchart of processing of an example of a conventional configuration. In the figure, 1a and 1b are information processing systems,
2a and 2b are processing units, 3a and 3b are main storage devices, 4a and 4b are auxiliary storage devices, 5 is an input line, and 6
1 is an output line, 7 is a signal line, 8a and 8b are system consoles, and 10 to 16 and 20 to 25 are processing steps.

Claims (1)

[Claims] 1. Consisting of two systems, each having a signal line for transmitting and receiving signals with the other system, and in the case of a dual operation state in which both systems operate, one of the systems is In the case of a single operating state where only one system operates in the master state, the other system operates as a slave state, the operating system operates in the master state, and maintains a predetermined state record indicating the operating state of each system. A duplex information processing system configured as follows, in which each system identifies the state of the partner system through the signal line when a predetermined initial program load is performed, and determines the state of the partner system. If the other system is identified as not being operational, it operates as a master state, and if the partner system is identified as operating as a master state, it operates as a slave system. If the other system is identified as being ready for operation but not in the master state, it inspects the status record held in its own system, and updates the status record with recent operations. If it is not recorded that the state was in the master state, the system operates as a slave state, and if the state record records that the most recent operating state was in the master state, If the own system is operating as a master state, and it is recorded that the operating state is single operation state, a signal to interrupt the processing of the other system is sent via the signal line. A system recovery control method comprising: