JPH0423149A - Duplex data preserving device - Google Patents

Abstract

PURPOSE:To surely switch a duplex operating state to a single operating state at a high speed when one of two shared memories has a fault by providing an input/output path cutting mechanism which cuts physically the input/output paths which connect the shared memories and the clusters. CONSTITUTION:For instance, a cluster 12-1 separates a shared memory 10-1 due to the detection of a fault occurred in an area 1 of the memory 10-1. Under such conditions, an input/output path cut processing part 13 cuts physically the input/output paths P11 - P31 which connect the memory 10-1 and all clusters by means of an input/output patch cutting mechanism 11-1. When the clusters 12-2 and 12-3 have accesses to an area 1 of the memory 10-1, a program check state occurs owing to the physical separation. Thus the separation of the area 1 can be recognized with no performance of the inter-cluster communication. Thus it is possible to surely switch a duplex operating state to a single operating state at a high speed when one of the shared memories has a fault.

Description

[Detailed Description of the Invention] (Summary) This invention relates to a redundant data maintenance device in a multi-purpose computer system comprising a plurality of clusters including processors and a redundant shared memory connected to each cluster via an input/output path. An input/output method that physically disconnects the input/output path connecting the shared memory and the cluster, with the aim of quickly and reliably transitioning from a duplex operation state to a single-lung operation state in the event of a shared memory failure. In addition to being equipped with a path disconnection mechanism, each cluster has a control information section that manages the validity/invalidity of each area of the duplicated shared memory, and a control information section that manages the validity/invalidity of each area of the shared memory. An input/output path disconnection processing unit that sets a certain value and disconnects all input/output paths connecting that area and each cluster, and a control information unit that handles abnormal access termination due to disconnection of input/output paths. to set that area to be invalid.

Thereafter, the device is configured to include an access prohibition processing unit that prohibits access to that area.

[Industrial Application Field] The present invention is applicable to a compound computer system having a 5-duplex shared memory, in which when a failure occurs or a user specifies, one cluster is disconnected, and the memory of the disconnected side and all clusters are disconnected. The present invention relates to a duplex data maintenance device that maintains duplex data by cutting off an input/output path to the duplex data.

In modern computer systems, the growth in the power of single processors is slowing down, and there is a strong need for improved reliability, so it is becoming increasingly important to build complex computer systems that connect multiple clusters with shared memory. is becoming common.

Since the shared memory stores important data that is shared by multiple clusters, two shared memories are often duplicated for the purpose of increasing reliability.

If a failure occurs in one of these duplexed shared memories or if there is an instruction to disconnect from 5 users, only the other shared memory can be quickly used while maintaining consistency with all clusters. It is necessary to shift to single-lung driving.

[Conventional technology]

FIG. 5 shows an example of the prior art.

Conventionally, when disconnecting one of the duplicated shared memories 10-1 and 10-2, the process shown in FIG. 5(a) or FIG. 5(b)
The method shown in is used.

In the system shown in FIG. 5(a), access to the duplicated shared memories 10-1 and 10-2 is controlled using a control table 50 in the shared memory. That is, the control table 50 stores and manages information such as which shared memory to read from when reading, and which shared memory to write to when writing.

One shared memory, for example, area I of shared memory 10-1
If a failure occurs in Cluster 1 that detected the failure,
2a writes to the control table 50 in the shared memory that the area l is unusable.

The remaining cluster 12b has shared memory 10-110-2.
Before accessing the control table 50, it is checked whether the control table 50 is available or not.

Since area 1 of shared memory 10-1 is not available, access to area 1 is prohibited and only access to the other duplicated area 2 is performed.

By using the control table 50 in the 5 shared memories in this manner, all clusters prohibit access to the shared memory 101 and only access the remaining shared memory 10-2.

In the system shown in FIG. 5(b), each cluster 12a
, 12b has its own control table 50150-2,
In the event of a failure, by communicating between clusters,
Notify of failure occurrence.

In each control table 50-1, 50-2, when reading,
Which shared memory should be read from?

Also, when writing, information such as which shared memory to write to is stored and managed.

Compared to the above-described method shown in FIG. 5(a), it is only necessary to access local memory within five clusters.

The time required for one access is shortened.

One shared memory, for example, area 1 of shared memory 10-1
If a failure occurs in the cluster 12 that detected the failure,
A records in the control table 50-1 in its own cluster that area 1 is unusable. Further, it notifies other clusters 12b that a failure has occurred on SI area 1.

The cluster 12b that received the notification sends a notification to the control table 50-1 that area 1 is unavailable, similar to the cluster 12a.
Record in 2.

At this time, it is necessary to stop normal processing in all clusters until information updating of control tables in all clusters is completed.

Through the above processing, all clusters recognize that one shared memory 10-1 is in an unusable state, and all clusters are controlled to access the remaining shared memory 10-2.

(Problem to be solved by the invention) The method shown in FIG. 5(a) has the following problems.

(a) Shared memory 1 from each cluster 12a, 12b
When accessing 0-1 and 10-2, it is necessary to refer to the control table 50 in the shared memory 5 once to determine whether access is possible, and it takes time for one access.

(+)) Since there actually exists an input/output path to an area that has become unusable due to a failure, there is a risk of accessing that area if the cluster malfunctions.

(C) Exclusive control of the control table 50 in the shared memory is complicated.

(d) If a failure occurs in the control table area in shared memory,
Or if a contradiction occurs in the set information 5. The system may malfunction.

Furthermore, the method shown in FIG. 5(b) has the following problems.

(a) The cluster that has detected the failure must perform processing to notify other clusters that the failure has occurred.

Processing becomes complicated.

(c) Since there actually exists an input/output path to an area that has become unusable due to a failure, there is a risk of accessing that area if the cluster malfunctions.

(C) If a failure occurs in the control table area in the shared memory, or if an inconsistency occurs in the set information, the system may malfunction.

The present invention solves the problems of the conventional technology such as reduction in normal memory access time such as 5 or more, complication of processing due to communication between clusters, and data corruption in shared memory due to cluster malfunction. The purpose of this system is to enable a rapid and reliable transition from duplex operation to single-lung operation in the event of a failure.

[Means to solve the problem]

FIG. 1 is a diagram explaining the principle of the present invention.

In Figure 1, 10-1 and 10-2 are shared memories that are duplicated, 11-111-2 is an input/output path disconnection mechanism, and 12-1 to 12-3 are clusters each equipped with a processor. , 13 is an input/output path disconnection processing unit that physically disconnects the input/output path, 14 is an access prohibition processing unit that prohibits access to the shredded shared memory in advance, and 15 is an access to the duplicated shared memory. A control information section containing management information, pH-P32, represents an input/output path used for data transfer between each cluster and the shared memory.

In the present invention, the dual shared memory 10-110-2
A hardware-based input/output path disconnection mechanism I11.1m-2 is provided to physically disconnect the input/output paths pH to P32 connecting the clusters 12-1 to 12-3.

When accessing the shared memory separated by the input/output path disconnection mechanism 11-1 or 11-2, the hardware control unit including the input/output path disconnection mechanism 11-1 or 11-2 generates a recoverable error; The event is notified to the software of the access source cluster using a program change interrupt or the like.

Each of the clusters 12-1 to 12-3 has a control information unit 15 in its own local memory that manages control information for determining which area of the shared memory is to be accessed.

For example, when the cluster 12-1 disconnects the shared memory 101 due to the detection of a failure in area 1 in the shared memory 10-1 or due to a disconnection instruction from the user, the input/output path disconnection processing unit 13 automatically disconnects the shared memory 101. Information indicating that area 1 is in an unusable state is set in the control information unit 15 in the cluster (Fig. 1), and the input/output path disconnection mechanism 11-1
Input/output path p connecting shared memory 10-1 and all clusters
H, P21. Physically disconnect P31.

Other clusters 12-2.12 to 3 use the disconnected input/output path l"21.P31 to access the shared memo U10-1.
When area 1 is accessed, a program check that can be recovered by 1 occurs because it is physically separated. Here, 1-recovery means that it is possible to return to 1-original processing after performing error interrupt processing and the like.

The access prohibition processing units 14 of clusters 12-2 and 12-3 recognize that area l is unusable by detecting 1 program check, and do not access area 1 from now on. In order to do this, it is set in the control information section 15 existing in the cluster that area 1 is in an unusable state ((2), (2) in FIG. 1).

As a result, all clusters access only area 2 on the shared memory 10-2.

The integrity of duplicated data is achieved.

[Effect]

In the present invention, the input/output path pHP to the separated area 1
21. P31 is physically disconnected throughout all clusters.

Clusters 122 other than failure detection cluster 12-1 12
-3 accesses 5 separated area 2, but 1 input/output path P21 between that area 1 and the own cluster. P3
Since 1 does not exist, a program check occurs.

When a program check occurs, each cluster is
It is possible to recognize that area 1 is separated without using inter-cluster communication or the like.

By physically disconnecting in this way, each cluster will be unable to access Area 1 even if it attempts to do so, and each cluster will only access Area 2 on the connected side. )become.

Even if the cluster malfunctions, the area 1 on the separated side will not be accessed, and the duplexed data can be maintained. Furthermore, by physically disconnecting each input/output path, it is possible to notify other clusters that the faulty memory is unusable without using communication between clusters. Since the control information unit 15 is provided for each cluster, the duplexed data in the shared memory can be accessed at high speed.

The reason for this is that accessing local memory is faster than accessing shared memory, compared to when control information is set in shared memory.

The control information can be referred to at high speed, and there is no need to perform complicated exclusion side '<711 etc. regarding the control information.

〔Example〕

FIG. 2 is an example of state transition according to an embodiment of the present invention.

FIG. 3 shows a processing flow of an embodiment of the present invention, and FIG. 4 shows an explanatory diagram of an input/output path cutting mechanism used in an embodiment of the present invention.

Hereinafter, in order to simplify the explanation, a case where there are two clusters will be explained as an example, but it can be similarly applied to a case where there are three or more clusters.

Figure 2 (a) shows 2 normal duplex shared systems;
-1.10-2 shows the operational status of a system using multiple clusters 12a and 12b. Area 1 is the main system, and area 1 is the slave system.

The main system is subject to light
Access only.

As shown in FIG. 2(b), it is assumed that the cluster 12a accesses area l and detects a failure.

When cluster 12a detects a failure in area l,
As shown in c), the main system is rewritten to area 2 in the internal control information, and area 1 is rendered unusable. At the same time, the input/output path from cluster 12a to area 1 and the input/output path from cluster 12b to area 1 are cut off. In this state, the control information in cluster 12b is 1
It remains as it was.

Assume that in cluster 12b, area 1 is accessed as shown in FIG. 2(d) in order to request access to duplicated data.

When cluster ]21] accesses area 1, the input/output path to area 1 is disconnected.

As shown in FIG. 2 (BO), a program check occurs.

When a program check occurs in the cluster 12b,
It recognizes that area 1 has been separated and rewrites the main system to area 2 in the internal control information, making area 1 unusable.

As a result, from now on, all clusters will not be accessed for area 1, and single-lung operation will be performed using only area 2.

Although the example in which area 1 is separated due to a failure has been described, the same applies to the case in which area I is separated by an instruction from an operator or the like.

The processing flow is as shown in (1) to (2), not shown in FIG. 3, for example.

(2) For example, assume that the cluster 12a detects a failure in one of the redundant areas.

■ Determine whether a failure has occurred in area l or area 2.

■ If a failure occurs in area 1, after updating the internal control table, disconnect the input/output paths between area 1 and all clusters. Note that if a failure occurs in area 2, the input/output paths between area 2 and all clusters are disconnected.

(2) Suppose that after the cluster 12a disconnects the input/output path, another cluster 12b, which is unaware of the failure, accesses 5 areas.

■ A program check occurs in one area.

(2) Determine whether a program check occurs when accessing area 1 or when accessing area 2.

■ When a program check occurs in area I, area 1 is made unusable in the internal control table. If a program check occurs in area 2, similar processing is performed for five areas 2.

Once one region is separated by the above processing, one-lung operation will be performed using only the other region.

The input/output path disconnection mechanism 11-1 and 11-2 shown in FIG. ].

The input/output path cutting mechanism used in this embodiment has a structure as shown in FIG.

As shown in FIG. 4, the shared memory 10-1 and 10-2 are divided into a storage mechanism 40 for storing data and a control mechanism 41 for controlling the entire shared memory or communicating with the cluster 12. .

Communication with each cluster 12 is performed via a boat 43 in the control mechanism 41. One boat 43 is fixedly assigned to each cluster 12.

The boat 43 has two states, valid and invalid, and in order to control the state, a control memory 42 of 1 bit per port exists in the control mechanism 41 and corresponds to each boat 43 on a one-to-one basis. do. This control memory 42 includes the storage mechanism 4
This is different from the memory in 0.

When the bit of the control memory 42 is "1", the state of the corresponding port 43 is valid, and the cluster I2 assigned to that port 43 can communicate with the shared memory. In this state, the cluster 12 can not only transfer data to and from the shared memory, but also change the contents of the entire control memory. That is, the boat 43 in the active state
The cluster 12 connected to the boat 43 can also change the status of other boats 43.

A cluster 12 connected to an invalid boat 43 is not only unable to transfer data.

Control memory cannot be changed either.

By using the above mechanism, the ports 43 of all clusters 12 related to the shared memory where the failure has occurred are made invalid.
Data transfer from each cluster 12 can be physically inhibited. This also makes it possible to avoid data destruction due to malfunction of the cluster 12.

[Effect of the invention] The effects of the present invention are as follows.

(a) The shared memory can be separated 7 quickly and easily while data is guaranteed. No communication between clusters is required.

α)) Access to the separated shared memory is not only prohibited by rough hardware, but also physically inaccessible, so there is no risk of system malfunction.

(0) Since there is no need to have information for managing availability in the shared memory, it is possible to access duplexed data in the shared memory at high speed.

(d) Processing related to separation of shared memory.

High reliability due to strong independence of each cluster

[Brief explanation of the drawing]

FIG. 1 is a diagram explaining the principle of the present invention. FIG. 2 is a diagram showing a side beam of a state transition according to an embodiment of the present invention. FIG. 4 is an explanatory diagram of an input/output path cutting mechanism used in an embodiment of the present invention. FIG. 5 shows an example of the prior art. In the figure, 10-1.1 (1-2 is shared memory, 111.1
1-2 is an input/output path disconnection mechanism, 12-1 to 12-3 are clusters, 13 is an input/output path disconnection processing unit, 14 is an access prohibition processing unit, 15 is a control information unit, and P11 to P32 are human output paths. represent.

Claims (1)

[Claims] A plurality of clusters (12-1, 12-
2,...) and input/output paths (P11, P12,...
) In a multicomputer system equipped with duplicated shared memories (10-1, 10-2) connected to each cluster via Output path cutting mechanism (11-1,
11-2), and each cluster includes: a control information unit (15) that manages the validity/invalidity of each area of the duplicated shared memory; When disconnecting, the input/output path disconnection process sets that the area is invalid in the control information section and uses the input/output path disconnection mechanism to disconnect all input/output paths connecting the area and each cluster. By using the processing unit (13) and the disconnected input/output path, when an access terminates abnormally, the area is set to be invalid in the control information unit, and access to that area is disabled from now on. 1. A duplex data protection device comprising: an access prohibition processing unit (14) that prohibits access.