JPH0430224A - Execution continuing system for processing - Google Patents

Abstract

PURPOSE:To prevent the deterioration in reliability by ensuring a check point when a fixed fault occurs in a certain instruction processor, reporting interruption to the other normal instruction processor and continuously executing an interrupted processing in a normal instruction processor. CONSTITUTION:When the fixed fault occurs in the instruction processor 111a(111b), the check point security part 118b(118a) of a fault instruction proces sor 11b(11a) ensures the check point. Then, the instruction processor 111a(11b) stops check and malfunction alarm interruption is communicated with the other instruction processor 11b(11a). The instruction processor 11b(11a) receiving communication reads scanout information stored in a main storage 131 by the processing of OS. When it is recognized that information of the check point is accurately stored by a check point display, stored internal information on the instruction processor 11b(11a) is edited and a control table required for the continuous execution of the processing is generated. Thus, the processing executed in the intruction processor where the fault occurs can be executed in the other normal instruction processor by succeeding it without increasing the probability of the shut-off of the system.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to a method for continuing execution of processing that has been interrupted due to a failure. Especially in a multiprocessor system where multiple instruction processing units share the main memory, if processing cannot be continued due to a failure in one instruction processing unit, the processing being executed by that instruction processing unit will continue normally. This invention relates to a method for continuing execution of a process that provides a method for making it executable.

[Conventional technology]

Known recovery methods when an intermittent failure occurs in an instruction processing device include a method of retrying the process that was being executed at the time of the failure, and a method of returning to a certain checkpoint such as an instruction unit and re-executing the process. .

On the other hand, when a fixed fault occurs in an instruction processing device and recovery from the fixed fault fails, an interrupt indicating failure recovery from the fault is generally generated for the instruction processing device itself.

For example, a machine check interrupt or the like is used to notify that an unrecoverable failure has occurred.

There are two types of machine check interrupts when an unrecoverable failure occurs:

(1) Although an unrecoverable failure has occurred, the checkpoint state before the failure is guaranteed at the time the interrupt occurs.

(2) An unrecoverable failure occurs, and the state of the checkpoint before the occurrence of the failure is not guaranteed at the time the interrupt occurs.

The machine check interrupt in state (1) is called PD-B (processor damage backup), and the machine check in state (2) is called PD (processor damage). The difference between these two will be explained using FIG. Figure 2,
, 21 to 24 are instructions. Now, suppose that a failure occurs while the instruction processing device is executing instruction C. The instruction processing device generates a PD-B or PD machine check interrupt depending on the content of the failure. Status of instruction processing device before execution of instruction C (checkpoint status before failure occurrence)
5 instruction processing device generates a PD-B machine check interrupt. Therefore, after accepting the interrupt, if the program is generally re-executed from instruction C, the program can continue to be executed normally. - If the internal state of the instruction processing device has been changed by instruction C, etc.
If the checkpoint state before execution of instruction C cannot be guaranteed, the instruction processing device generates a PD machine check interrupt. In this case, even if the instruction is re-executed from instruction C even after the interrupt occurs, the normality of the process cannot generally be guaranteed.

Furthermore, depending on the failure situation, subsequent re-execution operations and failure recovery operations may not be possible at all.

Furthermore, if another failure occurs during failure recovery processing such as checkpoint guarantee, the failure recovery operation is impossible, and in such a case, the instruction processing device abnormally stops. This operation is called a check stop, and when one instruction processing device in a multiprocessor system performs a check stop, an interrupt called a malfunction alarm is reported to other operating instruction processing devices.

Detection and reporting of failures in the above instruction processing device.

The operation of the check stop and malfunction alarm interrupt will be explained with reference to FIG. In FIG. 3, 311a.

311b is an instruction processing device. Although this configuration example shows a case where there are two instruction processing devices, the same applies to a case where there are two or more instruction processing devices. Each instruction processing device includes instruction execution units 312a, b, failure detection units 313a, b, interrupt control units 314a, b, check stop latches 315a, b.
There is.

If the failure detection unit 313a of the instruction processing device 311a detects a failure and it is not a check stop factor, it communicates this fact to the instruction execution unit 312a via the signal line 319a. Upon receiving the notification, the instruction execution unit 312a continues processing if the instruction retry and the 6-instruction retry that attempts to recover the checkpoint state are successful, but if the instruction retry fails, the instruction execution unit 312a , generates a machine check interrupt. As mentioned above, a PD-B machine check interrupt is generated if the checkpoint state recovery is successful, and a PD machine check interrupt is generated if the checkpoint state recovery is unsuccessful.

Furthermore, when the fault detection unit 313a detects a fault that is the cause of the check stop, the fault detection unit 313a detects the fault on the signal line 319a.
The instruction execution unit 312a is instructed to stop executing the instruction via the instruction execution unit 312a, and the instruction execution unit 312a stops executing the instruction. Furthermore, the fault detection section 313a sets the check stop latch 315a via the signal line 317a. When check stop latch 315a is set, it is connected to another instruction processing device 311b via signal line 318a.
is transmitted to the interrupt control unit 314b, and the interrupt control unit 314
In b, an interrupt mask is calculated to control whether or not an interrupt is allowed.
Create an interrupt signal. The interrupt signal is transmitted to the instruction execution unit 312b via the signal line 320b, and the instruction execution unit 31
At 2b, a malfunction alarm interrupt occurs. In this case, the internal state of the check-stopped instruction processing device 311a is generally undefined, and even if the internal state can be read out, it is impossible to try or re-execute from the checkpoint based on that information.

By the way, when a failure occurs and re-execution by the hardware fails, the O8 running on the instruction processing device where the failure occurred receives a report via a machine check interrupt or the like and continues processing or performs abnormal termination processing. There is a high possibility that the instruction processing device will fail again. In such a case, the failure will occur in a core part such as the failure handling part of O8, and there is a high possibility that the system will go down.

Conventionally, in multiprocessor systems, in order to prevent system failures due to fixed failures, a method has been used in which the processing that was being performed by the failed instruction processing unit is taken over and executed by another normal instruction processing unit. It has been taken. Regarding this method, several technologies have been provided so far (Japanese Patent Publication No. 47-36181, Japanese Patent Publication No. 61
-56537, JP-A-57-85151, JP-A-5
7-137949, Japanese Patent Application Publication No. 1-133171, etc.)
In these methods, the state of the faulty instruction processing device immediately before the fault occurs is stored in the main memory, etc. by the operation of the faulty instruction processing device, the normal instruction processing device, or the recovery control device. Alternatively, the information is directly transferred to a normal instruction processing device, and the normal instruction processing device uses the information to re-execute the interrupted process on the failed instruction processing device.

[Problem to be solved by the invention]

In the conventional technology, a device for recovery control (Japanese Patent Publication No. 47-361
No. 81, Japanese Patent Publication No. 61-56537, etc.) It is necessary to provide a circuit for retrying the instructions of the faulty instruction processing device in the normal instruction processing device (Japanese Patent Publication No. 57-137949, etc.), and a lot of additional hardware is required. The problem is that it requires hardware and the mechanism becomes complicated, and because the failure instruction processing device creates information for continued execution of processing (Japanese Patent Publication No. 57-85151, etc.), there is a high possibility that failure will occur again. There was a problem with that. In addition, even if there is a multiprocessor, if for some reason only one processor has failed, a normal instruction processing unit can take over the processing, allowing the faulty instruction to be processed. This results in the abandonment of the re-execution 2 recovery process in the processing device, which increases the probability that the system will stop and reduces reliability.

It is an object of the present invention to overcome the above-mentioned problems, to reduce the need for additional hardware, and to prevent the occurrence of new failures due to the creation of information for continued execution of processing by an instruction processing device in which a failure has occurred. Furthermore, even if there is only one instruction processing device in operation, the processing that was being performed by the failed instruction processing device can be taken over by another normal instruction processing device without increasing the probability of the system stopping. The purpose is to provide a method for executing the method.

[Means to solve the problem]

In order to achieve the above object, the present invention provides an indicator that indicates whether or not the checkpoint state has been successfully recovered in failure recovery processing during instruction execution, and displays the internal state of hardware such as an instruction processing device in the main memory. a scan-out mechanism for storing the operating status in the instruction processing unit, a mechanism for communicating the operating status with other instruction processing units, a mechanism for communicating a malfunction alarm interrupt to other instruction processing units when the instruction processing unit has check-stopped, and a main unit. An instruction to read the contents of a storage device is used.

[Effect]

When a fixed failure occurs in a certain instruction processing device, the faulty instruction processing device guarantees a checkpoint and attempts to retry the instruction. When the instruction retry fails and the checkpoint state before the instruction execution can be guaranteed, a checkpoint guarantee indicator is set and the checkpoint state is stored in the main memory by scan-out processing. Regarding the specific operations of the scan-in and scan-out methods, see, for example, JP-A-59-161744 "Scan Method for Information Command Processing Device" and JP-A-61-123939.
An example of this is described in ``Scan Method of Information Instruction Processing Device''. Thereafter, the instruction processing device performs a check stop and a malfunction alarm interrupt is communicated to other instruction processing devices. The instruction processing device that received the notification reads the scanout information stored in the main memory through O8 processing, and after confirming that the checkpoint information is correctly stored using the checkpoint indicator, processes the stored instruction. Edit the internal information of the device and create the control table necessary for continued execution of processing. This makes it possible to continue processing using other normal instruction processing devices even in the event of a fixed fault, without requiring particularly large-scale additional circuits/devices or information manipulation by faulty instruction processing devices. Become.

〔Example〕

An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram of a multiprocessor system to which an embodiment of the present invention is applied. In the figure, 1lla
, b is an instruction processing device (hereinafter referred to as IP), 121 is a system control unit W (hereinafter referred to as SC), and 131 is a main storage device (hereinafter referred to as MS). The instruction processing devices 111a and 111b have the same configuration, and each includes an instruction execution section 112a, b, a fault detection section 113a, b, an interrupt control section 114a, b, and a checkpoint guarantee latch 11.
5a, b, check stop latch 1.1.6a.

It is equipped with b. The instruction execution units 112a, b include execution control units 117a, b, checkpoint guarantee unit 118a,
There is b. The system control device 121 also includes a scan control section 122. Although FIG. 1 shows a configuration in which there are two instruction processing devices, the configurations of both instruction processing devices are the same, and the present embodiment can be applied without modification to a configuration in which there are two or more instruction processing devices. Here, the checkpoint guarantee latch uses the conventional malfunction alarm interrupt for communication to continue processing, and when a normal IP receives the malfunction alarm interrupt, it is a checkpoint in the conventional sense. This is essential in order to distinguish whether it is a malfunction alarm interrupt caused by a malfunction alarm interrupt or a malfunction alarm interrupt for continuing processing as described in the present invention.

Next, the operation when a failure occurs in IP 111a will be explained using FIG. The instruction execution unit 112a of the IpH1a executes the command execution unit 112a of the IpH1a via the signal line 152a.
1 and executes instruction processing. In addition, other instruction processing devices are notified via the signal line 147 that the instruction execution unit 112a is in operation. Similarly, whether or not other instruction processing devices are in operation is reported to the execution control unit 117a via the signal line 148. This signal has conventionally been used for buffer storage, address translation buffer match control, etc. which are not explicitly shown in this embodiment. The failure detection unit 113a detects a failure in its own IP and reports the fact to the execution control unit 117a of its own IP via a signal line 143a.

The execution control unit 117a is executed when a fixed IP failure occurs.

Checkpoint guarantee unit 118 via signal line 146a
If the checkpoint guarantee is successful, the checkpoint guarantee latch 115a is set via the signal line 141a. Next, an instruction is sent to the scan control unit 122 in the 5C 121 to scan out the internal state of the instruction processing device 111a via the signal line 149a. Scan control unit 12 in 5C121
2 reads the internal information of the IPlla via the signal line 150a and writes it to the MS 1131 via the signal line 151. Further, when the execution control unit 117a confirms that the other instruction processing device is in operation based on the operating state of the other instruction processing device notified through the signal line 148, the execution control unit 117a
42a,b to check stop latch 116a,
Set b.

Furthermore, execution of instructions on the own IP is stopped. By setting the check stop latches 116a and 116b,
An interrupt signal is sent to the interrupt control units 114b and 114a of other normal IPs via the signal lines 145a and 145b. The interrupt control units 114b and 114a control the signal line 144 according to the separate signal.
Instruct the normal IP execution control units 117b and a to generate an interrupt through the IP instruction execution units 112a and b through b and a.6 The IP instruction execution units 112a and b
Check the state of P at a certain point before the failure occurs (checkpoint)
checkpoint guarantee units 118a, b, and instruction execution control unit 117a.

It has b. FIG. 4 shows an example of the configuration of the checkpoint guarantee section. The execution control section is a control circuit, and its operation is shown in FIG. Although FIG. 4 shows the checkpoint guarantee means 118a of IPlla, the same applies to IPllb.

In FIG. 4, the execution control unit 117a is connected to the signal line 146a.
-1, 146a-2, etc., each element of the checkpoint guarantee unit is controlled. Here, only two control signal lines 146a-1 and 146a-2 necessary for describing the operation are shown. In the figure, 411 is the signal line 152a-1
412 is a register for setting data before being operated on by the arithmetic unit (ALU) 413, 413 is an arithmetic unit, and 414 is a register for setting the arithmetic result. It is a register. 415 is a group of general-purpose registers that can be referenced by instructions; 41
6 is a selector that selects input to the general-purpose register group 415, and 417 is a register group that stores data before calculation. Further, 418 is a control information group indicating whether the stored data 417 before calculation is data that can be retried or data that can guarantee a checkpoint, and is controlled in synchronization with the register group 417. Data in register group 415 is set in register 412 via signal line 425. The contents of the registers 411 and 412 are stored in the arithmetic unit (ALU) 413.
After the calculation is performed, the data is written to the register group 415 again via the signal line 424.

It is written to the MS 131 via the signal line 152a-2. The register group 417 saves the contents of the register 412 every time an instruction is executed.
The contents of No. 5 before writing (before execution of calculation) are saved in order. The control information group 418 determines whether the data saved in the register group 417 each time an instruction is executed is data that can be retried.
This is information indicating whether the data can guarantee a checkpoint, and is sequentially saved by the execution control unit via the control signal line 146a-1 in synchronization with the save to the register group 417.

Next, the operation of the instruction execution unit when a failure occurs in the IPlla will be explained using FIGS. 4 and 5. This operation is the same even when a failure occurs in IPlllb.

When a failure occurs in IPlla, the execution control unit 117a
receives the report from the failure detection unit 113a via the signal $143a. First, the state of the save information immediately before the failure occurs is read via the signal line 146a-2, and it is determined whether the save information can be retried (step 501).
). If retry is not possible, control is performed to generate a machine check interrupt (PD) indicating failure of retry. If retry is possible, the data for retry is restored to the register group 415 via the signal line 423, or a try restore process is performed (step 502), and the failure occurrence process is retried (step 503).

In this embodiment, it is determined whether the failure is a fixed failure or an intermittent failure based on the success/failure of this retry (step 504).
). In addition to this, it is also possible to determine whether a fault that has occurred is a fixed fault by determining whether the same fault occurs even if the command is tried multiple times, or by testing the part where the fault occurs. You can judge by. If the disability is not a fixed disability.

The processing attempt is successful and normal instruction execution processing can be continued.

If the retry fails or if it is determined that the failure is a fixed failure when the failure occurs, the following processing is performed. First, the state of the saved information before the failure occurs is read out via the signal line 146a-2, and it is confirmed whether or not the internal state can be returned to a certain checkpoint before the failure occurred (step 505). What checkpoints cannot guarantee is that MS
131 has already been rewritten, or when the register group 415 cannot be recovered from the contents of the save register 417. At this time, a machine check interrupt for PD display is generated. If the checkpoint can be guaranteed, the save register 41 in FIG.
The contents of 7 are written to the register group 415 via the signal line 424° selector 416 until a checkpoint can be guaranteed (step 506). When the checkpoint guarantee ends, the checkpoint guarantee latch is set via signal IX 141a (step 507).

Next, a scan-out instruction is issued to the internal scan-out control unit 122 of the 5C 121 via the signal line 149a (step 508). Canout control unit 12 that received the notification
2, as in the normal scan operation, the internal state of the instruction processing device, including the contents of the register group 415 in FIG.
a-1 etc., and MS via the signal line 151.
113. When reading and storing are completed, the control unit 1 executes scan-out completion through the signal line 149a.
Report to 17a. The execution control unit 117a, which has received the completion of the scan-out, then checks the operating status of the IP other than itself via the signal line 148 (step 509). If there is an IP in operation other than your own, set the check stop latch using the signal line 142a (step 51o).
, stops execution of the instruction and performs a checkstop. By setting the check stop latch, a malfunction alarm interrupt request is communicated to the interrupt control unit 114b of the IPllb, which is an operating normal IP, via the signal line 145a.

If there is no other IP in operation, a PD-B machine check is generated for itself.

FIG. 6 is an example of IP internal information stored on the MS 113. The internal information 61 includes checkpoint guarantee latch information 611 indicating whether or not checkpoint guarantee was successful, information 612 on registers that can be read from the program, which is the internal state of the IP, and information 61 on timers.
It consists of 3 etc. The area in which this information is stored may be a fixed area set in advance for each instruction processing device, or may be specified to the instruction processing device or scanout control unit 122 before a failure occurs.

Alternatively, an area used exclusively for scan-out may be set and the data may be stored therein. However, in that case, a means for the software to read the stored information is required.

Next, an example of the operation when the execution control unit 117b of IPllb accepts or accepts a malfunction alarm interrupt will be described with reference to FIG. When the malfunction alarm interrupt is accepted, the O8
The internal state of the IP stored in 131 is read (step 701), and the presence or absence of checkpoint guarantee is tested (step 702). If a checkpoint is guaranteed and the IP internal information before the failure is stored, task control is performed to read the stored IPlla internal information and continue executing the process that was being executed. The task is edited in the form of information (Step 703), and registered in the appropriate ready task queue for continued execution (Step 704). Once registered in the queue,
Like tasks that become ready in normal time slice control or tasks that wait for I10 after Ilo is completed, they are dispatched and executed in order. If the checkpoint is not guaranteed, the internal information of IPlla has not been saved and it is impossible to continue processing.
Similar to the process that was performed when a conventional malfunction alarm interrupt occurred, the process that was being performed when a failure occurred in IpH 1a is abnormally terminated (step 705).

Since the above software processing is performed in IPllllb, it is guaranteed that the process can continue, and even if the process is continued, or if it is not possible to continue and abnormally terminated, the failure will not occur again. .

In this embodiment, a method is adopted in which a hardware latch is provided as an indicator of checkpoint guarantee and its state is stored in the MS. Direct M instead of hardware latch
Even if the IP that continues processing writes to S or directly reads the state of the latch, it is sufficient if the value of the checkpoint guarantee indicator can be tested from the IP that continues processing.

Further, although task control information is created in this embodiment in an instruction processing device that continues processing, other control methods that allow continuous execution of processing may be used.

〔Effect of the invention〕

As is clear from the above description, according to the present invention, in a multiprocessor system that shares a main memory,
When a fixed failure occurs in a certain instruction processing device, a checkpoint is guaranteed, the interrupt is reported to another normal instruction processing device, and the interrupted processing is continued to be executed by the normal instruction processing device. However, it is possible to easily and inexpensively use a conventional mechanism with a minimum increase in the amount of hardware, and without reducing reliability even when only one instruction processing unit is operating in a multiprocessor. It has the effect of becoming.

[Brief explanation of drawings]

FIG. 1 is a block diagram showing the configuration of a multiprocessor system to which an embodiment of the present invention is applied, FIG. 2 is an explanatory diagram of checkpoints, and FIG. 3 is a block diagram showing the configuration of an instruction processing device in a conventional system. , FIG. 4 is a configuration diagram showing an example of the configuration of the checkpoint guarantee section in the instruction execution section, and FIG.
Figure 6 is a flowchart of processing when handling a failure in the instruction execution control unit, Figure 6 is an explanatory diagram showing an example of IP internal information, and Figure 7 is a flowchart of processing performed by a normal instruction processing device that receives and takes an interrupt. It is. 13・Main storage device, 21 to 24・Instruction, 61・IP internal information example, 1lla, b...Instruction processing device, 112a,
b-Instruction execution unit, 113a, b-fault detection unit, 114a
, b-interrupt control unit, 115a. b... Checkpoint guarantee latch, 116a, b Checkstop latch, 117a, b Execution control unit,
118a, b...Checkpoint guarantee department, 121 ・
System control device, 122... scanout control unit,
411, 412, 414... register, 413...
Arithmetic unit, 415...General-purpose register group, η

Claims (1)

[Claims] 1. In a multiprocessor system having a plurality of instruction processing devices and a main memory shared by the plurality of instruction processing devices, a failure in the instruction processing device is detected and the corresponding means for returning the state of the instruction processing unit to the state at a certain point in time (checkpoint) before the failure occurred; means for saving the internal state of the instruction processing unit to the main memory; comprising means for communicating with at least one of the processing devices, and means for reading and processing internal information of the failed instruction processing device saved in the storage device;
When a failure occurs, each instruction processing device guarantees the state at the time mentioned above before the failure occurs, and if it can be guaranteed, saves the state to the main storage, and then contacts other instruction processing devices. The other instruction processing device that received the instruction reads the internal information of the faulty instruction processing device that has been saved in the storage device, uses the internal information to create control information for continuing processing, and resolves the fault in the faulty instruction processing device. A process execution continuation method characterized by continuing execution of a process that has been interrupted. 2. The process execution continuation method according to claim 1, wherein an interrupt means is used to communicate with the other instruction processing device. 3. Read internal information of the failure instruction processing device;
3. The process execution continuation method according to claim 1, further comprising a program that uses the internal information to create control information for continuing the process. 4. The process execution continuation method according to claim 1, wherein a scan circuit is used when saving the internal state of the instruction processing device to the main memory. 5. Continuation of execution of the process according to any one of claims 1 to 4, characterized in that the internal information of the failure instruction processing device is provided with an indicator indicating that the state at the time immediately before the failure is guaranteed. method. 6. When contacting the other instruction processing device, the other instruction processing device is contacted only when there is at least one operating processor other than the own instruction processing device. Method for continuing execution of the process described in 5.