Main Memory System and Checkpointing Protocol for Fault-Tolerant Computer System

This invention provides a mechanism for maintaining a consistent state in main memory without constraining normal computer operation, thereby enabling a computer system to recover from faults without loss of data integrity or processing continuity. In a typical computer system, a processor and input/output elements are connected to a main memory via a memory bus. In the invention, a shadow memory element, which includes a buffer memory and a main storage element, is also attached to this memory bus. During normal processing, data written to primary memory is also captured by the buffer memory of the shadow memory element. When a checkpoint is desired (thereby establishing a consistent state in main memory to which all executing applications can safely return following a fault), the data previously captured in the buffer memory is then copied to the main storage element of the shadow memory element. This structure and protocol can guarantee a consistent state in main memory, thus enabling fault-tolerant operation.

In the drawing,

FIG. 1 is a block diagram of a fault tolerant computer system which uses the main memory structure of the present invention;

FIG. 2 is a block diagram illustrating in more detail a processing unit with a cache and a shadowed main memory;

FIG. 3 is a more detailed block diagram of the shadow memory shown in FIG. 2;

FIG. 4 is a more detailed block diagram of the memory control logic shown in FIG. 3;

FIG. 5 is a diagram of memory locations used by the processing units to maintain main memory consistency; and

FIG. 6 is a flowchart describing how each processing unit controls flushing of its cache to maintain main memory consistency.

The present invention will be more completely understood through the following detailed description which should be read in conjunction with the attached drawing in which similar reference numbers indicate similar structures. All references cited herein are hereby expressly incorporated by reference.

A computer system must guarantee the existence of a consistent state in main memory (i.e., a "checkpoint") to which all application programs can return following a fault if it is to be able to recover transparently from the fault. It is highly desirable for the computer system to provide this capability without placing any special requirements on application programs using it. In some currently available computer systems, a consistent state is assured by storing all modifiable data in two physically disjoint locations (a primary location and a shadow location) in main memory. U.S. Pat. Nos. 4,654,819 and 4,819,154 further describe such a computer system. For this procedure to work, however, each processor in the computer system must have a blocking cache; that is, the processor cannot write any cache line back to main memory unless it writes back all currently modified lines at the same time. Thus, any cache overflow or request for data in the cache from another processor forces the processor to flush the entire cache.

The major disadvantage of this approach is that it precludes the use of more conventional non-blocking caches along with their associated cache-coherency protocols. Porting software from other computer systems to be used with such a computer system is difficult and performance problems are likely after the port is completed. Also, the use of unconventional hardware increases the cost of the computer system, whereas the use of standard commercially available processors would reduce its cost. Conventional processors also require the use of conventional cache protocols; however, previous checkpointing systems were unable to guarantee main memory consistency and thus to provide fault tolerant operation using conventional caches.

FIG. 1 is a block diagram of one embodiment of a fault tolerant computer system 11 embodying the invention. One or more processing elements 14 and 16 are connected to one or more main memory systems 18 and 20 via one or more buses 10 and 12. One or more input/output (I/O) subsystems 22 and 24 are also connected to the bus 10 (12). Each I/O subsystem comprises an input/output (I/O) element 26 (28) and one or more buses 30 and 32 (34 and 36). An I/O element 26 (28) may also be connected to any standard I/O bus 38 (40), such as a VME bus. For ease of description, only one of each of these systems and subsystems are referred to below.

As shown in FIG. 2, each processing element, e.g., 14, includes a processing unit 44 connected to a cache 42. This connection also connects the processing unit 44 and the cache 42 to the bus 10. The processing unit 44 may be any standard microprocessor unit (MPU). For example, the PENTIUM microprocessor, available from Intel Corporation, is suitable for this purpose. The processing unit 44 operates in accordance with any suitable operating system, as is conventional. A processing element 14 may include dual processing units 44 for self-checking purposes. The cache 42 is either a write-through or a write-back type of cache and has an arbitrary size and associativity. The processing unit 44 may store in the cache 42 either data only or both computer program instructions and data. In the former case, an additional similar instruction cache 43 may be connected to the processing unit 44 for the processing unit 44 to store computer program instructions. This connection also connects the instruction cache 43 to the bus 10. If this system is a symmetric multiprocessing computer system, each processing unit 44 may use any conventional mechanism to maintain cache coherency, such as bus snooping.

The cache 42 is connected to a main memory system, e.g., 18, via bus 10. The main memory system includes a primary memory element (PME) 46 and a shadow memory element (SME) 48 which are interconnected and connected to bus 10. The PME 46 and the SME 48 must have equal, but arbitrary, capacities.

The SME 48, as shown in FIG. 3, includes a buffer memory 52 and a main storage element 50, each having data inputs, data outputs and control inputs including access control and address inputs. The buffer memory and main storage element are typically implemented as dynamic, volatile, random-access memories (DRAMs), in the form of integrated circuits, typically, single in-line memory modules (SIMMs). A bus transceiver 55 connects the inputs of a data input buffer 54 and data outputs of the main storage element 50 to bus 10. Outputs of the data input buffer 54 are connected to the data inputs of buffer memory 52 and the data inputs of main storage element 50. The data outputs of the buffer memory 52 are also connected to the data inputs of the main storage element 50. Memory control logic 58 has control outputs which are connected to control inputs of each of the buffer memory 52, main storage element 50, data input buffer 54 and bus transceiver 55 to control the flow of data among those elements, in a manner which is described below. Memory control logic 58 also has data paths connected to bus 10 through the bus transceiver 55, a first address input connected to the address portion of bus 10 via bus transceiver 57 and a second address input connected to the data outputs of an address buffer memory 56. The address buffer memory 56 is also connected to outputs of an address input buffer 59, of which outputs are connected to the address portion of bus 10 via bus transceiver 57. Both bus transceiver 57 and address input buffer 59 have a control input connected to the memory control logic 58. The memory control logic 58 also controls storage in the address buffer memory 56 of addresses which correspond to data stored in the buffer memory 52, in a manner which is described below. The non-memory logic elements may be implemented using conventional circuitry, custom or semi-custom integrated circuits or programmable gate arrays.

Since it may be advantageous to keep the number of module types to a minimum, the PME's 46 may also have the same structure as the SME's 48. The buffer memory 52 in a memory element used as a PME 46 may store computer program instructions or read-only data which does not have to be shadowed. The memory control logic 58 in a memory element is preferably programmable to enable the memory element to be either a PME or an SME.

The buffer memory 52 should be large enough to capture all data modified between any pair of cache flushes. Given the process described below for using this system, the total capacity of all of the buffer memories 52 combined in computer system 11 should preferably be (at least) larger than the combined capacity of the caches 42 in the computer system 11.

The memory control logic 58 is illustrated in more detail in FIG. 4. It includes a command register 68 which has data input connected to bus 10 via the bus transceiver 55. A status register 66 has an output also connected to the bus 10 via bus transceiver 55. Buffer memory control circuit 60 and main storage control circuit 62 provide the row address strobe (RAS), column address strobe (CAS), row and column addresses and write enable (WE) control signals to the buffer memory 52 and main storage element 50, respectively. Control circuit 60 and 62 also have connections for coordinating data transfer between buffer memory 52 and main storage element 50. Buffer memory control circuit 60 has an output connected to the input of the status register 66 to indicate how full the buffer memory 52 is and whether copying from the buffer memory 52 to main storage element 50 is complete. Buffer memory control circuit 60 also has an input connected to the output of command register 68 which indicates whether it should copy data between the buffer memory 52 and the main storage element 50. The command register also indicates whether the memory element is a primary memory element or a shadow memory element. An I/O interface control 64 controls the flow of information through the status register 66 and command register 68, and coordinates data transfers through the bus transceivers 55 and 57 with the buffer memory control circuit 60 and main storage control circuit 62. The I/O interface control 64 also accepts inputs from the address portion of bus 10, so as to recognize addresses to the command and status registers and to the main memory system itself.

The process of using this system to maintain memory consistency following a fault will now be described. This process allows data to be passed from one processing element 14 to another processing element 16 without requiring the entire cache 42 of processing unit 14 to be flushed. Since all processing units 44 in the computer system 11 have access to all buses, each processing unit 44 may use conventional bus snooping methods to assure cache coherency. If all processing units 44 do not have access to all system buses, the processing units 44 may use other well-known cache coherency techniques instead.

The buffer memory 52 in each shadow memory element 48 allows consistency to be maintained in the main memory system 18 in the event of a fault. All data lines that are stored in one primary memory element 46 are also stored in the buffer memory 52, along with their corresponding memory (physical) addresses which are stored in the associated address buffer memory 56 in the shadow memory element 48. The protocol also applies to lines written to the primary memory element 46 when a cache 42 is flushed by the operating system using either specially designed flushing hardware or conventional cache flushing processor instructions. Flushing operations by the processing units 44 are synchronized. When all processing units 44 have completed their flush, the operating system instructs the shadow memory element 48, using command register 68, to copy, using main storage control circuit 62, the contents of the buffer memory element 52 into its main storage element 50. To maintain consistency, once a processing element 14 has begun a flush, it cannot resume normal operation until all other processing elements 14 have completed their flushes.

Processor cache flushing is synchronized because the buffer memory needs to know which data should be copied to the main storage element 50, and which data should not. That is, the buffer memory needs to distinguish between post-flush and pre-flush data. Thus, if the buffer does not know what processor is sending data, all processors must complete their flushes before normal operation can begin in order to maintain consistency. Synchronization is preferably controlled using a test-and-set lock operation using a designated location in main memory 18, such as indicated at 80 in FIG. 5, to store the lock value. At periodic intervals, each processing unit 44 determines whether it should initiate a flush operation as indicated at step 90 in FIG. 6. The processing unit 44 can make this determination in a number of different ways. For example, one or more bits in the status register 66 of the shadow memory element 48 could be used to indicate the remaining capacity of the buffer memory 52. If the buffer memory 52 is too full, a processing unit 44 initiates a flush. Also, a flush may be initiated after a fixed period of time has elapsed. If this processing unit 44 does not need to initiate a flush, then it examines the designated memory location 80 to determine whether another processing unit 44 has already set the lock (step 92). If the lock is not set, this process ends as indicated at 94. Otherwise, if the lock is set, this processing unit 44 flushes its cache 42 in step 96. The effect of the flushing operation is to store all lines in the cache (or preferably only those lines that have been modified since the last flush) to the primary memory element 46, and, because of the aforementioned properties of the shadow memory element 48, to the buffer memory 50 of the shadow memory element 48 as well. Prior to the actual flushing operation, the processing unit 44 saves its state in the cache 42 so that this information is flushed as well.

If the processing unit 44 determines in step 90 that it should initiate a flush, it then determines whether the lock is already set in step 98, similar to step 92. If the lock is already set, the processing unit 44 continues by flushing its cache 42 in step 96. Otherwise, it sets the lock in step 100, and identifies itself as the initiator of the flush before flushing its cache 42.

After a processing unit 44 flushes its cache 42 in step 96, it increments its corresponding flush counter in step 102. As indicated in FIG. 5, each processing unit 44 has a flush counter, such as shown at 82 and 84, which are predetermined designated locations in main memory 18. After the flush counter (e.g., 82) is incremented, the processing unit 44 determines whether it is the initiator of this flush sequence (step 104). If it is not the initiator, it then waits until the lock is released in step 106. When the lock is released, this process ends in step 108 and the processing unit 44 may resume normal operations.

If the processing unit 44 is the initiator of the flush as determined in step 104, it then waits until all flush counters (82-84) are incremented in step 110. Once all flush counters have been incremented, this processing unit 44 instructs the shadow memory element 48 to begin copying data in the buffer memory 52 into the main storage element 50, by sending a command to the command register 68, and releases the lock (step 112). Receipt of the command notifies the shadow memory element 48 that the flush has completed and causes the buffer memory control 60 in conjunction with the main storage control 62 to move the data that was stored in the buffer memory 52 into the appropriate locations (as determined by the corresponding physical address stored in address buffer memory 56) in the main storage element 50. Once this command has been sent, the flush lock is released and the processing units 44 can resume normal processing. The loops around steps 106 and 110 should have time-out protection which triggers fault recovery procedures, in the event of a failure during flushing operations.

The buffer memory control 60 can distinguish between pre-flush and post-flush data, for example, by storing the last address of buffer memory 52 in which data is stored at the end of each synchronized flushing operation. There are other ways to identify such a boundary, for example by monitoring the addresses of buffer memory 52 from which data has been copied, or by counting how much data has been written to buffer memory 52. All data stored in addresses in buffer memory 52 between the address stored for the (i-1)th flush and the address stored for the ith flush is pre-flush data. Any data stored in an address outside of that range is post-flush data which is not copied to the main storage element 50. Any (i+1)th flush data may be placed in any area of the buffer memory 52 which has been copied to the main storage element.

These operations ensure the existence of a consistent state in main memory 18 to which the computer system 11 can safely return following a fault. If the fault affects any portion of the computer system 11 other than the shadow memory element 48 itself, the shadow memory element 48 contains the state of main memory 18 following the last completed flush. If data was being moved from the buffer memory 52 to the main storage element 50 at the time of the fault, this operation has to be completed before normal processing can resume. Since, as part of the flushing operation, each processing unit 44 has stored the processing state that existed at the time that the flush was initiated, all running tasks have been saved in a consistent state in main memory 18. Following a fault, the contents of the shadow memory element 48 can either be copied to the corresponding primary memory element 46, if it is still operational, or the shadow memory element 48 can take over the role of the primary memory element 46. In either event, normal processing can resume from that saved state.

If the fault was in the shadow memory element 48 itself, then the remainder of the computer system 11 is unaffected. The only consequence is that the computer system 11 no longer has the ability to recover if a second fault should occur before the shadow memory element 48 is repaired.

Overflow of a buffer memory 52 is also not fatal. The contents of the associated shadow memory element 48 can always be restored by copying the contents of its associated primary memory element 46. Since the system may not be able to recover from a fault during this interval, however, it is important that the probability of such an overflow be kept to a minimum.

This checkpointing protocol allows data to be written to a primary memory element 46 at any time. Consequently, a single cache line can be written to a primary memory element 46 without forcing the entire cache 42 to be flushed, thereby relaxing the requirement for a large, associative cache. Further, data can be passed from cache 42 of one processing unit 44 to cache 42 of another processing unit 44 so long as it is simultaneously updated in the primary memory element 46 and in the buffer memory 52 in the shadow memory element 48. Significant performance advantages can be obtained using this protocol in a multiprocessing system in which shared data is frequently passed from the processing element (e.g., 14) to another processing element (e.g., 16).

If a standard bus protocol is used to implement this process, a shadow memory element 48 remains passive so far as the bus 10 is concerned. It simply stores in its buffer memory 52 all data written to its corresponding primary memory element 46. In order for the shadow memory element 48 to accept data synchronously with the primary memory element 46 the data input buffer 54 temporarily stores the data because a line may be in the process of being copied from the buffer memory 52 to the main storage 50 at the time of the write.

Some performance advantage can be gained if certain non-standard bus protocols are also implemented. For example, if the bus protocol allows the shadow memory element 48 to distinguish between processing elements 14, or at least to identify whether a line being stored has been written by a processing element 14 that has completed its ith flush or is still executing its ith flush, a processing element 14 does not have to wait until all other processing elements have completed their flushes before it resumes normal operation. In this case, consistency is maintained in main memory by requiring a processing element 14 to suspend normal operation after completing its ith flush, only until all other processing elements 16 have also at least begun (but not necessarily completed) their ith flushes. This relaxed synchronization restriction still achieves checkpoint consistency. That is, it guarantees that a processing element 16 that has not begun its flush does not receive post-flush modified data from another processing element 14 that has completed its flush and resumed normal processing. This less restrictive synchronization protocol can be allowed if the logic associated with the buffer memory 52 can distinguish between data that is being written as part of the flushing operation (and hence must be stored in the part of the buffer memory 52 that is to be stored to the main storage element 50 as soon as all processing elements 14 have completed their flushes) and data that is being written by a processing element 14 that has completed its flush (and hence is not to be transferred to main storage element 50 until the next flush is completed). To implement this protocol, the order and placement of steps 96 and 102 in FIG. 6 are reversed.

Other non-standard bus protocol features, while also not necessary to support memory consistency, can be introduced to decrease recovery times following a fault by reducing memory-to-memory copy time. Two such features are the ability to support "dual-write" and "copy" memory access modes. If a line is stored in dual-write mode, both the primary memory element 46 and the shadow memory element 48 store the line in the main storage element 50. (Thus, the shadow memory element 48 does not store this data in the associated buffer memory 52). In copy mode, the primary memory element 46 sources the addressed line and the shadow memory element 48 stores the resulting data to the corresponding location in the main storage element 50.

It may also be useful to provide the capability for a memory element to operate in a "phantom mode" in which it acts like a primary memory element for accesses over some designated range of addresses, but like a shadow for all other addresses. This mode allows the computer system 11 to operate with some PMEs 46 shadowed and others unshadowed. Such a feature may be useful, for example, when a portion of the primary memory has failed and no replacement is immediately available, but the remainder of primary memory is still functioning normally.

Given the embodiments of the invention described here, it should be apparent to those skilled in the art that the foregoing is merely illustrative and not limiting, having been presented by way of example only. Numerous modifications and other embodiments are within the scope of one of ordinary skill in the art and are contemplated as falling within the scope of the invention as defined by the appended claims.