Backup Switching Control System and Method

The present invention relates to a system and method in a data processing system for controlling the switching between an operating machine and a backup machine within the system. More particularly, the invention relates to controlling the backup switching between substantially similar operating and backup machines when the operating machine becomes faulty so that the backup machine takes over the processing from the faulty operating machine automatically, rapidly, reliably and economically.

There exist data processing or computer systems operating under a backup control scheme wherein a backup processor takes over from the operating processor if the latter develops a failure. For example, in Japanese Patent Laid-Open No. 75843/1988, there is a backup switching scheme involving a backup CPU for detecting a failure of an operating CPU that sends a break signal to the operating CPU (e.g., "000 . . . 0") via a serial interface. In turn, the operating CPU performs a suitable function to measure the bit length of the break signal, and then attempts to recover from the failure by issuing an interrupt signal and a reset signal. If the attempt to remedy the failure is unsuccessful, the failed CPU disconnects from the system.

In the conventional backup switching method outlined above, only one operating machine is backed up per serial line connection between the machines. That is, one backup machine is assigned to each operating machine. One disadvantage of this conventional technique is that it makes system setup of the backup machines for a computer system uneconomical. Another disadvantage results from a significant reduction in system availability once a failure occurs because of a prolonged system down time produced by a recovery process that must be completed before the backup machine can take over from the failed machine. A further disadvantage is that in the recovery process there is a loss of information about the primary failure that triggered the disconnection of the failed machine from the system.

It is therefore an object of the present invention to overcome the above and other deficiencies and disadvantages of the prior art by providing a backup switching control method which automates switching from an operating machine to a backup machine; prevents the communication conflict or contention between the operating and the backup machines with respect to switching over control of the system resources; automates acquisition and/or storage of failure information about the machine that experiences a failure; permits rapid switching to a backup machine; and decreases the expense or cost of the backup switching system by backing up a plurality of operating machines with a plurality of backup machines.

In achieving the foregoing and other objects of the present invention, there is provided a backup switching control method for use with a system comprising an operating processor and a backup processor having synchronizing means and failure information storing means each, both means being utilized during backup processing. The operating and backup processors placed under this backup switching control method each have a switching mechanism for exchanging therebetween a disconnection command, a dump acquisition command and a disconnection complete notice. The switching mechanism includes a reset function for forcing the currently operating processor to release the system resources it occupies. Also included in the switching mechanism is a time counting function for monitoring the time required from the receipt of a disconnection command by the operating processor to the output of a disconnection complete notice therefrom so that if the disconnection complete notice is not recognized within a predetermined period of time, the operating processor is reset.

Equipped with the means outlined above, the system under the backup switching control method of the invention allows the backup processor to take over from the operating processor when the backup processor judges the operating processor to be inoperative and when the backup processor has verified that the operating processor has released the system resources it occupied.

Specifically, the backup processor has its switching mechanism initially transmit a disconnection command and a dump acquisition command to a target operating processor via the switching mechanism of the latter. Upon receipt of the disconnection command, the switching mechanism of the operating processor forwards the command to the latter and starts counting the elapsed time until the output of a disconnection complete notice from the operating processor. In accordance with the disconnection command and the dump acquisition command forwarded from the backup processor, the operating processor releases the system resources it has used and dumps failure information by data transfer to an auxiliary storage external of the operating processor. The release of the system resources and execution of the failure information dump process proceed concurrently or in parallel under suitable control of the operating system or a backup switching control system associated therewith. Upon completion of the disconnection from the system, the operating processor notifies the backup processor of the completion of the disconnection. If the operating processor fails to complete the disconnection process within a predetermined period of time, the switching mechanism of the operating processor triggers a reset and notifies the backup processor of the completion of the forced disconnection. On receiving the disconnection completion notice, the backup processor utilizes the released system resources and takes over the processing from the now-failed operating processor. The disconnected processor then undergoes failure checks and, when the cause of the failure is overcome, stands by as a newly functioning backup processor that is ready to take over from the currently operating processor. In this manner, the backup switching procedure is automated and the communication conflict or contention between the operating and the backup processors for the system resources is prevented. In addition, by the present invention switching to the backup processor is executed quickly.

FIG. 1 is a block diagram of a backup processor switching control system according to a first embodiment of the present invention.

FIG. 2 is a block diagram of a backup processor switching control system according to a second embodiment of the present invention.

FIG. 3 is a flowchart showing the steps performed in an initial phase of the backup switching control method according to the present invention.

FIG. 4 is a flowchart of the interrupt handling involving the main processors in both the operating and the backup processors.

FIG. 5 is a flow chart of the steps followed in the disconnection task processing.

FIG. 6 is a flowchart of the interrupt handling involving the auxiliary processors in both the operating and the backup processors.

FIG. 7 is a flowchart of the steps followed in the handling of notices communicated through the communication ports of the auxiliary processors.

FIG. 1 shows the backup system of the invention which includes an operating data processor or machine 1 and a backup data processor or machine 101 placed under the backup switching control method of the invention. Processor 1 includes a main processor 2 and an auxiliary processor 6. Communication connections between the main processor 2 and the auxiliary processor 6 include an interrupt signal 3 sent from the main processor 2 to the auxiliary processor 6 and an interrupt signal 4 sent from the auxiliary processor 6 to the main processor 2. A shared memory 8 is connected to both processors 2 and 6 for reading and writing data. Main processor 2 also has memory that is not shared with the auxiliary processor 6, as well as registers, for storing data being processed. The processor 1 is arranged to be reset when a reset signal 5 is sent from the auxiliary processor 6 to the main processor 2. The auxiliary processor 6 includes a clock 9 and a communication port 7 connected with a communication channel 200.

The embodiment of the invention shown in FIG. 1, includes one operating data processor and one backup data processor, each having a substantially identical configuration at least with respect to the inclusion in each of a main processor, auxiliary processor, shared memory and communication port. Auxiliary processor 6 and backup auxiliary processor 106 generally monitor such ambient conditions as temperature and supply voltage levels. In this embodiment, the auxiliary processors are used to control switching between the backup processor and the operating processor upon failure of the latter. The auxiliary processors communicate with each other over a communication channel or network 200 through the communication port 7 and a backup communication port 107. The communication channel 200 may be either a wired channel or a wireless channel.

In the event that the processor 1 develops a failure while utilizing system resources 50 (one or more of a hard disc drive, printer, magnetic tape unit, etc.), switching to the backup processor 101 takes place through the execution of the backup switching procedures described below with reference to flowcharts of FIGS. 3 through 7.

The backup processor 101 starts disconnecting the operating processor 1 using the procedure of FIG. 3 and completes the disconnection process with the procedure of FIG. 4. It should be noted that the disconnection task processing of FIG. 5 is carried out in parallel with the failure information dump processing of FIG. 4 under control of the operating system of the main processor 2. Although the disconnection command of this embodiment also functions as a dump acquisition command, alternatively it is possible to separate the dump acquisition command from the disconnection command, whereby the contents of the shared memory can be separated from notices exchanged between the auxiliary processors.

In the preferred embodiment of the backup control system and method of the invention, a backup main processor 102 of the backup processor 101 monitors the operation of operating processor 1 for the purpose of detecting when a failure occurs in the operating processor. When such a failure occurs, backup main processor 101 writes to a backup shared memory 108 a disconnection command with which to disconnect the operating processor 1 (step 601 of FIG. 3). After this, an interrupt signal 103 is issued to the backup auxiliary processor 106 (step 602). On detecting the interruption, the backup auxiliary processor 106 reads the backup shared memory 108 (step 901 of FIG. 6). When the backup auxiliary processor 106 retrieves from the memory 108 the disconnection command with which to disconnect the operating processor 1 (step 902), the backup auxiliary processor 106 sends a disconnection command to the auxiliary processor 6 of the operating processor 1 using the backup communication port 107 and via the communication channel 200 (step 906). On receiving the disconnection command through the communication port 7 (step 911 of FIG. 7), the auxiliary processor 6 of the operating processor 1 writes the disconnection command to the shared memory 8 (step 916). Thereafter, the auxiliary processor 6 issues the interrupt signal 4 to the main processor 2 (step 917) and uses the clock 9 to count the elapsed time (step 918).

The system of the invention operates in response to non-catastrophic failures in the operation of the operating processor, for example operational failures occurring in the execution of application software as a result of software or hardware error. When such a failure is minor enough for the main processor 2 to accept the interrupt signal 4, the contents of the shared memory 8 are read (step 701 of FIG. 4). If what is read out is found to be the disconnection command (step 702), the disconnection task processing is started (step 706). The main processor 2 then disconnects itself from the system resources 50 (step 801 of FIG. 5) and concurrently dumps failure information, which includes data in a memory of main processor 2, and data being processed in the registers of the main processor 2 to an auxiliary storage device 60 (step 707). Auxiliary storage device 60 may be a hard disk, DAT or the like. When the system resources 50 are disconnected (step 801), a disconnection complete notice is written to the shared memory 8 (step 802). Thereafter, the interrupt signal 3 is issued to the auxiliary processor 6 (step 803) by the main processor 2.

When the auxiliary processor 6 detects the interrupt signal 3 and receives the disconnection complete notice from the shared memory 8 within a predetermined period of time (step 920 of FIG. 7), the auxiliary processor 6 transmits a disconnection complete notice to the auxiliary processor 106 of the backup processor 101 through the communication port 7 and via the communication channel 200 (step 921). If the auxiliary processor 6 fails to detect the completion of the disconnection triggered by the interrupt signal 3 within the predetermined period of time (i.e., if 5 seconds, for example) elapses as determined by clock 9 and time is up without the disconnection completion notice being detected), the reset signal 5 is used to reset the main processor 2 (step 922). A reset-triggered disconnection complete notice is then transmitted to the auxiliary processor 106 in the backup processor 101 through the communication port 7 and via the communication channel 200 (step 923).

When the auxiliary processor 106 in the backup processor 101 receives the disconnection complete notice or reset-triggered disconnection complete notice through the communication port 107 (step 908 of FIG. 6), the auxiliary processor 106 sets the disconnection complete notice to the shared memory 108 (step 909). The auxiliary processor 106 then issues an interrupt signal 104 to the main processor 101 to inform the latter of the completion of the disconnection of the main processor 2 from the system resources 50 (step 910). Since the dump process may take a long time, one object of the invention is to control the switching of the failed operating processor to release the shared resources 50 and subsequently transmit the disconnection completion notice to the backup processor independently of completion of the dumping of the data by the main processor 2 to an external memory, e.g. auxiliary memory 60.

When the main processor 102 detects the interrupt signal 104 and receives the disconnection completion notice from the shared memory 108 (step 703 of FIG. 4), the main processor 102 takes over or exclusively occupies the system resources 50 and starts to carry out the data processing operations that would have been performed by the operating processor had the failure not occurred. As a result, the backup processor becomes a new operating processor that takes over from the now-failed operating processor in a short amount of time, not dependent on the completion of the dump processing. And further as a result, communication conflict between the operating and backup processors regarding the use of the system resources is avoided. A reset signal 105, a clock 109 and an auxiliary storage 160 of the backup processor are to be used when and if the newly operating processor (101) develops a failure and is replaced by a new backup processor (1), the switching therebetween taking place in the same manner as previously described. Accordingly, the disconnected processor (1) becomes the new backup processor after recovery from the failure that disabled it. If the new operating processor (101) fails, the remedied backup processor (1) is switched over in accordance with the present invention to again become the operation processor.

In the foregoing embodiment of the system and method of the invention, as described, two processors of substantially identical configuration can alternately function as the operating and backup processors.

Another embodiment of the invention will now be described with reference to a backup processor system shown in FIG. 2 having a plurality of operating data processors or machines 300, 301, . . . , 302 that are respectively connected to a corresponding plurality of backup data processors or machines 400, 401, . . . , 402 via a common communication channel 500. Each of the operating and backup machines are assigned a specific address. A particular operating machine is combined selectively with a particular backup machine by use of their addresses. Communication between the machines is effected on a local area network (LAN) basis.

As shown in FIG. 2, operating machine 300 and backup machine 400 share system resources 50-1, 50-2 and/or 50-3. System resources 50-1 are of the type connected directly between a designated combination of an operating machine 300 and a backup machine 400, while on the other hand, system resources 50-2 and 50-3 are directly connected to the network or communication channel 500 for use by one or more of the operating machines and functioning backup machines that have been switched into service in place of a failed operating machine.

During operation of the operating machines 300, etc., the status of operation is monitored so that the backup machines will be notified when a corresponding operating machine has a failure, such as an application program software failure or non-catastrophic hardware failure. As one example, the paired operating and backup machines can be directly connected to each other or indirectly connected through communication channel 500 so that a continuous checking of the status of the operating processor by the backup processor can be maintained and a notification of a failure of the operating processor transmitted to the backup processor through the connection thereof. In another example, the operating and backup processors may be connected to a service processor that monitors the operating condition of all of the operating machines so as to determine when a failure occurs with one of them. In this case, the failure would be communicated to the appropriate backup machine by the system machine or processor. The manner of determining whether a failure has occurred or not and of communicating or notifying the backup processor of the failure can be accomplished in any conventional manner.

In the multiple machine system of this embodiment, the switching between a given combination or pair of operating and backup machines is executed in the same manner as described above for the first embodiment of the invention by using communication channel 500 or another suitable connection between the respective machines, not shown, for sending and receiving the notices and other data between their communication ports.

According to the embodiments of the invention, the backup processor has its auxiliary processor take over the processing of the currently operating processor when the latter releases the system resources needed to carry out the processing of the system. This prevents duplicate use of the system resources by the operating and the backup processors upon switching and thus optimizes the timing of the backup switching. According to the system and method of the invention, it is possible to control the backup switching for a one-operating, one-backup machine system and also for a backup system involving a plurality of operating machines and a plurality of backup machines, all machines being substantially identically configured and connected to a common network or other interconnection. A highly economical backup system can be configured depending on the availability required for the system.

In the case of switching to the backup machine upon a failure of the operating machine, the failed machine can assume its new role of a backup as soon as it recovers from the failure, with no interruption in the processing of the system. This also contributes to improving the availability of the system. Since failure information about the failed operating machine is automatically dumped, the timely information thus acquired facilitates the effort of troubleshooting. Even when large amounts of failure information about the failed operating machine are dumped over an extended period of time, the backup machine can take over the processing of the system without waiting for the dump to end. These features combine to enhance the economy and versatility of the backup system considerably.