Processor system and method for maintaining internal state consistency between active and stand-by modules

• US 5,664,090 A
• Filed: 06/21/1996
• Issued: 09/02/1997
• Est. Priority Date: 12/15/1993
• Status: Expired due to Fees

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation), Toshiba Corporation
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: Seki, Toshibumi, Okataku, Yasukuni
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Wright, Norman M.
• Application Number:
  US08/670,718
• Time in Patent Office: 438 Days
• Field of Search: 395/182.09, 395/185.08, 395/182.13, 395/182.11, 395/182.08, 395/182.19, 371/62
• US Class Current: 714/15
• CPC Class Codes: G06F 11/2035 without idle spare hardware
• CPC Class Codes: G06F 11/2097 maintaining the standby controller/processing unit updated initialisation or re-synchronisation thereof G06F11/1658 and subgroups

Abstract

A stand-by system replicates a program module to an active object and a passive object. During execution of operations of the active object, when the active object fails, operations continue to be executed in the passive object. There is provided a checkpoint period memory for storing a checkpoint period, a detecting unit for detecting whether an internal state of the active object has been changed according to the checkpoint period, a consistency maintaining unit for maintaining consistency of the internal state between the active object and the passive object when the internal state has been changed, and a checkpoint period changing unit for increasing the checkpoint period when the internal state has not been changed.

Claims

1. A stand-by system for a process including a process module replicated to at least two process modules, wherein one of the process modules is a privileged process module having an execution privilege, the execution privilege being transferred to another one of the process modules upon occurrence of a process fault in the privileged module, the stand-by system comprising:

a checkpoint period memory for storing a checkpoint period representing a time interval value between consecutive checkpoints of a succession of checkpoints;

checking means for checking whether an internal state of the privileged process module has been changed during each said checkpoint period and for providing a checking result;

checkpoint period changing means for changing the time interval value of the checkpoint period stored in said checkpoint period memory based on the checking result; and

consistency maintaining means for maintaining consistency of the internal states of the privileged process module and the another one of process modules based on the checking result.

9. A stand-by system according to claim 1 or 2, wherein said consistency maintaining means copies a changed portion of the internal state in the privileged process module to a corresponding portion of the internal state in the another one of the process modules.

2. A stand-by system for a processor including a process module replicated to at least two process modules, wherein one of the process modules is a privileged process module having an execution privilege, the execution privilege being transferred to another one of the process modules upon occurrence of a process fault in the privileged module, the stand-by system comprising:

a checkpoint period memory for storing a checkpoint period representing a time interval value between consecutive checkpoints of a succession of checkpoints;

checkpoint period changing means for changing the time interval value of the checkpoint period stored in said checkpoint period memory;

checking means for checking whether an internal state of the privileged process module has been changed during each said checkpoint period;

consistency maintaining means for maintaining consistency of the internal states of the privileged process module and another one of process modules based on a checking result indicated by said checking means; and

wherein said checking means including first means for causing said checkpoint period changing means to change the time interval value of the checkpoint period when the checking result indicates that the internal state of the privileged process module has not been changed, and second means for causing said consistency maintaining means to maintain the consistency of the internal states when the checking result indicates that the internal state of the privileged process module has been changed.

3. A stand-by system according to claim 2, wherein said second means includes means for causing said checkpoint period changing means to change the time interval value of the checkpoint period.

4. A stand-by system according to claim 2, wherein said second means includes means for causing said checkpoint period changing means to change a present time interval value of the checkpoint period to a pre-selected initial time interval value.

5. A stand-by system according to claim 2, wherein said first means includes means for causing said checkpoint period changing means to increase the time interval value of the checkpoint period;

and

said second means includes means to cause said checkpoint period changing means to change the time interval value of the checkpoint period to a pre-selected initial time interval value.

6. A stand-by system according to claim 2, wherein said first means includes means for causing said checkpoint period changing means to change the time interval value of the checkpoint period to a pre-selected initial time interval value;

and

said second means includes means for causing said checkpoint period changing means to decrease the time interval value of the checkpoint period.

7. A stand-by system according to claim 2, wherein said first means includes means for causing said checkpoint period changing means to increase the time interval value of the checkpoint period;

and

said second means includes a means to cause said checkpoint period changing means to decrease the time interval value of the checkpoint period.

8. A stand-by system according to claim 3, 4, 5, 6 or 7, wherein said checkpoint period changing means changes the time interval value of the checkpoint period within a predetermined range.

10. A stand-by system for a processor including a process module replicated to at least two process modules, said system comprising:

a privileged process module having an execution privilege;

a non-privileged process module, the execution privilege being transferred to the non-privileged process module upon occurrence of a process fault in the privileged process module;

said privileged process module comprising;

a checkpoint period memory for storing a checkpoint period representing a time interval value between consecutive checkpoints of a succession of checkpoints;

checkpoint period changing means for changing the time interval value of the checkpoint period stored in said checkpoint period memory;

sending means for sending an internal state of the privileged process module to the non-privileged process module; and

checking means for checking whether the internal state of the privileged process module has been changed during each said checkpoint period, wherein said checking means includes first means for causing said checkpoint period changing means to change the time interval value of the checkpoint period when said checking means determines that the internal state of the privileged process module has not been changed during a checkpoint period and second means for causing said sending means to change the checkpoint period when said checking means determines that the internal state of the privileged process module has been changed;

said non-privileged process module comprising;

an internal state memory for storing an internal state of the non-privileged process module; and

internal state changing means for changing the internal state stored in said internal state memory according to the internal state sent by said sending means.

12. A stand-by system according to claims 10 or 11, wherein said second means includes means for causing said checkpoint period changing means to change said checkpoint period.

13. A stand-by system according to claims 10 or 11, wherein said second means includes means for causing said checkpoint period changing means to change the checkpoint period to a pre-selected initial time interval value.

14. A stand-by system according to claims 10 or 11, wherein said first means includes means for causing said checkpoint period changing means to increase the time interval value of the checkpoint period;

and

said second means includes means for causing said checkpoint period changing means to change the checkpoint period to a pre-selected initial time interval value.

15. A stand-by system according to claims 10 or 11, wherein said first means includes means for causing said checkpoint period changing means to change the checkpoint period to a pre-selected initial time interval value;

and

said second means includes means for causing said checkpoint period changing means to decrease the time interval value of the checkpoint period.

16. A stand-by system according to claims 10 or 11, wherein said first means includes means for causing said checkpoint period changing means to increase the time interval value of the checkpoint period;

and

said second means includes means for causing said checkpoint period changing means to decrease the time interval value of the checkpoint period.

11. A stand-by system for a processor including a process module replicated to at least two process modules, said system comprising:

a privileged process module having an execution privilege;

a non-privileged process module, the execution privilege being transferred to the non-privileged process module upon occurrence of a process fault in the privileged module;

said privileged process module comprising;

means for checking whether the internal state of the privileged module has changed in response to an inquiry request message from the non-privileged process module; and

sending means for sending a checking result indicated by said checking means to the non-privileged process module;

said non-privileged process module comprising;

a checkpoint period memory for storing a checkpoint period representing a time interval value between consecutive checkpoints of a succession of checkpoints;

checkpoint period changing means for changing the time interval value of the checkpoint period stored in said checkpoint period memory;

an internal state memory for storing an internal state of the non-privileged process module;

internal state changing means for changing the internal state stored in said internal state memory;

inquiry request message sending means for sending the inquiry request message to said checking means at each said checkpoint, the inquiry request message inquiring whether the internal state of the privileged process module has been changed during each checkpoint period;

first means for causing said checkpoint period changing means to change the time interval value of the checkpoint period when the checking result sent from said sending means does not include a changed internal state of the privileged process module; and

second means for causing said internal state changing means to change the internal state of the non-privileged process module to be consistent with the changed internal state of the privileged process module included with the checking result sent from said sending means.

17. A method for changing a checkpoint period in a stand-by system for a processor, the stand-by system including a process module replicated to at least two process modules, wherein one of the process modules is a privileged process module having an execution privilege, the execution privilege being transferred to a non-privileged one of the process modules upon occurrence of a process fault in the privileged process module, the method comprising the steps of:

checking whether an internal state of the privileged process module has been changed at each of a succession of checkpoints having a checkpoint period representing a time interval value;

sending the internal state of the privileged process module to the non-privileged process module each time the internal state of the privileged process module has been changed during a checkpoint period;

changing the time interval value of the checkpoint period upon detecting that the internal state of the privileged process module has not been changed; and

changing the internal state of the non-privileged process module according to the changed internal state sent in said sending step.

19. A method for changing a checkpoint period in a stand-by system according to claims 17 or 18, wherein said internal state changing step includes a step of changing the time interval value of the checkpoint period.

20. A method for changing a checkpoint period in a stand-by system according to claims 17 or 18, wherein said internal state changing step includes a step of resetting the checkpoint period to a pre-selected initial time interval value.

21. A method for changing a checkpoint period in a stand-by system according to claims 17 or 18, wherein said checkpoint period changing step includes a step of increasing the time interval value of the checkpoint period;

and

said internal state changing step includes a step of resetting the checkpoint period to a pre-selected initial time interval value.

22. A method for changing a checkpoint period in a stand-by system according to claims 17 or 18, wherein said checkpoint period changing step includes a step of resetting the checkpoint period to a pre-selected initial time interval value;

and

said internal state changing step includes a step of decreasing the time interval value of the checkpoint period.

23. A method for changing a checkpoint period in a stand-by system according to claims 17 or 18, wherein said checkpoint period changing step includes a step of increasing time interval value of the checkpoint period;

and

said internal state changing step includes a step of decreasing the time interval value of the checkpoint period.

18. A method for changing a checkpoint period in a stand-by system for a processor, the stand-by system including a process module replicated to at least two process modules, wherein one of the process modules is a privileged module having an execution privilege, the execution privilege being transferred to a non-privileged one of the process modules upon occurrence of a process fault in the privileged process module, the method comprising the steps of:

sending an inquiry request message from the non-privileged process module to the privileged process module at each of a succession of checkpoints having a checkpoint period representing a time interval value, the inquiry request message inquiring whether the internal state of the privileged process module has been changed during each checkpoint period;

checking whether the internal state of the privileged process module has been changed in response to the inquiry request message sent from the non-privileged process module;

sending a result of said checking step to the non-privileged process module;

changing the time interval value of the checkpoint period when the result of said checking step sent to said non-privileged process module does not include the internal state of the privileged process module; and

changing an internal state of the non-privileged process module when the result of said checking step sent to the non-privileged process module includes the internal state of the privileged process module.

24. A method for changing a checkpoint period in a stand-by system for a processor, the stand-by system including a process module replicated to at least two process modules, wherein one of the process modules is a privileged process module having an execution privilege, the execution privilege being transferred to a non-privileged other one of the process modules upon occurrence of a process fault in the privileged process module, the method comprising the steps of:

checking whether an internal state of the privileged process module has changed at each of a succession of checkpoints having a checkpoint period representing a time interval value and providing a checking result;

changing the time interval value of the checkpoint period based on the checking result; and

maintaining consistency of the internal states of the privileged process module and the non-privileged other one of the process modules based on the checking result.

32. The method according to claims 24 or 25, wherein said maintaining step copies a changed portion of the internal state of the privileged process module to a corresponding portion of the internal state of the non-privileged other one of the process modules.

25. A method for changing a checkpoint period in a stand-by system for a processor, the stand-by system including a process module replicated to at least two process modules, wherein one of the process modules is a privileged process module having an execution privilege, the execution privilege being transferred to a non-privileged other one of the process modules upon occurrence of a process fault in the privileged process module, the method comprising the steps of:

checking whether an internal state of the privileged process module has changed during each said checkpoint period and providing a checking result;

maintaining consistency of the internal states of the privileged process module and the non-privileged other one of the process modules based on the checking result; and

wherein said checking step includes a first step for causing said checkpoint period changing step to change the time interval value of the checkpoint period when the checking result indicates that the internal state of the privileged process module has not changed, and a second step for causing said maintaining step to maintain the consistency of the internal states when the checking result indicates that the internal state of the privileged process module has changed.

26. The method according to claim 25, wherein said second step includes changing the time interval value of the checkpoint period.

27. The method according to claim 25, wherein said second step includes changing a present time interval value of the checkpoint period to pre-selected initial time interval value.

28. The method according to claim 25, wherein said first step increases the time interval value of a present checkpoint period;

and

said second step includes changing the time interval value of the present checkpoint period to a pre-selected initial time interval value.

29. The method according to claim 25, wherein said first step changes the time interval value of the present checkpoint period to a pre-selected initial time interval value;

and

said second step includes decreasing the time interval value of the present checkpoint period.

30. The method according to claim 25, wherein said first step increases the time interval value of a present checkpoint period;

and

said second step includes decreasing the time interval value of the present checkpoint period.

31. The method according to claims 26, 27, 28, 29, or 30, wherein said changing step changes the time interval value of the checkpoint period within a predetermined range.