Fault tolerant multiple network servers

• US 5,696,895 A
• Filed: 06/19/1995
• Issued: 12/09/1997
• Est. Priority Date: 05/19/1995
• Status: Expired due to Term

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Compaq Computer Corporation (HP Inc.)
• Inventors: Lawler, Thomas S., Hemphill, John M., Stewart, Gregory Mart
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): LE, DIEU MINH T
• Application Number:
  US08/491,738
• Time in Patent Office: 904 Days
• Field of Search: 395/182.02, 395/181, 395/182.08, 395/182.09, 395/182.11, 395/182.21, 364/268, 364/268.9, 364/242.94
• US Class Current: 714/4.3
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/142 Reconfiguring to eliminate the error group management mechanisms in a peer-to-peer network H04L67/1044
• CPC Class Codes: G06F 11/1482 by means of middleware or OS functionality
• CPC Class Codes: G06F 11/2002 where interconnections or communication control functionality are redundant flexible arrangements for bus networks involving redundancy H04L12/40176
• CPC Class Codes: G06F 11/2005 using redundant communication controllers
• CPC Class Codes: G06F 11/2007 using redundant communication media
• CPC Class Codes: G06F 11/2023 Failover techniques
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare
• CPC Class Codes: G06F 11/2033 switching over of hardware resources
• CPC Class Codes: G06F 11/2035 without idle spare hardware
• CPC Class Codes: G06F 11/2038 with a single idle spare processing component
• CPC Class Codes: G06F 11/2046 where the redundant components share persistent storage G06F11/2043 takes precedence
• CPC Class Codes: G06F 11/2092 Techniques of failing over between control units
• CPC Class Codes: G06F 11/22 Detection or location of defective computer hardware by testing during standby operation or during idle time, e.g. start-up testing
• CPC Class Codes: G06F 13/4022 using switching circuits, e.g. switching matrix, connection or expansion network G06F13/4009 takes precedence

Abstract

A fault tolerant multiple network server system in which multiple servers concurrently act as back-up servers for each other even while they are providing their own server services to the system. Rather than having an unused server monitoring for failure of a primary server and taking over control, each acts upon the network, but when its partner should fail, it assumes control of these partner servers storage subsystem. In this way, processing power of both servers is available during normal operation, but they each provide back-up capability for the other.

Claims

1. A dual fault tolerant active server system for a network, the system comprising:

a first active server for connection to the network, said first active server providing a first indication that it is functioning properly;

a second active server for connection to the network, said second active server receiving said first indication from said first active server and providing a second indication that it is functioning properly to said first active server, wherein said first active server provides a first switch command when said second active server fails to provide said second indication that said second active server is functioning properly and wherein said second active server provides a second switch command when said first active server fails to provide said first indication that said first active server is functioning properly;

a first storage system with a first storage media, said first storage system primarily coupling said first storage media to said first active server and alternatively coupling said first storage media to said second active server and decoupling said first storage media from said first active server upon receipt of said second switch command from said second active server; and

a second storage system with a second storage media, said second storage system primarily coupling said second storage media to said second active server and alternatively coupling said second storage media to said first active server and decoupling said second storage media from said second active server upon receipt of said first switch command from said first active server.

2. The system of claim 1, further comprising:

a first SCSI bus connecting said first active server with said second storage system, and wherein said first switch command comprises a series of SCSI reset signals over said first SCSI bus from said first active server; and

a second SCSI bus connecting said second active server with said first storage system, and wherein said second switch command comprises a series of SCSI reset signals over said second SCSI bus from said second active server.

3. The system of claim 1, further comprising:

a serial interconnect between said first active server and said second active server, said serial interconnect carrying said first and second indications.

4. The system of claim 1, wherein said first and second indications are provided to and received from the network.

5. The system of claim 1, wherein said first active server further includes:

a recovery agent service that sends a heartbeat message to said second active server as said first indication and receives a heartbeat message from said second active server as said second indication.

6. The system of claim 5, wherein said heartbeat messages include a ping heartbeat message and a normal shutdown heartbeat message.

7. The system of claim 1, wherein said first active server and said second active server run registered applications, wherein upon failure of said second active server to provide the indication that said second active server is functioning properly, said first active server sends a predetermined message to said registered applications in said first active server, and wherein upon failure of said first active server to provide the indication that said first active server is functioning properly, said second active server sends the predetermined message to said registered applications in said second active server.

8. The system of claim 1, wherein said first active server includes software for checking data integrity of said second storage medium after providing said first switch command to said second storage system.

9. A multiple active backup server system for a network, the system comprising:

a first active server;

a second active server;

a third active server, wherein said first active server, said second active server, and said third active server send and receive heartbeat messages to and from each other, wherein upon failure of said first active server to send said heartbeat message, said second active server provides a second switch command, wherein upon failure of said second active server to send said heartbeat message, said third active server provides a third switch command, and wherein upon failure of said third active server to send said heartbeat message, said first active server provides a first switch command;

a first storage system primarily coupled to said first active server and alternatively coupled to said second active server and decoupled from said first active server upon receipt of said second switch command;

a second storage system primarily coupled to said second active server and alternatively coupled to said third active server and decoupled from said second active server upon receipt of said third switch command; and

a third storage system primarily coupled to said third active server and alternatively coupled to said first active server and decoupled from said third active server upon receipt of said first switch command.

10. A method of providing active backup between a first active server and a second active server, the first active server having a first storage system that is switchable to the second active server, and the second active server having a second storage system that is switchable to the first active server, the method comprising the steps of:

providing data from the first storage system through the first active server to the network;

providing data from the second storage system through the second active server to the second storage system;

providing an indication from the first active server to the second active server that the first active server is functioning properly;

providing an indication from the second active server to the first active server that the second active server is functioning properly; and

upon a failure of the first active server to receive the indication from the second active server that the second active server is functioning properly, switching the second storage system from the second active server to the first active server, and providing data from the second storage system through the first active server to the network.

11. The method of claim 10, further comprising the step of:

upon a failure of the second active server to receive the indication from the first active server that the first active server is functioning properly, switching the first storage system from the first active server to the second active server, and providing data from the first storage system through the second active server to the network.