Switching control in a fault tolerant system

• US 5,822,512 A
• Filed: 06/05/1996
• Issued: 10/13/1998
• Est. Priority Date: 05/19/1995
• Status: Expired due to Term

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Compaq Computer Corporation (HP Inc.)
• Inventors: Cook, M. Damian, Miller, Joseph P., Goodrum, Alan L., Cox, B. Tod, Sides, Chi Kim, Sanders, Michael C.
• Primary Examiner(s): DeCady, Albert
• Application Number:
  US08/658,582
• Time in Patent Office: 860 Days
• Field of Search: 395/180, 395/181, 395/182.01, 395/182.02, 395/182.03, 395/182.05, 395/182.08, 395/182.1, 395/182.11, 395/182.13, 395/182.14, 364/225.3, 364/229, 364/229.4
• US Class Current: 714/13
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/142 Reconfiguring to eliminate the error group management mechanisms in a peer-to-peer network H04L67/1044
• CPC Class Codes: G06F 11/2002 where interconnections or communication control functionality are redundant flexible arrangements for bus networks involving redundancy H04L12/40176
• CPC Class Codes: G06F 11/2023 Failover techniques
• CPC Class Codes: G06F 11/2025 using centralised failover control functionality
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare
• CPC Class Codes: G06F 11/2033 switching over of hardware resources
• CPC Class Codes: G06F 11/2038 with a single idle spare processing component
• CPC Class Codes: G06F 11/2046 where the redundant components share persistent storage G06F11/2043 takes precedence
• CPC Class Codes: G06F 11/22 Detection or location of defective computer hardware by testing during standby operation or during idle time, e.g. start-up testing
• CPC Class Codes: G06F 13/4022 using switching circuits, e.g. switching matrix, connection or expansion network G06F13/4009 takes precedence

Abstract

Control is switched from a first server to a second server in a fault tolerant system. The first and second servers are coupled with an expansion bus in an expansion box for communication with the expansion bus. An indication is provided to the second server to indicate the activity state of the first server. Communication between the first server and the expansion box is disabled if the indication indicates the first server is inactive. Communication between the second server and the expansion bus is disabled if the indication indicates that the first server is active. Communication between the second server is enabled if the indication indicates that the first server is inactive. The indication includes a heartbeat message transmitted periodically to the second server. The expansion bus includes a PCI bus.

Claims

1. A method of switching control from a first server to a second server in a fault tolerant system, the first and second servers coupled to respective first and second slots on an expansion bus of an expansion box, the method comprising:

providing an indication to the second server of the activity state of the first server; and

disabling communication between the first server and the expansion bus by disconnecting the first server from the first slot if the indication indicates that the first server is inactive; and

enabling communication between the second server and the expansion bus by connecting the second server to the second slot if the indication indicates that the first server is inactive.

2. The method of claim 1, wherein the first server communicates with the expansion bus through a first expansion card inserted in the first slot, and wherein the disabling step includes tri-stating output pins of the first expansion card.

3. The method of claim 2, wherein the second server communicates with the expansion bus through a second expansion card inserted in the second slot.

4. The method of claim 3, further comprising:

the second expansion card asserting a failover signal to the first expansion card to tri-state the first expansion card.

5. The method of claim 1, further comprising:

disabling communication between the second server and the expansion bus if the indication indicates that the first server is active by disconnecting the second server from the second slot.

6. The method of claim 1, further comprising:

identifying a third slot on the expansion bus which was disabled when the first server was active.

7. The method of claim 6, further comprising:

maintaining the third slot disabled when communication between the second server and the expansion bus is enabled.

8. The method of claim 7, wherein the third slot was disabled because it is associated with a faulty device.

9. The method of claim 5, wherein the first server communicates with the expansion bus through a first expansion card inserted in the first slot and the second server communicates with the expansion bus through a second expansion card inserted in the second slot, and wherein the first server disabling step includes tri-stating output pins of the first expansion card and the second server disabling step includes tri-stating output pins of the second expansion card.

10. The method of claim 9, wherein the first expansion card includes a first bridge for providing communication between the expansion bus and a bus in the first server, and the second expansion card includes a second bridge for providing communication between the expansion bus and a bus in the second server.

11. The method of claim 9, further comprising:

the second server setting a command bit in the second expansion card to begin the first server disabling and second server enabling steps.

12. The method of claim 1, wherein the enabling step includes switching output pins of the second server from tri-state mode to active driving mode.

13. The method of claim 1, wherein the first server active indication includes a heartbeat message periodically transmitted by the first server.

14. The method of claim 13, wherein the disabling step is performed if the heartbeat message is not transmitted within a predetermined period of time.

15. The method of claim 1, wherein the expansion bus includes a PCI bus.

16. A system comprising:

a first server;

a second server;

a link over which the first server provides an indication to the second server of the activity state of the first server; and

an expansion box having an expansion bus, the first and second servers being coupled to respective first and second slots on the expansion bus for communication with the expansion bus, wherein communication between the first server and the expansion bus is disabled by disconnecting the first server from the first slot and communication between the second server and the expansion bus is enabled by connecting the second server to the second slot if the indication indicates the first server is inactive.

17. The system of claim 16, further comprising:

a first expansion card inserted in the first slot, wherein the first server communicates with the expansion bus through the first expansion card, and wherein communication between the first server and the expansion bus is disabled by tri-stating output pins of the first expansion card.

18. The system of claim 16, further comprising:

a second expansion card inserted in the second slot, wherein the second server communicates with the expansion bus through the second expansion card.

19. The system of claim 18, wherein the second expansion card asserts a failover signal to the first expansion card to tri-state the first expansion card.

20. The system of claim 16, wherein the expansion box disables communication between the second server and the expansion bus by disconnecting the second server from the second slot if the indication indicates that the first server is active.

21. The system of claim 16, wherein the expansion box further includes a device for identifying a third slot on the expansion bus which was disabled when the first server was active.

22. The system of claim 21, wherein the device maintains the third slot disabled when communication between the second server and the expansion bus is enabled.

23. The system of claim 22, wherein the third slot was disabled because it is associated with a faulty device.

24. The system of claim 16, further comprising:

a first expansion card inserted in the first slot, wherein the first server communicates with the expansion bus through the first expansion card; and

a second expansion card inserted in the second slot, wherein the second server communicates with the expansion bus through the second expansion card, and wherein the first server is disabled by tri-stating output pins of the first expansion card and the second server is disabled by tri-stating output pins of the second expansion card.

25. The system of claim 24, wherein each of the first and second servers include an internal bus, and wherein the first expansion card includes a first bridge for providing communication between the expansion bus and the first server bus, and the second expansion card includes a second bridge for providing communication between the expansion bus and the second server bus.

26. The system of claim 24, wherein the second expansion card includes a command bit set by the second server to begin disabling the first server and enabling the second server.

27. The system of claim 24, wherein communication between the second server and the expansion bus is enabled by switching output pins of the second server from tri-state mode to active driving mode.

28. The system of claim 16, wherein the first server active indication includes a heartbeat message periodically transmitted by the first server.

29. The system of claim 28, wherein the first server is disabled if the heartbeat message is not transmitted within a predetermined period of time.

30. The system of claim 16, wherein the expansion bus includes a PCI bus.

31. The system of claim 16, further comprising:

a network, wherein both the first and second servers are connected to the network.

32. The system of claim 16, wherein the link includes a serial link.

33. A system comprising:

a network;

a first server connected to the network;

a second server connected to the network;

a serial link connected between the first and second servers, wherein the first server provides a heartbeat message to the second server over the serial link; and

an expansion box having an expansion bus, a first expansion card connected to the expansion bus and the first server, and a second expansion card connected to the expansion bus and the second server, wherein output pins of the second expansion card are tri-stated if the heartbeat message is provided by the first server, and wherein output pins of the first expansion card are tri-stated and the output pins of the second expansion card are enabled if the heartbeat message has not been detected for a predetermined period of time.

34. A system comprising:

a first system;

a second system;

a link over which the first system provides an indication to the second system of the activity state of the first system; and

an expansion box including a bus having a first slot coupled to the first system and a second slot coupled to the second system, wherein communication between the first system and the bus is disabled by disconnecting the first system from the first slot if the indication indicates the first system is inactive, and communication between the second system and the bus is enabled by connecting the second system to the second slot if the indication indicates that the first system is inactive.

35. The system of claim 34, further comprising:

a first interface card inserted in the first slot, wherein the first system communicates with the bus through the first interface card and the first system is disabled by tri-stating output pins of the first interface card.

36. The system of claim 34, further comprising:

a second interface card inserted in the second slot, wherein the second system communicates with the bus through the second interface card.

37. The system of claim 36, wherein the second interface card asserts a failover signal to the first interface card to tri-state the first interface card.

38. The system of claim 34, wherein communication between the second system and the bus is disabled by disconnecting the second system from the second slot if the indication indicates that the first system is active.

39. The system of claim 34, further comprising a device for identifying a third slot on the bus which was disabled when the first system was active.

40. The system of claim 39, wherein the device maintains the third slot disabled when communication between the second system and the bus is enabled.

41. The system of claim 40, wherein the third slot was disabled because it is associated with a faulty device.

42. The system of claim 34, further comprising:

a first interface card inserted in the first slot, wherein the first system communicates with the bus through the first interface card; and

a second interface card inserted in the second slot, wherein the second system communicates with the bus through the second interface card, and wherein the first system is disabled by tri-stating output pins of the first interface card and the second system is disabled by tri-stating output pins of the second interface card.

43. The system of claim 42, wherein each of the first and second systems includes an internal bus, and wherein the first interface card includes a first bridge for providing communication between the bus and the first system bus, and the second interface card includes a second bridge for providing communication between the bus and the second system bus.

44. The system of claim 43, wherein the second interface card includes a command bit set by the second system for disabling the first system and enabling the second system.

45. The system of claim 34, wherein the second system is enabled by switching output pins of the second system from tri-state mode to active driving mode.

46. The system of claim 34, wherein the first system active indication includes a heartbeat message periodically transmitted by the first system.

47. The system of claim 46, wherein the first system is disabled if the heartbeat message is not transmitted within a predetermined period of time.

48. The system of claim 34, wherein the bus includes a PCI bus.

49. The system of claim 34, further comprising:

a network, wherein both the first and second systems are connected to the network.

50. The system of claim 34, wherein the link includes a serial link.