Systems and methods for split mode operation of fault-tolerant computer systems

• US 20070043972A1
• Filed: 08/19/2005
• Published: 02/22/2007
• Est. Priority Date: 08/19/2005
• Status: Active Grant

• Current Assignee: Stratus Technologies Ireland Ltd. (Stratus Technologies Bermuda Holdings Ltd.)
• Original Assignee: Stratus Technologies Bermuda Ltd. (Stratus Technologies Bermuda Holdings Ltd.)
• Inventors: Somers, Jeffrey, Graham, Simon, Fournie, Laurent
• Granted Patent: US 7,669,073 B2
• Time in Patent Office: Days
• US Class Current: 714/12
• CPC Class Codes: G06F 11/1662 the resynchronized component or unit being a persistent storage device re-synchronization of failed mirror storage G06F11/2082; rebuild or reconstruction of parity RAID storage G06F11/1008
• CPC Class Codes: G06F 11/1683 at instruction level

Abstract

Methods and systems are provided by which a computer system, and in particular, a lockstep fault-tolerant computer system, may be split into a plurality of independently operational subsystems. Each subsystem may be examined, managed or upgraded by an administrator while the overall computer system continues to service end-users. Finally, the separate subsystems may be merged in an efficient fashion and fault-tolerant operation will resume upon the combined system.

Claims

1. A method for splitting a fault-tolerant computer system comprising at least two processing subsystems, the method comprising:

designating an active subsystem and an upgrade subsystem from among the at least two processing subsystems;

isolating components within the upgrade subsystem from the other subsystems; and

splitting the fault-tolerant computer system such that, at the time of the split, the active subsystem and the upgrade subsystem have identical operational states, but thereafter operate independently.

2. The method of claim 1, further comprising:

performing a system check to ensure that the system can safely be split before the active subsystem and upgrade subsystem are designated.

3. The method of claim 2, wherein the system check comprises ensuring that all components in the computer system are in a fully-duplexed and safe-to-pull state.

4. The method of claim 1, further comprising:

using the active subsystem to administer the installation of software on the upgrade subsystem.

5. The method of claim 4, further comprising:

once the software has been installed on the upgrade subsystem, stopping any applications then executing on both the active subsystem and the upgrade subsystem.

6. The method of claim 5, further comprising:

after the applications have been stopped, reconnecting the isolated components within the upgrade subsystem with the other subsystems.

7. The method of claim 6, further comprising:

after the isolated components have been reconnected, merging the upgrade subsystem with the active subsystem.

8. The method of claim 7, further comprising:

after the systems have been merged, resuming applications on the merged system.

9. The method of claim 8, further comprising:

after applications have been resumed, synchronizing the merged system.

10. The method of claim 9, further comprising:

after the computer system has been synchronized, restoring the computer to fault-tolerant operation using the newly installed software.

11. The method of claim 10, wherein the computer system is split, merged and restored to fault-tolerant operation without significant interruption in its ongoing operations.

12. The method of claim 11, wherein the computer system'"'"'s ongoing operations are interrupted by less than one second during the split, merge and restore procedures.

13. The method of claim 4, wherein the software to be installed comprises new or updated operating system software.

14. The method of claim 4, further comprising:

testing the software on the upgrade subsystem before applying similar changes to the active subsystem.

15. The method of claim 1, further comprising:

using the active subsystem to access or administer the functions of the upgrade subsystem.

16. The method of claim 14, further comprising:

installing firmware or making system configuration changes to the upgrade subsystem through the use of the active subsystem.

17. The method of claim 1, wherein isolating the components within the upgrade subsystem comprises isolating an upgrade subsystem network and an upgrade subsystem external storage from an active subsystem network and an active subsystem external storage.

18. The method of claim 17, further comprising removing the upgrade subsystem'"'"'s access to all networks and external storage devices.

19. The method of claim 1, wherein splitting the computer system comprises implementing a hardware switch to split the system into the active subsystem and the upgrade subsystem.

20. The method of claim 8, further comprising:

if, after applications have been resumed on the merged system, the software installation has not been performed successfully, rolling a state of the computer system back to a previously valid state.

21. The method of claim 9, further comprising:

validating the upgrade before the merged system is synchronized.

22. A computer system comprising at least two processing subsystems, configured to perform the following steps:

designate a first subsystem and an second subsystem from among the at least two processing subsystems;

isolate components within the second subsystem from the first subsystem; and

split the system such that, at the time of the split, the first subsystem and the second subsystem have identical operational states, but thereafter operate independently.

23. The system of claim 22, further configured to perform a system check to ensure that the system can safely be split before the first subsystem and second subsystem are designated.

24. The system of claim 23, wherein the system check comprises ensuring that all components in the computer system are in a fully-duplexed and safe-to-pull state.

25. The system of claim 22, further configured to use the first subsystem to administer the installation of software on the second subsystem.

26. The system of claim 25, further configured to stop any applications then executing on both the first subsystem and the second subsystem, once the software has been installed on the second subsystem.

27. The system of claim 26, further configured to reconnect the isolated components within the second subsystem with the other subsystems, after the applications have been stopped.

28. The system of claim 27, further configured to merge the second subsystem with the first subsystem, after the isolated components have been reconnected.

29. The system of claim 28, further configured to resume applications on the merged system, after the systems have been merged.

30. The system of claim 29, further configured to synchronize the merged system, after applications have been resumed.

31. The system of claim 30, further configured to restore the computer system to fully-duplexed operation using the newly installed software, after the system has been synchronized.

32. The system of claim 25, wherein the software to be installed comprises new or updated operating system software.

33. The system of claim 22, wherein isolating the components within the second subsystem comprises removing the second subsystem'"'"'s access to all networks and external storage devices.

34. The system of claim 22, wherein splitting the computer system comprises routing legacy I/O traffic on the second subsystem to the first subsystem using a hardware switch and initializing hardware registers to select primary and secondary subsystems when the split command is issued.

35. The system of claim 22, wherein the computer system comprises a dual-mode-redundant fault-tolerant system.

36. The system of claim 31, wherein the computer system'"'"'s ongoing operations are interrupted by less than one second during the restore procedure.

37. A dual-mode redundant, fault-tolerant computer system comprising:

a first subsystem comprising a first processor, a first network connection, and a first local mass storage medium; and

a second subsystem comprising a second processor, a second network connection, and a second local mass storage medium, the second subsystem connected to and in lockstep operation with the first subsystem;

wherein, the second subsystem may be split from the first subsystem and operated independently without rebooting or physically removing either subsystem.

38. A dual-mode redundant, fault-tolerant computer system comprising:

a first subsystem comprising a first processor, a first network connection, and a first local mass storage medium;

a second subsystem comprising a second processor, a second network connection, and a second local mass storage medium; and

specific circuitry dedicated to the split in communication with the first and second subsystems, capable of isolating the first subsystem from the second subsystem while preserving the state of the fault-tolerant computer system prior to the isolation.

39. A fault-tolerant computer system comprising:

a first subsystem comprising a first processor, a first network element, and a first persistent storage device; and

a second subsystem comprising a second processor, a second network element, and a second persistent storage device, the second subsystem adapted to connect to and operate in lockstep operation with the first subsystem;

wherein, the second subsystem may be split from the first subsystem and operated independently of the first subsystem without reboot or removal of either subsystem.

40. The fault-tolerant system of claim 39 wherein the first persistent storage device comprises a redundant array of independent disks.

41. The fault-tolerant system of claim 39 wherein each subsystem is connected to a first input/output system and a second input/output system by a plurality of data buses such that selective control of data bus traffic allows for isolation of each subsystem.

42. The fault-tolerant system of claim 39 wherein the second processor is adapted to cease lockstep operation and to initiate isolation of the first processor from the second processor in response to a control code, instruction or interrupt.

43. The fault-tolerant system of claim 42 further comprising a chipset or BIOS protocol adapted to maintain operation of legacy system features associated with the first subsystem after a split.

44. The fault-tolerant system of claim 43 wherein the legacy system features include USB operation, video operation, peripheral operation, power delivery and combinations thereof.

45. The fault-tolerant system of claim 39 wherein the second network element is adapted to allow remote user access to the first subsystem or the second subsystem.

46. The fault-tolerant system of claim 39 wherein the second network element is selected from the group consisting of a wireless network adapter, a router, an Ethernet port, an optical I/O port, a modem, and combinations thereof.

47. A fault-tolerant computer system comprising:

a first subsystem comprising a first processor, a first network element, and a first local mass storage device;

a second subsystem comprising a second processor, a second network element, and a second local mass storage device; and

a VLSI circuit in electrical communication with the first and second subsystems, the VLSI circuit adapted to isolate the first subsystem from the second subsystem, preserve code execution for at least one of the processors prior to the isolation, and regulate lockstep operation of the two processors.

48. The fault-tolerant computer system of claim 47 wherein the VLSI circuit is adapted to return the first and second subsystem to lockstep operation following an upgrade of at least one the subsystems.

49. The fault-tolerant computer system of claim 47 wherein the VLSI circuit is adapted to route data to I/O components.

50. The fault-tolerant computer system of claim 47 wherein the VLSI circuit comprises specific circuitry dedicated to the split.

51. The fault-tolerant computer system of claim 47 wherein the VLSI circuit comprises a motherboard chipset.

52. The fault-tolerant computer system of claim 47 wherein the VLSI circuit comprises a split mode control register.