Asynchronous arbitration method and device

Abstract

The invention provides an asynchronous arbitration method and device. The method comprises the following steps: starting to execute N redundant instances; n is an integer greater than 1; when the ith redundant instance runs to the synchronization point, stopping executing the ith redundant instance, and recording a current output result of the ith redundant instance to obtain ith arbitration data; i is a positive integer not greater than N; storing the ith arbitration data; after storing the ith arbitration data, executing the part behind the synchronization point of the ith redundant instance; after the N pieces of arbitration data are obtained, target arbitration data are determined from the N pieces of arbitration data, and the redundant instance corresponding to the target arbitration data is the correct redundant instance at the synchronization point. In the method, the redundant instance does not need to wait at the synchronization point, so that the CPU utilization rate can be improved.

Description

Technical Field

[0001] Embodiments of the present application relate to electronic technology, and more particularly to an asynchronous arbitration method and device. Background Art

[0002] With the development of multi-mode redundancy technology, multi-mode redundancy technology is becoming more and more widely used in aerospace, satellites, distributed systems and high performance computing (HPC). For example, it is used in database storage, scientific research computing, weather forecasting, military research and gene sequencing.

[0003] At present, in order to realize arbitration in the same state in multi-module redundancy technology, the instance busy waiting method is usually adopted. For example, the three-module redundant OS technology commonly used in the industry performs synchronous arbitration through an arbitrator. Its synchronization adopts blocking and busy waiting methods to align the states of all redundant instances at the synchronization point.

[0004] However, this multi-mode synchronization method has many shortcomings, among which the most significant pain point is that different redundant instances execute at different speeds, busy waiting causes low central processing unit (CPU) utilization, and the slowest single-point instance becomes a bottleneck for the overall software and hardware operating efficiency. Summary of the invention

[0005] The present application provides an asynchronous arbitration method and device. The method can save the arbitration data at the synchronization point when the redundant instance runs to the synchronization point, and continue to execute the part after the synchronization point of the redundant instance after saving the arbitration data; finally, the arbitration data of all redundant instances are arbitrated. In this method, the redundant instances do not need to busy wait at the synchronization point, which can improve CPU utilization.

[0006] In a first aspect, an embodiment of the present application provides an asynchronous arbitration method, the method comprising:

[0007] Start executing N redundant instances; N is an integer greater than 1;

[0008] When the i-th redundant instance runs to the synchronization point, the i-th redundant instance is stopped from being executed, and the current output result of the i-th redundant instance is recorded to obtain the i-th arbitration data; i is a positive integer not greater than N;

[0009] Save the i-th arbitration data;

[0010] After saving the i-th arbitration data, execute the part after the synchronization point of the i-th redundant instance;

[0011] After obtaining N arbitration data, target arbitration data is determined from the N arbitration data, and the redundant instance corresponding to the target arbitration data is the correct redundant instance at the synchronization point.

[0012] The N redundant instances are N instances in the N modular redundancy technology; the N redundant instances may be obtained by copying the same instance.

[0013] Among them, an instance is a functional module including a running object and target data. An instance can include a running object and target data involved in the running process (such as input and running data). The running object can be a software module or a hardware module; the instance can start executing the running object after receiving the input, and the running object can call the running data during the running process.

[0014] In the N-module redundancy technology, the running objects of the N redundant instances may also be called redundant objects; the redundant objects of the N redundant instances are the same, receive the same input, and call the same running data during the running process.

[0015] The i-th arbitration data is used to indicate the running status of the i-th instance up to the current position, and the arbitration data at least includes the output result of the current position.

[0016] In the embodiment of the present application, by continuing to execute the redundant instance after saving the arbitration data of the redundant instance, the asynchronous execution of multiple redundant instances can be achieved, effectively eliminating the synchronization busyness of the faster instance, and improving the overall CPU resource utilization of the program. The faster instance refers to the instance that runs to the synchronization point faster among the N redundant instances.

[0017] In combination with the first aspect, in a possible implementation manner, after saving the i-th arbitration data and before executing the part after the synchronization point of the i-th redundant instance, the method further includes:

[0018] The checkpoint CKPT data of the i-th redundant instance at the synchronization point is saved, and the CKPT data of the i-th redundant instance at the synchronization point is used to restore the data state of the i-th redundant instance at the synchronization point.

[0019] In the embodiment of the present application, the redundant instance can also be checkpointed to save the CKPT data used to restore to the current synchronization point state; the erroneous redundant instance can be corrected based on the correct CKPT data later, thereby ensuring that the number of redundant instances of multi-mode redundancy will not decrease, and the reliability and availability of multi-mode redundancy can be effectively improved. In this method, the CKPT data can ensure that there is a state to be restored to during asynchronous rollback. When all members arbitrate to identify the fault, whether the slowest instance or the faster instance has an error, asynchronous error correction can be performed.

[0020] In combination with the first aspect, in a possible implementation manner, the i-th arbitration data is not the target arbitration data; after determining the target arbitration data from the N arbitration data, the method further includes:

[0021] Restore the i-th redundant instance based on the CKPT data of the correct redundant instance at the synchronization point;

[0022] Execute the i-th redundant instance after recovery from the synchronization point.

[0023] In an embodiment of the present application, the erroneous redundant instance can be corrected based on the CKPT data of the correct redundant instance at the synchronization point, thereby ensuring that the number of redundant instances of multi-mode redundancy will not decrease, and the reliability and availability of multi-mode redundancy can be effectively improved.

[0024] In combination with the first aspect, in a possible implementation, saving the checkpoint CKPT data of the i-th redundant instance at the synchronization point includes:

[0025] When it is identified that the arbitration data of the i-th redundant instance is the same as the saved arbitration data, the CKPT data of the i-th redundant instance is not saved.

[0026] In an embodiment of the present application, it is possible to first identify whether the arbitration data of the redundant instance is the same as the saved arbitration data (i.e., pre-arbitration technology); then, for instances with the same arbitration data, only one CKPT data can be saved. This method can reduce the number of CKPT times, reduce power consumption, and improve CPU resource utilization.

[0027] In combination with the first aspect, in a possible implementation manner, the i-th redundant instance is an instance among the N redundant instances except the last instance that runs to the synchronization point.

[0028] In the embodiment of the present application, it is not necessary to checkpoint the last redundant instance, and there is no need to save the CKPT data of the redundant instance.

[0029] In this method, through pre-arbitration technology, it can be ensured that at least one of the CKPT instance and the slowest instance is in the correct state, and unnecessary CKPT times can be avoided. Among them, the CKPT instance refers to the instance that has performed CKPT (that is, the instance that saves CKPT data); the slowest instance refers to the last instance that runs to the synchronization point. For example, only one CKPT is required for one round of synchronization points in a fault-free scenario. Generally, in the worst fault scenario, N / 2-1 instances fail. Then, the N-module instances in the worst fault scenario only need to perform N / 2-1 CKPTs in one round of synchronization points, achieving the theoretical optimal CKPT cost.

[0030] In a possible implementation, when the i-th redundant instance is the last instance among N redundant instances to run to the synchronization point, the operation of identifying whether the arbitration data of the i-th redundant instance is the same as the saved arbitration data is not performed, but all arbitration data is directly subjected to full arbitration (i.e., determining the target arbitration data) and error correction rollback and other operations. After the operation is performed, the redundant instance is executed. This method can reduce the number of pre-arbitration times.

[0031] In combination with the first aspect, in a possible implementation manner, determining target arbitration data from N arbitration data includes:

[0032] Determine the arbitration data with the largest number among the N arbitration data as the target arbitration data;

[0033] Or, the arbitration data whose number is greater than a preset number among the N arbitration data are determined as the target arbitration data.

[0034] In the embodiment of the present application, by determining the arbitration data with the largest number or a number greater than a preset number as the target arbitration data, the availability and reliability of the correct redundant instance can be guaranteed.

[0035] In combination with the first aspect, in a possible implementation manner, saving the i-th arbitration data includes:

[0036] When the i-th redundant instance is an instance other than the last instance running to the synchronization point, the i-th arbitration data is saved;

[0037] The method further includes:

[0038] When the arbitration data of the last redundant instance running to the synchronization point is obtained, the step of determining the target arbitration data from the N arbitration data is performed.

[0039] In the embodiment of the present application, for the slowest instance, the arbitration data thereof is not saved, so that the shared memory consumption and the communication overhead can be reduced.

[0040] In combination with the first aspect, in a possible implementation manner, the method further includes:

[0041] When the execution gap between the i-th redundant instance and the slowest redundant instance among the N redundant instances is greater than a preset gap, the execution of the i-th redundant instance is suspended.

[0042] In the embodiment of the present application, the execution gap between redundant instances can be controlled to avoid a significant mismatch between the instances.

[0043] In combination with the first aspect, in a possible implementation, the number of synchronization points in the redundant instance is at least two, and the arbitration data of the i-th redundant instance is stored in a preset storage space; after determining the target arbitration data from the N arbitration data, the method further includes: deleting the arbitration data of the synchronization point;

[0044] The suspending execution of the i-th redundant instance includes: suspending execution of the i-th redundant instance when a preset storage space is full.

[0045] In the embodiment of the present application, the shared memory can be configured to a fixed size, so that the execution gap between direct instances is determined by the size of the shared memory, thereby avoiding a large mismatch between redundant instances.

[0046] In combination with the first aspect, in a possible implementation manner, for example, recording target data of a current state of an i-th redundant instance to obtain i-th arbitration data includes:

[0047] When the i-th application instance runs to calling a library function or the library function returns data, the i-th application instance is stopped, and the current system call number, input parameters and output parameters of the i-th application instance are recorded to obtain the i-th arbitration data.

[0048] In a second aspect, an embodiment of the present application provides an asynchronous arbitration device, the device comprising N processors and an arbitrator;

[0049] The N processors are respectively used to execute the instance; when the instance is executed to the synchronization point, the arbitration data of the synchronization point is output to the arbitrator, and the arbitration data includes the current output result; after the arbitration data of the synchronization point is output, the processing steps after the synchronization point are executed;

[0050] The arbitrator is used to save the arbitration data when receiving the arbitration data sent by the processor; and determine the target arbitration data from the N arbitration data when receiving N arbitration data.

[0051] In conjunction with the second aspect, in a possible implementation, the processor is further configured to send the checkpoint CKPT data of the synchronization point to the arbitrator when processing to the synchronization point;

[0052] The arbitrator is further used to send the CKPT data corresponding to the target arbitration data to the processor corresponding to the non-target arbitration data;

[0053] The processor corresponding to the non-target arbitration data is further used to restore the data state at the synchronization point based on the CKPT data corresponding to the target arbitration data.

[0054] In a third aspect, an embodiment of the present application provides an asynchronous arbitration device, the device comprising:

[0055] An execution unit, for executing N redundant instances for the same input, where N is an integer greater than 1; and i is a positive integer not greater than N;

[0056] The execution unit is further used to: stop executing the i-th redundant instance when the i-th redundant instance runs to the synchronization point, record the current output result of the i-th redundant instance, and obtain the i-th arbitration data; save the i-th arbitration data; after saving the i-th arbitration data, execute the part after the synchronization point of the i-th redundant instance;

[0057] The determination unit is used to determine target arbitration data from the N arbitration data after obtaining the N arbitration data, wherein the redundancy instance corresponding to the target arbitration data is the correct redundancy instance at the synchronization point.

[0058] In conjunction with the third aspect, in a possible implementation manner, the device further includes a storage unit;

[0059] The storage unit is used to store the checkpoint CKPT data of the i-th redundant instance at the synchronization point, and the CKPT data of the i-th redundant instance at the synchronization point is used to restore the data state of the i-th redundant instance at the synchronization point.

[0060] In conjunction with the third aspect, in a possible implementation manner, the device further includes a recovery unit; the recovery unit is configured to:

[0061] Restore the i-th redundant instance based on the CKPT data of the correct redundant instance at the synchronization point;

[0062] Execute the i-th redundant instance after recovery from the synchronization point.

[0063] In conjunction with the third aspect, in a possible implementation manner, the storage unit is further configured to:

[0064] When it is identified that the arbitration data of the i-th redundant instance is the same as the saved arbitration data, the CKPT data of the i-th redundant instance is not saved.

[0065] In combination with the third aspect, in a possible implementation manner, the i-th redundant instance is an instance other than the last instance among the N redundant instances that runs to a synchronization point.

[0066] In conjunction with the third aspect, in a possible implementation manner, the determining unit is specifically configured to:

[0067] Determine the arbitration data with the largest number among the N arbitration data as the target arbitration data;

[0068] Or, the arbitration data whose number is greater than a preset number among the N arbitration data are determined as the target arbitration data.

[0069] In conjunction with the third aspect, in a possible implementation manner, the execution unit is specifically configured to:

[0070] When the i-th redundant instance is an instance other than the last instance running to the synchronization point, the i-th arbitration data is saved; when the arbitration data of the last redundant instance running to the synchronization point is obtained, the step of determining the target arbitration data from the N arbitration data is performed.

[0071] In conjunction with the third aspect, in a possible implementation manner, the execution unit, the device further includes a pausing unit, the pausing unit being configured to:

[0072] When the execution gap between the i-th redundant instance and the slowest redundant instance among the N redundant instances is greater than a preset gap, the execution of the i-th redundant instance is suspended.

[0073] In conjunction with the third aspect, in a possible implementation, the execution unit, the number of synchronization points in the redundant instance is at least two, and the arbitration data of the i-th redundant instance is stored in a preset storage space; the device further includes a deletion unit, the deletion unit being configured to delete the arbitration data of the synchronization point;

[0074] The pausing unit is specifically used to suspend the execution of the i-th redundant instance when the preset storage space is full.

[0075] In conjunction with the third aspect, in a possible implementation manner, the execution unit, the redundant instance is an application instance, and the execution unit is specifically used to:

[0076] When the i-th application instance runs to calling a library function or the library function returns data, the i-th application instance is stopped, and the current system call number, input parameters and output parameters of the i-th application instance are recorded to obtain the i-th arbitration data.

[0077] In a fourth aspect, the present application provides a computer storage medium, including computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes the asynchronous arbitration method in the above-mentioned first aspect or any possible implementation of the first aspect.

[0078] In a fifth aspect, the present application provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the asynchronous arbitration method in the above-mentioned first aspect or any possible implementation of the first aspect.

[0079] In a sixth aspect, the present application provides a chip, comprising: a processor and an interface, wherein the processor and the interface cooperate with each other so that the chip executes the asynchronous arbitration method in the above-mentioned first aspect or any possible implementation of the first aspect.

[0080] It can be understood that the asynchronous arbitration device provided in the second and third aspects, the computer-readable storage medium provided in the fourth aspect, the computer program product provided in the fifth aspect, and the chip provided in the sixth aspect are all used to execute the method provided in the embodiment of the present application. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] Figure 1 is a schematic diagram of multi-mode redundancy provided in an embodiment of the present application;

[0082] Figure 2 It is a schematic diagram of a redundant instance synchronous waiting provided by an embodiment of the present application;

[0083] Figure 3 It is a schematic diagram of an application scenario provided by an embodiment of the present application;

[0084] Figure 4 is a schematic diagram of another application scenario provided by an embodiment of the present application;

[0085] Figure 5 is a flow chart of an asynchronous arbitration method provided by an embodiment of the present application;

[0086] Figure 6 is a flow chart of another asynchronous arbitration method provided by an embodiment of the present application;

[0087] Figure 7 It is a schematic diagram of executing multiple redundant instances provided in an embodiment of the present application;

[0088] Fig. 8A This is a schematic diagram of N redundant instances provided by an embodiment of the present application when there is no failure at the synchronization point;

[0089] Figure 8B This is a schematic diagram of a case where a failure occurs at a synchronization point among N redundant instances provided by an embodiment of the present application;

[0090] Fig. 9 A flowchart of another asynchronous arbitration method provided in an embodiment of the present application;

[0091] Fig.10 is a schematic diagram of managing arbitration data provided by an embodiment of the present application;

[0092] Fig.11 is a schematic diagram of another asynchronous arbitration method provided in an embodiment of the present application;

[0093] Fig.12 is a schematic diagram of another type of management arbitration data provided by an embodiment of the present application;

[0094] Fig.131 is a schematic diagram of the structure of an asynchronous arbitration device 130 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0095] The technical solutions in the embodiments of the present application will be described clearly and in detail below in conjunction with the accompanying drawings. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, "multiple" means two or more than two.

[0096] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.

[0097] The term "user interface (UI)" in the following embodiments of the present application refers to a medium interface for interaction and information exchange between an application or operating system and a user, which realizes the conversion between the internal form of information and the form acceptable to the user. The user interface is a source code written in a specific computer language such as Java and extensible markup language (XML). The interface source code is parsed and rendered on an electronic device, and finally presented as content that can be recognized by the user. The commonly used form of user interface is a graphical user interface (GUI), which refers to a user interface related to computer operation displayed in a graphical manner. It can be a visual interface element such as text, icons, buttons, menus, tabs, text boxes, dialog boxes, status bars, navigation bars, widgets, etc. displayed on the display screen of an electronic device.

[0098] First, the technical terms in the embodiments of the present application are introduced.

[0099] 1. Redundancy

[0100] In the engineering field, redundancy usually refers to increasing system reliability through multiple backups. This means repeatedly configuring some key components of the system. When a system failure occurs, the redundant components intervene and take over the work of the failed components, thereby reducing the system failure time. Although redundancy brings system complexity and increases costs, it is necessary given the high cost of business interruption caused by failures in business-critical systems.

[0101] Reliability refers to the probability that a device can complete a specified task under specified conditions and within a specified time. Improving reliability requires reducing the number of system interruptions (failures). Availability refers to the proportion of total available time for a functional individual within a given time interval. Improving availability requires emphasizing reducing the time to recover from failures.

[0102] For some mission critical systems, the cost of business interruption caused by system failure is very high, so in the design, it is necessary to consider avoiding single point failures and improving system reliability and availability. Redundancy is an indispensable means to improve system reliability.

[0103] 2. Multi-mode redundancy and redundancy examples

[0104] When the system or business needs to ensure high reliability, multi-mode redundancy is one of the necessary and effective reliability mechanisms. The process of multi-mode redundancy includes redundant execution of the same input of hardware modules and software programs. Furthermore, the output of redundant objects can be arbitrated. The data involved in the instance of the redundant object (referred to as redundant instance) includes the same instruction stream, backup data, redundant processes, etc.

[0105] See also Figure 1 , Figure 1 It is a schematic diagram of multi-mode redundancy provided in an embodiment of the present application. Figure 1 Two redundant instances are shown as an example. The process of multi-mode redundancy can be to input the same input to the two redundant instances, perform redundant execution, and finally arbitrate the obtained output. The two redundant instances can be obtained by replication (Sphere of Replication, SoR). It should be understood that multi-mode redundancy is at least two redundant instances.

[0106] 3. Multi-mode redundant arbitration

[0107] In order to identify possible errors in redundant instances, it is necessary to verify whether the redundant instances meet expectations at the designated arbitration point, such as comparing whether the output values ​​between instances are consistent.

[0108] 4. Redundant instance synchronization

[0109] Since the execution speeds of multiple redundant instances can be different, the time it takes for multiple redundant instances to execute to the synchronization point can be different. In order to ensure that the state of multi-mode redundancy passes arbitration when there is no failure, the redundant instances can be synchronized so that each redundant instance does not show a state deviation trend after a long period of execution.

[0110] The synchronization method usually specifies synchronization points in the software and hardware processes. In order to align the pace between redundant instances, the instance that reaches the synchronization point first waits until subsequent instances arrive one after another, and then passes the synchronization point after arbitration.

[0111] See also Figure 2 , Figure 2 It is a schematic diagram of redundant instance synchronous waiting provided in an embodiment of the present application. Figure 2 Three redundant instances are shown as an example, namely redundant instance 1, redundant instance 2 and redundant instance 3; and four synchronization points, namely synchronization point 1, synchronization point 2, synchronization point 3 and synchronization point 4. In the figure, a white rectangle represents an instance in operation, a gray rectangle represents operation to a synchronization point, and a slash rectangle represents stopped operation (i.e., busy waiting).

[0112] like Figure 2 As shown, redundant instance 1, redundant instance 2 and redundant instance 3 all include the above four synchronization points. The horizontal direction is the time direction. It can be seen that the time for each redundant instance to run to the synchronization point is not the same. Taking synchronization point 1 as an example, redundant instance 1 is the first instance to run to synchronization point 1. It starts waiting after redundant instance 1 reaches synchronization point 1; redundant instance 2 is the second instance to run to synchronization point 1. It starts waiting after redundant instance 2 reaches synchronization point 1; redundant instance 3 is the last instance to run to synchronization point 1. The time when redundant instance 3 runs to synchronization point 1 is synchronization time t1. Redundant instances 2 and 3 start to continue running at synchronization time t1.

[0113] In the embodiment of the present application, the synchronization point refers to a preset position in the instance, such as Figure 2 The synchronization point shown, instead of Figure 2 The synchronization time is shown.

[0114] 5. Checkpoint (CKPT) Example

[0115] In the multi-mode redundancy process, state preservation can be performed regularly in order to perform stream / data stream rollback error correction, and state preservation is CKPT. For the convenience of description, the redundant instance after CKPT is referred to as CKPT instance in the embodiment of the present application.

[0116] In order to achieve synchronization in multi-module redundancy technology and arbitrate in the same state, the instance busy waiting method can be adopted. For example, the three-module redundant OS technology commonly used in the industry uses an arbitrator for synchronous arbitration. Its synchronization adopts blocking and busy waiting methods to align the states of all redundant instances at the synchronization point.

[0117] However, this multi-mode synchronization method has many shortcomings. Among them, the most significant pain point is that different redundant instances execute at different speeds, the traditional busy waiting method causes low CPU utilization, and the slowest single-point copy becomes a bottleneck for the overall software and hardware operating efficiency.

[0118] At present, multi-mode redundancy technology can adopt the mode of leader plus follower instance (follower) in synchronous arbitration. Shared memory (such as Ring Buffer) supports inter-process communication. Followers need to follow the external event behavior of the leader and arbitrate the data status. The specific steps are as follows:

[0119] Step 1: After redundant execution starts, when a round of synchronization point is reached, check whether the current instance is a leader or a follower; Step 2: If it is a leader, save the arbitration data to the shared memory and resume execution; if it is a follower, check whether the leader has arrived; Step 3: If the leader has arrived, obtain the leader data from the shared memory and perform arbitration; if the follower arrives before the leader, wait synchronously until the leader arrives. This mode can eliminate the synchronous busy wait of the leader and subsequent followers, but because the leader is specified as a fixed thread, the overall execution efficiency is still limited by the speed of the leader.

[0120] The asynchronous arbitration method proposed in this application is a universal technology for software and hardware, and can be widely applied to any scenario using redundant instances. Two application scenarios are exemplified below from the perspective of hardware and software. It should be understood that the scenarios implemented in this application are not limited to the following scenarios.

[0121] See also Figure 3 , Figure 3 is a schematic diagram of an application scenario provided by an embodiment of the present application. Figure 3 As shown, the application scenario may include M primary central processing units (CPUs), where M is an integer greater than 1; each CPU includes three core processors (cores), each core is used to execute a redundant OS instance, that is, a total of 3M redundant OS instances are included; each CPU includes an arbitrator, which is used to perform synchronization point arbitration on the redundant OS instances in the CPU.

[0122] The application scenario may also include an external device (referred to as peripheral) for sending input to the CPU, and several secondary microcontrollers. Figure 3 It should be understood that the application scenario may also include other processors such as a three-level processor, which is not limited here.

[0123] In one implementation, the peripheral can copy M copies of the input to the primary CPU, and the OS redundant instances running in each execution core will perform business processing. After each OS redundant instance in the primary CPU reaches a round of synchronization point, it will be arbitrated by the arbiter of the primary CPU for multi-mode synchronization. If an error is identified, it will be corrected. Finally, a CPU determines a correct primary arbitration result from the three redundant instances, and then outputs the primary arbitration result to several secondary Microcontrollers. Then the secondary Microcontroller can receive M primary arbitration results.

[0124] Furthermore, the arbitrator of the secondary microcontroller performs secondary arbitration on the M primary arbitration results, and performs error correction if an error is identified.

[0125] In the embodiment of the present application, the OS redundant instance in the primary CPU performs asynchronous arbitration when executing to the synchronization point, so that the OS redundant instance is no longer busy when reaching the synchronization point.

[0126] In the embodiment of the present application, an error correction module may be added to the arbitrator, and when the asynchronous arbitration identifies an erroneous OS redundant instance, a rollback error correction is performed on it.

[0127] See also Figure 4 , Figure 4 is a schematic diagram of another application scenario provided by an embodiment of the present application. Figure 4 As shown, the user-mode application performs multi-mode execution, and processes APP1-APPM are its redundant instances, that is, there are M APP redundant instances in total, and M is an integer greater than 1.

[0128] Figure 4 The arbitration process of two synchronization points is shown in an exemplary manner, where the first synchronization point is before the system call (or after obtaining the C library function): when the APP redundant instance runs in the user state and makes a system call, it obtains the called library function from the C library and performs synchronization waiting before falling into the OS until all APP redundant instances reach the synchronization point of this round. After all APP redundant instances complete the synchronization waiting, the arbitration module in the C library performs a consistency comparison on the input of all APP redundant instances, and once passed, they enter the OS to execute the original system call respectively.

[0129] The second synchronization point is before the system call returns the result to the user-mode application: after each APP redundant instance completes the current system call, the output value of the C library function is returned from the OS, and the system waits for all APP redundant instances to complete the OS process. Then, the consistency arbitration of the output value of all APP redundant instances is performed. After the consistency arbitration of the output value of all APP redundant instances is passed, the output value is returned to the user-mode application, and the user-mode APP redundant instance performs the next round of execution.

[0130] In an embodiment of the present application, all APP redundant instances can save arbitration data and / or CKPT data after reaching the synchronization point, and then continue to execute, without waiting at the synchronization point position for all APP redundant instances to execute to the synchronization point position.

[0131] Please refer to Figure 5 , Figure 5 1 is a flowchart of an asynchronous arbitration method provided by an embodiment of the present application. The method may include some or all of the following steps.

[0132] S101: Start executing N redundant instances, where N is an integer greater than 1.

[0133] In some embodiments, the electronic device includes N redundant instances, and the N redundant instances may be copied from the same instance, that is, the codes corresponding to the N redundant instances are implemented the same.

[0134] Optionally, the N redundant instances may start running at the same time. For example, the electronic device may input the same input to the N redundant instances at the same time, and execute the N redundant instances at the same time.

[0135] In a possible implementation, the specific process of the electronic device executing N redundant instances may refer to all or part of the following steps S102 to S105:

[0136] S102: When the i-th redundant instance runs to a synchronization point, the i-th redundant instance is stopped from being executed, and a current output result of the i-th redundant instance is recorded to obtain an i-th arbitration data, where i is a positive integer not greater than N.

[0137] Optionally, the arbitration data may also include business input parameters, OS result output, etc.

[0138] In a possible implementation, the redundant instance is an application instance. When the i-th application instance runs to calling a library function or the library function returns data, the i-th application instance is stopped, and the current system call number, input parameters, and output parameters of the i-th application instance are recorded to obtain the i-th arbitration data.

[0139] by Figure 4 As an example, assuming that the synchronization point can be before the system calls the C library function, the current output result of the i-th redundant instance can be the input parameter of the C library function, and the i-th arbitration data includes the input parameter of the C library function and the system call number, etc.; assuming that the synchronization point is after the system calls the C library function, the current output result of the i-th redundant instance can be the output parameter of the C library function, and the i-th arbitration data includes the output parameter of the C library function and the system call number, etc. For details, please refer to Fig.11 and Fig.12The relevant contents of the embodiments of the present invention will not be expanded here.

[0140] S103: Save the i-th arbitration data.

[0141] Optionally, the i-th arbitration data may be saved to a shared memory or a ring buffer. The embodiment of the present application does not limit the storage location, which may be determined according to actual applications.

[0142] Optionally, when the i-th redundant instance is the last redundant instance to run to the synchronization point, the i-th arbitration data is not saved.

[0143] Optionally, when the i-th redundant instance is the last redundant instance to run to the synchronization point, step S102 may be directly executed.

[0144] In some embodiments of the present application, the checkpoint CKPT data of the i-th redundant instance at the synchronization point may also be saved, and the CKPT data of the i-th redundant instance at the synchronization point is used to restore the data state of the i-th redundant instance at the synchronization point.

[0145] In some embodiments, after the arbitration data of the i-th redundant instance is saved, the i-th redundant instance can be checkpointed, that is, the CKPT data of the i-th redundant instance at the current synchronization point is recorded. The data can be recorded based on a preset type, and the specific data type can be determined based on the actual redundant instance; the CKPT data is used to restore the data state to the current synchronization point.

[0146] In a possible implementation, the redundant instance is an application instance, and the checkpoint method includes but is not limited to blocking the original APP, copying (forking) and blocking the sub-APP, recording the complete status data of the APP, etc. Among them, the blocking of the original APP means suspending the execution of the application instance, and the original APP blocking can be partially adopted in the embodiment of the present application; copying (forking) and blocking the sub-APP means forking the current application instance (which can be called the original APP), the forked application instance is the sub-APP, the sub-APP is not executed, and the original APP is continued; recording the complete status data of the APP. That is, all data of the current application instance from the beginning of operation to the current synchronization point is saved.

[0147] In a possible implementation, the redundant instance is an OS redundant instance executed by redundant hardware, and the checkpoint method includes but is not limited to recording OS complete status data, etc., wherein the OS complete status data includes all data of the OS redundant instance from the start of running to the current synchronization point, such as the memory data content occupied by the OS redundant instance running, the device status data of the OS redundant instance, and the data stored in the register during the running of the OS redundant instance and the status data of the register, etc.

[0148] Optionally, when it is identified that the arbitration data of the i-th redundant instance is the same as the saved arbitration data, the CKPT data of the i-th redundant instance may not be saved.

[0149] Optionally, the CKPT data of the last instance among the N redundant instances that runs to the synchronization point may not be obtained and saved.

[0150] S104: After saving the i-th arbitration data, executing the part after the synchronization point of the i-th redundant instance.

[0151] In some embodiments, if the i-th redundant instance is the first instance to run to the synchronization point, the portion after the synchronization point of the i-th redundant instance can be executed after saving the i-th arbitration data and the CKPT data of the i-th redundant instance. If the i-th redundant instance is the first instance to run to the synchronization point, step S102 can be executed after obtaining the i-th arbitration data, and then the portion after the synchronization point of the i-th redundant instance is executed. There is no need to checkpoint the i-th redundant instance, nor is there a need to save the i-th arbitration data or the CKPT data of the i-th redundant instance. If the i-th redundant instance is not the first and last instance to run to the synchronization point, the i-th arbitration data can be saved, and it is determined whether to save the CKPT data of the i-th redundant instance according to the rules, and then the portion after the synchronization point of the i-th redundant instance is executed.

[0152] S105: After obtaining N arbitration data, determine target arbitration data from the N arbitration data, and the redundant instance corresponding to the target arbitration data is the correct redundant instance at the synchronization point.

[0153] Optionally, the arbitration data with the largest number among the N arbitration data is determined as the target arbitration data; or, the arbitration data with a number greater than a preset number among the N arbitration data is determined as the target arbitration data.

[0154] Exemplarily, the preset number may be N / 2, that is, if the number of arbitration data of the redundant instance exceeds half of the total number of redundant instances, the redundant instance is determined to be the correct redundant instance. For example, there are 5 redundant instances in total, and the arbitration data of 3 redundant instances are the same, then the arbitration data of the 3 redundant instances are the target arbitration data, and these 3 redundant instances are the correct redundant instances.

[0155] For example, when N is 2, the two arbitration data may be judged based on a preset judgment rule to determine the target arbitration data from the two arbitration data. For example, if the current output result in the arbitration data exceeds the preset data range, the arbitration data is determined to be non-target arbitration data, etc. The preset judgment rule is not limited in the embodiment of the present application.

[0156] In some embodiments, the erroneous redundant instance can be restored to the state of the correct redundant instance at the synchronization point based on the CKPT data of the correct redundant instance at the synchronization point, and the restored redundant instance can be executed from the synchronization point.

[0157] For example, the i-th arbitration data is not the target arbitration data, that is, the i-th redundant instance is an erroneous redundant instance; after determining the target arbitration data from N arbitration data, the i-th redundant instance can be restored based on the CKPT data of the correct redundant instance at the synchronization point; and the i-th redundant instance after restoration is executed from the synchronization point.

[0158] In one possible implementation, after obtaining the arbitration data, the last redundant instance that runs to the synchronization point does not save the arbitration data or perform a checkpoint; instead, it retrieves the saved arbitration data from the memory, and then determines the target arbitration data from the N arbitration data. The redundant instance corresponding to the target arbitration data is the correct redundant instance at the synchronization point. Assuming that the redundant instance with the largest number of N arbitration data is determined as the target arbitration data, the redundant instance that has saved the same arbitration data as the slowest instance before the slowest instance can use the CKPT data of the redundant instance for error correction and rollback. Optionally, the slowest instance can continue to execute after obtaining the arbitration data; or it can wait for the arbitration results of all members, perform error correction in the event of a failure, and then continue to execute, or continue to execute in the absence of a failure.

[0159] In some embodiments of the present application, when the execution gap between the i-th redundant instance and the slowest redundant instance among the N redundant instances is greater than a preset gap, the execution of the i-th redundant instance can be suspended. For example, the number of synchronization points in the redundant instance is at least two, and the arbitration data of the i-th redundant instance is stored in a preset storage space; when the preset storage space is full, the execution of the i-th redundant instance is suspended.

[0160] Please refer to Figure 6 , Figure 61 is a flow chart of another asynchronous arbitration method provided by an embodiment of the present application. The method may include some or all of the following steps.

[0161] S201: Start executing N redundant instances.

[0162] Wherein, N is an integer greater than 1; and the redundant instance includes at least one synchronization point.

[0163] Optionally, the N redundant instances are copied from one instance.

[0164] In some embodiments, the electronic device inputs the same input to N redundant instances and executes the N redundant instances simultaneously.

[0165] In a possible implementation, the redundant instance includes multiple synchronization points, and at each synchronization point, the N redundant instances need to execute the following methods shown in S202 to S209.

[0166] See also Figure 7 , Figure 7 It is a schematic diagram of the execution of multiple redundant instances provided in an embodiment of the present application. Figure 7 The straight line with an arrow represents a redundant instance, and N redundant instances and M synchronization points are shown, where both N and M are integers greater than 1. Figure 7 As shown, N redundant instances start to execute. When any instance among the N redundant instances runs to synchronization point 1, the following step S202 is executed. Based on the result of step S202, the steps in steps S203 to S209 below are executed. For details, see Figure 6 It should be understood that the arbitration error correction process of N redundant instances at M synchronization points is consistent with the arbitration error correction process of N redundant instances at synchronization point 1, and will not be repeated.

[0167] S202: When each redundant instance runs to the synchronization point, determine whether the redundant instance is the first to run to the synchronization point; if so, execute S203 to S205 in sequence; if not, execute S206.

[0168] In some embodiments, when the redundant instance runs the synchronization point, the electronic device can detect the execution status of other redundant instances of the N redundant instances to determine whether the redundant instance is the first redundant instance to run to the synchronization point. It should be understood that the embodiments of the present application do not limit the method for determining whether the redundant instance is the first to run to the synchronization point.

[0169] If the redundant instance is the first instance to run to the synchronization point, the electronic device can save the arbitration data of the redundant instance at the synchronization point; save the CKPT data of the redundant instance at the synchronization point; after saving the arbitration data and CKPT data, the electronic device continues to execute the part after the synchronization point of the redundant instance. For the specific process, please refer to the detailed contents of S203 to S205.

[0170] If the redundant instance is not the first instance to run to the synchronization point, the electronic device can determine whether the redundant instance is the last instance to run to the synchronization point, and then process it according to whether it is the last instance to run to the synchronization point. For the specific process, please refer to the details of S206.

[0171] S203: Save the arbitration data of the redundant instance at the synchronization point.

[0172] In some embodiments, the electronic device can record the key state data of the redundant instance based on the first recording rule, obtain the arbitration data of the redundant instance at the synchronization point, and then save the arbitration data. The key state data includes the output of the redundant instance executed to the synchronization point.

[0173] Optionally, the first recording rules of different instances may be different, that is, the content corresponding to the key status data of different instances may be different, that is, the content corresponding to the arbitration data may be different. Different instances may refer to instances with different functions or different inputs and outputs, for example Figure 3 and Figure 4 For different application scenarios, the redundant instances in the two scenarios may be different instances, and the specific contents of the arbitration data in the two embodiments may be different. It should be understood that the above N redundant instances are the same instance, and the first recording rules corresponding to the above N redundant instances are the same, but because the above N redundant instances may cause data errors due to certain factors during the execution process, the data of the same content recorded by the N redundant instances may be different.

[0174] S204: Save the CKPT data of the redundant instance at the synchronization point.

[0175] In some embodiments, the electronic device can checkpoint the redundant instance based on the second recording rule, obtain the CKPT data of the redundant instance at the synchronization point, and then save the CKPT data. The CKPT data is used to restore any redundant instance among the N redundant instances to the data state of the redundant instance at the synchronization point.

[0176] Optionally, the second recording rules of different instances may be different, that is, the CKPT data corresponding to different instances may be different. It should be understood that the above N redundant instances are the same instance, and the second recording rules corresponding to the above N redundant instances are the same, but because the above N redundant instances may cause data errors due to certain factors during the execution process, the data of the same content recorded by the N redundant instances may be different.

[0177] S205: Execute the part after the synchronization point of the redundant instance.

[0178] like Figure 7 As shown, the redundant instance on the left performs arbitration error correction on the right when it runs to the synchronization point, and returns to the synchronization point after the arbitration error correction is completed to continue executing the following contents of the redundant instance.

[0179] S206: Determine whether the redundant instance is the last one to run to the synchronization point; if so, execute S208; if not, execute S203 and S207 in sequence.

[0180] In some embodiments, the electronic device can detect the execution status of other redundant instances of the N redundant instances when the redundant instance runs the synchronization point to determine whether the redundant instance is the last redundant instance to run to the synchronization point. It should be understood that the embodiments of the present application do not limit the method for determining whether the redundant instance is the last to run to the synchronization point.

[0181] If the redundant instance is the last instance among the N redundant instances to run to the synchronization point, the electronic device conducts full arbitration on the arbitration data of the redundant instance and the arbitration data saved at the synchronization point to determine whether the N arbitration data pass the full arbitration. When the full arbitration passes, there is no need to perform error correction rollback (i.e., there is no need to execute S209). When the full arbitration fails, there is no need to perform error correction rollback (i.e., it is necessary to execute S209). For the specific process, please refer to the relevant content of step S208.

[0182] If the redundant instance is not the first and last instance among the N redundant instances to run to the synchronization point, the electronic device pre-arbitrates the arbitration data of the redundant instance with the arbitration data saved at the synchronization point to determine whether the CKPT data of the redundant instance needs to be saved. When passing the pre-arbitration, the CKPT data of the redundant instance is not saved. When passing the pre-arbitration, the CKPT data of the redundant instance is saved. For the specific process, please refer to the relevant content of step S207.

[0183] S207: Determine whether the redundant instance pre-arbitration passes; if so, execute S205; if not, execute S204 and S205 in sequence.

[0184] In some embodiments, the electronic device can determine whether the pre-arbitration of the redundant instance has passed based on the saved arbitration data of the synchronization point and the arbitration data of the redundant instance; when there is an arbitration data in the saved arbitration data that is the same as the arbitration data of the redundant instance, it is determined that the pre-arbitration of the redundant instance has passed, that is, there is no need to save the CKPT data of the redundant instance; when there is an arbitration data in the saved arbitration data that is different from the arbitration data of the redundant instance, it is determined that the pre-arbitration of the redundant instance has not passed, that is, it is necessary to save the CKPT data of the redundant instance.

[0185] S208: Determine whether the arbitration data of the synchronization point and the arbitration data of the redundant instance are saved through full arbitration. If so, execute S205; if not, execute S209 in sequence.

[0186] The arbitration data of the synchronization point and the arbitration data of the redundant instance saved are the N arbitration data of the N redundant instances at the synchronization point.

[0187] In some embodiments, when the above-mentioned N arbitration data are the same, the electronic device determines that the above-mentioned N arbitration data pass the full arbitration, and there is no need to perform error correction rollback (that is, there is no need to execute S209); when there are two different arbitration data among the above-mentioned N arbitration data, it is determined that the full arbitration does not pass the full arbitration, and error correction rollback is required (that is, S209 needs to be executed).

[0188] It should be understood that if the above N arbitration data pass full arbitration, that is, the N redundant instances have no failures at the synchronization point.

[0189] See also Fig. 8A , Fig. 8A This is a schematic diagram of N redundant instances provided by an embodiment of the present application when there is no failure at the synchronization point. Fig. 8A For example, five redundant instances are used for illustration. The straight lines with arrows represent redundant instances. The direction of the arrows represents the direction of the time axis. The five redundant instances are instance a, instance b, instance c, instance d, and instance e. The gray rectangular blocks are used to represent synchronization points. Fig. 8A Sync point 1 and sync point 2 are shown as examples in FIG.

[0190] like Fig. 8AAs shown, instance a is the first instance to run to synchronization point 1, and the electronic device saves the arbitration data of instance a. The electronic device checkpoints instance a and saves the CKPT data of instance a; instance b, instance d and instance e are not the first redundant instances to run to synchronization point 1, nor are they the last redundant instances to run to synchronization point 1, so the electronic device pre-arbitrates instance b, instance d and instance e. Since the arbitration data of instance b, instance d and instance e are the same as the arbitration data of instance a, instance b, instance d and instance e all pass the pre-arbitration and do not need to save the CKPT data; instance c is the last redundant instance to run to synchronization point 1, so the arbitration data of the five redundant instances at synchronization point 1 are compared. Since the arbitration data of the five redundant instances are the same, the five redundant instances pass the full arbitration, that is, the five redundant instances appear without failure at the synchronization point 1.

[0191] like Fig. 8A As shown in FIG. 1 , after adopting pre-arbitration, only one CKPT is required for one round of synchronization points in a fault-free scenario.

[0192] S209: Determine the correct instance from the N redundant instances; perform error correction and rollback on the erroneous instance based on the CKPT data of the correct instance.

[0193] In some embodiments, the electronic device determines the correct instance from the N redundant instances based on the N arbitration data; and performs error correction rollback on the erroneous instance based on the CKPT data of the correct instance.

[0194] Optionally, the electronic device may determine the arbitration data with the largest number among the N arbitration data as the target arbitration data; or determine the arbitration data with a number greater than a preset number among the N arbitration data as the target arbitration data; and then determine the redundant instance of the target arbitration data as the correct instance.

[0195] See also Figure 8B , Figure 8B This is a schematic diagram of a situation in which a failure occurs at a synchronization point among N redundant instances provided by an embodiment of the present application. Figure 8B Five redundant instances are used as an example for illustration. The straight lines with arrows represent redundant instances. The direction of the arrows represents the direction of the time axis. The five redundant instances are instance a, instance b, instance c, instance d, and instance e. Gray rectangular blocks are used to represent synchronization points without faults, and oblique rectangular blocks are used to represent synchronization points with faults. Figure 8B Sync point 1 and sync point 2 are shown as examples in FIG.

[0196] like Figure 8BAs shown, instance a is the first instance to run to synchronization point 1, the electronic device saves the arbitration data of instance a, and the electronic device checkpoints instance a and saves the CKPT data of instance a.

[0197] Instance b, instance d, and instance e are not the first redundant instances to run to synchronization point 1, nor are they the last redundant instances to run to synchronization point 1. The electronic device performs pre-arbitration on instance b, instance d, and instance e. Since the arbitration data of instance b is the same as the arbitration data of instance a, instance b does not pass the pre-arbitration. The electronic device performs a checkpoint on instance b and saves the CKPT data of instance b. Since the arbitration data of instance d and instance e are the same as the arbitration data of instance a, instance d and instance e both pass the pre-arbitration and do not need to save the CKPT data.

[0198] Instance c is the last redundant instance to run to synchronization point 1, and the arbitration data of the five redundant instances at synchronization point 1 are compared. Since the arbitration data of instance a and instance c (referred to as arbitration data 1) are the same, the arbitration data of instance b, instance d and instance e (referred to as arbitration data 2) are the same, arbitration data 1 and arbitration data 2 are different, and the number of arbitration data 2 is greater than the number of arbitration data 1, the electronic device can determine that the five redundant instances do not pass the full arbitration, that is, the five redundant instances fail at the synchronization point 1, wherein arbitration data 2 is the correct arbitration data (i.e., target arbitration data), instance a and instance c are instances that fail at synchronization point 1, and instance b, instance d and instance e are correct instances that are correct at synchronization point 1.

[0199] Furthermore, the electronic device can roll back instance a and instance c to the data state of instance b at synchronization point 1 based on the CKPT data of instance b at synchronization point 1. Figure 8B The example shows that during rollback, instance a is located at synchronization point 2. In other examples, instance a may run to other locations, which is not limited here.

[0200] The following introduces the embodiments corresponding to the above two application scenarios. Figure 5 and Figure 6 The asynchronous arbitration method is described in detail.

[0201] First, an asynchronous arbitration method in the application scenario of hardware redundancy is introduced.

[0202] The asynchronous arbitration method is applied to an asynchronous arbitration device of multiple OS redundant instances, the asynchronous arbitration device comprises multiple core processors and at least one asynchronous arbitrator, wherein each core processor is used to execute an OS redundant instance, and the OS redundant instance is a redundant instance.

[0203] Please refer to Fig. 9 , Fig. 9 A flowchart of another asynchronous arbitration method provided in an embodiment of the present application. The method may include some or all of the following steps.

[0204] S301: Multiple core processors respectively execute redundant instances of the OS.

[0205] Optionally, multiple core processors may be located in the same central processing unit (CPU).

[0206] S302: When the OS redundant instance runs to a synchronization point, the core processor saves arbitration data of the OS redundant instance at the synchronization point.

[0207] Optionally, the core processor executing S302 may be a core processor that is not the slowest OS redundant instance, that is, the core processor may determine whether the OS redundant instance it executes is the last OS redundant instance that runs to the synchronization point. If so, S302 is not executed; if not, S302 is executed.

[0208] Optionally, the synchronization point may be when the OS outputs the service execution result.

[0209] In some embodiments, the core processor may store key status data of the current synchronization point into a shared memory as arbitration data of the synchronization point, wherein the key status data includes but is not limited to business input parameters, OS result output, and the like.

[0210] See also Fig.10 , Fig.10 Schematic diagram of managing arbitration data provided by an embodiment of the present application. Fig.10 As shown, the straight line with an arrow is used to represent an OS redundant instance, and the figure shows 3 OS redundant instances, namely OS1, OS2 and OS3; the rectangular block is used to represent a shared memory, and the solid line with an arrow is used to indicate the storage of arbitration data; the rectangle with data is used to represent a synchronization point, and the figure shows synchronizing point 1 and synchronizing point 2. In the full arbitration 1 corresponding to synchronization point 1, since OS1 and OS2 are not the slowest instances running to the synchronization point, the core processor executing OS1 stores the arbitration data of OS1 in the shared memory, and the core processor executing OS2 stores the arbitration data of OS2 in the shared memory; in the full arbitration 2 corresponding to synchronization point 2, since OS2 and OS3 are not the slowest instances running to the synchronization point, the core processor executing OS2 stores the arbitration data of OS2 in the shared memory, and the core processor executing OS3 stores the arbitration data of OS3 in the shared memory.

[0211] S303: The core processor pre-arbitrates the OS redundant instance and performs CKPT as needed. The OS redundant instance is not the slowest OS redundant instance.

[0212] In some embodiments, the core processor may perform pre-arbitration on the OS redundant instance after saving the arbitration data of the OS redundant instance at the synchronization point.

[0213] Specifically, pre-arbitration can be to compare the arbitration data of the OS redundant instance with the arbitration data of the current round of CKPT instance one by one. If there is no arbitration data of any CKPT instance that is consistent with the arbitration data of the current OS, CKPT is performed. The current round of CKPT instance is an instance that performs CKPT at this synchronization point. It should be noted that for the convenience of description, the instance that has undergone CKPT is referred to as a CKPT instance.

[0214] Optionally, the CKPT method includes but is not limited to recording complete OS status data (including memory, device, and register status), etc.

[0215] In some embodiments, the worst case supported by N-module redundancy is N / 2-1 error instances, that is, the first half of the instances that arrive must have the correct state. Therefore, in order to further optimize the CKPT cost, only the first half of the instances (N / 2+1) in N-module redundancy need to perform the pre-arbitration + CKPT process. After completing the arbitration data preservation / pre-arbitration / CKPT, the OS redundant instance can continue to execute without waiting.

[0216] Optionally, the first OS redundant instance does not need pre-arbitration and directly performs CKPT. That is, the core processor can determine whether the OS redundant instance it executes is the first OS redundant instance that runs to the synchronization point. If so, it directly performs CKPT. If not, it performs pre-arbitration and then determines whether to perform CKPT based on the result of pre-arbitration.

[0217] S304: The core processor saves the CKPT data.

[0218] S305: The asynchronous arbitrator performs full arbitration based on the arbitration data of all OS redundant instances to determine the correct instance and the incorrect instance.

[0219] In some embodiments, after obtaining the arbitration data of the OS redundant instance that executes the slowest to the synchronization point, the asynchronous arbitrator may fetch the arbitration data of all OS redundant instances in this round from the shared memory and perform a comprehensive comparison. Fig.10As shown, the dotted line with an arrow is used to represent reading arbitration data. When OS3 runs to synchronization point 1, the asynchronous arbitrator can fetch the arbitration data of all OS redundant instances in this round, that is, the arbitration data of OS1 and OS2, from the shared memory, and fully arbitrate the arbitration data of OS1, OS2 and OS3; when OS1 runs to synchronization point 2, the arbitration data of all OS redundant instances in this round, that is, the arbitration data of OS2 and OS3, are fetched from the shared memory, and the arbitration data of OS1, OS2 and OS3 are fully arbitrated.

[0220] Optionally, if more than half of the instances reach consensus, that is, N / 2+1 arbitration data in the N modular redundancy reach consensus, the redundant instances that have reached consensus are considered correct and enter the next round of synchronization points; while the instances that have not reached consensus on the arbitration data are considered errors and need to be rolled back.

[0221] S306: The asynchronous arbitrator sends an error correction message to the core processor corresponding to the error instance, where the message includes an indication message for indicating a correct instance.

[0222] S307: The core processor corresponding to the erroneous instance performs error correction rollback based on the CKPT data of the correct instance or the status data of the slowest instance.

[0223] In some embodiments, if the correct instance is a CKPT instance, the state data (such as memory, device, register state, etc.) of the error instance is restored to the correct CKPT instance state; if the correct instance is the slowest OS redundant instance, the state data of the error instance is restored to the state data of the slowest OS redundant instance. After the rollback error correction is completed, the error instance continues to execute until the current round of synchronization points is completed and the next round of synchronization points is entered.

[0224] S308: After all OS redundant instances have successfully passed the synchronization point, the core processor recycles the arbitration data and / or CKPT data.

[0225] In some embodiments, after all OS redundant instances have successfully passed a round of synchronization points, the asynchronous arbitration device reclaims the memory consumed in this round, wherein the memory includes the reserved memory for storing arbitration data (such as Fig.10 Shared memory can also be called Shared Memory) and the memory occupied by CKPT data.

[0226] Optionally, after determining that all OS redundant instances have successfully passed a round of synchronization points, the core processor deletes from the memory the arbitration data and CKPT data saved by the OS redundant instances executed by it.

[0227] Next, an asynchronous arbitration method for redundant instances as application instances is introduced.

[0228] This method is applied to user-mode multi-mode execution. For example, processes APP1-APPM are redundant instances, and M is an integer greater than 1. Figure 4 In the embodiment of the present application, when the redundant APP instance reaches the specified synchronization point, such as the system call, it can be intercepted at the entrance and exit of the corresponding function of the C library, and an asynchronous arbitration method can be performed before and after falling into the kernel to execute the system call, which can eliminate the synchronization busy link.

[0229] See also Fig.11 , Fig.11 is a schematic diagram of another asynchronous arbitration method provided in an embodiment of the present application. The method may include some or all of the following steps:

[0230] S401: When the APP redundant instance runs to a synchronization point, the arbitration data at the synchronization point is saved.

[0231] Optionally, the slowest instance may not save its quorum data.

[0232] Exemplarily, when the APP redundant instance reaches the system call, the current key state is stored in the shared memory, and the current key state is the arbitration data, which includes but is not limited to the system call number, input and output parameters, etc. The shared memory includes but is not limited to the Ring Buffer, etc.

[0233] See also Fig.12 , Fig.12 FIG. 1 is another schematic diagram of managing arbitration data provided by an embodiment of the present application. Fig.12 As shown, the straight line with an arrow is used to represent the APP redundant instance. The figure shows three APP redundant instances, namely APP1, APP2 and APP3; the ring is used to represent the circular memory (Ring Buffer), and the solid line with an arrow is used to indicate the storage of arbitration data; the rectangle with data is used to represent the synchronization point, and the figure shows the synchronization point 1 and the synchronization point 2. In the full arbitration 1 corresponding to the synchronization point 1, since APP1 and APP2 are not the slowest instances running to the synchronization point, the arbitration data of APP1 and the arbitration data of APP2 are stored in the Ring Buffer; in the full arbitration 2 corresponding to the synchronization point 2, since APP2 and APP3 are not the slowest instances running to the synchronization point, the arbitration data of APP2 and the arbitration data of APP3 are stored in the Ring Buffer.

[0234] S402: Pre-arbitrate the APP redundant instances and perform CKPT as needed.

[0235] In some embodiments, after the APP redundancy instance saves the arbitration data, pre-arbitration is performed.

[0236] Exemplarily, pre-arbitration can specifically be to compare the arbitration data of the APP redundant instance with the arbitration data of the current round of CKPT instance one by one, and if there is no arbitration data of any CKPT instance that is consistent with the arbitration data of the APP redundant instance P, then CKPT is performed. Among them, the method of performing CKPT includes but is not limited to blocking the original APP, copying (fork) and blocking the sub-APP, recording the complete status data of the APP, etc.

[0237] In one implementation, the worst case supported by N-module redundancy is N / 2-1 error instances, that is, the first half of the instances that arrive have the correct status. Therefore, in order to further optimize the CKPT cost, only the first half of the instances (N / 2+1) in the N-module redundancy need to undergo the pre-arbitration + CKPT process. After completing at least one of the arbitration data preservation, pre-arbitration, and CKPT processes, the APP redundant instance can continue to execute without waiting. Among them, the specific process of the APP redundant instance executing arbitration data preservation, pre-arbitration, and CKPT can be found in the relevant content above, which will not be repeated here.

[0238] Optionally, the first APP redundant instance (ie, the first instance running to the synchronization point) may not perform pre-arbitration but directly perform CKPT.

[0239] S403: When the slowest APP redundant instance is executed to the synchronization point, all members perform arbitration and roll back and correct errors as needed.

[0240] In some embodiments, the slowest APP redundant instance can first be loaded from the shared memory (such as Fig.12 The arbitration data of all APP redundant instances in this round are taken out from the Ring Buffer and compared as a whole.

[0241] like Fig.12 As shown, the dotted line with an arrow is used to represent reading arbitration data. When APP3 runs to synchronization point 1, the arbitration data of all APP redundant instances in this round, that is, the arbitration data of APP1 and APP2, can be taken out from the Ring Buffer, and the arbitration data of APP1, APP2 and APP3 can be fully arbitrated; when APP1 runs to synchronization point 2, the arbitration data of all APP redundant instances in this round, that is, the arbitration data of APP2 and APP3, can be taken out from the shared memory, and the arbitration data of APP1, APP2 and APP3 can be fully arbitrated.

[0242] Optionally, if more than half of the instances reach a consensus, that is, N / 2+1 arbitration data in the N modular redundancy reach a consensus, the redundant instances that have reached a consensus are considered correct and enter the next round of synchronization points; while the instances that have not reached a consensus on the arbitration data are considered wrong and need to be rolled back. Based on the results of the full arbitration, one of the correct states can be selected from the CKPT instance and the slowest instance, and the wrong APP redundant instance can be rolled back to the correct state.

[0243] If the correct state exists in the CKPT instance, assuming that the CKPT mode is fork and blocks the sub-APP, the error instance will be terminated and replaced by the sub-APP that is being blocked by the CKPT instance; if the correct state exists in the slowest instance, the error instance will be terminated, the slowest APP redundant instance will be forked and copied, and its sub-APP will replace the original error APP. After the rollback error correction is completed, the error instance continues to execute until the current round of synchronization points is completed and the next round of synchronization points is entered.

[0244] S404: Reclaim the storage resources storing the arbitration data and CKPT data.

[0245] In some embodiments, after all APP redundant instances have successfully passed a round of synchronization points, the reserved memory (such as Fig.12 In the Ring Buffer implementation, the memory occupied by the read pointer (when it crosses the current round of data range) and the CKPT data is reclaimed, that is, the storage space for storing arbitration data and CKPT status data is released for use by subsequent synchronization points.

[0246] The method of the embodiment of the present application is described in detail above, and the device of the embodiment of the present application is provided below.

[0247] See also Fig.13 , Fig.13 1 is a schematic diagram of the structure of an asynchronous arbitration device 130 provided in an embodiment of the present application. The device 130 may be an electronic device. Of course, the device 130 may also be a device in an electronic device, such as a chip or an integrated circuit, etc. The device 130 may include an execution unit 1301, a determination unit 1302, a storage unit 1303, a recovery unit 1304, and a suspension unit 1305. The asynchronous arbitration device 130 is used to implement the asynchronous arbitration method of any of the aforementioned embodiments.

[0248] In a possible implementation, the device includes:

[0249] An execution unit 1301 is used to start executing N redundant instances, where N is an integer greater than 1; and i is a positive integer not greater than N;

[0250] The execution unit 1301 is specifically configured to: stop executing the i-th redundant instance when the i-th redundant instance runs to a synchronization point, record the current output result of the i-th redundant instance, and obtain the i-th arbitration data; save the i-th arbitration data; after saving the i-th arbitration data, execute the part after the synchronization point of the i-th redundant instance;

[0251] The determining unit 1302 is configured to determine target arbitration data from the N arbitration data after obtaining the N arbitration data, wherein the redundancy instance corresponding to the target arbitration data is a correct redundancy instance at the synchronization point.

[0252] In a possible implementation manner, the device further includes a storage unit 1303;

[0253] The saving unit 1303 is used to save the checkpoint CKPT data of the i-th redundant instance at the synchronization point, and the CKPT data of the i-th redundant instance at the synchronization point is used to restore the data state of the i-th redundant instance at the synchronization point.

[0254] In a possible implementation manner, the apparatus further includes a recovery unit 1304; the recovery unit 1304 is configured to:

[0255] Recovering the i-th redundant instance based on the CKPT data of the correct redundant instance at the synchronization point;

[0256] The i-th redundant instance after recovery is executed from the synchronization point.

[0257] In a possible implementation manner, the storage unit 1303 is further configured to:

[0258] When it is identified that the arbitration data of the i-th redundant instance is the same as the saved arbitration data, the CKPT data of the i-th redundant instance is not saved.

[0259] In a possible implementation manner, the i-th redundant instance is an instance other than the last instance among the N redundant instances that runs to the synchronization point.

[0260] In a possible implementation manner, the determining unit 1302 is specifically configured to:

[0261] Determine the arbitration data with the largest number among the N arbitration data as the target arbitration data;

[0262] Or, arbitration data whose number among the N arbitration data is greater than a preset number is determined as the target arbitration data.

[0263] In a possible implementation manner, the execution unit 1301 is specifically configured to:

[0264] When the i-th redundant instance is an instance other than the last instance running to the synchronization point, the i-th arbitration data is saved;

[0265] When the arbitration data of the last redundant instance running to the synchronization point is obtained, the step of determining the target arbitration data from the N arbitration data is performed.

[0266] In a possible implementation manner, the device further includes a pausing unit 1305, wherein the pausing unit 1305 is configured to:

[0267] When the execution gap between the i-th redundant instance and the slowest redundant instance among the N redundant instances is greater than a preset gap, the execution of the i-th redundant instance is suspended.

[0268] In a possible implementation manner, the number of synchronization points in the redundant instance is at least two, and the arbitration data of the i-th redundant instance is stored in a preset storage space; the device further includes a deletion unit, the deletion unit being configured to delete the arbitration data of the synchronization point;

[0269] The pausing unit 1305 is specifically configured to suspend the execution of the i-th redundant instance when the preset storage space is full.

[0270] In a possible implementation manner, the redundant instance is an application instance, and the execution unit 1301 is specifically configured to:

[0271] When the i-th application instance runs to calling a library function or the library function returns data, the i-th application instance is stopped from executing, and the current system call number, input parameters and output parameters of the i-th application instance are recorded to obtain the i-th arbitration data.

[0272] It should be noted that the implementation of each unit can also refer to Figure 5 , Figure 6 , Fig. 9 and Fig.11 The asynchronous arbitration device 130 may be the electronic device mentioned above.

[0273] It is understandable that in each device embodiment of the present application, the division of multiple units or modules is only a logical division based on function, and is not intended to limit the specific structure of the device. In a specific implementation, some functional modules may be subdivided into more small functional modules, and some functional modules may be combined into one functional module, but regardless of whether these functional modules are subdivided or combined, the general process executed by the device 130 during the pairing process is the same. Usually, each unit corresponds to its own program code (or program instruction), and when the program codes corresponding to these units are run on the processor, the unit is controlled by the processor to execute the corresponding process to achieve the corresponding function.

[0274] An embodiment of the present application also provides an electronic device, which includes one or more processors and one or more memories; wherein the one or more memories are coupled to the one or more processors, and the one or more memories are used to store computer program codes, and the computer program codes include computer instructions, and when the one or more processors execute the computer instructions, the electronic device executes the method described in the above embodiment.

[0275] The embodiments of the present application also provide a computer program product including instructions. When the computer program product is executed on an electronic device, the electronic device executes the method described in the above embodiments.

[0276] An embodiment of the present application also provides a computer-readable storage medium, including instructions, which, when executed on an electronic device, enable the electronic device to execute the method described in the above embodiment.

[0277] It can be understood that the various embodiments of the present application can be combined arbitrarily to achieve different technical effects.

[0278] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the present application are generated.

[0279] The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk), etc.

[0280] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

[0281] In short, the above is only an embodiment of the technical solution of this application, and is not intended to limit the protection scope of this application. Any modification, equivalent replacement, improvement, etc. made according to the disclosure of this application shall be included in the protection scope of this application.

Claims

1. An asynchronous arbitration method, characterized in that: The method comprises: Start executing N redundant instances, where N is an integer greater than 1; When the i-th redundant instance runs to the synchronization point, the i-th redundant instance is stopped from being executed, and the current output result of the i-th redundant instance is recorded to obtain the i-th arbitration data; the i is a positive integer not greater than the N; Saving the i-th arbitration data; After saving the i-th arbitration data, executing the portion after the synchronization point of the i-th redundant instance; After obtaining the N arbitration data, target arbitration data is determined from the N arbitration data, and the redundancy instance corresponding to the target arbitration data is the correct redundancy instance at the synchronization point.

2. The method according to claim 1, characterized in that After the i-th arbitration data is saved and before the part after the synchronization point of the i-th redundant instance is executed, the method further includes: The checkpoint CKPT data of the i-th redundant instance at the synchronization point is saved, and the CKPT data of the i-th redundant instance at the synchronization point is used to restore the data state of the i-th redundant instance at the synchronization point.

3. The method according to claim 1 or 2, characterized in that: The i-th arbitration data is not the target arbitration data; After determining the target arbitration data from the N arbitration data, the method further includes: Recovering the i-th redundant instance based on the CKPT data of the correct redundant instance at the synchronization point; The i-th redundant instance after recovery is executed from the synchronization point.

4. The method according to claim 2 or 3, characterized in that: The step of storing the checkpoint CKPT data of the i-th redundant instance at the synchronization point includes: When it is identified that the arbitration data of the i-th redundant instance is the same as the saved arbitration data, the CKPT data of the i-th redundant instance is not saved.

5. The method according to any one of claims 2 to 4, characterized in that: The i-th redundant instance is an instance among the N redundant instances except the last instance that runs to the synchronization point.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: When the execution gap between the i-th redundant instance and the slowest redundant instance among the N redundant instances is greater than a preset gap, the execution of the i-th redundant instance is suspended.

7. The method according to claim 6, characterized in that The number of synchronization points in the redundant instance is at least two, and the arbitration data of the i-th redundant instance is stored in a preset storage space; After determining the target arbitration data from the N arbitration data, the method further includes: deleting the arbitration data of the synchronization point; The suspending execution of the i-th redundant instance includes: suspending execution of the i-th redundant instance when the preset storage space is full.

8. The method according to any one of claims 1 to 7, characterized in that: The storing of the i-th arbitration data comprises: When the i-th redundant instance is an instance other than the last instance running to the synchronization point, saving the i-th arbitration data; The method further comprises: When the arbitration data of the last redundant instance running to the synchronization point is obtained, the step of determining the target arbitration data from the N arbitration data is performed.

9. An asynchronous arbitration device, characterized in that: The device includes N processors and an arbiter; The N processors are respectively used to execute an instance; when the instance runs to a synchronization point, the arbitration data of the synchronization point is output to the arbitrator, wherein the arbitration data includes a current output result; After outputting the arbitration data of the synchronization point, executing the processing steps after the synchronization point; The arbitrator is used to save the arbitration data when receiving the arbitration data sent by the processor; When the N arbitration data are received, target arbitration data are determined from the N arbitration data.

10. The device according to claim 9, characterized in that The processor is further configured to send the checkpoint CKPT data of the synchronization point to the arbitrator when processing reaches the synchronization point; The arbitrator is further used to send the CKPT data corresponding to the target arbitration data to the processor corresponding to the non-target arbitration data; The processor corresponding to the non-target arbitration data is further used to restore the data state at the synchronization point based on the CKPT data corresponding to the target arbitration data.

11. An asynchronous arbitration device, characterized in that: The device comprises: An execution unit, configured to start executing N redundant instances, where N is an integer greater than 1; The execution unit is further used to: stop executing the i-th redundant instance when the i-th redundant instance runs to the synchronization point, record the current output result of the i-th redundant instance, and obtain the i-th arbitration data; save the i-th arbitration data; after saving the i-th arbitration data, execute the part after the synchronization point of the i-th redundant instance; the i is a positive integer not greater than the N; The determination unit is used to determine target arbitration data from the N arbitration data after obtaining the N arbitration data, wherein the redundancy instance corresponding to the target arbitration data is the correct redundancy instance at the synchronization point.

12. The method according to claim 11, characterized in that The device also includes a storage unit; The saving unit is used to save the checkpoint CKPT data of the i-th redundant instance at the synchronization point, and the CKPT data of the i-th redundant instance at the synchronization point is used to restore the data state of the i-th redundant instance at the synchronization point.

13. The method according to claim 11 or 12, characterized in that: The device further comprises a recovery unit; the recovery unit is used to: Recovering the i-th redundant instance based on the CKPT data of the correct redundant instance at the synchronization point; The i-th redundant instance after recovery is executed from the synchronization point.

14. The method according to claim 12 or 13, characterized in that The storage unit is further used for: When it is identified that the arbitration data of the i-th redundant instance is the same as the saved arbitration data, the CKPT data of the i-th redundant instance is not saved.

15. The method according to any one of claims 12 to 14, characterized in that The i-th redundant instance is an instance among the N redundant instances except the last instance that runs to the synchronization point.

16. The method according to any one of claims 11 to 15, characterized in that The device further comprises a pause unit, wherein the pause unit is configured to: When the execution gap between the i-th redundant instance and the slowest redundant instance among the N redundant instances is greater than a preset gap, the execution of the i-th redundant instance is suspended.

17. The method according to claim 16, characterized in that The number of synchronization points in the redundant instance is at least two, and the arbitration data of the i-th redundant instance is stored in a preset storage space; the device further comprises a deletion unit, the deletion unit being used to delete the arbitration data of the synchronization point; The pausing unit is specifically configured to suspend the execution of the i-th redundant instance when the preset storage space is full.

18. The method according to any one of claims 11 to 17, characterized in that The execution unit is specifically used for: when the i-th redundant instance is an instance other than the last instance running to the synchronization point, saving the i-th arbitration data; when obtaining the arbitration data of the last redundant instance running to the synchronization point, executing the step of determining the target arbitration data from the N arbitration data.

19. An electronic device, characterized in that: The electronic device includes one or more processors and one or more memories; wherein the one or more memories are coupled to the one or more processors, and the one or more memories are used to store computer program code, and the computer program code includes computer instructions, and when the one or more processors execute the computer instructions, the electronic device executes the method as described in any one of claims 1-8.

20. A computer-readable storage medium comprising instructions, characterized in that: When the instructions are executed on an electronic device, the electronic device is caused to execute the method as claimed in any one of claims 1 to 8.

Images