Fault recovery method and device for out-of-step single computer in four-computer hot backup computer

Abstract

The invention provides a fault recovery method and device for an out-of-step single computer in a four-computer hot backup computer, the method is applied to the four-computer hot backup computer adopting a Byzantine fault-tolerant structure, and the method comprises the following steps: in each task period, classifying memory data in the four-computer hot backup computer; classification data including common slow change data and common quick change data are obtained; when the output results of the single machines of the four-machine hot backup computer are inconsistent, determining an out-of-step single machine; performing first recovery on the out-of-step single machine according to the common slow change data, and determining the changed common slow change data which changes in a task period in which the first recovery is performed; performing secondary recovery on the out-of-step single machine according to the common slow change data and the common fast change data to obtain recovery data; wherein the second recovery is carried out in a state of suspending task operation. According to the scheme, the single-machine-level fault of the four-machine hot backup system is accurately and autonomously recovered, and the high-redundancy fault-tolerant capability of a spaceborne computer system is improved.

Description

Technical Field

[0001] The present invention relates to the field of satellite-borne computer technology, in particular to the field of multi-machine hot backup control system technology, and more particularly to a fault recovery method and device for a single machine out of step in a four-machine hot backup computer. Background Art

[0002] Due to the influence of the complex environment of space, the reliability and safety of onboard computers have always been a key issue in the aerospace field. In order to effectively improve the reliability and safety of onboard computers, it is necessary to adopt redundant and fault-tolerant design technologies. The dual-machine cold backup system and the three-machine hot backup system are the most typical and widely used fault-tolerant systems for onboard computers. For the dual-machine cold backup system and the three-machine hot backup system, when the computer on duty fails, the fault-tolerant mechanism will switch to another computer on duty. Moreover, these two systems can only rebuild the working state by restoring important data on the entire machine. They cannot restore the faulty computer alone, and cannot restore the downgraded fault-tolerant system to a normal working state autonomously.

[0003] Compared with the dual-machine cold backup system and the three-machine hot backup system, the four-machine hot backup system consists of four machines that operate synchronously with hot redundancy. It has higher system reliability, better fault tolerance and higher system performance, but it is still unable to autonomously restore the downgraded fault-tolerant system to a normal working state. If the working state is rebuilt by restoring important data on the entire machine, the accuracy and reliability of the four-machine hot backup system will be affected. Therefore, it is urgent to provide a fault recovery method and device for a single machine that has lost synchronization in a four-machine hot backup computer. Summary of the invention

[0004] The present invention provides a fault recovery method and device for a lost single machine in a four-machine hot backup computer, which restores the lost single machine to a coordinated and synchronous normal working state by aligning data, thereby achieving accurate and autonomous recovery of single-machine-level faults in the four-machine hot backup system and greatly improving the high redundancy fault tolerance capability of the onboard computer system.

[0005] In a first aspect, the present invention provides a method for recovering a single out-of-step computer in a four-machine hot standby computer, which is applied to a four-machine hot standby computer using a Byzantine fault-tolerant structure, comprising:

[0006] In each task cycle, the memory data in the four hot standby computers are classified to obtain classified data including common slow-changing data and common fast-changing data;

[0007] When the output results of the individual computers of the four-computer hot standby computers are inconsistent, determining the out-of-step individual computer;

[0008] Performing a first recovery on the out-of-step stand-alone machine according to the shared slow-changing data, and determining the shared slow-changing data that has changed in the task cycle during the first recovery;

[0009] The out-of-step single machine is restored for a second time according to the shared slow-changing data and the shared fast-changing data to obtain restored data; wherein the second restoration is performed in a suspended task running state.

[0010] Optionally, the classified data also includes single-machine private data;

[0011] After obtaining the classified data including the common slow-changing data and the common fast-changing data and before determining the out-of-step single machine, the method further includes:

[0012] Compile the shared slow-changing data, the shared fast-changing data, and the stand-alone private data to the specified positions of the target segment of the executable file respectively; wherein the target segment includes a data segment and a bss segment, and different classification data are at different specified positions of the target segment;

[0013] According to the designated position, a link script corresponding to the classification data is generated.

[0014] Optionally, the first recovery of the out-of-step single machine according to the shared slowly varying data includes:

[0015] In each task cycle, the following are performed: determining the running time of the normal task running in the task cycle; and taking the difference between the total time of the task cycle and the running time as the recovery time;

[0016] The shared slowly varying data is copied to the out-of-step single machine within the recovery time, until all the shared slowly varying data are copied, thereby completing the first recovery.

[0017] Optionally, the determining that the changes in the task cycle during the first recovery have a total of slowly changing data includes:

[0018] Dividing the shared slowly varying data into a plurality of data blocks according to a preset data block size;

[0019] For each of the data blocks, the following steps are performed: determining whether the data block has changed during the task cycle in which the data block is restored for the first time; if the determination result is yes, determining the data block as a changed data block;

[0020] A union operation is performed on the change data blocks to obtain the change common slow-changing data.

[0021] Optionally, the second recovery of the out-of-step standalone machine according to the changed shared slow-changing data and the shared fast-changing data to obtain the recovered data includes:

[0022] Determine the minimum number of window cycles required for the second recovery according to the amount of the common slow-changing data, the amount of the common fast-changing data acquired up to the current task cycle, the data transmission rate and the total duration of the task cycle; wherein the minimum number of window cycles is not greater than the maximum acceptable number of suspended task cycles of the four-machine hot standby computer;

[0023] Within the minimum window period number, the shared slow-changing data and the shared fast-changing data are copied to the out-of-step single machine, the second recovery is completed, and the recovered data is obtained.

[0024] Optionally, the minimum window period number is determined by the following formula:

[0025]

[0026] Among them, T n Used to characterize the minimum window period number; Q s 'The amount of data used to characterize the total slow-changing data of the change; Q f It is used to characterize the data volume of the shared fast-changing data; DTR is used to characterize the data transmission rate; T is used to characterize the total duration of the task cycle; and ceil is used to characterize the upward rounding function.

[0027] Optionally, after obtaining the restored data, the method further includes:

[0028] In the next task cycle after obtaining the recovery data, the four hot standby computers that obtained the recovery data are processed in real time to obtain the verification output results of each single computer;

[0029] Determine whether the verification output results of the individual machines are consistent;

[0030] If the judgment result is yes, complete the fault recovery of the out-of-step single machine;

[0031] If the judgment result is no, then in the next task cycle after the current task cycle ends, the process returns to execute the first recovery of the out-of-step stand-alone machine according to the shared slowly varying data.

[0032] In a second aspect, the present invention further provides a fault recovery device for a single out-of-step computer in a four-machine hot backup computer, comprising:

[0033] A classification module, used for classifying the memory data in the four-machine hot backup computer in each task cycle to obtain classified data including common slow-changing data and common fast-changing data;

[0034] A fault determination module, used for determining the out-of-step single machine when the output results of the four hot backup computers are inconsistent;

[0035] A recovery module is used to perform a first recovery of the out-of-step single machine according to the shared slow-changing data, and determine the changed shared slow-changing data in the task cycle during the first recovery; and to perform a second recovery of the out-of-step single machine according to the changed shared slow-changing data and the shared fast-changing data to obtain recovery data; wherein the second recovery is performed in a suspended task running state.

[0036] In a third aspect, the present invention further provides a computing device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the fault recovery method for a lost single machine in a four-machine hot backup computer as described in any one of the above items.

[0037] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute any of the above-described methods for recovering a single machine out of step in a four-machine hot backup computer.

[0038] In a fifth aspect, an embodiment of the present invention further provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of the method described in any first aspect of this specification.

[0039] The present invention provides a fault recovery method and device for a lost-step single machine in a four-machine hot backup computer, which is applied to a four-machine hot backup computer using a Byzantine fault-tolerant structure. First, the memory data in each task cycle is classified to obtain common slow-changing data and common fast-changing data. When a lost-step single machine occurs, the lost-step single machine is firstly recovered by the common slow-changing data, and then the lost-step single machine is secondly recovered by the changed common slow-changing data and common fast-changing data in the task cycle where the first recovery is located, to obtain recovery data for fault recovery. In this way, the present invention realizes the recovery of the common slow-changing data and the common fast-changing data respectively through two recoveries. Since the second recovery is performed in the suspended task running state, it can ensure that the recovery data of the lost-step single machine is aligned with the data of other single machines while recovering, and then the lost-step single machine is restored to a coordinated and synchronous normal working state, realizing the accurate and autonomous recovery of single-machine-level faults of the four-machine hot backup system, and greatly improving the high redundancy fault tolerance capability of the onboard computer system. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 It is a flow chart of a method for recovering a single machine out of step in a four-machine hot backup computer provided by an embodiment of the present invention;

[0042] Figure 2 This is an example diagram of centralized storage of classified data in segments and partitions provided by an embodiment of the present invention;

[0043] Figure 3 is a hardware architecture diagram of a computing device provided by an embodiment of the present invention;

[0044] Figure 4 The present invention is a structural diagram of a fault recovery device for a single out-of-step computer in a four-machine hot backup computer provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0046] Please refer to Figure 1 The embodiment of the present invention provides a method for recovering a single out-of-step computer in a four-machine hot standby computer, which is applied to a four-machine hot standby computer using a Byzantine fault-tolerant structure, and includes:

[0047] Step 100, in each task cycle, classify the memory data in the four-machine hot standby computer to obtain classified data including common slow-changing data and common fast-changing data;

[0048] Step 102, when the output results of each single machine of the four-machine hot standby computer are inconsistent, determine the out-of-step single machine;

[0049] Step 104, performing a first recovery on the out-of-step standalone machine according to the shared slow-changing data, and determining the shared slow-changing data that has changed in the task cycle during the first recovery;

[0050] Step 106, performing a second recovery on the out-of-step standalone machine according to the shared slow-changing data and the shared fast-changing data, to obtain recovery data; wherein the second recovery is performed in a suspended task running state.

[0051] In the present invention, the method is applied to a four-machine hot backup computer using a Byzantine fault-tolerant structure. First, the memory data in each task cycle is classified to obtain shared slow-changing data and shared fast-changing data. When a single machine loses step, the single machine loses step for the first time through the shared slow-changing data, and then the single machine loses step for the second time through the shared slow-changing data and shared fast-changing data that have changed in the task cycle during the first recovery, to obtain recovery data for fault recovery. In this way, the present invention realizes the recovery of shared slow-changing data and shared fast-changing data respectively through two recovery. Since the second recovery is performed in the suspended task running state, it can ensure that the recovery data of the single machine loses step is aligned with the data of other single machines while recovering, and then the single machine loses step is restored to a normal working state of coordinated and synchronous synchronization, realizing the accurate and autonomous recovery of single-machine-level faults of the four-machine hot backup system, and greatly improving the high redundancy fault tolerance capability of the satellite-borne computer system.

[0052] It should be noted that the four-machine hot backup computer includes four independently running single machines. The single machines communicate and exchange data with each other at regular intervals in each task cycle. The four single machines run precisely and synchronously. The four machines use the bit level without tolerance to compare data and are completely accurate and consistent. Each single machine controls different buses to complete different IO tasks, and the four machines work together to complete data collection and output on distributed multi-buses. Among them, IO refers to the input and output of data between internal memory and external memory or other peripheral devices.

[0053] Described below Figure 1 How the various steps are performed.

[0054] First, for step 100, the classified data also includes single-machine private data. It should be noted that shared slow-changing data and shared fast-changing data are both shared data. The classification basis for private and shared data is whether the data is consistent in the four machines. If it is completely consistent, it is shared data of the four machines, otherwise it is single-machine private data. The classification basis for shared slow-changing data and shared fast-changing data is whether the data changes in each task cycle during the algorithm calculation. In each task cycle, it changes to fast-changing data, otherwise it is slow-changing data.

[0055] After step 100 and before step 102, the method further includes:

[0056] Compile the shared slow-changing data, shared fast-changing data, and single-machine private data into the specified positions of the target segment of the executable file respectively; wherein the target segment includes the data segment and the bss segment, and different classification data have different specified positions in the target segment;

[0057] Generate a link script for the corresponding classification data based on the specified location.

[0058] Specifically, Figure 2 The classified data is stored in the segmented partitions shown in the figure. Two steps are required: 1) In the source code, use the section keyword to mark the classified common slow-changing data, common fast-changing data, and single-machine private data separately, and then compile them into specific locations of specific segments of the ELF executable file; if the data variable has an initial value when it is defined, it is in the data segment (that is, Figure 2 .data), otherwise in the bss segment (i.e. Figure 2 .bss). For example, in the C language source code, the three types of data in the data segment are marked and compiled into specific locations of the .data of the ELF executable file; the three types of data in the bss segment are marked and compiled into specific locations of the .bss of the ELF executable file. 2) In the link script, the specified locations of the three types of data in the data segment and the bss segment are specified respectively. For example, in the link script, the positions of the three types of data in the data segment are specified in the order of shared slow-changing data, shared fast-changing data, and single-machine private data; the positions of the three types of data in the bss segment are specified in the order of shared slow-changing data, shared fast-changing data, and single-machine private data.

[0059] In the present invention, stand-alone private data, shared slow-changing data and shared fast-changing data are stored in different segments of the binary file by category during compilation, and are arranged in different continuous areas in the memory by category during loading and running to realize the centralized storage of segmented and partitioned classified data, thereby facilitating the direct acquisition of corresponding data from the link script of the target segment during subsequent recovery, improving the fault recovery speed, and further improving the fault tolerance of the system.

[0060] Then, for step 102, the method for determining the out-of-step stand-alone includes: real-time processing of data in each task cycle, and the real-time processing flow includes five links in sequence: data collection, input exchange, algorithm calculation, output comparison and result output. The main processing process is: by exchanging the different IO data collected by each stand-alone in pairs, the four stands can obtain all the collected data that are completely consistent; the four stands perform algorithm calculation based on the completely consistent data after the exchange, and then compare the algorithm calculation results to check the data's tolerance-free consistency; finally, each stand-alone outputs the calculation results through the bus it is responsible for IO output. If the output results are inconsistent, it is considered that the stand-alone whose output results are inconsistent with other stands is faulty, and the fault-tolerant system removes it, and other stands take over the IO work of the faulty stand-alone; after the faulty stand-alone is removed, it will no longer work synchronously with other normal stands, and will be in a state of out-of-step, and the faulty stand-alone is the out-of-step stand-alone.

[0061] Specifically, for example, in a four-machine hot backup computer including four single machines A, B, C, and D, a Byzantine fault-tolerant structure is adopted to exchange data in pairs, such as A and B exchange each other, A and C exchange each other, A and D exchange each other, B and C exchange each other, B and D exchange each other, and C and D exchange each other.

[0062] In step 104, the first recovery of the out-of-step standalone machine is performed according to the shared slowly varying data, including:

[0063] In each task cycle, the following are performed: determining the running time of the normal task in the task cycle; and taking the difference between the total duration of the task cycle and the running time as the recovery duration;

[0064] The shared slow-changing data is copied to the out-of-step single machine within the recovery time until all the shared slow-changing data is copied and the first recovery is completed.

[0065] In the present invention, the first recovery is performed under the normal operation state of the task, that is, at this time, the four-machine hot backup computer does not affect the normal operation of the system, so it is necessary to use a multi-task cycle to copy the shared slow-changing data. Since the shared slow-changing data will not change in each task cycle, the first recovery can achieve full recovery of the entire shared slow-changing data before the failure without affecting the normal operation of the task, thereby improving the recovery speed.

[0066] In step 104, the total slow-changing data that has changed in the task cycle during the first recovery is determined, including:

[0067] Dividing the common slowly varying data into a plurality of data blocks according to a preset data block size;

[0068] For each data block, the following steps are performed: determining whether the data block has changed in the task cycle during the first recovery; if the determination result is yes, determining the data block as a changed data block;

[0069] Perform a union operation on the changed data blocks to obtain the changed common slow-changing data.

[0070] In the present invention, since the first recovery is performed under the normal operation state of the task and does not affect the normal operation of the task, the newly generated common slow-changing data and common fast-changing data can still be collected during the first recovery process. In order to achieve data alignment of the out-of-step stand-alone machine, it is necessary to consider the synchronous recovery of the new data generated by the first recovery. In this way, the present invention can mark the data blocks with data changes according to the data block sequence number by dividing the common slow-changing data into a number of data blocks of the same size, thereby obtaining the changed common slow-changing data, fully considering all data in the fault recovery stage, and facilitating the subsequent realization of complete recovery and alignment of the common slow-changing data of the out-of-step stand-alone machine up to the first recovery.

[0071] Specifically, in the first recovery process, the common slow-changing data of the two target segments, the data segment and the bss segment, are copied. The specific steps include:

[0072] Step 1041, determining the recovery time available for data replication in each task cycle, the time required for normal task operation is considered according to the maximum time, and the recovery time available for data replication = the total time of the task cycle - the normal task operation time;

[0073] Step 1042, data replication is performed within the recovery time range of each task cycle; wherein the amount of data replicated in each task cycle may adopt a fixed length or variable length strategy;

[0074] Step 1043, and for the copied data area, divide it into data blocks according to the preset data block size, monitor whether the data content changes by block, and record the serial number of the changed data block; wherein, the length of the amount of data copied in each task cycle is required to be an integer multiple of the data block size; monitoring whether the content of the data block changes can be achieved by calculating the checksum of the data block in the software and / or by a hardware mechanism to monitor whether there is a bus write operation in the specified window memory area.

[0075] With respect to step 106, the out-of-step standalone machine is restored for the second time according to the shared slow-changing data and the shared fast-changing data, to obtain restored data, including:

[0076] Determine the minimum number of window cycles required for the second recovery based on the amount of the common slow-changing data, the amount of the common fast-changing data acquired up to the current task cycle, the data transmission rate and the total duration of the task cycle; wherein the minimum number of window cycles is not greater than the maximum acceptable number of suspended task cycles of the four-machine hot standby computer;

[0077] Within the minimum window period number, the common slow-changing data and the common fast-changing data are copied to the out-of-step single machine to complete the second recovery and obtain the recovered data.

[0078] In the present invention, since the second recovery is performed in the state of pausing the task running, all tasks will be suspended, and all the time of the entire task cycle will be used for data replication as much as possible, so as to minimize the time of suspending the task running and reduce the impact of fault recovery; at the same time, since all tasks are suspended, other normal single machines will not generate new shared slow-changing data, shared fast-changing data and single machine data at this time, so the out-of-step state can be fully aligned through data recovery. In this way, during the second recovery, by copying the changed shared slow-changing data and the shared fast-changing data obtained up to the current task cycle to the out-of-step single machine, and adding the shared slow-changing data copied during the first recovery, complete recovery data can be obtained, which is completely different from the existing method of only recovering important data. This solution achieves complete alignment of the data of the out-of-step single machine and other normal single machines, and realizes autonomous recovery.

[0079] In a preferred embodiment, the minimum window period number is determined by the following formula:

[0080]

[0081] Among them, T n Used to characterize the minimum window period number; Q s 'Used to characterize the amount of slow-changing data in bytes; Q f It is used to represent the amount of shared fast-changing data in bytes; DTR is used to represent the data transmission rate in bytes / milliseconds; T is used to represent the total duration of the task cycle in milliseconds; ceil is used to represent the upward rounding function; and T n ≤T x ; T x The maximum acceptable number of idle task cycles used to characterize a quad hot standby computer.

[0082] It should be noted that Q s '=n×s, n is the number of divided data blocks, s is the preset data block size, in bytes.

[0083] In the present invention, since the second resumption of the suspended task may affect the system performance, the number of task cycles required for the copy process should be controlled within a minimum window T n to avoid suspension affecting system performance.

[0084] In the present invention, the above formula is used to determine the influence of T n The various factors of the system are comprehensively considered to improve the accuracy of the minimum window period. In order to improve the accuracy of data classification, it is necessary to focus on the operation scenario during fault recovery and analyze the data of the algorithm of the long-term on-orbit operation mode; s' is the sum of the data volume of the data blocks where the shared slow-changing data is located, which has changed content during the first recovery of the data replication process. It is a change quantity, which depends on the accuracy of the shared slow-changing data classification, the continuity of the partition storage, and the number of cycles of the data replication process in the first recovery. The data with deterministic changes or no changes in the shared slow-changing data should be stored together continuously and placed at the front or back of the partition. At the same time, if all data blocks have changed, then theoretically Q s The maximum value of ' is the size of the entire shared slow-changing data area, so when designing, it is necessary to consider that there is enough margin, for example: design Q s The maximum value of ' is 50% of the total slow-changing data area size. The higher the ratio, the higher the success rate of recovery from the out-of-step stand-alone state, but it will cause T n Increased, so users can make specific designs based on specific application scenarios and actual conditions.

[0085] In a preferred embodiment, after obtaining the restored data in step 106, the method further includes:

[0086] The out-of-step single machine is introduced as a normal single machine, and in the next task cycle after the recovery data is obtained, the current four-machine hot backup computer that has obtained the recovery data is processed in real time to obtain the verification output results of each single machine;

[0087] Determine whether the verification output results of each stand-alone machine are consistent;

[0088] If the judgment result is yes, complete the fault recovery of the out-of-step single machine;

[0089] If the judgment result is no, then in the next task cycle after the current task cycle ends, the process returns to execute the first recovery of the out-of-step single machine according to the shared slow-changing data.

[0090] In the present invention, after all the recovery data is obtained, the suspended tasks are restored, and the four-machine hot backup computer is notified to introduce the out-of-step single machine that is in the out-of-step state after the removal, and the current task cycle is ended. The calculation results of the newly introduced single machine are compared for consistency in the next task cycle. If the calculation results of the newly introduced single machine in one or more consecutive task cycles are consistent with the calculation results of other normally working single machines, it is considered that the recovery is successful, otherwise it is considered that the recovery fails, and the out-of-step single machine is removed again, and the process returns to step 104, and steps 104 to 106 are repeated.

[0091] like Figure 3 , Figure 4 As shown, the embodiment of the present invention provides a fault recovery device for a single out-of-step computer in a four-machine hot backup computer. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 3As shown in the figure, it is a hardware architecture diagram of a computing device where a failure recovery device for a single out-of-step computer in a four-machine hot backup computer provided by an embodiment of the present invention is located. Figure 3 In addition to the processor, memory, network interface, and non-volatile memory shown in the figure, the computing device in which the device is located in the embodiment may also generally include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 4 As shown, as a device in a logical sense, the CPU of the computing device in which it is located reads the corresponding computer program in the non-volatile memory into the memory and runs it. This embodiment provides a fault recovery device for a single machine out of step in a four-machine hot backup computer, including:

[0092] A classification module 400 is used to classify the memory data in the four-machine hot backup computer in each task cycle to obtain classified data including common slow-changing data and common fast-changing data;

[0093] A fault determination module 402, configured to determine a single machine that has lost synchronization when the output results of the four hot standby computers are inconsistent;

[0094] The recovery module 404 is used to perform a first recovery of the out-of-step single machine according to the shared slow-changing data, and determine the changed shared slow-changing data in the task cycle during the first recovery; and perform a second recovery of the out-of-step single machine according to the changed shared slow-changing data and the shared fast-changing data to obtain recovery data; wherein the second recovery is performed in a suspended task running state.

[0095] In some specific implementations, the classification module 400 may be used to execute the above step 100 , the fault determination module 402 may be used to execute the above step 102 , and the recovery module 404 may be used to execute the above steps 104 and 106 .

[0096] In some specific implementations, the classification module 400 is further configured to perform the following operations:

[0097] Compile the shared slow-changing data, shared fast-changing data, and single-machine private data into the specified positions of the target segment of the executable file respectively; wherein the target segment includes the data segment and the bss segment, and different classification data have different specified positions in the target segment;

[0098] Generate a link script for the corresponding classification data based on the specified location.

[0099] In some specific implementations, the recovery module 404 is further configured to perform the following operations:

[0100] In each task cycle, the following are performed: determining the running time of the normal task in the task cycle; and taking the difference between the total duration of the task cycle and the running time as the recovery duration;

[0101] The shared slow-changing data is copied to the out-of-step single machine within the recovery time until all the shared slow-changing data is copied and the first recovery is completed;

[0102] Dividing the common slowly varying data into a plurality of data blocks according to a preset data block size;

[0103] For each data block, the following steps are performed: determining whether the data block has changed in the task cycle during the first recovery; if the determination result is yes, determining the data block as a changed data block;

[0104] Perform a union operation on the changed data blocks to obtain the changed common slow-changing data.

[0105] In some specific implementations, the recovery module 404 is further configured to perform the following operations:

[0106] The minimum number of window cycles required for the second recovery is determined based on the amount of the common slow-changing data, the amount of the common fast-changing data obtained up to the current task cycle, the data transmission rate, and the total duration of the task cycle; wherein the minimum number of window cycles is not greater than the maximum acceptable number of suspended task cycles of the four-machine hot standby computer; the minimum number of window cycles is determined by the following formula:

[0107]

[0108] Among them, T n Used to characterize the minimum window period number; Q s 'The amount of data used to characterize the change of the common slow-changing data; Q f It is used to characterize the amount of shared fast-changing data; DTR is used to characterize the data transmission rate; T is used to characterize the total duration of the task cycle; ceil is used to characterize the upward rounding function;

[0109] Within the minimum window period number, the common slow-changing data and the common fast-changing data are copied to the out-of-step single machine to complete the second recovery and obtain the recovered data.

[0110] In some more specific embodiments, the device further includes: a verification module, the verification module is further configured to perform the following operations:

[0111] In the next task cycle after obtaining the recovery data, the four hot standby computers that obtained the recovery data are processed in real time to obtain the verification output results of each single computer;

[0112] Determine whether the verification output results of the individual machines are consistent;

[0113] If the judgment result is yes, complete the fault recovery of the out-of-step single machine;

[0114] If the judgment result is no, then in the next task cycle after the current task cycle ends, the process returns to execute the first recovery of the out-of-step stand-alone machine according to the shared slowly varying data.

[0115] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on a fault recovery device for a single out-of-step computer in a four-machine hot standby computer. In other embodiments of the present invention, a fault recovery device for a single out-of-step computer in a four-machine hot standby computer may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0116] The information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For the specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0117] An embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a fault recovery method for a lost single machine in a four-machine hot backup computer in any embodiment of the present invention is implemented.

[0118] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes a fault recovery method for a lost single machine in a four-machine hot backup computer in any embodiment of the present invention.

[0119] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes a fault recovery method for a lost single machine in a four-machine hot backup computer as described in any of the above embodiments.

[0120] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0121] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0122] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0123] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0124] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0125] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0126] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0127] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for recovering a single out-of-step computer in a four-computer hot backup computer, characterized in that: Applied to a four-machine hot standby computer with Byzantine fault-tolerant structure, including: In each task cycle, the memory data in the four hot standby computers are classified to obtain classified data including common slow-changing data and common fast-changing data; When the output results of the individual computers of the four-computer hot standby computers are inconsistent, determining the out-of-step individual computer; Performing a first recovery on the out-of-step stand-alone machine according to the shared slow-changing data, and determining the shared slow-changing data that has changed in the task cycle during the first recovery; The out-of-step single machine is restored for a second time according to the shared slow-changing data and the shared fast-changing data to obtain restored data; wherein the second restoration is performed in a suspended task running state.

2. The method according to claim 1, characterized in that The classified data also includes single-machine private data; After obtaining the classified data including the common slow-changing data and the common fast-changing data and before determining the out-of-step single machine, the method further includes: Compile the shared slow-changing data, the shared fast-changing data, and the stand-alone private data to the specified positions of the target segment of the executable file respectively; wherein the target segment includes a data segment and a bss segment, and different classification data are at different specified positions of the target segment; According to the designated position, a link script corresponding to the classification data is generated.

3. The method according to claim 1, characterized in that The first recovery of the out-of-step standalone machine according to the shared slowly varying data includes: In each task cycle, the following are performed: determining the running time of the normal task running in the task cycle; and taking the difference between the total time of the task cycle and the running time as the recovery time; The shared slowly varying data is copied to the out-of-step single machine within the recovery time, until all the shared slowly varying data are copied, thereby completing the first recovery.

4. The method according to claim 1, characterized in that: The determination of the changes in the task cycle during the first recovery includes the following slow-changing data: Dividing the shared slowly varying data into a plurality of data blocks according to a preset data block size; For each of the data blocks, the following steps are performed: determining whether the data block has changed during the task cycle in which the data block is restored for the first time; if the determination result is yes, determining the data block as a changed data block; A union operation is performed on the change data blocks to obtain the change common slow-changing data.

5. The method according to claim 1, characterized in that The second recovery of the out-of-step stand-alone machine according to the changed shared slow-changing data and the shared fast-changing data to obtain the recovered data includes: Determine the minimum number of window cycles required for the second recovery according to the amount of the common slow-changing data, the amount of the common fast-changing data acquired up to the current task cycle, the data transmission rate and the total duration of the task cycle; wherein the minimum number of window cycles is not greater than the maximum acceptable number of suspended task cycles of the four-machine hot standby computer; Within the minimum window period number, the shared slow-changing data and the shared fast-changing data are copied to the out-of-step single machine, the second recovery is completed, and the recovered data is obtained.

6. The method according to claim 5, characterized in that The minimum window period number is determined by the following formula: Among them, T n Used to characterize the minimum window period number; Q s 'The amount of data used to characterize the total slow-changing data of the change; Q f It is used to characterize the amount of the shared fast-changing data; DTR is used to characterize the data transmission rate; T is used to characterize the total duration of the task cycle; and ceil is used to characterize the upward rounding function.

7. The method according to any one of claims 1 to 6, characterized in that: After obtaining the restored data, the method further includes: In the next task cycle after obtaining the recovery data, the four hot standby computers that obtained the recovery data are processed in real time to obtain the verification output results of each single computer; Determine whether the verification output results of the individual machines are consistent; If the judgment result is yes, complete the fault recovery of the out-of-step single machine; If the judgment result is no, then in the next task cycle after the current task cycle ends, the process returns to execute the first recovery of the out-of-step stand-alone machine according to the shared slowly varying data.

8. A fault recovery device for a single out-of-step computer in a four-machine hot backup computer, characterized in that: include: A classification module, used for classifying the memory data in the four-machine hot backup computer in each task cycle to obtain classified data including common slow-changing data and common fast-changing data; A fault determination module, used for determining the out-of-step single machine when the output results of the four hot backup computers are inconsistent; A recovery module is used to perform a first recovery of the out-of-step single machine according to the shared slow-changing data, and determine the changed shared slow-changing data in the task cycle during the first recovery; and to perform a second recovery of the out-of-step single machine according to the changed shared slow-changing data and the shared fast-changing data to obtain recovery data; wherein the second recovery is performed in a suspended task running state.

9. A computing device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 7.

Images