Method and system for determining main and standby controllers of distributed processing system

Abstract

The invention discloses a method and a system for determining a main controller and a standby controller of a distributed system. The method comprises the following steps of: after the system is powered on, carrying out initialization self-inspection on hardware resources of the main controller and the standby controller in the system; if the self-checking time of the main controller is larger than the self-checking time of the standby controller and exceeds a set threshold value, the standby controller serves as a new main controller to be used for system control, and otherwise, the main controller is still used for system control. When faults occur in the operation process, main and standby switching logic is achieved, the utilization rate of system resources and the robustness of the system are improved, judgment logic is set in the system operation process, main and standby switching is completed according to different fault conditions, and normal operation of the system can be effectively and rapidly guaranteed.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of embedded computer distributed system design, and particularly relates to a distributed processing system master-slave controller determination method and system. BACKGROUND

[0002] With the gradual development of embedded computing systems, the system complexity is gradually increased, and the safety and reliability requirements of the system are gradually improved. The system performance mainly depends on the controller responsible for system resource management and task management, so the controller must have a reliable fault-tolerant mechanism to improve the reliability of the entire system.

[0003] The fault-tolerant mechanism in this field has the following imperfections: a) In the initialization stage, the controller sets the controller in the fixed slot as the master controller, thereby completing the role determination of the system master-slave controller. If the master controller completes the self-check later than other controllers due to its own or external reasons, the entire system is waiting for the master controller, resulting in a long system startup time.

[0004] b) In the initialization stage, the controller uses a relatively complex master-slave controller confirmation form, which increases the complexity of the system and the system startup time.

[0005] c) The controller switches the master-slave during the running process, and is only controlled by its own communication and system fault signals, ignoring the influence of peripheral devices on the controller. As the manager of the system, the controller is also responsible for monitoring other peripheral devices of the system, such as data processing devices and large-capacity storage devices in the system. If the peripheral device fails, the fault is sent to the controller in the form of an interrupt. When the fault is a jump fault, the controller will be frequently disturbed in the form of an interrupt, and the controller will affect the execution of other tasks due to frequent response to the interrupt, causing the controller to switch the master-slave or even the system to fail. The failure of the master controller caused by the peripheral device failure causes serious waste of resources. SUMMARY

[0006] The present application provides a distributed processing system master-slave controller determination method and system to overcome the problems that the fixed bit is used as the master controller in the prior art, resulting in a long system startup time, and the master-slave controller confirmation is complicated, resulting in increased complexity of the system and the system startup time. The present application optimizes the master-slave determination logic during the initialization of the controller, the master-slave switching logic during the failure in the running process, improves the utilization rate of system resources and the robustness of the system.

[0007] A distributed system master-slave controller determination method, comprising the following steps: After the system is powered on, the hardware resources of the master controller and the standby controller in the system are initialized and self-checked; If the self-checking time of the main controller is greater than the self-checking time of the standby controller by more than a set threshold, the standby controller is used as a new main controller for system control, otherwise the main controller is still used for system control.

[0008] Preferably, the main-standby identities of the two controllers are adjusted according to the slot positions and self-checking results of the two controllers.

[0009] Preferably, the system sets the set threshold for the difference between the self-checking time of the main controller and the self-checking time of the standby controller to 10 seconds.

[0010] Preferably, after the system is powered on, if the self-checking result of the main controller is a fault, the standby controller is used as a new main controller to control the system after the self-checking of the standby controller ends and no fault is found.

[0011] Preferably, after the system is powered on, if the self-checking results of the main controller and the standby controller are both faults, the system is shut down for maintenance.

[0012] Preferably, after the system is powered on, if the self-checking result of the standby controller is a fault, the main controller is used as a new main controller to control the system after the self-checking of the main controller ends and no fault is found.

[0013] Preferably, during normal operation of the system controller, if an abnormal signal is received by the currently running main controller, switching between the main controller and the standby controller is performed, and the abnormal signal specifically includes: a main controller self-system fault identifier, a main controller self-FC communication fault identifier, and a main controller received abnormal interrupt signal identifier.

[0014] A distributed system main-standby controller determination system includes a system self-checking module and a confirmation module: The system self-checking module is configured to initialize and self-check hardware resources of a main controller and a standby controller in the system after the system is powered on, and obtain self-checking results, and send the self-checking results to the confirmation module. The confirmation module is configured to determine, according to the self-checking results, whether the self-checking time of the main controller is greater than the self-checking time of the standby controller by more than a set threshold, and if so, use the standby controller as a new main controller for system control, otherwise still use the main controller for system control.

[0015] Preferably, after the system is powered on, if the self-checking result of the main controller is a fault, the standby controller is used as a new main controller to control the system after the self-checking of the standby controller ends and no fault is found; if the self-checking results of the main controller and the standby controller are both faults, the system is shut down for maintenance; and if the self-checking result of the standby controller is a fault, the main controller is used as a new main controller to control the system after the self-checking of the main controller ends and no fault is found.

[0016] Preferably, the system controller switches between the main controller and the standby controller if the main controller currently running receives an abnormal signal during normal operation, and the abnormal signal specifically includes: An identification of a system fault of the main controller itself; an identification of FC communication fault of the main controller itself; and an identification of an abnormal interrupt signal received by the main controller.

[0017] Compared with the prior art, the application has the following beneficial technical effects: The application provides a distributed system main / standby controller determination method, which performs self-checking on hardware resources of a main controller and a standby controller in the system after the system is powered on; if the self-checking time of the main controller is greater than the self-checking time of the standby controller by more than a set threshold, the standby controller is used as a new main controller for system control, otherwise the main controller is still used for system control. The application optimizes the main / standby determination logic during controller initialization and the main / standby switching logic during operation, thereby improving the utilization rate of system resources and the robustness of the system.

[0018] Preferably, the application sets a judgment logic during system operation, and completes main / standby switching according to different fault conditions, thereby effectively and quickly ensuring normal operation of the system. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 FIG. 1 is a flowchart of a distributed system main / standby controller determination method according to an embodiment of the application.

[0020] Figure 2 FIG. 2 is a schematic diagram of a distributed system main / standby controller determination system according to an embodiment of the application. DETAILED DESCRIPTION

[0021] Hereinafter, only certain exemplary embodiments are simply described. As those skilled in the art can recognize, the described embodiments can be modified in various different ways without departing from the spirit or scope of the application. Therefore, the drawings and the description are considered to be exemplary in nature rather than limiting.

[0022] It should be understood that the terms used in the specification of the application are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in the specification and the appended claims of the application, the singular forms "a", "an" and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0023] It should be further understood that the term "and / or" used in the specification and the appended claims of the application means any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0024] As Figure 1 shown, the application provides a method for determining the master controller and the standby controller of a distributed processing system, the master controller and the standby controller work in a 1+1 hot backup mode, after the system is powered on, the two controllers complete self-initialization, and the system management software reads the slot numbers of the controllers. After the controllers complete initialization, the determination of the master controller and the standby controller is completed by setting the judgment logic; during the system operation, the judgment logic is set, and the master and standby switching is completed according to different fault conditions to ensure the normal operation of the system, which specifically includes the following steps: S1, after the system is powered on, the hardware resources of the master controller and the standby controller in the system are initialized and self-checked; S2, if the self-checking time of the master controller is greater than the self-checking time of the standby controller by more than a set threshold, the standby controller is used as the new master controller for system control, otherwise the master controller is still used for system control.

[0025] In the specific embodiments of the application, the distributed system uses two system-level controllers for control, the two master controllers are identified in advance, and the two system-level controllers work in a 1+1 hot backup mode; after the system is powered on, the two controllers perform self-checking and store the self-checking results. When the system starts, the two controllers first initialize the hardware, and the default state of both is the backup controller role, then the controllers perform self-checking and store the self-checking results.

[0026] The system is controlled by one controller in the later stage, so the two controllers are marked as master controllers or standby controllers, and the CONFLAG signal is used as the identifier of the master and standby controllers, where "1" in the CONFLAG signal represents the standby controller, and "0" represents the master controller.

[0027] After the system is powered on, the hardware resources of the master controller and the standby controller in the system are initialized and self-checked, after the self-checking is completed, the two controllers exchange the CONFLAG signal, and the system management software in the controller is used to read the slot identification numbers of the two controllers, the installation slots of the two controllers are numbered in the application, for example, slot 1 is the first controller and slot 2 is the second controller.

[0028] In the initial stage, if the CONFLAG of the first controller in slot 1 and the second controller in slot 2 are both "0", the first controller is defaulted as the master controller, and the second controller sets its CONFLAG to "1" to become the standby controller after receiving the CONFLAG signal of the first controller.

[0029] If the CONFLAG signal of the first controller is 0, the CONFLAG signal of the second controller is 1 or the first controller does not receive the CONFLAG signal of the second controller within a specified time, the first controller becomes the master controller.

[0030] If the CONFLAG signal of the second controller is 0, the first controller does not determine its own state within a specified time after receiving the CONFLAG signal of the second controller, the second controller becomes the master controller.

[0031] If the CONFLAG signal of the first controller is 1 and the CONFLAG signal of the second controller is 0, the second controller becomes the master controller.

[0032] According to the slot positions of the two controllers and the self-checking results, the master and standby identities of the two controllers are adjusted.

[0033] The system sets the set threshold of the difference between the self-checking time of the master controller and the self-checking time of the standby controller to 10 seconds.

[0034] If the self-checking result of the master controller is failure after the system is powered on, the standby controller is used as the new master controller to control the system after waiting for the self-checking of the standby controller to end and no failure.

[0035] If the self-checking results of the master controller and the standby controller are both failure after the system is powered on, the system is shut down for maintenance.

[0036] If the self-checking result of the standby controller is failure after the system is powered on, the master controller is used as the new master controller to control the system after waiting for the self-checking of the master controller to end and no failure.

[0037] If the currently running master controller receives an abnormal signal during the normal operation of the system controller, the switching between the master controller and the standby controller is performed, and the abnormal signal specifically includes: a system failure identifier (SYSFAIL) of the master controller (1 for failure state and 0 for normal state); an FC communication failure identifier (FCFAIL) of the master controller (1 for failure state and 0 for normal state); an abnormal interrupt signal identifier (INTFAIL) received by the master controller (1 for failure state and 0 for normal state.

[0038] In another embodiment of the application, as shown in Figure 2 a distributed system master and standby controller determination system is provided, which includes a system self-checking module and a confirmation module: The system self-checking module is used for initializing and self-checking the hardware resources of the master controller and the standby controller in the system after the system is powered on, obtaining the self-checking results, and sending the self-checking results to the confirmation module. The confirmation module determines whether the standby controller is used as a new master controller for system control if the self-checking time of the master controller is greater than the self-checking time of the standby controller by more than a set threshold value, or whether the master controller is still used for system control.

[0039] If the self-checking result of the master controller is a fault after the system is powered on, the standby controller is used as a new master controller to control the system after the self-checking of the standby controller is completed and no fault is found. If the self-checking results of the master controller and the standby controller are both faults after the system is powered on, the system is shut down for maintenance. If the self-checking result of the standby controller is a fault after the system is powered on, the master controller is used as a new master controller to control the system after the self-checking of the master controller is completed and no fault is found.

[0040] During normal operation of the system controller, if the currently running master controller receives an abnormal signal, switching between the master controller and the standby controller is performed. The abnormal signal specifically includes: A master controller system fault identifier; a master controller FC communication fault identifier; and an abnormal interrupt signal received by the master controller.

[0041] Embodiment 1 In the specific embodiments of the present application, the first controller is taken as an example for analysis, and the master controller and the standby controller are both normally operated during normal operation of the system.

[0042] When the FCFAIL signals of the two controllers are "1", it means that the network communication of the two controllers has failed, and at this time the system enters an emergency working state, and only the controller works.

[0043] When the SYSFAIL signals of the two controllers are "1", it means that the two controllers have system faults, and at this time the system enters a failure state.

[0044] When the SYSFAIL signal, the FCFAIL signal, or the INTFAIL signal of the first controller is "1", the master-standby switching between the controllers occurs, the second controller switches to a master controller, and the CONFLAG signal of the second controller is set to "0".

[0045] Compared with the SYSFAIL signal and the FCFAIL signal, the INTFAIL signal is relatively special. The present application takes the INTFAIL signal as an example for illustration: As a system controller, it is responsible for controlling the operation of the whole system and monitoring the running state of the whole system. When other devices being monitored, such as data processing device and mass storage device, run abnormally, it will inform the main controller in the form of interruption and input to the INTFAIL of the controller. If a node of the data processing device being monitored frequently jumps between abnormal and normal due to device failure, the controller will respond to the interruption frequently and drag the processor to death, thereby affecting the control function of the controller itself. Therefore, the INTFAIL signal is not only to receive the interruption of the peripheral device, but also to set the judgment logic in the controller.

[0046] Specifically, when the peripheral device transmits an interruption signal, the counter in the controller calculates the number of interruptions before the processor responds to the interruption, so as to judge whether the interruption is an abnormal interruption. At the same time, in order not to affect the normal operation of the system, the INTFAIL signal is set to "1". After the main controller processes the abnormal interruption, the INTFAIL signal is set to "0", indicating that it has the ability to work normally.

[0047] In the specific embodiment of the present application, the main controller and the standby controller set the same time for their CONFLAG.

[0048] As shown in Figure 2 The present application takes the first controller as the main controller for illustration. When the system failure signal SYSFAIL is "0", the network communication failure signal FCFAIL is "0", and the interruption abnormal signal INTFAIL is "0", any one of the three conditions occurs, the system occurs master-slave switching, the second controller switches to the main controller, and the first controller becomes the standby controller. According to whether the first controller which is reduced to the backup controller after the master-slave switching has the possibility to become the main controller again, the switching process is divided into two cases: CASE1: As long as the system failure signal SYSFAIL of the first controller is "0" or the network communication failure signal FCFAIL is "0", it indicates that there is a failure in the controller and it is no longer suitable to become the main controller, so after the first controller becomes the standby controller, if the second controller as the main controller fails, the first controller cannot switch to the main controller again. At this time, the whole system will enter the failure mode.

[0049] CASE2: When only the INTFAIL signal is "0", it means that the peripheral device sends frequent jump exceptions to the main controller, causing the main controller to frequently respond to the interrupt and unable to send control signals externally, thereby affecting system task execution. At this time, the first controller switches to the backup controller, and the second controller becomes the main controller to take over the system. When the first controller finishes processing the peripheral device exception, it sets INTFAIL to "1" and notifies the second controller as the main controller. If the second controller as the main controller fails, the first controller can switch to the main controller again.

[0050] In addition, there are extreme cases: a) When the SYSFAIL of the two controllers is "1", it means that both controllers have system failures, for example: watchdog failure, software actively setting failure, and the system is in a failure state.

[0051] b) When the FCFAIL of the two controllers is "1", it means that the controller loses the ability to communicate with other peripheral devices FC in the system, and the system enters an emergency mode, only the controller continues to work.

[0052] The present application has fault tolerance capability by setting two controllers, improves system reliability. It has a relatively flexible master-slave controller determination method. It contains the factors that affect the master-slave switching of the controller inside and outside the controller, enhances the robustness of the system. Optimize the use of resources.

[0053] Embodiment 2 The system master-slave controller determination implementation is as follows: a. The distributed system is provided with two system controllers, and the two system controllers run in a 1+1 hot backup mode; b. After the system is powered on, the two system controllers perform hardware initialization, self-checking and store the self-checking results, and the initial state is both backup controller roles, CONFLAG1 is "1", and CONFLAG2 is "1".

[0054] c. The system management reads the controller slot identification number, the controller located in slot 1 is the first controller, and the controller located in slot 2 is the second controller.

[0055] d. Under normal circumstances, the first controller and the second controller set their CONFLAG time to be roughly the same, at this time, the first controller defaults to the main controller. But if the first controller has not completed the setting of its own CONFLAG1 identification within T time after receiving the CONFLAG2 identification sent by the second controller, in order to make the system run in time, the second controller becomes the main controller.

[0056] The system master-slave controller switching method implementation is as follows: a. Take the first controller as the primary controller as an example, when the system failure SYSFAIL or network communication failure FAFAIL occurs during the system running, the CASE1 event occurs, the second controller switches to the primary controller, the first controller becomes the backup controller and does not have the condition of the primary and backup switching again.

[0057] b. The first controller is the primary controller, when the peripheral device abnormal failure INTFAIL occurs during the system running, the CASE2 event occurs, the second controller switches to the primary controller, the first controller becomes the backup controller but has the condition of the primary and backup switching again.

[0058] c. When the system failure SYSFAIL, the network communication failure FAFAIL and the peripheral device abnormal failure INTFAIL do not occur, the primary and backup switching does not occur.

[0059] d. When the SYSFAIL of the first controller and the second controller are both "1", the two controllers both have the system failure, such as the watchdog failure, the software active setting failure, the loss of the ability as the controller, and the whole system is in the invalid state.

[0060] e. When the FCFAIL of the first controller and the second controller are both "1", the two controllers both have the FC network communication failure, lose the ability of the FC communication with other peripheral devices in the system, and the system enters the emergency mode, only the controller continues to work.

[0061] The above shows and describes the basic principle, the main features and the advantages of the present application. The skilled in the art should understand that the present application is not limited by the above examples, the above examples and the description in the specification are only the preferred examples of the present application, and are not used to limit the present application, various changes and improvements of the present application fall within the scope of the present application without departing from the spirit and the scope of the present application. The scope of protection of the present application is defined by the appended claims and their equivalents.

Claims

1. A method for determining a primary and backup controller in a distributed system, characterized in that, Includes the following steps: After the system is powered on, it performs an initialization self-test on the hardware resources of both the main controller and the backup controller within the system. If the self-test time of the main controller exceeds the self-test time of the backup controller by more than a set threshold, the backup controller will be used as the new main controller for system control; otherwise, the main controller will still be used for system control.

2. The method for determining a primary and backup controller in a distributed system according to claim 1, characterized in that, Adjust the primary / standby status of the two controllers based on their slots and self-test results.

3. The method for determining a primary and backup controller in a distributed system according to claim 1, characterized in that, The system is set to set a threshold of 10 seconds for the difference between the self-test time of the main controller and the self-test time of the backup controller.

4. The method for determining a primary and backup controller in a distributed system according to claim 1, characterized in that, If the main controller fails to detect a fault after power-on, the system will wait for the backup controller to complete its self-test and find no fault. If so, the backup controller will be used as the new main controller to control the system.

5. The method for determining a primary and backup controller in a distributed system according to claim 1, characterized in that, If both the main controller and the backup controller show a fault after the system is powered on, the system will be shut down for maintenance.

6. The method for determining a primary and backup controller in a distributed system according to claim 1, characterized in that, If the backup controller fails to detect a fault after power-on, the system will wait for the main controller to complete its self-test and find no fault. If so, the main controller will then be used as the new main controller to control the system.

7. The method for determining a primary and backup controller in a distributed system according to claim 1, characterized in that, During normal operation, if the currently running primary controller receives an abnormal signal, the system controller will switch between the primary controller and the backup controller. The abnormal signal specifically includes: The main controller's own system fault identifier; the main controller's own FC communication fault identifier; and the identifier of the abnormal interrupt signal received by the main controller.

8. A distributed system master / slave controller determination system, characterized in that, Includes a system self-test module and a confirmation module: The system self-test module is used to initialize and self-test the hardware resources of the main controller and the backup controller in the system after the system is powered on, obtain the self-test results, and send the self-test results to the confirmation module. The confirmation module determines, based on the self-test results, whether the self-test time of the main controller exceeds the self-test time of the backup controller by a set threshold. If so, the backup controller is used as the new main controller for system control; otherwise, the main controller is still used for system control.

9. A distributed system master / slave controller determination system according to claim 8, characterized in that, If the main controller's self-test result is a fault after the system is powered on, the system will wait for the backup controller to finish its self-test and find no fault. If the backup controller does not finish its self-test, the system will be controlled by the backup controller. If both the main controller and the backup controller's self-test results are faulty after the system is powered on, the system will be shut down for maintenance. If the backup controller's self-test result is a fault after the system is powered on, the system will wait for the main controller to finish its self-test and find no fault. If the main controller does not finish its self-test, the system will be controlled by the main controller.

10. A distributed system master / slave controller determination system according to claim 8, characterized in that, During normal operation, if the currently running primary controller receives an abnormal signal, the system controller will switch between the primary controller and the backup controller. The abnormal signal specifically includes: The main controller's own system fault identifier; the main controller's own FC communication fault identifier; and the identifier of the abnormal interrupt signal received by the main controller.

Images