Failure recovery system and failure recovery method in loosely coupled multi-computer system, and medium for storing failure recovery program

In a loosely coupled multi-computer system, even when a failure happens to occur in any one of the loosely coupled computers, users can continue their works without having adverse influences caused by this failure. When a process operation for transaction used to update the shared data is commenced, a first computer registers such a message that it is using this shared data into an exclusive access device. After updating process information corresponding to the shared data before being updated has been outputted to the updated record holder, the first computer updates this shared data, and deletes the updating process information of the updated record holder when the transaction is ended. Either a second computer or a third computer, which is notified by the failure notifier that a failure has occurred in the first computer before the transaction is ended, registers such a message that the recovering computer uses this shared data into the exclusive access device. Then, the second or third computer returns the updating process information about "no recovery is required" to its original updating process information, among the updating process information stored in the updated record holder, thereby recovering this shared data. As a consequence, this updating process information is brought into such updating process information about "no recovery is required".

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
Referring now to drawings, various embodiments of the present invention 
will be described more in detail. 
Referring to FIG. 1, a failure recovery system employed in a loosely 
coupled multi-computer system, according to an embodiment of the present 
invention, comprises a computer 1, another computer 2, another computer 3, 
which constitute the loosely coupled multi-computer system; shared data 20 
commonly used by all the computers 1 to 3; and a multi-computer control 
means 10 including an exclusive means 11 for managing one computer for 
executing the updating process with respect to the shared data 20, and 
also a recovery information holding means 12 for holding recovery 
information required when a failure occurs in any of the computers 
constituting the loosely coupled multi-computer system, such that other 
computers operated under normal condition perform the recovery process. 
The failure recovery system further constitutes updated record holding 
means 31, 32, 33 for holding updating process information with respect to 
each of these computers, when the shared data 20 is updated by the 
execution processes by the respective computers; updated record managing 
means 41, 42, 43 for holding information about the updated record holding 
means 31, 32, and 33 hold with respect to each of the computers; and 
failure notifying means 50 for notifying all other computers of a failure 
in one computer. 
It should be noted that to identify the respective computers for 
constituting the loosely coupled multi-computer system, a computer 
identifier specific to each of the computers is held. For instance, the 
computer 1 holds "1" as the computer identifier thereof, the computer 2 
holds "2" as the computer identifier thereof, and the computer 3 holds "3" 
as the computer identifier thereof. 
The shared data 20 is arranged on a disk apparatus to which all of the 
computers have access. 
The updated record holding means 31, 32, 33 hold the information about the 
data before being updated with respect to each of the computers, and are 
arranged on the disk apparatuses to which all of these computers have 
access. This data to be updated is required to perform a roll back 
process. When a process in a certain logic unit (will be referred to as a 
"transaction" hereinafter) entered from a terminal and the like is 
interrupted for some reason, this roll back process may return the data 
which has been updated during the execution stage of this process to the 
data obtained before the updating operation was performed. 
It should also be noted that only when such a computer for performing the 
recovery process accesses the updated record holding means of the computer 
where the failure occurs, this recovery-process-executing computer 
accesses the updated record holding means of the other computers. The 
updated record managing means 41, 42, 43 hold the information such as 
names of the disk apparatuses for arranging the updated record holding 
means 31, 32, 33 and are arranged on the disk apparatuses connected to the 
respective computers. In normal operation, the disk apparatus equipped 
with the updated record managing means 41, 42, 43 can be accessed only by 
the computer to which it is attached, but cannot be accessed by other 
computers. 
Referring now to FIG. 2, the recovery information holding means 12 contains 
recovery information 121, 122 and 123 with regard to each of the 
computers. 
Referring now to FIG. 3, these recovery information 121, 122 and 123 
contain computer identifier information 12-1 used to set the computer 
identifiers of the respective computers; recovery processing state 
information 12-2 indicative of the recovery process state; and information 
about names of apparatus for arranging updated record managing means 12-3 
indicative of names of apparatus in which the updated record managing 
means 41, 42 and 43 are arranged. 
With reference to FIG. 4, the recovery processing state information 12-2 
contains recovery process identification information 12-2-1 for indicating 
whether or not the recovery process of each computer is carried out 
(namely, "1 (Yes)" or "0 (No)"), and recovery process computer 
identification information 12-2-2 corresponding to the computer identifier 
of the computer for executing the recovery process. 
Referring now to FIG. 1 to FIG. 7, a description will be made of operations 
of the failure recovery system according to the embodiment of the present 
invention. 
The computer 1 sets the recovery information 121 of the computer 1 into the 
recovery information holding means 12 before commencing the work process 
(step 61). 
As the recovery information 121, the computer identifier "1" of the 
computer 1 is set to the computer identifier information 12-1 in order to 
indicate that it is equal to the recovery information of the computer 1. 
Furthermore, the name of the apparatus for arranging thereon the updated 
record managing means 41 is set to the information about name of apparatus 
for arranging updated record managing means. 
When the work process is commenced and a request to update the shared data 
20 is issued, the computer 1 judges whether or not the information related 
to such a fact that other computers use this shared data 20 has been 
stored in the exclusive means 11 (step 62). When the computer 1 judges 
that other computers use the shared data 20, the computer 1 registers such 
a message that this computer 1 will use this shared data 20 into the 
exclusive means 11 (step 63). After the computer 1 outputs the shared data 
20 before being updated as the updating process information to the updated 
record holding means 31 (step 64), this shared data 20 is updated (step 
65). 
Upon completion of the process operation about a certain transaction, the 
computer 1 attaches an identifier of "no recovery is required " (not 
shown) to the updating process information held in the updated record 
holding means 31 (step 66), and also deletes from the exclusive means 11 
such information that the shared data 20 is used from the exclusive means 
11 (step 67). 
Similarly, the work processes are executed also in the computer 2 and the 
computer 3, which perform the work processes, while accessing to the 
shared data 20. 
When a failure occurs in the computer 1, the failure notifying means 50 
notifies the other computers of the failure in the computer 1. 
The computer 2 and the computer 3, which have received the notification 
about the failure occurrence, identify the recovery information 121 stored 
in the recovery information holding means 12 by using the computer 
identifier "1" contained in the notification about the failure occurrence. 
Furthermore, these computers 2 and 3 judge whether or not the recovery 
process identification information 12-2-1 within the recovery processing 
state information 12-2 of this recovery information 121 indicates that the 
recovery process of the computer 1 has been executed by other computers 
(step 71). 
When the computer 2 and the computer 3 judge that the recovery process of 
the computer 1 has not yet been carried out, these computers 2 and 3 
delete such information that the computer 1 uses the shared data 20, which 
is stored in the exclusive means 11 (step 72), and also register such 
information that computers 2 and 3 themselves will use the shared data 20 
(step 73). Furthermore, the computer 2 and the computer 3 set "1" for 
indicating "under recovery process" into the recovery process 
identification information 12-2-1 within the recovery processing state 
information 12-2 of the recovery information 121 (step 74), and also bring 
the computer 1 into execution state of recovery process by setting the 
computer identifier ("2" or "3") of the recovery executing computer into 
the recovery process computer identifier information 12-2-2 (step 75), so 
that the recovery process of the computer 1 is commenced by the recovery 
executing computer. 
On the other hand, either when the recovery information 121 of the computer 
1 where the failure occurs is not found in the recovery information 
holding means or when the recovery process identification information 
12-2-1 within the recovery processing state information 12-2 of the 
recovery information 121 indicates that the recovery process of the 
computer 1 has been already executed by other computers, such a judgement 
is made that the recovery process is no longer required, so that no 
recovery process is performed. 
Next, the computer 2 and the computer 3 acquire the name of the apparatus 
in which the updated record managing means 41 of the computer 1 where the 
failure occurs is arranged from the information about name of apparatus 
for arranging updated record managing means 12-3 of the recovery 
information 121, and then fetch the apparatus for arranging the updated 
record managing means 41 of this computer 1 into the recovery executing 
computer. 
Furthermore, the computer 2 and the computer 3 obtain the name of the 
apparatus for arranging the updated record holding means 31 with reference 
to the updated record managing means 41 fetched into the apparatus (step 
76). 
As previously described, the updating process information of the shared 
data 20 by the computer 1 has been stored in this updated record holding 
means 31. This updating process information also contains such information 
about "no recovery is required" when the process of the transaction is 
accomplished. 
The computer 2 and the computer 3 recover this shared data 20 based upon 
the information about "no recovery is required" among the updating process 
information stored in the updated record holding means 31, namely the 
updating process information for indicating such a fact that since the 
transaction is interrupted, the updating process for the shared data 20 is 
interrupted in a half way (step 77). 
When the above-described recovery process is complete, the computer 2 and 
the computer 3 set the updating process information stored in the updated 
record holding means 31 and utilized to recover the shared data 20 into 
"no recovery is required" (step 78), and then delete the information that 
the own computers use the shared data 20 from the exclusive means 11 (step 
79). Furthermore, the computer 2 and the computer 3 delete the recovery 
information 121 of the computer 1 from the recovery information holding 
means 12 (step 7A), and release the apparatus for holding the updated 
record managing means 41 fetched from the computer 1 from the own 
computers (step 7B). 
After the shared data 20 updated by the computer 1 where the failure has 
occurred is recovered by other computers in the above-described manner, 
this computer 1 can be reinitiated. 
In such a case that a failure occurs in the computer 1, and also another 
failure occurs in the computer 2 while the recovery process is carried out 
by this computer 2, the recovery process of the shared data 20 updated by 
the computer 2 is performed by the computer 3. 
As previously explained, the computer 3 recovers the shared data 20 updated 
by the computer 2, and also searches the recovery information with request 
to the respective computers, such information being present within the 
recovery information holding means 12. When the recovery process 
identification information 12-2-1 is equal to "1", and also such 
information is present, i.e., the recovery process computer identification 
information 12-2-2 is equal to "2" corresponding to the computer 
identifier of the computer 2 where the failure has occurred, this computer 
3 recognizes that the shared data 20 updated by the computer (namely, 
computer 1) corresponding to this recovery information (in this case, 
recovery information 121) should be recovered, and recovers the shared 
data 20 in a similar manner. 
Even when the failure occurs in such a computer which performs the recovery 
process, the shared data updated by this computer can be recovered. 
When any of these computers accomplishes the work process without an 
occurrence of a failure therein, this computer deletes such information 
for indicating that the own computer uses the shared data 20 from the 
exclusive means 11, and deletes the recovery information of the own 
computer from the recovery information holding means 12. For instance, 
when the computer 1 accomplishes the work process, the recovery 
information 121 of the computer 1 is deleted from the recovery information 
holding means 12. 
Subsequently, even when a failure occurs in the computer 1 and the 
occurrence of this failure is notified to the computer 2 and the computer 
3 by the failure notifying means 50, since no recovery information 121 of 
the computer 1 is present within the recovery information holding means 
12, neither the computer 2 nor the computer 3 performs the recovery 
process of the computer 1. 
With the above-described manner, the process operations of the failure 
recovery system in the loosely coupled multi-computer system, according to 
the embodiment of the present invention is accomplished. 
The failure recovery system employed in the loosely coupled multi-computer 
system, according to one embodiment of the present invention, has such an 
advantage that even when the failure occurs in any one of the computers 
for constituting the loosely coupled multi-computer system, if there are 
other computers operable under normal condition, then such data updated by 
the first-mentioned computer where the failure occurs can be recovered to 
the data before being updated by way of any one of these computers 
operable under normal conditions. 
Also, the failure recovery program used in the loosely coupled 
multi-computer system, according to another embodiment of the present 
invention, may execute the process operation substantially equivalent to 
that of the above-described failure recovery system. In addition, this 
failure recovery program may be stored into a storage medium such as a 
memory, a disk, a floppy disk, and a CD-ROM. 
The failure recovery system and the failure recovery method in the loosely 
coupled multi-computer system, and also the medium for storing therein the 
failure recovery program, according to the present invention, have the 
feature that even when the failure occurs in any one of the computers of 
the loosely coupled multi-computer system, the users can continue their 
work without being subjected to the adverse influence caused by this 
failure. To realize this feature, when the process for the transaction 
used to update the shared data 20 is commenced, the computer 1 registers 
such a message that the computer 1 uses this shared data 20 into the 
exclusive means 11. After the updating process information corresponding 
to the shared data 20 before being updated has been outputted to the 
updated record holding means 31, the computer 1 updates this shared data 
20, and deletes the updating process information of the updated record 
holding means 31 when the transaction is ended. Either the computer 2 or 
the computer 3, which is notified by the failure notifying means 50 as to 
such a fact that the failure happens to occur in the computer 1 before the 
transaction is ended, registers such a message that the own computer 2 or 
3 uses this shared data 20 into the exclusive means 11. Then, the computer 
2 or 3 returns the updating process information with the exception of the 
information about "no recovery is required", among the updating process 
information stored in the updated record holding means 31, thereby 
recovering this shared data 20. As a consequence, this updating process 
information is brought into such updating process information about "no 
recovery is required". 
As previously explained, the present invention has an effect to provide 
such a highly reliable computer system that even when the failure occurs 
in any of the computers for constituting the loosely coupled 
multi-computer system, the user can continuously execute his work without 
any adverse influences caused by this failure. 
Also, the present invention has another effect. That is, even when the 
failure occurs in any of the computers for constituting the loosing 
coupled multi-computer system, if there are other computers operated under 
normal conditions, then the data updated by the first-mentioned computer 
where the failure happens to occur can be recovered to the data before 
being updated by way of any one of these normally operated computers. 
Furthermore, the present invention has another merit that the previous 
preparing process is no longer required. That is, in this previous 
preparing process, such a computer which may recover the data updated by 
the computer where the failure occurs to the original data thereof should 
receive the information required to execute this recovery process before 
this failure occurs. 
In addition, according to the present invention, there is an advantage that 
since the computers need not to be connected with each other via the 
channels and the communication lines, the loosely coupled multi-computer 
system can be established at low cost. 
Although the invention has been described in detail above in connection 
with various preferred embodiments thereof, it will be appreciated by 
those skilled in the art that these embodiments have been provided solely 
for purpose of illustration, and are in no way to be considered as 
limiting the invention. Instead, various modifications and substitutions 
of equivalent techniques will be readily apparent to those skilled in the 
art upon reading this specification, and such modifications and 
substitutions are to be considered as falling within the true scope and 
spirit of the following claims.