MAINTAINING AVAILABILITY OF A RESTARTABLE DATA BASE SYSTEM

Abstract: A method is disclosed for maintaining availability of a restartable data base system where continuity of service is guaranteed by having a loosely-coupled backup processor taking over processing of a degraded active processor. The backup processor continuously tracks the activities of the active processor to ascertain data set elements updatable by the active processor. Upon switchover, images of data set elements updatable by the degraded active processor are created in the buffer of the backup processor. By making references and updates to the images, processing of the backup processor can start immediately after switchover. Upon preventing the degraded active processor from making further updates, the backup processor writes the images back to the data base.

Description: This invention relates to transaction-oriented, fault-tolerant systems, and more particularly, to a transaction-oriented data base managed by an active processor with management replacement being made by a backup processor tracking and synchronizing its information state from the active processor's log. In the copending European Patent Application 86111955.0 published on 13.05.87 as EP-A-0 221 274 there is disclosed a method for ensuring switchover in a restartable data base system between a backup and a degrading active processor. By transferring workload of a degraded processor to a backup processor, continuity of service of the data base system is guaranteed. However, as will be more fully described hereinafter, even though control may have passed to the backup processor, it is possible that, after switchover, concurrent references to the same data base may still be made by both the degraded and the backup processors. To maintain data integrity of the system after switchover, there needs to be a delay in the processing of the backup until references or updates by the degraded processor are stopped. In prior art data processing systems, concurrent access to shared data is resolved by serialization achieved by methods such as prioritization, locking, enqueuing or semaphores. While such methods preserve the order of access, they nevertheless cannot ensure data integrity because either processor may alter the data being used by the other. According to the invention there is provided a method for maintaining data availability in a data base system having backup and active processors, said system utilizing staged storage and logging facilities, characterised by the steps by a backup processor of: (a) ascertaining the names and locations of the data set elements in staged storage which are updatable by the active processor, and upon the passing of control from a degraded active processor to the backup processor, logging the ascertained names and locations; (b) ascertaining whether the degraded active processor ceases to perform updates to staged storage; (c) upon the first reference by said backup processor to each data set element in staged storage: which is updatable by the active processor, copying said referenced element to a buffer, diverting subsequent references from staged storage to the buffer copy, logging each update to said copy, the steps of copying, diverting, and logging being repeated until indication of said degraded active processor ceases to perform updates to staged storage; and (d) writing the buffer contents back to staged storage when said degraded active processor ceases to perform updates to staged storage. The principal advantage resulting from the practice of this method is minimal stoppage of processing in a data base system and maintenance of data integrity even in the event of a processor degradation. In another aspect of the invention there is provided a method for maintaining data availability in a restartable data base system, said system utilizing staged storage and logging facilities, said data availability being extended to those data sets having associated therewith access errors, characterised by the steps of: (a) responsive to each access error, creating a concordance of the affected data set name, location, and error type, copying said affected data to another staged storage location, and logging the concordance and a copy of the affected data to staged storage; said logging also being invoked at periodic checkpoints; (b) diverting subsequent references from staged storage to the buffer copy, logging each update to said copy, the steps of copying, diverting, and logging being repeated until said access error becomes resolved; (c) in the event of system restart, restoring the concordance and the affected data from the log to staged storage; and (d) restoring said error by successfully writing the buffer contents back to staged storage. In order that the invention may be fully understood a preferred embodiment will now be described with reference to the accompanying drawings in which: FIG. 1 is a diagram depicting the normal sequence of data base accesses upon degradation of the active processor according to the method disclosed in the above identified copending application; FIG. 2 is a diagram depicting the sequence of data base accesses and system availability improvement when the method of this invention is incorporated into the system of the above-identified copending application; and FIG. 3 is a schematic diagram of the system disclosed in said earlier filed application modified in accordance with the present invention. To better understand the improved method of the present invention, the method according to the above identified earlier filed copending application will first be briefly described. FIG. 1 illustrates the events which may occur immediately before and after a switchover in the system of said copending application. Prior to degradation, the active processor needed to make n updates V1, V2,...,Vn to the data base. Accordingly, log entries L1, L2,...,Ln of the corresponding updates were first written to the log as required by the Write Ahead Logging protocol. Write Ahead Logging protocol is well recognized to prior art (see U.S. Patent 4,507,751, Gawlick et al, "Method and Apparatus for Logging Journal Data Using a Log Write Head Data Set") and is used by IMS to guarantee recoverability of data base updates. When the active processor degraded at time td, it was prohibited from writing into the log. However, since entries L1, L2,...,Ln had already been logged, the old active processor could still write V1, V2,...,Vn to the data base. To maintain data integrity, the backup processor could not make updates to the data base until after time tp, when the degraded processor finished writing V1, V2,...,Vn to the data base. Therefore, processing of the backup processor and, consequently, the availability of the data base system must be delayed to time tp. Since number n of updates is usually large, the delay of processing (i.e., the time between td and tp) of the backup processor may be significant. Therefore, although the invention of the copending application can successfully provide a continuity of service of the data base system, there is a need for an improvement whereby processing of the backup processor can start immediately upon switchover. In accordance with the present invention, and as illustrated in FIG. 2, the backup processor tracks data set elements Da, Db,...,Dx which are updatable by the active processor. Upon switchover at time td, if the backup processor needs to reference a data set element Dx which is one of the data set elements updatable by the degraded processor, it builds an image of Dx in its buffer and diverts all reference to this image. When the degraded processor finished writing V1, V2,...,Vn to the data base at time tp, the image of Dx is written back to the data base. By diverting references of Dx to its buffer image, processing of the backup processor can start immediately upon switchover at td. FIG. 3 shows the system described in the above- identified copending application as modified in accordance with the present invention. The disclosure of said copending application is incorporated herein by reference. The tracking of buffer elements updatable by the active processor 101 is described in sections entitled "DL/I 'indoubt' buffer tracking/reduction" and "Fast Path 'indoubt' buffer reduction". Briefly, while the backup processor 102 is reading the log 103 of the active processor 101 during the tracking phase, it uses the log information to maintain a group of chained subpool tables 105. Each subpool table is used to track buffers of a DL/I subpool which contains "uncommitted" data changes for the associated ISAM/OSAM or VSAM subpool, and it comprises entries each of which contains the name and location of a data set element together with a modifying PST (region) bit map. Each bit in the modifying PST bit map identifies a PST (region) which may update the data set element. For Fast Path processing, the backup processor 102 maintains a "write pending" bit in the DMHR (a control block associated with the buffer) of a corresponding "indoubt" Fast Path Control Interval where forward recovery is needed. In IMS/VS systems heretofore proposed, each data base is associated with a Data Management block directory, hereinafter called a DDIR, which is used in prior art IMS/VS to store information pertinent to the access of the data base. Prior to the access of a data set element, the information from the DDIR is first checked by IMS. Upon switchover, the backup processor examines each subpool table maintained during the tracking phase. For each entry in a subpool table which has a nonzero modifying PST bit map, a control block, which is hereinafter called an Extended Error Queue Element (EEQE), is created and put in a chain pointed to by the corresponding DDIR. The process of creating and chaining EEQEs off a DDIR is familiar to persons skilled in the art of IMS/VS. When an EEQE is created, the name and location of the data set element for which an EEQE is created are logged to ensure their recoverability in case of a system failure. In such heretofore proposed IMS/VS systems, if access to a data set element of a data base is needed by the backup processor after switchover, the backup processor first accesses the corresponding DDIR. From the accessed DDIR, the backup processor searches for an EEQE corresponding to the data set element and, depending upon the result of the search, performs one of the following functions: (a) Normal, no EEQE found - The data set element is not updatable by the degraded processor. Reference of the data set element is made to the data base directly. (b) EEQE found, first reference - The data set element, which is updatable by the degraded processor, is referenced by the backup processor for the first time. The backup processor restores the data set element and copies it to a buffer in the Extended Control Service Area (ECSA). ECSA is a work area provided by the MVS extended architecture (XA). The process of restoring and copying a data set element is known to persons skilled in the art of IMS/VS. The address of the buffer area where the image is located is saved in the EEQE so that all subsequent references of the data set element can be diverted to this buffer area. (c) EEQE found, not first reference - The data set element, which is updatable by the degraded processor, has previously been referenced by the backup processor and thus an image of the data element has already been created in the ECSA. The address of the image is obtained from the EEQE. References and updates to the data set elements are then diverted to the image of the data set element in the ECSA. To enable recoverability in the event of a breakdown of the backup processor, all updates made to the images are logged. In the prior art of IMS/VS, when the degraded processor finishes all the updates, a notification is sent to the operator. When the backup processor in this invention is informed that the degraded processor has completed all I/Os to the data base, it then copies the image of each data set element from the ECSA back to the data base. Data Availability During Access Errors While the method of using an EEQE to divert references to an image created in the buffer can be used to maintain availability of the data base in the event of processing switchover, it should be apparent that the method can also be used to maintain system availability of a data base system during the occurrence of an access error in the data base. When an access error occurs in the data base during the referencing of a data set element, an EEQE is created and put in a chain pointed to by the DDIR of the data base. A copy of the affected data set element is then created and copied into the IMS Extended Control Service Area (ECSA). The creation of the EEQE, together with the name and location of the affected data set element, is logged to ensure recoverability. When references and updates to the affected data set element are needed, the EEQE, which is accessed with the corresponding acquiring of the DDIR, causes the references to be diverted to the buffer copy of the data set element in the ECSA. If an update is made to the affected data set element, it is also logged to ensure recoverability. If, during its normal operation, IMS can successfully write to the data base area previously affected by an access error, the data set element is then restored and copied back into staged storage.

Claims: A method for maintaining data availability in a data base system having backup and active processors, said system utilizing staged storage and logging facilities, characterised by the steps by a backup processor of: (a) ascertaining the names and locations of the data set elements in staged storage which are updatable by the active processor, and upon the passing of control from a degraded active processor to the backup processor, logging the ascertained names and locations; (b) ascertaining whether the degraded active processor ceases to perform updates to staged storage; (c) upon the first reference by said backup processor to each data set element in staged storage which is updatable by the active processor, copying said referenced element to a buffer, diverting subsequent references from staged storage to the buffer copy, logging each update to said copy, the steps of copying, diverting, and logging being repeated until indication of said degraded active processor ceases to perform updates to staged storage; and (d) writing the buffer contents back to staged storage when said degraded active processor ceases to perform updates to staged storage. A method for maintaining data availability in a restartable data base system, said system utilizing staged storage and logging facilities, said data availability being extended to those data sets having associated therewith access errors, characterised by the steps of: (a) responsive to each access error, creating a concordance of the affected data set name, location, and error type, copying said affected data to another staged storage location, and logging the concordance and a copy of the affected data to staged storage; said logging also being invoked at periodic checkpoints; (b) diverting subsequent references from staged storage to the buffer copy, logging each update to said copy, the steps of copying, diverting, and logging being repeated until said access error becomes resolved; (c) in the event of system restart, restoring the concordance and the affected data from the log to staged storage; and (d) restoring said error by successfully writing the buffer contents back to staged storage.

Inventors: BEIER, HARLEY AL, FUKUMOTO, TAKESHI, SCOFIELD, HARRISON, WATTS, VERN LEE
Applicants: INTERNATIONAL BUSINESS MACHINES CORPORATION
Application year: 1987
Main classification: G06F11
IPC codes: G06F15, G06F12, G06F11