KR100411978B1 - Fault tolerant system and duplication method thereof - Google Patents

Abstract

The present invention relates to a fault-tolerant system and a redundancy method therefor. In particular, the present invention relates to a redundancy system and method capable of smoothly recovering a service without interruption even when an active host is switched over. to provide.

The present invention provides a dedicated heartbeat line between the redundant monitoring process (DGP) operating in the redundant server in addition to the redundant network to monitor the status of each other, so that when the host fails, when the network fails, In the event of a failure in the process, a failure in the process driving can be automatically switched when more than a predetermined number of times occurs, and also by enabling the manual switching by the operator, to implement a fault-tolerant server system.

As a result, the present invention can be applied to a communication system requiring reliability, thereby providing an uninterrupted communication service.

Description

Fault-tolerant system and duplication method {FAULT TOLERANT SYSTEM AND DUPLICATION METHOD THEREOF}

The present invention relates to a fault tolerant system and a duplication method for the same, and more particularly, to a duplication system and method capable of smoothly recovering a service without interruption even when an active host is switched over. It is about.

Data communication using the network is now widely popularized and used throughout the society, such as the financial and medical field, the mobile communication field, and public institutions, and various services and information are provided through the network. There will be one or more servers and clients on the network, which will manage and process the shared resources and data.

However, data communication using a network has a disadvantage in that, when a network failure occurs in a network server providing a service or an error occurs in a device constituting the network server, resources and data shared in the network server cannot be used. Problems occur due to service interruption.

Moreover, in the case of a network server that needs to process a large amount of data every second, a problem may occur that the data is lost until the network server recovers and operates normally when a failure occurs in the network server.

For example, a network server of a financial institution that provides financial services over a network, or a server that manages call history and billing of a customer of a telecommunications service provider, can cause significant financial damage due to network or server outages. In addition, there is a need for a network server system and method capable of safely preserving data and providing services without interruption even in the event of a server failure.

In order to solve such a problem, a technology for continuously providing a service without interruption even in the event of a network server failure using a duplication method using an active server and a stand-by server has been proposed.

Such a server duplication system is described in Korean Patent Application No. 10-2000-0014192, US Patent No. 4,853,875, and the like. However, the above-described duplex system technology disclosed in U.S. Patent No. 4,853,875 has a technical difficulty that requires a broadband data transmission means in order to share data stored in the main memory of the active server and data stored in the shared storage means. There is a inconvenience in that data is lost due to a delay in switching from the active server to the standby server.

As a result, the system administrator has been inconvenient to check and restore lost data at the time of redundant server changeover. Meanwhile, in the server duplication technology disclosed in Korean Patent Application No. 10-2000-0014192, the active server and the standby server have a system failure due to a duplication guardian process (DGP) sending heartbeats to each other. When all of the hubs of the redundant network fail, heartbeats cannot be exchanged.

In addition, in the server duplication technology disclosed in the above-described Korean Patent Application No. 10-2000-0014192, there has been a technical difficulty in continuously providing a service by quickly switching a system when a database failure occurs.

Accordingly, a first object of the present invention is to provide a fault tolerant system and a duplication method capable of continuously performing a service without data loss even when a network or server failure occurs.

A second object of the present invention is to provide a high reliability Fault Tolerant System and a redundancy method in which, in addition to the first object, broadband data communication is not required for server redundancy.

The third object of the present invention is, in addition to the first object, a fault tolerant system that can be switched to a server which is rapidly waiting without losing data and processes during server changeover without synchronizing process sequences. And a method of redundancy.

A fourth object of the present invention is to provide a fault tolerant system and a redundancy method capable of continuously performing a service without loss of data even in the event of a failure in the redundant network in addition to the first object. .

In addition to the first object, the fifth object of the present invention is to provide a new communication channel and protocol for rapidly detecting a failure of an active server in a redundant server system and continuously providing a service without interruption. Fault Tolerant System and redundancy method.

A sixth object of the present invention is to provide a fault tolerant system and a redundancy method that provide continuous service by determining a condition for automatically switching a system in a redundant server system in addition to the first object. have.

1 is a view showing the configuration of a fault-tolerant server system according to the present invention.

2A to 2H are diagrams illustrating an automatic switching method of a redundant server according to the present invention.

<Explanation of symbols for the main parts of the drawings>

100, 101: redundant network

110: active server (first server)

120: standby server (second server)

320: process

311: process resource management process

330, 331: redundant monitoring process

350: heartbeat network

In order to achieve the above object, the present invention provides a redundant server system in which a first server and a second server are redundantly connected to an active server and a standby server, respectively, through the redundant network line. Each of the two servers runs the processes set in the configuration table while operating as an active server, monitors the status of the network interface cards provided for network redundancy, and manages the processes. process and resource manager; When booting is completed and in operation regardless of an active or standby state, it is started by the process resource management process and periodically connected with a counterpart server directly connected through a heart beat network line provided separately from the redundant network. A duplication guardian process (DGP) for determining whether a counterpart server has failed through communication; And a reflective memory device (RFM) connected to an opponent server via an optical cable so that data generated by a process running in an active server can be accessed in real time from a partner standby server.

Hereinafter, a fault-tolerant server system and a duplication method according to the present invention will be described in detail with reference to FIGS. 1 and 2.

The fault tolerant server system according to the present invention basically aims for a service without interruption. To this end, the server is configured as a first server and a second server to monitor each other, and when an abnormality occurs, it is configured to switch over quickly to recover the service.

1 is a view showing the configuration of a fault-tolerant server system according to the present invention. Referring to FIG. 1, two servers 110 and 120 are configured to configure one redundant server, and fault tolerant structures according to the present invention are active and standby. -by) state.

The active server (first server; 110) and the standby server (second server; 120) constituting the fault-tolerant server system according to the present invention are both booted and there is no difference in that the operating system (OS) is operating. . However, in the functional aspect, the server 110 in the active state is different from the server 120 in the standby state because the necessary process 320 is started and provides a service.

The server 120 in the standby state continuously monitors the other active server 110. At this time, in the standby server 120, processes necessary for monitoring the active server 110 are activated. That is, the standby server 120 activates a process resource management process (PNR) and a duplication guardian process (DGP) 331.

On the other hand, in the active server 120, all the processes 320 described in the configuration table are activated. On the other hand, the standby server 120 has other processes 321 in addition to the process resource management process (PNR) 311, the redundancy monitoring process (DGP) 331, and the virtual message communication process (VMP) (not shown). Does not start at all.

That is, the standby processes 321 are configured to be activated immediately after being switched to detect that the active server 120 is down and to function as an active. In addition, since the first server 110 and the second server 120, which are duplicated according to the present invention, each have data to be preserved at the time of switching, a reflective memory (RFM; not shown) is used. To synchronize the contents of the memory between the two systems.

Thus, as a component for a fault tolerant server system according to the present invention, a process resource management process (PNR) 310, 311, a redundant monitoring process (DGP) 330, 331 and a reflective memory (RFM) Characterized in having a.

Process resource management process (PNR) 310, 311 according to the present invention is a process for managing the processes (320, 321), it is to be activated in the first booting stage of the system. Accordingly, if the server is booted and is in a running state, the PNR processes 310 and 311 may be always activated.

The process resource management process (PNR) 310, 311 according to the present invention first reads the process management table, i. In other words, it reads information about process execution from a given configuration file and starts the process. When the started process (child process for PNR) is normal or abnormal, it is detected and terminated. It will be restarted by referring to the configuration value in (configuration file).

That is, the PNRs 310 and 311 according to the present invention are the parent processes for the other processes 320 and 321. When the PNR ends, all the child processes are terminated. In addition, the process resource management process (PNR) 310, 311 according to the present invention checks and manages the status of the network interface card (NIC) installed in its system for network redundancy (100, 101).

Here, in order to implement a complete fault tolerant system, the information managed by each process must also be duplicated. If the above information is stored in the shared memory or local memory area of the main memory, it is impossible for the new active server to access the existing information in case of sudden changeover. In order to solve this problem, the present invention uses a reflective memory.

The reflective memory (RFM) according to the present invention may use a PCI method as a memory board separately provided in addition to the main memory. As a preferred embodiment according to the present invention, the RF RF board for PCI is installed in both the active and standby server, respectively, two memory boards may be connected by an optical cable. When the processes 320 running in the active server 110 write data to either RFM, the same contents are recorded in the RFM of the standby server 120 on the other side, thereby enabling data synchronization.

The first process initiated by the process resource management process (PNR) according to the present invention is a duplication monitoring process (DGP; Duplication Guardian Process (330, 331), the duplication monitoring process through the heartbeat network 350 Communicates periodically with the process and detects if the other side has been transferred so that the transfer can take place.

That is, the fault tolerant server system according to the present invention is in charge of the redundancy monitoring function by the redundancy monitoring process (DGP) 330, 331, the heartbeat is separated from the redundant service network (100, 101) By periodically communicating with the other party's redundant monitoring process (DGP) through the network (heart beat network) 350 to determine whether the other party's server failure.

According to the present invention, two types of automatic / passive switching are possible in the active / standby state switching between two redundant hosts 110 and 120. The automatic switchover according to the present invention automatically switches over by detecting an abnormality of the active host on the standby host side, and the manual switchover alternates the functions of the active and standby hosts with each other by an operator's operation. Hereinafter, the automatic switching condition of the redundant server according to the present invention will be described in detail.

First, when a failure occurs in the power source of the active host 110 or the central processing unit (CPU), the standby host 120 detects this and transitions to the active host. In addition, even when the network line of the active host fails, even if the host itself operates normally and the process can operate properly, communication with the outside is lost, so that the function as an active server cannot be performed properly.

In this case, as in the case where an abnormality is detected in the host, the switching operation is performed. The fault tolerant server system according to the present invention can perform a switching operation even when a database has a fault. In addition, even when the process running in the active server is down more than a predetermined number of times, it can be recognized as a system failure and the transfer operation can proceed.

2A to 2H are diagrams illustrating an automatic switching method of a redundant server according to the present invention. Referring to FIG. 2A, in order to explain the present invention, it is assumed that the first server 110 is an active system, and the description begins with the second server 120 as the standby system. Typically, the determination of the initial state is determined by a redundant monitoring process (DGP) configuration file.

The redundancy monitoring process 330, 331 according to the present invention exchanges heart beats with each other via a heartbeat dedicated network. As a preferred embodiment according to the present invention can be a 0.5 second cycle, it can be modified in the configuration file. The redundancy monitoring process (DGP) according to the present invention creates a thread that continuously transmits a heartbeat message every 0.5 seconds so that the heartbeat message can be exchanged at all times while the DGP is activated.

Referring to FIG. 2B, if a failure occurs in the first server 110 acting as an active host and the DGP 330 activated in the active first server 110 does not operate normally, it may be detected. Can be.

That is, when the first server 110 is active and the DGP 330 does not operate normally due to a failure of the first server, the redundancy monitoring process 330 of the first server 110 continues with a heartbeat message. Since the second server's redundancy monitoring process 331 does not transmit the heartbeat message until the timeout occurs, it detects the other party's failure.

In a preferred embodiment of the present invention, the heart beat time out value may be 1 second, which is twice the heart beat generation period, for example 0.5 seconds. This case can be defined as the first timeout. As a result, when the first timeout occurs, the DGP 331 of the standby system may actually have an abnormality in the heartbeat network 350, although the host itself may be abnormal. You should check whether the active host is actually down.

Therefore, heartbeats are transmitted through all service networks and wait for a response. If the first server itself is intact and the heartbeat network fails because only the heartbeat network fails, the DGP 330 in the first server 110 may receive a heartbeat message through the service network. Upon receiving this, the two DGPs 330 and 331 will now exchange heartbeats over this network.

Of course, even in this case, heartbeat transmission over the heartbeat network continues to be attempted. Therefore, when the heartbeat network is restored, the heartbeat message is exchanged through the heartbeat network instead of the service network.

If a timeout occurs while sending and receiving a heartbeat through the service network, this case is treated as if the timeout occurred in the heartbeat network. If a timeout occurs while sending and receiving heartbeats through the service network, this is also defined as the first timeout.

If the timeout occurs again after the first time occurs through the service network or through the heartbeat network, this is defined as the second timeout. Here, the second timeout value may also be set to twice the heartbeat interval, that is, 1 second. On the other hand, if the timeout occurs twice, the DGP 331 determines that the DGP 330 of the other system is not operating normally, and performs the switching operation.

Referring to FIG. 2C, when the timeout occurs twice, the standby side DGP 331 assumes that the active system 110 has failed and enters the transfer operation. Referring to FIG. 2C, since the DGP of the second server detects an abnormality of the first server, the transfer is started. The time it takes to detect an abnormality of the first server takes two seconds, four times the heartbeat interval. Of course, since this value depends on the transmission period of the heartbeat, it can be changed by changing the heartbeat transmission period.

Referring to FIG. 2D, the duplication monitoring process (DGP) 331 of the second server that detects the down of the first server sends a SIGUSR1 signal to the process resource management process (PNR) 311 to start the transfer. The PNR 311 of the second server starts the transition from the standby state to the active state upon receiving the signal SIGUSR1. In a preferred embodiment according to the present invention, when the PNR running on the server receives the SIGUSR2 signal, it transitions from the active state to the standby state.

The PNR according to the present invention manages the state information of the system in the reflective memory, and the DGP allows the PNR to manage the correct state by reflecting the state change in the synchronized reflective memory when entering the transfer. . In this case, the DGP is an active system, which records its current state in reflective memory.

Referring to FIG. 2E, upon receiving the SIGUSR1 signal, the PNR process 311 of the second server 120 first terminates the processes set to run only in the standby state and then starts the processes set to run in the active state. Then, the switching to the active system is performed.

As a result, when the transfer operation is completed, the second server system performs a function as an active system. Even if the first server system is down, the DGP 331 of the second server 120 will continue to attempt to transmit the heartbeat message, and thus detects that the other party is down after 2 seconds (four times the heartbeat transmission interval). Done. Then, the DGP 331 of the second server 120 recognizes that the standby server 110 is down. And do the necessary work. For example, the state of the partner standby system is recorded in the down state.

Referring to FIG. 2F, when the first server which has been down is restored and the PNR 310 is restarted, the DGP 330 is activated to start operation. When the DGP 330 of the restored first server 110 is started, the initial state is set to the Init state, and the DGP 331 of the partner host 120 includes a request for asking which state its state should be transitioned to. Send a heartbeat message. According to a preferred embodiment of the present invention, the ack_req of the heartbeat message may be set to REQUIRED and the code may be sent to REQ_CHG_TO_STANDBY.

At this time, the transmission of the heartbeat message is performed through the heartbeat network and all service networks. In addition, the heartbeat message timeout value is twice the heartbeat transmission period. If a response is received before the timeout occurs, the DGP 330 of the first server 110 may proceed with the transition accordingly. If the timeout occurs, the DGP 330 may assume that the DGP of the partner host is not operating normally. Therefore, it transfers its state to the active state. That is, it sends a SIGUSR1 signal to the PNR process. In the above case, since the second server is alive, the heartbeat message is transmitted from the DGP 331 of the second server 120.

Referring to FIG. 2G, the DGP 331 of the second server 120 receives a heart beat message from the DGP 330 of the first server 110. As a result of this analysis, it is found that the code value is REQ_CHG_TO_STANDBY. This is because, as explained above, the other party asks what state it should transition its state to, so the DGP on the second server that receives this message will look at the state of the second server host and decide what state it is in. Take action.

(1) If the state of the second server 120 is active, the other party is informed by filling the code value with INST_CHG_TO_STANDBY to inform the other party to transition to the standby state.

(2) If the state of the second server 120 is in the standby state, the other party is sent to transition to the active state. This can also be sent as a heartbeat message by filling the code value with INST_CHG_TO_ACTIVE.

(3) If the state of the second server 120 is in the Init state, if the second server 120 is in the active state by default according to the contents of the configuration file (dgpconfiguration file), it is in the active state. Transfer and tell the other party to go to standby. That is, INST_CHG_TO_STANDBY is transmitted to the DGP 330 of the first server 110 in the code of the heartbeat. If the initial system state is in standby, then in the same way, it transitions to the standby state and tells the other side to transition to the active state (INST_CHG_TO_ACTIVE).

Meanwhile, the DGP 331 of the second server 120 may recognize the fact that the first server 110, which has been down, has been recovered by receiving a heartbeat message, so as to inform the PNR 311 to the PNR 311. Allows state management. This is done by sending a SIGTTIN signal to the PNR 311. In the preferred embodiment according to the present invention, the PNR 311 recognizes that the other party's standby system is restored upon receiving the SIGTTIN signal, and recognizes that the other party's standby system is down upon receiving the SIGTTOU signal.

On the other hand, when the standby system is restored and survived, the DGP of the active server performs RFM Sync to match the RFM contents. This is because the RFM is made up of DRAM and its contents are erased when the power is turned off. Therefore, when the standby system comes to life, RFM Sync is performed assuming that all RFM contents of the system are deleted.

Referring to FIG. 2H, the first server 110 has transitioned from the standby second server 120 to the active state. On the other hand, the manual transfer method according to the present invention is as follows. When the system operator requests manual switchover, the manual switchover command is issued to the PNR process of the active host, and the PNR performs the switchover by sending a SIGUSR1 signal (transition command to the standby) to the DGP process.

Hereinafter, the functions of the process resource management process (PNR) and the redundant monitoring process (DGP) software module according to the present invention will be described in detail. The function of the PNR according to the present invention manages processes according to active and standby states, and activates an alarm when an error occurs in a process or a resource. It also performs creation / deletion of processes or resources and checks the status of the network, and manages them in conjunction with the DGP and DBMGR. The PNR according to the invention is started at boot by the Init process as described in the initial configuration file inittab.

The PNR process according to the present invention initially reads the configuration file (pnr.tab) file to list the active processes in the active or standby state. The PNR according to the present invention reads pnr.tab the first time it is started, but reads this configuration file anew even if it receives SIGHUP (details will be described later).

In addition, the PNR process according to the present invention reads the pnr_conf.ini file and reads the host name of the current system. In addition, the SIGUSR1 signal is received from the DGP according to the present invention in an active state, and the SIGUSR2 signal is received in a standby state. Upon receiving the above-described signal, the PNR according to the present invention activates the processes operating in the active state and the processes operating in the standby state, respectively. On the other hand, the processes should be able to be terminated by SIGTERM. In the operation of the PNR according to the invention, other processes and interfaces are made via signals. Preferred embodiments of the signal processing of the PNR according to the present invention are as follows.

SIGUSR1 is a transition to the active state. It is a signal sent from the DGP to the PNR and is a signal received when a state transition occurs to the active state. Processes that used to be idle when the STATE is in standby send a SIGTERM signal to create processes that have a status of active.

SIGUSR2 is a transition to the active state, and is a signal sent from the DGP to the PNR, and is a signal received when a state transition occurs to the active state. Processes that used to be in a standby state are terminated by sending a SIGTERM signal, then create processes with the state active.

SIGTTIN indicates that the counterpart server is in the initial (INIT) state and then transitions to the standby state. If the current system is active, the standby state can be known by the DGP. Occurs when the state of the opposing system is standby.

SIGTTOU indicates that the other server is in the standby state and then transitioned to the initial state (INIT) or down, and is a signal generated by the DGP when the other system is in an abnormal state when the other system is not in the standby state. At this time, an alarm message indicating that the standby system is down is generated.

SIGHUP is a signal received by the user when the contents of the reconfiguration pnr.tab are changed. It is sent to the PNR if you want to add new contents to the pnr.tab and run the process with a new configuration. When the PNR receives this signal, it rereads the process table and terminates or creates a new process accordingly.

SIGCHLD is the termination of a child process. This signal is issued when a process running in RESPAWN state terminates. This generates an alarm (ALARM) as the process ends. It also recreates the process and sends an ALARM CLEAR.

A server in service can have three states, that is, classified into ACTIVE, STAND-BY, and INIT. Here, the INIT state is a state before the standby state, and the initial state of the server is the INIT state. Once the server is restored and alive, it is unconditionally INIT. Then it asks the active server whether it should go to standby or active.

After receiving confirmation from the other server in the INIT state, the server is either standby or changed to active state. The standby server monitors the status of the active server and switches over to the active server when an error occurs. It also supports manual switching, so when DGP requests a state change, it requests the standby server to change the state and itself changes the state.

In the fault tolerant system according to the present invention, when a failure occurs in the heartbeat interface 350, a return request packet is transmitted through another network, and the return request packet is continuously transmitted to the returned network. The standby system resets the timer when a heartbeat arrives through any network possible.

When a timeout occurs while a packet is normally transmitted as a heartbeat network according to the present invention, since a failure abnormality may be suspected in the heartbeat network, all networks, that is, two networks (100 and 101) currently duplicated and a heartbeat network In step 350, a packet requesting an acknowledgment is transmitted.

If the returned packet is not a heartbeat network, the next heartbeat is transmitted through the network on which the response came. This state is a state where the heartbeat network 350 has failed. If the retransmitted network fails in this state, it sends a request packet back to all networks and waits for a response. If the response does not return within two times (2 * t1) of the defined time heartbeat period, it transitions to active. In any case, if a packet of the heartbeat network 350 is detected, it operates normally.

On the other hand, the heartbeat transmission is timed out by two times the heartbeat period (2 * t1), or the heartbeat transmission via the redundant LAN network 100, 101 is 2 * t1. If a timeout occurs by sending a heartbeat requesting a return to the entire network.

Then, if a timeout occurs after 2 * t1 again, it assumes that the active server is down and attempts to switch over. When the return arrives on a specific redundant LAN network 100, 101, heartbeat transmission is performed by the transmitted LAN. At this time, confirmation is made within 4 * t1 seconds after the active server is down.

On the other hand, when the heartbeat via the heartbeat network 350 is 2 * t1 time elapsed, the heartbeat transmission state through the redundant LAN networks 100 and 101 is performed. At this time, the heartbeat transmission through the heartbeat network continues to be attempted and is returned when a heartbeat requesting an acknowledgment is received. When the heartbeat does not arrive within 2 * t1 hours when the heartbeat is transmitted through the redundant LANs 100 and 101, the standby server is considered inoperable and performs standby down. When the heartbeat arrives again, it performs StandbyUp.

Also, when the initial system starts to operate, Init performs the initialization process. After that, each DGP sends REQ_TO_STANDBY in the code to request a return. If no packet arrives within 2 * t1 hours, it assumes that there is no counterpart DGP and acts as an active server. Therefore, when only one system is operating, it operates as an active server after 2 * t1 hours. If the active server is already running, the active server returns INST_CHG_TO_STANDBY, so it acts as a standby server.

On the other hand, when two systems start to operate simultaneously, one server sends a REQ_TO_STANDBY message and receives a REQ_TO_STANDBY while waiting for the message. At this time, if the start state is set as the active system by the initial system setting, the mobile station operates as an active server and transmits INST_CHG_TO_STANDBY. Also, in the opposite case, it acts as a standby server and sends INST_CHG_TO_ACTIVE.

The foregoing has outlined rather broadly the features and technical advantages of the present invention to better understand the claims of the invention which will be described later. Additional features and advantages that make up the claims of the present invention will be described below. It should be appreciated by those skilled in the art that the conception and specific embodiments of the invention disclosed may be readily used as a basis for designing or modifying other structures for carrying out similar purposes to the invention.

In addition, the inventive concepts and embodiments disclosed herein may be used by those skilled in the art as a basis for modifying or designing other structures for carrying out the same purposes of the present invention. In addition, such modifications or altered equivalent structures by those skilled in the art may be variously changed, substituted, and changed without departing from the spirit or scope of the invention described in the claims.

As described above, the present invention provides a dedicated heartbeat line between the redundant monitoring process (DGP) operating in the redundant server in addition to the redundant network to monitor the state of each other, so that when the host fails, the network fails. In this case, when a failure occurs in the database, when a failure in the process driving occurs more than a predetermined number of times, automatic switching can be performed, and by enabling manual switching by an operator, a fault tolerant server system can be implemented.

As a result, the present invention can be applied to a communication system requiring reliability, thereby providing an uninterrupted communication service.

Claims (11)

And a heartbeat separate from the redundant network line in order to check whether a counterpart server has failed between the first server that is operated by the user process and the second server that is duplicated through the redundant network line. In a redundant server system having a memory means synchronized in real time between the first server and the second server in order to access the data generated by the user process running on one server without interruption when the second server is switched The first server and the second server each start a process and resource manager (PRN) and a duplication guardian process (DGP), each operating as a standby server or a standby server. Become, The process management process is for starting a user process set in a configuration table in a server operating as an active server, monitoring a state of a network interface card provided for the network redundancy, and managing the user process. Features, The redundancy monitoring process is started by the process resource management process when booting is always completed after being operated regardless of whether the server is an active server or a standby server. Judging whether there is a failure of the counterpart server through periodic communication with the monitoring process, and in case of detecting a failure of the counterpart server which was acting as an active server, it transmits a signal requesting a transfer to its process resource management process and records it in the memory means It is characterized in that the user process is started again with reference to the configuration file, and the state change is requested to the redundant monitoring process of the counterpart server. The memory means is an RFM installed separately in each of the active server and the standby server. two And data recorded in the memory means of the active server are recorded in synchronization with the memory means of the counterpart server in real time. delete delete delete delete The process resource management process (PNR) for running and managing user application processes and monitoring the status of a network interface card provided for network redundancy and the redundancy for monitoring the status of the counterpart server in the redundant server. It is equipped with a Duplication Guardian Process (DGP) that monitors faults through the heartbeat line provided separately from the established network, and the data generated by the processes are connected to each other by an optical cable and interfaced in a PCI manner to synchronize data with each other. In the first server and the second server, which are stored in a reflective memory to write and are duplicated, a method in which an active first server is transferred to a standby state and the second server is transferred to an active state, (a) Redundancy monitoring of the second server when a heartbeat message is not received from the redundancy monitoring process (DGP) running on the first server through the heartbeat line for a predetermined multiplier period of a heartbeat communication period. The process includes sending a heartbeat to the redundancy monitoring process of the first server through other network lines except the heartbeat line; (b) a failure occurs in the heartbeat transmitted through the other network line in step (a) to receive a heartbeat message from the duplication monitoring process to the first server within a predetermined multiplier period of the heartbeat communication period. If not, the redundancy monitoring process of the second server sends a signal requesting a transition from the standby state to the active state to the process resource management process (PNR) of the second server, and notifies the state change in the switching step. Writing to the reflective memory and thereafter writing to the reflective memory that a second server is an active server; (c) the process resource management process of the second server receives the state transition request signal from the duplication monitoring process of the second server, suspends the user application process that is set to run only in the standby state, and in the active state. Starting a process to be driven; And (d) The duplication monitoring process of the second server attempts to transmit a heartbeat message to the counterpart first server and recognizes that the standby server is down when there is no response within the predetermined multiplier period of the heartbeat communication period. step Server redundancy switching method comprising a. The method of claim 6, wherein the server redundancy switching method Restoring the first server that was down and starting the process resource management process (PNR) of the first server, and then setting itself to an initial state when the redundancy monitoring process (DGP) is started; The redundancy monitoring process of the restored first server sends a heartbeat message to the redundancy monitoring process of the second server, which is currently active, to the heartbeat line and the heartbeat message containing information on which state its state should be transitioned to. Transmitting via any one or a combination of the redundant networks; And Transitioning the state of the first server to a standby or active state according to the response from the duplication monitoring process of the second server; Redundant server switching method further comprising. The process resource management process (PNR) for running and managing user application processes and monitoring the status of a network interface card provided for network redundancy and the redundancy for monitoring the status of the counterpart server in the redundant server. It is equipped with a Duplication Guardian Process (DGP) that monitors faults through the heartbeat line provided separately from the network, and the data generated by the processes are connected to each other with an optical cable and interfaced by PCI to synchronize data. In the first server and the second server, which are stored in a reflective memory to be recorded and are duplicated, the method of switching from the first server that is active to the second server in the standby state is: (A) the process resource management process (PNR) of the first server receiving the transfer command of the system operator sends a signal requesting a change to the standby state to the redundant monitoring process of the first server; (b) the duplication monitoring process of the first server sends a heartbeat message requesting a state change to an active state to the duplication monitoring process of the second server through the heartbeat line; And (c) the process resource management process of the second server receives the state transition request signal from the duplication monitoring process of the second server, suspends the user application process that is set to run only in the standby state, and in the active state. Starting the process to be started Server redundancy switching method comprising a. The process resource management process (PNR) for running and managing user application processes and monitoring the status of a network interface card provided for network redundancy and the redundancy for monitoring the status of the counterpart server in the redundant server. It is equipped with a Duplication Guardian Process (DGP) that monitors faults through the heartbeat line provided separately from the network, and the data generated by the processes are connected to each other with an optical cable and interfaced by PCI to synchronize data. In the first server and the second server, which are stored in a reflective memory to be recorded and are duplicated, the method of switching from the first server that is active to the second server in the standby state is: (a) the process resource management process (PNR) of the first server may include transmitting a signal requesting a transition to a standby state to a duplication monitoring process of the first server when a database server fails; (b) the duplication monitoring process of the first server sends a heartbeat message requesting a state change to an active state to the duplication monitoring process of the second server through the heartbeat line; And (c) the process resource management process of the second server receives the state transition request signal from the duplication monitoring process of the second server, suspends the user application process that is set to run only in the standby state, and in the active state. Starting the process to be started Server redundancy switching method comprising a. The process resource management process (PNR) for running and managing user application processes and monitoring the status of a network interface card provided for network redundancy and the redundancy for monitoring the status of the counterpart server in the redundant server. It is equipped with a Duplication Guardian Process (DGP) that monitors faults through the heartbeat line provided separately from the network, and the data generated by the processes are connected to each other with an optical cable and interfaced by PCI to synchronize data. In the first server and the second server, which are stored in a reflective memory to be recorded and are duplicated, the method of switching from the first server that is active to the second server in the standby state is: (a) When the process resource management process (PNR) of the first server fails more than a predetermined number of times of any one or a combination of the user application processes, the process resource management process (PNR) of the first server returns to a standby state in the redundant monitoring process of the first server. Transmitting a signal requesting a transition; (b) the duplication monitoring process of the first server sends a heartbeat message requesting a state change to an active state to the duplication monitoring process of the second server through the heartbeat line; And (c) the process resource management process of the second server receives the state transition request signal from the duplication monitoring process of the second server, suspends the user application process that is set to run only in the standby state, and in the active state. Starting the process to be started Server redundancy switching method comprising a. The process resource management process (PNR) for running and managing user application processes and monitoring the status of a network interface card provided for network redundancy and the redundancy for monitoring the status of the counterpart server in the redundant server. It is equipped with a Duplication Guardian Process (DGP), which monitors faults through a heartbeat line provided separately from the network, and synchronizes data by interconnecting data generated by the processes with an optical cable using a PCI method. In the first memory and the second server which is stored in a reflective memory to record and duplicated, (a) the duplication monitoring process of the first server or the second server may include transmitting a first heartbeat at a predetermined period of the duplication monitoring process of the counterpart server; (b) if the transmitted heartbeat requests an acknowledgment (ACK) from a receiving server, transmitting a second heartbeat at the predetermined period through a network channel receiving the heartbeat; (c) if the transmitted first heartbeat requests the transition of the state of the receiving server to either initial, active, or standby by the receiving side redundancy monitoring process; Requesting a state process resource management process for a state transition of the system; (d) one or a combination of the heartbeat line and another redundant network, if the second heartbeat is not transmitted from a receiving server in a doubled period of a predetermined period after the first heartbeat is transmitted; Transmitting a third heartbeat to a receiving server using the; (e) If the heartbeat has not been transmitted from the receiving end through any communication channel of the heartbeat line or the redundant network at twice the predetermined period after the third heartbeat is transmitted, the counterpart server Recognizing it is down and transferring itself to the active; (f) when the downed server is restored, the restored server is set to an initial state (INIT), and the redundant monitoring process of the restored server queries the redundant monitoring server of the partner server for its state transition; (g) The recovered server makes a state transition to the standby or active state according to the instructions contained in the heartbeat sent by the redundant monitoring server of the counterpart server in response to the state transition query in step (g). Transitioning his state to active if none Server redundancy switching method comprising a.