JP2001022599A - Fault tolerant system, fault tolerant processing method, and fault tolerant control program recording medium - Google Patents

Abstract

(57) [Summary] [PROBLEMS] In a multiprocessor system, a C
When a PU fails, the processing of that CPU is performed by another CPU.
It is an object of the present invention to be able to easily specify which CPU takes over when a task takes over in task units. When a failure of another CPU is detected, a takeover determination unit 11 takes over a task in a reconfiguration table 2.
Transition information as a series of U numbers and current transition position table
From the current transition position indicating the currently processing CPU in 4, a task running on the failed CPU is searched, and the next CPU taking over the task is checked. CPU to take over
If is the own CPU, the standby task activating unit 12 activates the standby task 3 of the task and takes over the processing.
The current transition position updating unit 13 updates the current transition position in the current transition position table 4. If there is no CPU taking over the task, the task or the entire system is stopped based on the process selection information.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a fault-tolerant technique in a system equipped with a plurality of processors (hereinafter, referred to as CPUs), and more particularly, to the processing performed by a CPU when another CPU fails. A fault-tolerant system, a fault-tolerant processing method, and a fault-tolerant system in a multi-CPU system in which when a normal CPU takes over in a task unit, it is possible to easily specify which CPU takes over until the normal CPU becomes the last one. The present invention relates to a tolerant control program recording medium.

[0002]

2. Description of the Related Art In a multi-CPU system, a C
When the PU fails, without stopping the system,
In order to allow the processing to be continued by another normal CPU, for example, there is the following fault-tolerant technique.

[0003] (1) In the "mutual hot standby system standby system selection method" (Japanese Patent Laid-Open No. Hei 9-81409), a standby system processing function associated with an active system processing function no longer exists due to a failure in an electronic computer. When a standby processing function that can be automatically associated without operator intervention is selected and associated to establish a hot standby relationship, the identifier of the active processing function that runs on the local computer Information including an identifier of a standby processing function and a number of an electronic computer on which the standby processing function operates, which is associated with the active processing function so as to establish a hot standby relationship, and a standby system operating on its own computer. The identifier of the processing function, the identifier of the active processing function associated to establish a hot standby relationship with the standby processing function, and the active processing function In addition to a processing function management table for registering information consisting of the number of the computer to be created, when a failure occurs in the computer, in response to a request from an active processing function that has no associated standby processing function, With reference to the processing function management table, a standby processing function having no active processing function associated with another computer is selected and associated with the active processing function of the request source, and the hot standby relationship is automatically established. Processing function management means to be constructed.

(2) A "business takeover system (Japanese Patent Application No. 9-528794)" is a system in which business processing is executed by a plurality of processing devices in a hot standby mode or a load sharing mode. In order to provide a business takeover system that can take over efficiently in the event of a failure without requiring a great deal of programming, it indicates whether each processing unit is an active system or a standby system for business The table is retained, and when a failure occurs in the processing unit that is the active system for the business, the processing related to the business in the processing unit in which the failure has occurred is transferred to the processing unit serving as the standby system of the business with reference to the table Is to do so.

[0005]

However, conventionally, when a large number of CPUs continue to fail one after another, the failed CPU
There is no method for easily designating which CPU takes over the above processing.

In the technique (1), it is necessary to manage the active system processing identifier and the standby system identifier using the processing function management table. Also, in this technology, the computer that takes over the processing is dynamically determined, so the CPU that takes over the processing in advance
Cannot be statically determined until the last one,
There is a problem that all CPUs need to have functions such as equivalent hardware.

In the technique (2), it is necessary to create tables for all clusters, and if there is a task to be taken over until all clusters fail, the standby task must be described in all tables. In addition, it is unknown which cluster takes over the processing while the standby cluster is being prepared, and there is a problem that it is not possible to assign a priority and make settings so that the cluster can take over the processing. .

The present invention solves the above problem. In a multi-CPU system, when a certain CPU breaks down, when the processing of the CPU takes over in units of tasks, the last CPU determines which CPU takes over. It is an object of the present invention to provide a means that can be easily designated until one device is used.

[0009]

According to the present invention, a plurality of CPUs are provided.
In a system equipped with a
It has a reconfiguration table having information describing, by task, which CPU has taken over a task operating on a PU by a series of CPU numbers. When a failed CPU is found, the CPU that discovers it is all other CPUs.
To the CPU number of the failed CPU (identification number for identifying each CPU). Each CPU knows the task running on the failed CPU based on the reconfiguration table, and determines whether or not the CPU taking over the task is itself. If the task is designated to be taken over by the own CPU, the task that has been waiting to take over the task is started.

[0010] For this handover, the CPU to be handed over can be easily specified in the reconfiguration table, because it is only necessary to express the CPUs that take over tasks by a list of CPU numbers. Also,
By remembering on which CPU the task is currently being executed, the CPU that easily takes over
Can be checked.

[0011] In the reconfiguration table, the CP
When U no longer exists, information for designating whether to stop only this task or the entire system is stored. With this, it is possible to select stopping only the task or stopping the entire system.

The CPU (central process) referred to here
The sing unit includes an MPU (microprocessing unit). The task here means a unit of processing executed by the CPU, and has a broad concept including a processing unit called a process.

A program for realizing each of the above processing means by a computer can be stored in an appropriate recording medium such as a computer-readable portable medium memory, a semiconductor memory, and a hard disk.

[0014]

FIG. 1 is a block diagram showing an outline of the present invention. In the present embodiment, a multi-CPU system includes a fault-tolerant processing unit 1 and a reconfiguration table 2 for each CPU. Further, a current transition position table 4 is provided in a storage area accessible by any CPU.

The reconfiguration table 2 contains, for each task, a task ID (identifier) for identifying each task, and a CPU number (for each CPU) indicating which CPU is to take over the task being executed on the failed CPU. (Sequential numbers for identifying the IDs) and process selection information for specifying whether to stop only the task or the entire system when there is no CPU to take over.

The current transition position table 4 indicates which task each task stored in the reconfiguration table 2 is currently using.
The current transition position information indicating whether or not the operation is performed by U is indicated by the position of the sequence of the transition information in the reconfiguration table 2.

The fault-tolerant processing means 1 includes another C
When a failure occurs in a PU, a transition determination unit 11 that determines, based on transition information in the reconfiguration table 2, whether a task being executed on the failed CPU is to be taken over by itself (own CPU). When the own CPU takes over the processing of the task, the standby task 3 for activating and taking over the standby task 3 of the task, and a position indicating the current transition position of the reconfiguration table 2 indicating the own CPU And a current transition position updating unit 13 for updating the current transition position. Waiting task 3
May be generated in advance, or may be newly generated when necessary and activated by passing control.

FIG. 2 shows an example of the flow of the processing operation of the present invention. In this example, in a multiprocessor system including four CPUs numbered from CPU1 to CPU4, a task having a task ID of 101 (hereinafter, task 10) is executed.
1), and a task with a task ID of 201 (hereinafter, referred to as a task ID 201).
A task having a task ID of 202 (hereinafter, referred to as a task 202) and a task ID of 3
It is assumed that four tasks of task 01 (hereinafter referred to as task 301) are being executed.

In the reconfiguration table 2, a task ID and an order of CPU numbers which take over the task in the event of a failure are set in advance for each task as transition information.
In addition, processing selection information indicating whether to stop only the task when there is no CPU to be taken over or to stop the entire system is set. If the task of the task 101 is described as an example, the reconfiguration table 2 stores the CPU 1 → CPU 2 → CPU
It is set to take over the processing in the order of 3 → CPU4, and if there is no CPU to take over, the processing of the entire system is set to be stopped.

The current transition position table 4 contains, for each task registered in the reconfiguration table 2, information indicating the number of the currently executing CPU from the beginning of the transition information in the current transition position table. Stored as position. In the initial state where there is no failed CPU, the current transition positions are all “1”. That is, before a failure occurs, the task 101 is on the CPU 1 and the tasks 201 and 202 are
It is shown that the task 301 is being executed on the CPU 3 on the PU 2.

Assuming that the CPU 2 has failed, the CPU 1, CPU 3, and CPU 4 send C
The failure notification of PU2 is received (step S1). In each CPU, referring to the reconfiguration table 2, the CPU
A task that has been executed on 2, that is, a task in which the first current transition position in the transition information is “2 (CPU2)” is searched for (step S2). Here, CPU2
It can be seen that the tasks executed above are the tasks 201 and 202.

The CPU 1 determines the transition information (2
From (1), it is found that the CPU taking over this task is its own CPU, and the CPU 4 takes over from the transition information (2 → 4) of the task 202,
It can be seen that it is. Therefore, the CPU 1 activates the task for 201, and the CPU 4 activates the task for 202 (step S3).

The CPUs 1 and 4 update the current transition positions of the tasks 201 and 202 in the current transition position table 4 from "1" to "2", respectively (step S4).

Thereafter, it is assumed that the CPU 1, the CPU 3 and the CPU 4 are operating, and the CPU 1 further fails. CPU3, CPU4
Receives the failure notification of the CPU 1 (step S5).
The CPUs 3 and 4 perform tasks 101 and 20 in the reconfiguration table 2 based on the current transition positions 1, 2, 2, and 1, respectively.
The first, second, second, and first transition information of the transition information 1, 202, and 301 are examined, and it is known that the tasks executed by the CPU 1 are the tasks 101 and 201. When the CPU number to be taken over is obtained from the transition information of these tasks 101 and 201,
Since the CPU 2 to be taken over has already failed, the next transition information is further examined, and the next CPU 3
It turns out that it is PU. On the other hand, the task 201 knows that there is no CPU to take over (step S6).

Therefore, the CPU 3 activates the task for 101 (step S7). The task 201 having no CPU to be taken over is a "task" in the processing selection information of the reconfiguration table 2, so that only the task 201 is stopped instead of stopping the entire system. afterwards,
The current transition position of the task 101 in the current transition position table 4 is updated to "3", and the current transition position of the task 201 having no CPU to be taken over is updated to "-1" indicating "none" (step S8). .

As described above, according to the present invention, the failed CPU
By listing the CPU takeover order taking over the tasks that were running above in the reconfiguration table 2 by listing the CPU numbers, the normal CPU can determine which CPU should take over in task units as the last one. Until it can be easily specified. In addition, by indicating on which CPU the task is currently being executed,
Can be easily checked. In addition, processing when there is no CPU to be taken over can be easily set, and by simply stopping a task, it is possible to easily specify whether to continue processing with another task or stop the entire system. .

For this reason, it is not necessary to equip all CPUs with hardware such as a communication line and a disk storage device necessary for executing a certain process, and specific hardware may be used in accordance with a task processing function. CP with
Only U can take over reliably.

FIG. 3 shows a plurality of CPUs to which the present invention is applied.
An example of a system equipped with is shown. As a generally known connection form of a plurality of CPUs, there are a loosely coupled type and a tightly coupled type. The present invention can be applied in either of these forms.

FIG. 3A shows an example of a loosely-coupled connection mode, in which each of the CPUs 20-1 to 20-n has its own dedicated processor buses 21-1 to 21-n and a local memory 22.
Only the global memory 24 through the system bus 23 can be shared between the CPUs 20-1 to 20-n.

FIG. 3B shows an example of a tightly-coupled connection mode, in which each of the CPUs 30-1 to 30-m is connected to a processor bus 3.
1 and the local memory 32 are shared.
A memory space exclusively used by each of the CPUs 30-1 to 30-m and a memory space shared by the CPUs are logically divided and used.

FIG. 4 shows an example of a block configuration in a loosely-coupled multi-CPU system. Although two CPUs are shown here for simplicity of illustration, many CPUs are shown.
May be connected. Each function required for the present invention is C
Local memories 22-1 and 22-2 of PUs 20-1 and 20-1
2-2, and an area for managing common resources between CPUs is arranged in the global memory 24.

FIG. 5 shows an example of a block configuration in a tightly-coupled multi-CPU system. The means required for the present invention are arranged in the CPU dedicated memory space of the local memory 32 for each of the CPUs 30-1 and 30-2.
An area for managing common resources between U is arranged in a shared memory space provided in the local memory 32.

In FIGS. 4 and 5, the task management unit 5
1 controls a task that operates on its own CPU, activates a task waiting to be taken over when a request to take over a task is issued from the fault tolerant unit 53, and stops a task when requested to stop. The failure detection unit 52 detects a failure of its own CPU or another CPU, and notifies the other CPU of the failure via the inter-CPU communication unit 55. The fault-tolerant unit 53 detects the failure of another CPU by itself, or sends it to another CPU via the inter-CPU communication unit 55.
When the failure notification is received, it is determined with reference to the reconfiguration table 54 whether the own CPU takes over the task.
The inter-CPU communication unit 55 is a module for performing message communication between the CPUs. The global memory 24 shown in FIG. 4 or the local memory 32 shown in FIG.
In the shared memory space within the CPU, a multi-CPU control area 56 for managing common resources between CPUs is provided. In this example, the current transition position table 57 is also provided in the shared memory space.

FIG. 6 shows a processing flowchart of a program for realizing the present invention by a computer. This flowchart particularly shows a processing flow of a portion centering on the fault tolerant section 53.

First, when a failure of one CPU in the system is detected, a normal CPU is used for reconfiguration.
Synchronization is established (step S11). For the detection of a failure, a conventionally known method such as, for example, periodically exchanging a message for confirming existence between CPUs can be used. The synchronization between the CPUs is performed by the multi-CPU control area 56 or the inter-CPU communication section 55 in the shared memory space.
However, since the synchronization method is well known, a detailed description thereof will be omitted here.

After that, in order from the task at the head of the reconfiguration table 54, the task of interest runs on which CPU the task of interest is based on the current transition position obtained from the current transition position table 57 and the transition information in the reconfiguration table 54. Is checked (step S12). If the task is not already running, that is, if the current transition position obtained from the current transition position table 57 is “−1”, the process proceeds to step S21 (step S13). If the CPU indicated by the current transition position is not the stopped (failed) CPU, the process proceeds to step S21 (step S14).

If the CPU to which the task is assigned is not the task that has not been operated and the CPU to which the task has been stopped, the CPU that operates the task next is determined from the transition information in the reconfiguration table 54. Check (step S15).

If the next CPU does not exist in the transition information,
Proceed to step S23 (step S16). If the next CPU exists in the transition information, but the next CPU is also stopped (step S17), the process returns to step S15, and the CPU that operates the task next is checked again from the transition information.

If the next CPU is not the stopped CPU, it is checked whether or not the CPU taking over the task is its own CPU (step S18). If it is its own CPU, the process proceeds to step S19, and if it is not its own CPU, the process proceeds to step S21.

If the CPU that takes over the task is the own CPU, the current transition position in the current transition position table 57 is updated (step S19), and the waiting task is activated (step S20).

In step S21, the reconstruction table 54
It is checked whether or not the above processing has been performed for all the tasks in step S12, and steps S12 to S20 are repeated until the above processing is completed for all the tasks. When the above processing has been performed for all the tasks in the reconfiguration table 54, the processing is waited for by the other CPUs and synchronized (step S22). When the task takeover processing is completed and synchronized in all the normal CPUs, business processing is continued with the new task configuration.

In the process of step S15, the CPU which operates the next task is checked from the transition information.
If the next CPU does not exist (step S16), the process selection information of the task is checked (step S23). If the process selection information is a task, the current transition position table 5
The current transition position of No. 7 is set to "-1" to indicate that the task has disappeared from the system (step S24), and thereafter, the process proceeds to step S21. If the process selection information is not a task but the entire system, the entire system is stopped and the process is terminated (step S25).

As described in the above embodiment, the reconfiguration table 54 is arranged in the local memory 32 of each CPU, and the current transition position table 57 is arranged in the shared memory space. It is possible to realize high-speed access and easy management of the current transition position, and to construct a suitable fault-tolerant system. However, the reconfiguration table 54 and the current transition position table 57 are not necessarily stored in the local memory 32.
However, the present invention can be implemented even if these tables are provided in common in either the local memory 32 or the shared memory space, for example.

[0044]

Next, the processing operation of an embodiment of the present invention will be described with reference to a system having the following tasks for processing input data and outputting the processed data. This system is composed of four CPU1 to CPU4.
It is assumed that a controller capable of controlling an input device is arranged in PU3, and a controller controlling an output device is arranged in CPU2 and CPU4.

The tasks that operate in this system are: an input processing task, an output processing task, a data processing master task, and a data processing subtask.

FIG. 7 shows a configuration example of a task in an initial state. The input processing task is operated by the CPU 1 and the output processing task is operated by the CPU 2. The data processing is divided and distributed to each CPU.
The data processing subtasks arranged in the PU1 and actually processing data are arranged in all the CPUs and operated in parallel.

The data processing master task is a CPU
2, the CPU 3 and the CPU 4 wait; the input processing task is the CPU 3; the output processing task is the CPU 4;

FIG. 8 shows a setting example of the reconfiguration table and the current transition position table. The task ID, transition information, and process selection information of the reconfiguration table 54 are set as shown in FIG. Reconstruction table 54
May be incorporated in the program in advance. The input processing task is set so that when the CPU 1 breaks down, the CPU 3 takes over, and when there is no CPU to take over, the processing of the entire system is stopped.

When the CPU 2 fails, the CPU 4 takes over the output processing task.
When there is no PU, the processing of the entire system is set to be stopped. When the operating CPU fails, the data processing master task executes the CPU1, CPU2, CP
The processing is taken over by the CPUs that can be sequentially used in the order of U3 and CPU4, and when there are no more usable CPUs, the processing of the entire system is stopped. The data processing subtask 1 is set so that even if the CPU 1 fails, the other CPUs do not take over and stop the task processing. The data processing subtasks 2, 3, and 4 do not take over if the operating CPUs 2, 3, and 4 fail.

The current transition position table 57 is allocated to an area of the shared memory space, and each current transition position (a position in a sequence of transition information for indicating on which CPU each task is currently operating) is: All are set to "1" at system initialization.

Now, if a failure occurs in the CPU 2 and the system is reconfigured with the configuration excluding the CPU 2, the CPUs 1 and 2
The PU 3 and the CPU 4 refer to the transition information of the reconfiguration table 54 and the current transition position of the current transition position table 57 to check the task running on the CPU 2. Thus, the tasks operating on the CPU 2 are the “output processing task” and the “data processing subtask 2”, and the output processing task is taken over by the CPU 4 and the “data processing subtask 2” does not need to take over. You can see that.

According to the transition information, "-1" is set at the current transition position of "data processing subtask 2". CPU4
Starts the task that has been waiting to take over the “output processing task”, and displays the current transition position table 5 to indicate that the “output processing task” has been taken over by the CPU 4.
7 is updated to “2”. The task configuration in this state is as shown in FIG. The reconfiguration table 54 and the current transition position table 57 after the update
Is as shown in FIG.

Thereafter, if a failure occurs in the CPU 1 and the system is reconfigured except for the CPU 1, the CP
U3 and the CPU 4 refer to the current transition position in the current transition position table 57 and the transition information in the reconfiguration table 54, and
The task running on the CPU 1 is checked, and the tasks running on the CPU 1 are “input processing task”, “data processing master task”, and “data processing subtask 1”. It can be understood that the data processing subtask 1 does not need to be taken over. "Data processing master task" is C
It is known that PU2 takes over, but since CPU2 has already failed, the next transition information is further examined and CPU3 takes over.
Recognize that will take over. It should be noted that whether or not the CPU 2 has already failed is described in the multi-CPU control area 56 in the shared memory space, and is thereby recognized.

When the CPU 3 recognizes that the “input processing task” and the “data processing master task” are to be taken over from the transition information, the CPU 3 activates the tasks that have been waiting to take over these tasks, and “input processing task” Is updated to “2”, and the current transition position of “data processing master task” is updated to “3”. Further, “−1” is set to the current transition position of “data processing subtask 1”.
The task configuration in this state is as shown in FIG. The updated reconfiguration table 54 and current transition position table 57 are as shown in FIG.

[0055]

As described above, according to the present invention,
In a multi-CPU system, the order of the takeover can be easily specified by listing the CPU numbers in the reconfiguration table to indicate which CPU takes over the task on the failed CPU. By indicating whether a task is being executed on the CPU, it is possible to easily check the next CPU to take over.

Thus, by specifying all CPUs in the transition information, it is possible to specify that a normal CPU takes over until it becomes the last one, or to specify some specific CPUs.
You can easily specify that only one will take over.

Further, by giving the process selection information for each task in the reconfiguration table, it is possible to specify that only the task is stopped or the entire system is stopped when there is no CPU to take over. It can be set easily.

Further, since a CPU to be taken over is set in advance, a CP having hardware necessary for a task is provided.
It is also possible to ensure that only U takes over.

[Brief description of the drawings]

FIG. 1 is a block diagram showing an outline of the present invention.

FIG. 2 is a diagram showing an example of a flow of a processing operation of the present invention.

FIG. 3 is a diagram illustrating an example of a connection form of a multi-CPU system.

FIG. 4 is a diagram illustrating an example of a block configuration in a loosely coupled system.

FIG. 5 is a diagram illustrating an example of a block configuration in a tightly coupled system.

FIG. 6 is a processing flowchart of a program for realizing the present invention by a computer.

FIG. 7 is a diagram illustrating a configuration example of a task in an initial state according to the embodiment of this invention.

FIG. 8 is a diagram illustrating a setting example of a reconfiguration table and a current transition position table according to the embodiment of this invention.

FIG. 9 is a diagram for explaining a state of a task of each CPU of the system.

FIG. 10 is a diagram illustrating an example of an updated reconfiguration table and a current transition position table.

FIG. 11 is a diagram for explaining a state of a task of each CPU of the system.

FIG. 12 is a diagram illustrating an example of an updated reconfiguration table and a current transition position table.

[Explanation of symbols]

 REFERENCE SIGNS LIST 1 fault tolerant processing means 11 takeover determination unit 12 standby task activation unit 13 current transition position update unit 2 reconfiguration table 3 standby task 4 current transition position table

 ────────────────────────────────────────────────── ─── Continuation of the front page (72) Inventor Jiro Okamoto 4-1-1, Kamidadanaka, Nakahara-ku, Kawasaki-shi, Kanagawa F-term in Fujitsu Limited (Reference) 5B034 BB11 CC01 5B045 BB02 BB12 GG06 JJ09 JJ13 JJ44 5B098 AA10 GA04 JJ00

Claims (6)

[Claims] In a multiprocessor system in which a plurality of tasks, which are execution processing units of a processor, are distributed and arranged in a plurality of processors, and each processor performs processing, each task operates on a failed processor when the processor fails. Storage means for storing transition information defining a series of processors that take over a task that has been performed, and a current transition position indicating on which processor the task is currently operating; Means for determining, based on the transition information and the information on the current transition position, whether the task operating on the failed processor is a task to be taken over by the own processor, and, as a result of the determination, taking over by the own processor. In that case, the task is taken over and the task taken over by the local processor Means for operating the fault tolerant system. 2. The storage means stores, when there is no processor taking over a task, processing selection information indicating either a halt of the task or a halt of the entire system, and the processor operates on a failed processor. 2. The fault tolerant system according to claim 1, wherein when there is no processor taking over the task, the task or the entire system is stopped based on the processing selection information. 3. A fault-tolerant processing method in a multiprocessor system in which a plurality of tasks, which are execution processing units of a processor, are distributed and arranged in a plurality of processors, and each of the tasks is executed when a processor fails. Using a storage means for storing transition information defining a series of processors taking over the task that was operating on the failed processor and a current transition position indicating on which processor the task is currently operating, In the event of a failure, the processor refers to the storage means and determines whether the task operating on the failed processor is a task to be taken over by the own processor based on the transition information and the information on the current transition position, If the result of the determination is that the processor will take over, the processor A fault-tolerant processing method characterized by taking over another task and operating the task taken over by its own processor. 4. When there is no processor taking over a task, processing selection information indicating either a halt of the task or a halt of the entire system is stored in the storage means, and the task operating on the failed processor is stored. 4. The fault tolerant processing method according to claim 3, wherein when there is no processor taking over the task, the task or the entire system is stopped based on the processing selection information. 5. A recording medium on which a program for realizing a fault-tolerant processing method in a multiprocessor system by a computer is recorded, wherein for each task, a processor taking over the task that was operating on the failed processor when the processor failed. Using storage means for storing the transition information defining the series of and the current transition position indicating on which processor the task is currently operating. When a certain processor fails, the storage means is referred to. Based on the transition information and the information on the current transition position, determine whether the task operating on the failed processor is a task to be taken over by the own processor, and as a result of the determination, take over by the own processor Takes over the task, and takes over on its own processor. A program recording medium for fault-tolerant control, characterized by recording a program for causing a computer to execute a process for operating a task. 6. The fault-tolerant control program recording medium according to claim 5, wherein the program comprises:
A processor that takes over the task that has been operating on the failed processor based on the process selection information stored in the storage unit together with the transition information, the process selection information indicating either a task halt or a system halt. A program recording medium for fault-tolerant control, characterized by including a program for causing a computer to execute a process for stopping a task or the entire system when there is no such program.