JP2009205409A - Redundancy configuration system, information management method used for the redundancy configuration system and information management control program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve reliability of a device by heightening a stability degree for a restart when power sources of both an operation system and a standby system are each brought into an ON state after brought into an OFF state, in a redundancy configuration system comprising both the systems. <P>SOLUTION: Succession data M for succeeding to operation data and succession data S having the same contents as the succession data M are stored in an NVRAM (Non Volatile Random Access Memory) 31b when operation of a router device 10 restarts after a stop, by a CPU part 31a. When the power source 21 and the power source 22 each come into the OFF state, the succession data M stored in the NVRAM 31b are updated by the CPU part 31a. When the succession data M stored in the NVRAM 31b is abnormal when the power source 21 and the power source 22 each restore to the ON state from the OFF state, information about the succession data S is read, and prescribed control is performed, by the CPU part 31a. Thereby, the restart after the operation of the router device 10 stops is stably performed, so that the reliability of the router device 10 is improved. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a redundant configuration system, an information management method and an information management control program used for the redundant configuration system, and particularly suitable for use in a router device having a redundant configuration consisting of an active system and a standby system. The present invention relates to a configuration system, an information management method and an information management control program used for the redundant configuration system.

  A router device, which is one of network products, is used for connection between different types of networks, and its device control unit and power supply unit generally have a redundant configuration including an active system and a standby system. The router device configured as such a redundant configuration system operates by switching the active device control unit to the standby device control unit even if the system goes down due to a control-related failure or a power supply failure. By doing so, the failure can be recovered in a short time.

  In this type of redundant configuration system, for example, as shown in FIG. 8, a device control unit (system 0) is provided in the active system device, and a device control unit (system 1) is provided in the standby system device. Non Volatile Random Access Memory (nonvolatile RAM). Each NVRAM manages the contents of Boot (start-up) -ROM (Read Only Memory) for starting up the device and online software for realizing an operation service. In this case, when recovery is performed after the power of both systems in operation is shut down, it is necessary for each device to take over the state before and after the resumption of operation. ) Information is managed.

  Here, when the power supplies of both systems are down (power off), as shown in FIG. 9, the power supply voltage drops from the steady voltage level to the ground (GND) level due to variations in the power supply sections of both systems. The slope (a) of the voltage drop of the 0-system power supply is different from the slope (b) of the voltage drop of the 1-system power supply. For this reason, the time to reach the reset detection level of the power supply voltage differs between the 0-system power supply and the 1-system power supply. This time difference is the time X during which the NVRAMs of the device control units of both systems can operate after the reset of the power supply voltage is detected. It becomes. However, when a reset of the power supply voltage is detected by the active device control unit, a failure notification is sent to the standby device control unit, but the state change information is stored on the NVRAM by both device control units. The time required for this may be longer than the time X. For this reason, storage of state change information may not be completed in the NVRAM of both system control units at the time when the operation of the device stops due to power shutdown, and after the standby system control unit has started up, There is a problem that the active device controller may not start up.

In addition to the above-described redundant configuration system, there is, for example, a high-speed dual system control apparatus described in Patent Document 1 as a related technique of this type.
In this high-speed dual system control device, a master / slave control unit and a master / slave selection module for selecting one of the control units are provided. The master and slave control units each have a dual port memory and a control arithmetic unit. The master and slave dual port memories share control data in real time. Further, the master and slave control operation units perform the same control operation based on the control data of their own dual port memory. Furthermore, the master / slave selection module monitors and determines the abnormality of the main system and the sub system at high speed, and when one of them is abnormal, the normal one is used as the main system.

Further, in the duplex control method described in Patent Document 2, in the duplex system, the storage control unit sequentially stores the contents of changes in the main storage unit in the buffer, and notification is triggered by the separation of the main processing. To store the context of the main CPU's program counter, register, etc. in the buffer, and at the same time, start to store the changed contents of the main memory in another buffer area, and in parallel to save the contents and context of the previous buffer area The system switchover is performed by detecting the failure of the main CPU, and the use of the new main storage unit with the same contents as the old main system and the recovery of the context from there, the processing breaks. Restart. This ensures continuity of control when the main CPU fails.
Japanese Patent Laying-Open No. 2005-050088 (Abstract, FIG. 2) Japanese Patent Application Laid-Open No. 07-218902 (Abstract, Fig. 1)

However, the above techniques including the above documents have the following problems.
That is, since the power supply may be shut off before the access to the NVRAM is completed, an access protection time for the NVRAM may be provided, and the operation may not be performed while the power is turned off. However, this protection time is provided. As a result, there is a problem that the rise time is delayed by the protection time. In addition, it is difficult to adjust the protection time due to variations in the power supply units.

  In the high-speed dual system control device described in Patent Document 1, the master-slave selection module monitors and determines the abnormality of the master system and the slave system at high speed, and when one of them is abnormal, the normal one is used as the master system. However, the hardware configuration is different from that of the present invention, and the above problems are not improved.

  In the duplex control method described in Patent Document 2, the continuity of control when a failure of the main CPU is ensured, but the hardware configuration is different from the present invention, and the above problems are not improved.

  The present invention has been made in view of the above circumstances, and a redundant configuration system that stably performs a start-up operation when the power supply of both the active system and the standby system is turned on after being turned off, An object of the present invention is to provide an information management method and an information management control program used in the redundant configuration system.

  In order to solve the above-described problem, a first configuration of the present invention includes an active device control unit that performs predetermined control based on operation data, and a standby device control that is a backup for the active device control unit. A redundant configuration system comprising: an operating system power supply unit that supplies power to the operating system device control unit and the standby system device control unit; and a standby power supply unit serving as a backup for the operating system power supply unit, The active system controller controls the first takeover data for taking over the operation data when the redundant configuration system is stopped and restarted, and the second takeover data having the same contents as the first takeover data. When the active power supply unit and the standby power supply unit are turned off, the first takeover data is updated, and the active power supply unit and the standby power supply unit are turned on from the off state. When recovering to the state, If the first takeover data is normal, predetermined control is performed based on the first takeover data. If the first takeover data is abnormal, predetermined control is performed based on the second takeover data. It is the structure which performs the control of.

  According to a second configuration of the present invention, there is provided an active device controller that performs predetermined control based on operation data, a standby device controller that is reserved for the active device controller, and the active device control. An information management method used in a redundant configuration system having an operation power supply unit that supplies power to a storage system and a standby system device control unit, and a standby system power supply unit that serves as a backup for the operation system power supply unit. A first takeover data for taking over the operation data when the system unit control unit restarts after the operation of the redundant configuration system is stopped, and a second takeover having the same contents as the first takeover data Data is stored, and when the active power supply unit and the standby power supply unit are turned off, the first takeover data is updated, and the active power supply unit and the standby power supply unit are changed from the off state to the on state. Before recovery If the first takeover data is normal, predetermined control is performed based on the first takeover data, while if the first takeover data is abnormal, a predetermined control is performed based on the second takeover data. It is characterized by performing control.

  According to the configuration of the present invention, the active device control unit causes the first takeover data to take over the operation data when the operation of the redundant configuration system is stopped and then restarted, and the first takeover data; When the second takeover data having the same contents is stored and the active power supply unit and the standby power supply unit are turned off, the first takeover data is updated, and the active power supply unit and the standby power supply unit are turned off. If the first takeover data is abnormal when recovering to the ON state, predetermined control is performed based on the second takeover data. Thereby, the restart after the operation of the redundant configuration system is stopped can be stably performed, and the reliability of the redundant configuration system can be improved.

  The operational system controller has storage means and control means, and the control means uses the first takeover data to take over the operational data when the redundant configuration system is stopped and restarted, and Second takeover data having the same content as the first takeover data is stored in the storage means, and the first takeover data stored in the storage means when the active power supply unit and the standby power supply unit are turned off. Is updated, and when the active power supply unit and the standby power supply unit are restored from the OFF state to the ON state, if the first takeover data stored in the storage means is normal, the first takeover data is read. When the first takeover data is abnormal, the redundant configuration system in which the second takeover data is read and the predetermined control is performed is used for the redundant configuration system. It provides broadcast management method and an information management control program.

  In the present invention, when the first takeover data is abnormal, the control means uses the second takeover data to copy to the storage area for the first takeover data.

  In the present invention, the control means is configured to initialize the first takeover data and the second takeover data when the first takeover data and the second takeover data are abnormal.

  In the present invention, the storage means is composed of a nonvolatile RAM, and has two storage areas for storing the first takeover data and the second takeover data.

  In the present invention, the storage means is composed of a first nonvolatile RAM for storing first takeover data and a second nonvolatile RAM for storing second takeover data. .

FIG. 1 is a block diagram showing an electrical configuration of a main part of a redundant configuration system according to an embodiment of the present invention.
As shown in the figure, the redundant configuration system of this example is a router device 10 and includes a power supply unit 20 and a main body unit 30. The main body 30 includes an operation system (system 0) device control section 31, a standby system (system 1) device control section 32, a cooling fan 33, and network interfaces 34, 35, 36, and 37. Yes. The device control unit 31 includes a CPU (central processing unit) unit 31a and an NVRAM 31b. The CPU unit 31a controls the entire device control unit 31 based on an information management control program as a computer. Operation data is stored in the NVRAM 31b. Thereby, the device control unit 31 performs predetermined control based on the operation data stored in the NVRAM 31b.

  The device control unit 32 includes a CPU unit 32 a and an NVRAM 32 b, has the same function as the device control unit 31, and serves as a spare for the device control unit 31. The cooling fan 33 cools the device control units 31 and 32. The network interfaces 34, 35, 36, and 37 are connected to other networks (not shown). The power supply unit 20 includes an operation system (system 0) power supply 21 and a standby system (system 1) power supply 22. The power source 21 supplies power to the device control units 31 and 32. The power source 22 is a backup for the power source 21.

  In particular, in this embodiment, the CPU unit 31a of the device control unit 31 includes the first takeover data for taking over the operation data when the operation of the router device 10 is stopped and restarted, and the first The second takeover data having the same content as the takeover data is stored in the NVRAM 31b, and when the power supply 21 and the power supply 22 are turned off (down state), the first takeover data stored in the NVRAM 31b is updated. In addition, when the first takeover data stored in the NVRAM 31b is normal when the power supply 21 and the power supply 22 are restored from the off state to the on state, the CPU 31a reads the first takeover data and performs predetermined processing. On the other hand, if the first takeover data is abnormal, the second takeover data is read and predetermined control is performed. Further, when the first takeover data is abnormal, the CPU 31a uses the normal second takeover data to copy to the first takeover data storage area and update the first takeover data. Further, when the first takeover data and the second takeover data are abnormal, the CPU unit 31a initializes the first takeover data and the second takeover data.

FIG. 2 is a diagram showing a memory map of the NVRAM 31b in FIG.
As shown in FIG. 2, the NVRAM 31b has two storage areas for storing takeover data M (first takeover data) and takeover data S (second takeover data) in the memory area. ing. The takeover data M includes detailed information p1, and the detailed information p1 is composed of takeover information m1, m2,. The takeover information m1 includes detailed information p2, and the detailed information p2 includes, for example, “restart date / time”, “failure factor”, “diagnosis result”, “stored information”, and the like. The takeover data S (standby) is composed of the same information as the takeover data M. The NVRAM 32b is configured similarly to the NVRAM 31b.

FIG. 3 is a sequence diagram illustrating an operation when the CPU unit 31a fails to read from the takeover data M. FIG. 4 illustrates an operation when the CPU unit 31a succeeds in reading the takeover data M in the restart. FIG. 5 is a sequence diagram for explaining the operation when the CPU unit 31a fails to read the takeover data M at the restart. FIG. 6 is a sequence diagram for reading the takeover data M and S when the CPU unit 31a is restarted. FIG. 7 is a flowchart for explaining the operation when the CPU unit 31a accesses the NVRAM 31b when the router device 10 is started up.
With reference to these drawings, processing contents of the information management method used in the router device 10 of this example will be described.

  In the router device 10, the CPU unit 31a causes the NVRAM 31b to transfer to the NVRAM 31b the takeover data M for taking over operation data when the operation of the router device 10 is stopped and restarted, and the takeover data S having the same contents as the takeover data M. Remembered. When the power source 21 and the power source 22 are turned off (down state), the CPU 31a updates the takeover data M stored in the NVRAM 31b, and the power source 21 and the power source 22 are restored from the off state to the on state. If the takeover data M stored in the NVRAM 31b is normal, the takeover data M is read and predetermined control is performed. On the other hand, if the takeover data M is abnormal, the CPU 31a reads the information of the takeover data S and performs predetermined control. When the takeover data M is abnormal, the CPU 31a copies the takeover data M to the storage area of the takeover data M using the normal takeover data S. In addition, when the takeover data M and the takeover data S are abnormal, the CPU 31a initializes the takeover data M and the takeover data S.

  That is, when the CPU unit 31a fails to read from the takeover data M, as shown in FIG. 3, when a failure occurs in the connected network, the CPU unit 31a is notified of the failure and stored in the NVRAM 31b. When a change in state occurs in the operation data being stored and the takeover data M is stored in the NVRAM 31b, first, a write request for saving information to the memory area of the takeover data M in the NVRAM 31b is made from the CPU unit 31a ( Step A1), the stored information is updated (Step A2). Then, the diagnosis result of the stored information is updated to normal (OK) (step A3), and a write completion notification (“normal end”) is returned to the CPU unit 31a (step A4). After the result is received by the CPU unit 31a, as a next operation, a write request is made from the CPU unit 31a to the memory area of the takeover data S of the NVRAM 31b (step A5). Similarly, the storage information for the takeover data S is updated (step A6), and when it is updated normally, the diagnosis result is updated (OK) (step A7), and a write completion notification (“normal end”) is sent to the CPU unit 31a. The process ends normally (step A8).

  On the other hand, during the process of step A2, the operation of the router device 10 may stop due to a drop in power supply voltage. In this case, since the operation of the router device 10 is stopped while the takeover data M of the NVRAM 31b is being updated, the stored information is destroyed and cannot be stored normally. For this reason, the process after step A3 is not performed. Since the CPU 31a does not receive the write completion notification (normal end) of the takeover data M, the stored information in the NVRAM 31b is referred to from the takeover data S. Thereby, in the CPU unit 31a, the takeover data S of the NVRAM 31b is referred to as a normal state in which memory access is not performed when the power is stopped.

  When the CPU unit 31a succeeds in reading the takeover data M in the restart, as shown in FIG. 4, the information stored in the takeover data M in the NVRAM 31b is read out by the CPU unit 31a at the time of restart. If it is diagnosed whether or not the state before resumption is normally stored (step B1), and the diagnosis result is determined to be normal (OK) (step B2), “diagnosis result OK” is output from the NVRAM 31b to the CPU unit. 31a is notified (step B3), the stored information stored in the takeover data M is read (steps B4 and B5), and the information is developed in the CPU unit 31a (reading complete, step B6). Then, the storage information of the takeover data M read to the CPU unit 31a is written in the memory area of the takeover data S (step B7), and a write completion notification is returned to the CPU unit 31a (step B8).

  Further, when the CPU unit 31a fails to read the takeover data M in the restart, as shown in FIG. 5, the information stored in the takeover data M in the NVRAM 31b is read by the CPU unit 31a at the time of restart. If it is diagnosed whether or not the state before resumption is normally stored (step C1), and the diagnosis result is determined to be abnormal (NG) (step C2), “diagnosis result NG” is output from the NVRAM 31b to the CPU unit. It is notified to 31a (step C3). Then, the storage information is read from the takeover data S by the CPU unit 31a. That is, the CPU 31a reads the information stored in the takeover data S in the NVRAM 31b, diagnoses whether or not the state before the restart is normally saved (step C4), and the diagnosis result is normal (OK). ) (Step C5), the diagnosis result OK is notified from the NVRAM 31b to the CPU 31a (step C6), and the stored information stored in the takeover data S is read (steps C7 and C8). Information is developed in the CPU unit 31a (reading complete, step C9).

  Thereafter, when the information of the takeover data S is normally read out, the CPU 31a initializes the diagnosis result for the takeover data M in the NVRAM 31b (step C10), and the diagnosis result is “NG” in the takeover data M. Is set to "OK" (step C11), and "initialization completion of diagnosis result" is notified from the NVRAM 31b to the CPU unit 31a (step C12). Then, the storage information is written from the CPU unit 31a to the takeover data M of the NVRAM 31b (step C13). In this case, the information of the takeover data S read by the CPU unit 31a is copied to the storage area of the takeover data M (storage, step C14). The NVRAM 31b notifies the CPU unit 31a of "write complete" (step C15), whereby normal takeover data information is managed in two planes with the same contents on the NVRAM 31b.

  Further, when the CPU unit 31a fails to read the takeover data M and S in the restart, as shown in FIG. 6, the information stored in the takeover data M in the NVRAM 31b by the CPU unit 31a is shown in FIG. It is read and diagnosed whether or not the state before resumption is normally stored (step D1), and when the diagnosis result is determined to be abnormal (NG) (step D2), “diagnosis result NG” is output from the NVRAM 31b. The CPU unit 31a is notified (step D3). Then, the CPU unit 31a reads the information stored in the takeover data S in the NVRAM 31b, diagnoses whether or not the state before resumption is normally saved (step D4), and the diagnosis result is abnormal (NG ) (Step D5), the NVRAM 31b notifies the CPU unit 31a of “diagnosis result NG” (step D6).

  Thereafter, the CPU 31a initializes the stored information for the takeover data M of the NVRAM 31b (steps D7 and D8). Then, “initialization completion” is notified from the NVRAM 31b to the CPU unit 31a (step D9), and the storage information is written to the takeover data S of the NVRAM 31b by the CPU unit 31a (step D10). In this case, the information of the takeover data M (initialization state information) read by the CPU unit 31a is copied to the memory area of the takeover data S (storage, step D11). Then, “write complete” is notified from the NVRAM 31b to the CPU unit 31a (step D12).

  When the takeover data M and S are initialized, processing is performed with priority given to the startup of the router device 10. That is, when the router device 10 is started up, the CPU unit 31a accesses the NVRAM 31b, and as shown in FIG. 7, the information of the takeover data M is read (step E1), and the diagnosis result is normal (OK). If this is the case (step E2), the stored information is read (step E3), and the information of the takeover data M is expanded to the CPU unit 31a (step E4).

  If the diagnosis result is abnormal in step E2, information (preliminary) of the takeover data S is read (step E5). If the diagnosis result is normal (OK) (step E6), the stored information is read. When the reading is normally performed (OK, step E8), the diagnosis result of the takeover data M is initialized (step E9), and the stored information is copied (step E10). In this case, the information of the takeover data S stored in the CPU unit 31a is written in the memory area of the takeover data M. Then, the process proceeds to Step E4. If the diagnosis result is abnormal in step E6, the stored information is initialized as no takeover data (step E11), and the process proceeds to step E4. Further, when the reading is not normally performed in step E8, the process proceeds to step E4 via step E11.

  As described above, in this embodiment, the CPU unit 31a causes the takeover data M to take over the operation data when the operation of the router device 10 is stopped and restarted, and the takeover data having the same contents as the takeover data M. When S is stored in the NVRAM 31b and the power source 21 and the power source 22 are turned off, the takeover data M stored in the NVRAM 31b is updated by the CPU 31a, and the power source 21 and the power source 22 are restored from the off state to the on state. At this time, if the takeover data M stored in the NVRAM 31b is abnormal, the CPU 31a reads the information of the takeover data S and performs predetermined control. Thereby, the restart after the operation of the router device 10 is stopped is stably performed, and the reliability of the router device 10 is improved.

The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to the embodiment, and even if there is a design change without departing from the gist of the present invention, Included in the invention.
For example, in the above embodiment, the NVRAM 31b has two storage areas for storing the takeover data M and S. However, the NVRAM 31b may be composed of two NVRAMs for storing the takeover data M and S, respectively. . As a result, substantially the same operation and effect as in the above embodiment can be obtained, and information can be left even when one NVRAM is physically damaged (corresponding to claim 6).

  The present invention can be applied not only to the router device but also to all redundant configuration systems that operate based on operation data.

It is a block diagram which shows the electric constitution of the principal part of the redundant configuration system which is one Example of this invention. It is a figure which shows the memory map of NVRAM31b in FIG. FIG. 11 is a sequence diagram illustrating an operation when the CPU unit 31a fails to read from the takeover data M. It is a sequence diagram explaining operation | movement when CPU part 31a succeeds in reading of the taking over data M in restart. It is a sequence diagram explaining operation | movement when CPU part 31a fails in reading of the taking over data M in restart. It is a sequence diagram explaining operation | movement when CPU part 31a fails in reading of the taking over data M and S in restart. 7 is a flowchart illustrating an operation when the CPU unit 31a accesses the NVRAM 31b when the router device 10 is started up. It is a figure explaining the problem of the conventional redundant configuration system. It is a figure explaining the problem of the conventional redundant configuration system.

Explanation of symbols

10 Router device (redundant configuration system)
20 Power supply part (part of router device)
21 Power supply (operational power supply unit)
22 Power supply (standby power supply)
30 Main body (part of redundant configuration system)
31 Device Control Unit (Operational Device Control Unit)
31a CPU (central processing unit) section (control means)
31b NVRAM (storage means)
32 Device control unit (standby system device control unit)
32a CPU section (part of standby system control section)
32b NVRAM (part of standby system controller)
34, 35, 36, 37 Network interface (part of router device)
M takeover data (first takeover data)
S Takeover data (second takeover data)

Claims (11)

An active system controller that performs predetermined control based on operational data, a standby system controller that is a spare for the active system controller, and a power source for the active system controller and the standby system controller A redundant configuration system having an operation system power supply unit that supplies a standby system power supply unit that serves as a backup for the operation system power supply unit,
The operational system controller is
Storing the first takeover data for taking over the operation data when the operation of the redundant configuration system is stopped and restarted, and the second takeover data having the same content as the first takeover data; When the active power supply unit and the standby power supply unit are turned off, the first takeover data is updated, and when the active system power supply unit and the standby power supply unit are restored from the off state to the on state, the first takeover data is updated. If one takeover data is normal, predetermined control is performed based on the first takeover data. If the first takeover data is abnormal, predetermined control is performed based on the second takeover data. A redundant configuration system characterized in that the system is configured to perform. An active system controller that performs predetermined control based on operational data, a standby system controller that is a spare for the active system controller, and a power source for the active system controller and the standby system controller A redundant configuration system having an operation system power supply unit that supplies a standby system power supply unit that serves as a backup for the operation system power supply unit,
The operational system controller is
Storage means;
When the operation of the redundant configuration system is stopped and restarted, the first takeover data for taking over the operation data and the second takeover data having the same contents as the first takeover data are stored in the storage unit. When the operating power supply unit and the standby power supply unit are turned off, the first takeover data stored in the storage unit is updated, and the operating power supply unit and the standby power supply unit are When the first takeover data stored in the storage means is normal when recovering from the off state to the on state, the first takeover data is read and predetermined control is performed. A redundant configuration system comprising: control means for reading out the second takeover data and performing predetermined control if the takeover data is abnormal. The control means includes
When the first takeover data is abnormal,
3. The redundant configuration system according to claim 2, wherein the second handover data is copied to a storage area for the first handover data. The control means includes
4. The configuration according to claim 2, wherein the first takeover data and the second takeover data are initialized when the first takeover data and the second takeover data are abnormal. 5. Redundant configuration system. The storage means
5. The redundant configuration system according to claim 2, wherein the redundant configuration system comprises a nonvolatile RAM and has two storage areas for storing the first takeover data and the second takeover data. The storage means
A first non-volatile RAM for storing the first takeover data;
5. The redundant configuration system according to claim 2, comprising a second nonvolatile RAM for storing the second takeover data. An active system controller that performs predetermined control based on operational data, a standby system controller that is a spare for the active system controller, and a power source for the active system controller and the standby system controller An information management method used in a redundant configuration system having an operation system power supply unit that supplies a standby system power supply unit that serves as a backup for the operation system power supply unit,
A first takeover data for taking over the operation data when the active device control unit restarts after the operation of the redundant configuration system is stopped, and a second of the same contents as the first takeover data When the active power supply unit and the standby power supply unit are turned off, the first takeover data is updated, and the active power supply unit and the standby power supply unit are turned on from the off state. When the state is restored, if the first takeover data is normal, predetermined control is performed based on the first takeover data, while if the first takeover data is abnormal, the second takeover data An information management method characterized by performing predetermined control based on takeover data. An active system controller that performs predetermined control based on operational data, a standby system controller that is a spare for the active system controller, and a power source for the active system controller and the standby system controller An information management method used in a redundant configuration system having an operation system power supply unit that supplies a standby system power supply unit that serves as a backup for the operation system power supply unit,
A storage unit and a control unit are provided in the operational system control unit,
First takeover data for taking over the operation data when the control means restarts after the operation of the redundant configuration system is stopped, and second takeover data having the same content as the first takeover data Is stored in the storage means, and when the active power supply unit and the standby power supply unit are turned off, the first takeover data stored in the storage unit is updated, and the active power supply unit and the standby power supply unit are updated. When the system power supply unit recovers from the off state to the on state, if the first takeover data stored in the storage means is normal, the first takeover data is read and predetermined control is performed. If the first takeover data is abnormal, the second takeover data is read and predetermined control is performed.   9. The information management method according to claim 8, wherein when the first takeover data is abnormal, the control means uses the second takeover data to copy to the storage area for the first takeover data. .   10. The control unit according to claim 8 or 9, wherein the control means initializes the first takeover data and the second takeover data when the first takeover data and the second takeover data are abnormal. Information management method.   An information management control program for causing a computer to control the redundant configuration system according to any one of claims 1 to 6.

Images