JP2013149128A - Computer system, power supply disconnection processing device, power supply disconnection processing method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a computer system including a diagnostic processor for diagnosing a computer when a failure occurs in the computer, in which the computer can be protected more promptly than before.SOLUTION: A flag management unit 252 sets a value of a state flag on the basis of whether or not expiration in a timer unit 241 occurs and a signal from a diagnostic processor 110. When a failure detection unit 230 detects a failure that requires disconnection of a power supply of a computer 300, a processing selection unit 280 selects shut-down processing by the diagnostic processor 110 or disconnection of the power supply of the computer 300 by a power supply disconnection unit 210 on the basis of the state flag value and causes the processor or the unit to perform the selected processing. Therefore, a processing selection execution unit 282 can cause the diagnostic processor 110 or the power supply disconnection unit 210 to perform processing without waiting for expiration of a watch dog timer (timer unit 241) after the failure detection unit 230 detects a failure, thereby enabling more prompt protection of the computer.

Description

  The present invention relates to a computer system, a power-off processing apparatus, a power-off processing method, and a program.

Patent Document 1 discloses a computer system that detects an abnormality of a diagnostic processor using a timer.
Specifically, the computer system includes a diagnosis processor, a failure monitoring unit that monitors a failure of a diagnosis target device that is a diagnosis target of the diagnosis processor, a timer, and a system control unit. When the failure monitoring unit detects the occurrence of a failure in the diagnosis target device, the failure monitoring unit generates a failure interrupt and starts counting up the timer.
When the diagnostic function of the diagnostic processor is normal, the timer clear means instructs the timer reset at the timing when the diagnostic processor detects a failure interrupt. On the other hand, when the diagnostic function of the diagnostic processor is disabled, the timer clear means does not operate and does not give a timer reset instruction. When the timer expires because the timer reset instruction is not issued, the system control unit stops the operation of the computer system.

  Thus, in the computer system described in Patent Document 1, it is possible to detect an abnormality in the diagnostic processor when the timer expires. Then, the system control unit stops the operation of the computer system in accordance with the expiration of the timer, so that when the failure occurs in the diagnostic processor, the operation of the computer system is continued while the diagnosis target device 45 remains in the failure state. Can be avoided.

JP 2009-3706 A

  Thus, in a computer system that detects an abnormality in a diagnostic processor, if the presence or absence of an abnormality in the diagnostic processor can be quickly determined, the computer (diagnosis device) can be protected more quickly.

  An object of the present invention is to provide a computer system, a power-off processing apparatus, a power-off processing method, and a program that can solve the above-described problems.

  The present invention has been made to solve the above-described problems, and a computer system according to an aspect of the present invention includes a computer, a failure detection unit that detects a failure that requires the computer to be turned off, and the computer. A power-off unit that cuts off the power, a diagnostic processor that shuts off the power of the computer in a shutdown process for the computer, a watchdog timer that detects a failure state of the diagnostic processor when the count expires, and a diagnostic processor Based on a diagnostic processor status information storage unit for storing diagnostic processor status information indicating a status, a signal indicating expiration of the watchdog timer, and a signal indicating that the diagnostic processor is operating from the diagnostic processor A diagnostic processor state information setting unit for setting a value of the diagnostic processor state information; and When the detection unit detects a failure that requires the computer to be powered off, the diagnostic processor performs the shutdown process based on the value of the diagnostic processor state information, or the power-off unit causes the computer to power off the computer. And a process selection section that selects and executes whether or not to disconnect.

  The power-off processing apparatus according to one aspect of the present invention includes a failure detection unit that detects a failure that requires a computer to be turned off, a power-off unit that turns off the computer, and a shutdown process for the computer. A watchdog timer for detecting a failure state of a diagnostic processor for cutting off the power supply of the computer when the count expires, a diagnostic processor state information storage unit for storing diagnostic processor state information indicating the state of the diagnostic processor, and the watch A diagnostic processor state information setting unit for setting a value of the diagnostic processor state information based on a signal indicating expiration of a dog timer and a signal indicating that the diagnostic processor is operating from the diagnostic processor; When the failure detection unit detects a failure that requires powering off the computer, the diagnostic processor A process selection unit that selects and executes whether to cause the diagnostic processor to perform the shutdown process or to cause the power-off unit to turn off the power of the computer based on a value of state information, To do.

  A power-off processing method according to an aspect of the present invention is a power-off processing method for a power-off processing apparatus that includes a diagnostic processor that performs a shutdown process on a computer and a power-off unit that cuts off the power of the computer. A failure state of a diagnostic processor that turns off the power of the computer in a shutdown process for the computer, a watchdog timer step that detects when the count expires, and a signal that indicates the expiration of the count in the watchdog timer step; A diagnostic processor status information setting step for setting a value of diagnostic processor status information indicating the status of the diagnostic processor based on a signal from the diagnostic processor indicating that the diagnostic processor is operating; and a power supply for the computer Fault detection step for detecting faults that require disconnection In the fault detection step, when a fault that requires the computer to be powered off is detected, the diagnostic processor is caused to perform the shutdown process based on the value of the diagnostic processor state information, or the power cut-off unit And a process selection step of selecting and executing whether to turn off the power of the computer.

  According to another aspect of the present invention, there is provided a program for shutting down a computer, including a diagnostic processor that performs a shutdown process for the computer, and a computer that controls a power cut-off processing device that turns off the power of the computer. A watchdog timer step for detecting a failure state of the diagnostic processor which cuts off the power supply of the computer by processing at the expiration of the count, a signal indicating the expiration of the count in the watchdog timer step, and A diagnostic processor status information setting step for setting a value of diagnostic processor status information indicating the status of the diagnostic processor based on a signal indicating that the diagnostic processor is operating; and a fault that requires powering off the computer A fault detecting step for detecting In the harm detection step, when a failure that requires the computer to be turned off is detected, based on the value of the diagnostic processor state information, the diagnostic processor is caused to perform the shutdown process, or the power cut-off unit And a process selection step for selecting and executing whether to turn off the power of the program.

  According to the present invention, the computer can be protected more quickly.

FIG. 1 is a schematic block diagram showing a functional configuration of a computer system according to an embodiment of the present invention. 4 is a flowchart illustrating a procedure of processing performed by a diagnostic processor (embedded software) in the embodiment. 6 is a flowchart illustrating a procedure of processing performed by the relay package in the embodiment. 6 is a flowchart illustrating a procedure of processing performed by the relay package in the embodiment. It is a schematic block diagram which shows the minimum structure of this invention among each part in the embodiment.

  Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a schematic block diagram showing a functional configuration of a computer system according to an embodiment of the present invention. In FIG. 1, the computer system 1 includes a diagnostic processor mounting card 100, a relay package (power-off processing device) 200, and a computer 300. The diagnostic processor card 100 includes a diagnostic processor 110 and a removal signal transmission unit 130. The diagnostic processor 110 includes embedded software 120. The relay package 200 includes a power-off unit 210, a data storage unit 221, a simple log writing unit (log writing unit) 222, a failure detection unit 230, a timer unit (watchdog timer) 241, and a timer management unit 242, a flag storage unit (diagnostic processor state information storage unit) 251, a flag management unit (diagnostic processor state information setting unit) 252, an extraction signal reception unit (extraction detection unit) 260, a reboot processing unit 270, and a process And a selection unit 280. The process selection unit 280 includes a time margin determination unit 281 and a process selection execution unit 282.

The computer 300 is a computer (computer) that is diagnosed by the diagnostic processor 110. When a failure occurs in the computer 300, the relay package 200 (failure detection unit 230) detects the failure, and the diagnosis processor 110 performs a diagnosis.
Note that the present invention does not depend on the contents of processing performed by the computer 300. That is, the present invention can be applied to computers for various purposes.

  The diagnostic processor mounting card 100 is a card (board) on which the diagnostic processor 110 is mounted. For example, the diagnostic processor mounting card 100 operates by being inserted into a card insertion slot of a diagnostic device in which the relay package 200 is mounted. Here, the diagnosis device and the computer 300 may be configured as one device or may be configured as separate devices. That is, the diagnostic processor-equipped card 100 may be installed in the computer 300, or may be installed in a casing separate from the computer 300.

When the failure detection unit 230 detects a failure of the computer 300, the diagnosis processor 110 performs a state diagnosis of the computer 300 via the diagnosis paths W11 and W12. In particular, when the failure detection unit 230 detects a failure that requires the computer 300 to be powered off, the diagnostic processor 110 turns off (OFF) the computer 300 in a shutdown process for the computer 300. By performing the shutdown process, the diagnostic processor 110 saves data and the OS (
The power of the computer 300 can be shut off more safely by protecting the operating system).

The embedded software 120 is software executed by the diagnostic processor 110. The diagnostic processor 110 operates by executing the embedded software 120.
The removal signal transmission unit 130 transmits a removal signal, which is a signal for detecting removal of the diagnostic processor card 100, to the removal signal receiving unit 260. For example, the removal signal transmission unit 130 transmits a removal signal at the timing when the diagnostic processor card 100 is removed, and the removal signal reception unit 260 detects the removal of the card by receiving the removal signal.

The relay package 200 relays signals transmitted and received between the diagnostic processor card 100 and the computer 300, and detects a failure of the computer 300.
The power cut-off unit 210 cuts off the power supply of the computer 300. Here, the power cut-off unit 210 does not perform a shutdown process on the computer 300, for example, by turning off the power supply of the computer 300 by opening (OFF) a switch provided in a power supply path to the computer 300. Turn off the power. Therefore, the power-off of the computer 300 performed by the power-off unit 210 is not as safe as the power-off performed by the diagnostic processor 110 in terms of data storage and OS protection. However, since the power-off unit 210 cuts off the power of the computer 300 by a simpler process than the diagnostic processor 110, the power of the computer 300 can be turned off more reliably.

The data storage unit 221 includes a semiconductor memory, for example, and stores various data. In particular, the data storage unit 221 stores a simple log written by the simple log writing unit 222.
The simple log writing unit 222 writes a simple log in the data storage unit 221 according to the operation of the relay package 200. In particular, the simple log writing unit 222 writes the simple log in the data storage unit 221 when the power-off unit 210 turns off the power of the computer 300. For example, the simple log writing unit 222 writes information indicating the state of the computer 300, such as the time when the failure detection unit 230 detects the failure of the computer 300 and the type of failure, into the data storage unit 221 in a simple log. In addition, for example, the simple log writing unit 222 writes information indicating the state of the diagnostic processor loaded card 100 such as whether or not the diagnostic processor loaded card 100 is detected to be included in the simple storage log in the data storage unit 221. Further, for example, the simple log writing unit 222 writes in the data storage unit 221 by including information indicating that the power-off unit 210 has turned off the power of the computer 300 (or that the computer 300 has been turned off) and the corresponding time in a simple log.
As described above, the simple log writing unit 222 writes the simple log in the data storage unit 221, so that the administrator of the computer system 1 can use the simple log to investigate the cause of the failure and take countermeasures. it can.

The failure detection unit 230 detects a failure in the computer 300 and outputs a signal indicating that the failure has been detected and the type of failure to the processing selection unit 280. In particular, the failure detection unit 230 detects a failure that requires the computer 300 to be powered off.
Here, the failure requiring the power off of the computer 300 includes, for example, a failure requiring the power off to protect the computer 300 such as an unstable power supply voltage of the computer 300, or a CPU of the computer 300. Examples include, but are not limited to, a failure that requires power-off to restore the state of the computer 300, such as when the (Central Processing Unit) falls into a halt state.

The timer unit 241 includes a timer for measuring time, and functions as a watchdog timer that detects a failure state of the diagnostic processor 110 when the count expires. That is, the diagnostic processor 110 resets the timer unit 241 at regular intervals via the signal path W24 and the timer management unit 242, and the timer unit 241 measures the elapsed time from the reset. Here, the time interval at which the diagnostic processor 110 resets the timer unit 241 is set to be shorter than the count expiration time of the timer unit 241, and when the diagnostic processor 110 is operating normally, the count of the timer unit 241 is Does not expire. On the other hand, when the failure occurs in the diagnostic processor 110 and the timer unit 241 is not reset, the count of the timer unit 241 expires. The timer unit 241 detects a failure state of the diagnostic processor 110 when the count expires.
The timer unit 241 also functions as a timer for measuring a waiting time when the time margin determining unit 281 waits for the recovery of the diagnostic processor 110.

  The timer management unit 242 manages the timer unit 241 such as resetting the timer unit 241 (resetting the count value of the timer included in the timer unit 241), executing counting, or stopping counting. In particular, when the timer management unit 242 receives a reset signal from the diagnostic processor 110, the timer management unit 242 resets the timer unit 241 according to the reset signal (that is, sets the measurement time to 0) and causes the count to be executed.

  In addition, the timer management unit 242 detects a failure state of the diagnostic processor 110 by detecting that the count of the timer unit 241 has expired. The timer management unit 242 then reboots the diagnostic processor 110, sets the status flag value to “0” (a value indicating that shutdown processing is not possible), and resets and counts the timer unit 241. Execute. Specifically, the timer management unit 242 outputs information indicating that a failure has been detected to the reboot processing unit 270 and the flag management unit 252, and resets the timer unit 241 to execute counting.

The flag storage unit 251 stores a status flag as diagnostic processor status information indicating the status of the diagnostic processor 110. This status flag is a value “1” and indicates that the shutdown process is possible (the diagnostic processor 110 is in a state where the shutdown process of the computer 300 can be executed). In addition, this state flag is a value “0” and indicates that the shutdown process is not possible (the diagnosis processor 110 is in a state where the shutdown process of the computer 300 cannot be executed).
However, the diagnostic processor state information stored in the flag storage unit 251 is not limited to the flag format information. For example, the flag storage unit 251 may store text data indicating the state of the diagnostic processor 110 as a character string as diagnostic processor state information.

  The flag management unit 252 sets and reads the value of the status flag stored in the flag storage unit 251. In particular, the flag management unit 252 is based on a signal indicating that the timer unit 241 has expired and a signal indicating that the diagnostic processor 110 is operating from the diagnostic processor 110 (in this embodiment, a boot completion notification). Sets the value of the status flag. Specifically, when the flag management unit 252 receives an output of a signal indicating that the timer unit 241 has expired, the flag management unit 252 sets the value of the status flag to “0”. Further, when the flag management unit 252 acquires a signal indicating that the diagnostic processor 110 is operating, the flag management unit 252 sets the value of the status flag to “1”. In addition, when the removal signal receiving unit 260 detects removal of the diagnostic processor-equipped card 100, the flag management unit 252 sets the value of the status flag to “0” (a value indicating that shutdown processing is not possible).

  The removal signal receiving unit 260 detects removal of the diagnostic processor loaded card 100 on which the diagnostic processor 110 is mounted. Specifically, as described above, the removal signal transmission unit 130 transmits a removal signal at the timing at which the diagnostic processor-equipped card 100 is removed, and the removal signal reception unit 260 receives the removal signal to receive the card. Detect removal of. However, the method by which the removal signal receiver 260 detects removal of the diagnostic processor card 100 is not limited to this. For example, the removal signal transmission unit 130 always transmits a signal, and the removal signal reception unit 260 determines that the signal transmitted by the removal signal transmission unit 130 cannot be received, thereby removing the card 100 mounted with the diagnostic processor. You may make it detect. In addition, the signal transmitted by the removal signal transmission unit 130 may be a radio wave or a signal other than a radio wave such as infrared rays. Furthermore, the removal signal receiving unit 260 includes a switch that is depressed when the diagnostic processor card 100 is inserted, and detects that the diagnostic processor card 100 is removed by determining that the switch is not depressed. The removal of the diagnostic processor card 100 may be detected by a method other than the communication with the removal signal transmission unit 130.

The reboot processing unit 270 causes the diagnostic processor 110 to reboot. Specifically, the reboot processing unit 270 outputs a reboot instruction to the diagnostic processor 110 via the signal path W23 in accordance with a signal from the timer management unit 242 or a signal from the processing selection unit 280, whereby the diagnostic processor 110 Reboot.
When the failure detection unit 230 detects a failure that requires the computer 300 to be powered off, the process selection unit 280 causes the diagnostic processor 110 to perform a shutdown process based on the value of the state flag, or causes the power cut-off unit 210 to The computer 300 is selected to be turned off and executed.

When the failure detection unit 230 detects a failure that requires the computer 300 to be powered off and the value of the status flag is “0” (a value indicating that shutdown processing is not possible), the time margin determination unit 281 It is determined whether or not there is a time allowance until the computer 300 is powered off.
The process selection execution unit 282 waits for the recovery of the diagnostic processor 110 when the time margin determination unit 281 determines that there is a time margin. Specifically, the process selection execution unit 282 determines that the value of the status flag is “1” (a value indicating that the shutdown process is possible) before a predetermined time elapses from the determination that the time margin determination unit is present. Causes the diagnostic processor 110 to perform a shutdown process. On the other hand, if the value of the diagnostic processor state information does not become “1” (a value indicating that the shutdown process is possible) before the predetermined time elapses, the process selection execution unit 282 sends the power-off unit 210 to the computer 300. Turn off the power.

Next, the operation of the computer system 1 will be described with reference to FIGS.
FIG. 2 is a flowchart showing a procedure of processing performed by the diagnostic processor 110 (embedded software 120). When the diagnostic processor 110 is started by being connected (ON) with the power of the diagnostic processor 110, and when the diagnostic processor 110 is restarted upon receiving a reboot instruction from the reboot processing unit 270 via the signal path W23, the processing of FIG. To start.

  In the process of FIG. 5, the diagnostic processor 110 (embedded software 120) first performs a boot process (start-up process) of the diagnostic processor 110 itself (step S101). When the boot process is completed, the embedded software 120 outputs a boot completion notification indicating the completion of the boot to the timer management unit 242, the flag management unit 252, and the process selection unit 280 via the signal path W24 (step S102).

  Next, the embedded software 120 determines whether it is time to reset the timer unit 241 (step S111). Specifically, the diagnostic processor 110 has a timer whose expiration time is shorter than that of the timer unit 241 (in order to distinguish from the timer unit 241, here, referred to as “internal timer”). The elapsed time after resetting the unit 241 is measured. Then, the embedded software 120 determines that the timing for resetting the timer unit 241 has come when the internal timer expires.

  If it is determined in step S111 that the timing for resetting the timer unit 241 has come (step S111: YES), the embedded software 120 resets the timer unit 241 (step S112). Specifically, the embedded software 120 outputs a timer reset signal instructing reset of the timer unit 241 to the timer management unit 242 via the signal path W24, thereby causing the timer management unit 242 to reset the timer unit 241. .

Next, the embedded software 120 determines whether or not a failure has occurred in the computer 300 (step S121). Specifically, the embedded software 120 determines whether or not a failure detection notification (a signal indicating that a failure has occurred in the computer 300) has been acquired from the processing selection unit 280 via the signal path W22.
When it is determined that no failure has occurred in the computer 300 (step S121: NO), the process returns to step S111.

  On the other hand, when it is determined that a failure has occurred in the computer 300 (step S121: YES), the embedded software 120 determines whether or not the failure requires a power-off of the computer 300 (step S131). Specifically, the process selection unit 280 outputs information indicating the type of failure in the failure detection notification to the diagnosis processor 110, and the embedded software 120 needs to turn off the computer 300 based on the information. It is determined whether or not there is a failure.

If it is determined that the failure does not require the computer 300 to be powered off (step S131: NO), the embedded software 120 diagnoses the computer 300 via the diagnostic paths W11 and W12, and if there is a recoverable failure. A restoration process is performed, and a diagnosis result and a record of the restoration process are stored in a log (step S141). The embedded software 120 may record a log in a storage device included in the diagnostic processor 110, or may record a log outside the diagnostic processor 110 such as the data storage unit 221.
After step S141, the process returns to step S111.

On the other hand, if it is determined that the computer 300 needs to be powered off (step S131: YES), the embedded software 120 diagnoses the computer 300 via the diagnostic paths W11 and W12, and there is a recoverable failure. If there is, a restoration process is performed, and a diagnosis result and a record of the restoration process are stored in a log (step S151).
Further, the embedded software 120 causes the computer 300 to generate a data backup (temporary storage file) and store a record of the processing in a log (step S152).

Further, the built-in software 120 turns off the power of the computer 300 in the shutdown process for the computer 300, and saves a record of the shutdown process in a log (step S153). Specifically, the embedded software 120 transmits the shutdown signal to the computer 300 via the diagnostic paths W12 and W11, thereby causing the computer 300 to execute the shutdown.
After step S153, the process of FIG. This is because when the shutdown is completed and the power source of the computer 300 is turned off, there is no diagnosis target.
When the embedded software 120 receives a reboot instruction during the execution of the process of FIG. 2, the embedded software 120 ends the process of FIG. 2 being executed and starts the process again from step S101.

3 and 4 are flowcharts showing a procedure of processing performed by the relay package 200. FIG. When the relay package 200 is connected to the power source of the relay package 200 and becomes in an operating state, the relay package 200 performs the process shown in FIG.
In the process of FIG. 3, the relay package 200 (timer management unit 242 and flag management unit 252) first determines whether a boot completion notification is received from the diagnostic processor 110 via the signal path W24 (step S201). .
If it is determined that the boot completion notification has been received (step S201: YES), the flag management unit 252 sets the value of the status flag to “1” (step S202). In addition, the timer management unit 242 resets the count value of the timer unit 241 and starts counting (step S203).

Next, the timer management unit 242 determines whether or not the timer unit 241 has expired (step S211).
When it is determined that the timer unit 241 has expired (step S211: YES), the timer management unit 242 outputs a signal indicating the expiration of the timer unit 241 to the flag management unit 252, and the flag management unit 252 Is set to “0” (step S212). That is, the timer management unit 242 performs processing for setting the value of the status flag to “0” (a value indicating that shutdown processing is not possible) via the flag management unit 252.
In addition, the timer management unit 242 outputs a signal indicating the expiration of the timer unit 241 to the reboot processing unit 270, and the reboot processing unit 270 transmits a reboot instruction to the diagnostic processor 110 via the signal path W23, so that the diagnostic processor 110 is restarted (step S213). That is, the timer management unit 242 performs processing for rebooting the diagnostic processor 110 via the reboot processing unit 270.
In addition, the timer management unit 242 resets the count value of the timer unit 241 and starts counting (step S214).

  Next, the removal signal receiving unit 260 determines whether or not the diagnostic processor card 100 has been removed (step S221). When it is determined that the diagnostic processor loaded card 100 has been removed (step S221: YES), the removal signal receiving unit 260 sends a removal detection signal indicating that the removal of the diagnostic processor loaded card 100 has been detected to the timer management unit 242 and the flag. The flag management unit 252 sets the value of the status flag to “0” (step S222). In addition, the timer management unit 242 stops the count of the timer unit 241 (step S223).

  Here, in a state where the diagnostic processor mounting card 100 is removed, the shutdown processing for the computer 300 of the diagnostic processor 110 is impossible, and the timer unit 241 does not need to detect the state of the diagnostic processor 110. Therefore, the timer management unit 242 stops counting of the timer unit 241, thereby reducing unnecessary operations and reducing the load and power consumption of the relay package 200.

Next, the failure detection unit 230 determines whether or not there is a failure in the computer 300 based on the state information obtained from the computer 300 via the diagnostic path W11 (step S231).
If it is determined that no failure has occurred in the computer 300 (step S231: NO), the process returns to step S201.

On the other hand, when it is determined that a failure has occurred in the computer 300 (step S231: YES), the failure detection unit 230 performs processing by including information indicating the type of failure in the failure detection notification indicating that a failure has been detected. The data is output to the selection unit 280 (step S232).
Then, based on the failure detection notification from the failure detection unit 230, the process selection unit 280 (process selection execution unit 282) determines whether or not there is a failure that requires the computer 300 to be powered off (step S233).
When it is determined that the failure requires the computer 300 to be powered off (step S233: YES), the processing proceeds to FIG.

On the other hand, when it is determined that the failure does not require powering off the computer 300 (step S233: NO), the process selection execution unit 282 determines whether or not the value of the status flag stored in the flag storage unit 251 is “0”. Is determined (step S234).
When it is determined that the value of the status flag is “1” (step S234: NO), the process selection execution unit 282 includes information indicating the type of failure in a signal indicating that a failure has occurred in the computer 300. And transmitted to the diagnostic processor 110 via the signal path W22 (step S235). For example, the process selection execution unit 282 transfers the failure detection notification from the failure detection unit 230 to the diagnosis processor 110.
Thereafter, the process returns to step S201.

On the other hand, when it is determined in step S201 that a boot completion notification has not been received (step S201: NO), the process proceeds to step S211.
On the other hand, if it is determined in step S211 that the timer unit 241 has not expired (step S211: NO), the process proceeds to step S221.
On the other hand, if it is determined in step S221 that the diagnostic processor card 100 has not been removed (step S221: NO), the process proceeds to step S231.
On the other hand, when it is determined in step S234 that the value of the state flag is “0” (step S234: YES), the process returns to step S201. In this case, the relay package 200 waits for the recovery of the diagnostic processor 110 based on the reboot of the diagnostic processor 110 in step S213.

In the process of FIG. 4, the process selection unit 280 (process selection execution unit 282) first determines whether or not the value of the status flag stored in the flag storage unit 251 is “0” (step S301).
When it is determined that the value of the status flag is “0” (step S301: YES), the process selection unit 280 (temporal margin determination unit 281) determines whether there is a temporal margin based on the type of failure in the computer 300. Is determined (step S311).

  Here, in step S232 in FIG. 3, the failure detection unit 230 includes information that can be used to determine whether or not there is a time margin as information indicating the type of failure, and outputs the information to the processing selection unit 280. Then, the time margin determining unit 281 determines whether or not there is a time margin based on the type of the failure. For example, when the failure detection unit 230 detects an abnormality in the power supply voltage of the computer 300, as information indicating the type of failure, when the magnitude of the voltage fluctuation is less than 5% (5%) of the normal voltage, Information that distinguishes from the percentage or more is included in the failure detection notification. The time margin determining unit 281 determines that there is a time margin when the magnitude of the voltage fluctuation is less than 5% of the normal voltage, and determines that there is no time margin when the voltage variation is 5% or more.

  If it is determined in step S311 that there is a time margin (step S311: YES), the process selection unit 280 (process selection execution unit 282) outputs a signal instructing timer reset to the timer management unit 242, and the timer management unit 242 resets the timer unit 241 according to the signal and starts counting (step S321).

Then, the process selection execution unit 282 determines whether or not the timer unit 241 has expired (step S322).
When it is determined that the timer unit 241 has not expired (step S322: NO), the process selection execution unit 282 determines whether or not a boot completion notification from the diagnostic processor 110 is received via the signal path W24 ( Step S331).

If it is determined that the boot completion notification has not been received (step S331: NO), the process returns to step S322.
On the other hand, if it is determined that a boot completion notification has been received (step S331: YES), the process selection execution unit 282 includes a signal indicating that a failure has occurred in the computer 300, including information indicating the type of failure. The data is transmitted to the diagnostic processor 110 via the path W22 (step S341). For example, the process selection execution unit 282 transfers the failure detection notification acquired from the failure detection unit 230 in step S232 of FIG.
Thereafter, the process of FIG. 4 is terminated. This is because the diagnosis processor 110 shuts down the computer 300, so that there is no failure detection target.

On the other hand, when it is determined in step S301 that the value of the state flag is “1” (step S301: NO), the process proceeds to step S341.
On the other hand, if it is determined in step S311 that there is no time margin (step S311: NO), or if it is determined in step S322 that the timer unit 241 has expired (step S322: YES), the process selection execution unit 282 A simple log is written to the data storage unit 221 via the simple log writing unit 222 (step S351). For example, as described above, the process selection execution unit 282 includes information indicating the type of failure detected by the failure detection unit 230, a record that the diagnostic processor 110 is in a state where the shutdown processing of the computer 300 is not executable, and the like. Are included in the simple log and stored in the data storage unit 221.
Then, the process selection execution unit 282 outputs a power-off instruction to the power-off unit 210, thereby causing the power-off unit 210 to turn off the computer 300 (step S352).
Thereafter, the process of FIG. 4 is terminated.

Note that the count performed by the timer unit 241 in FIG. 4 is for detecting the passage of time for a margin. The expiration value in this case may be the same as or different from the expiration value as the watchdog timer (that is, the expiration value in step S211 in FIG. 3).
When the same expiration value is used, it is sufficient to prepare one value as the expiration value of the timer unit 241, and the configuration of the timer unit 241 can be simplified.
On the other hand, when a different expiration value is used, the diagnosis processor 110 can be restored for a longer time depending on the degree of time margin, so that the diagnosis processor 110 recovers and protects the data and OS of the computer 300. This increases the possibility that the computer 300 can be turned off.

As described above, the timer unit 241 as a watchdog timer detects a failure state of the diagnostic processor 110 when the count expires. Further, the flag management unit 252 stores a state flag indicating the state of the diagnostic processor 110 in the flag storage unit 251 based on the detection status of the failure state of the diagnostic processor 110 and a signal from the diagnostic processor 110. Then, when the failure detection unit 230 detects a failure that requires the computer 300 to be powered off, the process selection execution unit 282 causes the diagnostic processor 110 to execute a process based on the value of the status flag or the power-off unit 210. Select whether to execute the process.
Therefore, after the failure detection unit 230 detects a failure, the process selection execution unit 282 may cause the diagnostic processor 110 or the power-off unit 210 to execute the process without waiting for the watchdog timer (timer unit 241) to expire. As a result, the computer can be protected more quickly.

  Further, since the failure detection unit 230 distinguishes and detects a failure that requires the computer 300 to be powered off and a failure that does not require the power to be turned off, the process selection execution unit 282 performs more appropriate processing on the diagnostic processor 110 or It can be executed by the power-off unit 210. That is, the computer system 1 can turn off the power of the computer 300 in a state where a failure that requires the computer 300 to be turned off has occurred. In particular, even when the diagnostic processor 110 cannot perform the shutdown process of the computer 300, the power-off unit 210 can turn off the computer 300.

Further, the timer management unit 242 reboots the diagnostic processor 110 when the timer unit 241 expires. The timer manager 242 can be expected to restore the diagnostic processor 110 to a normal operation state by rebooting the diagnostic processor 110.
In addition, when the diagnostic processor 110 is rebooted, the timer management unit 242 resets the timer unit 241 to start counting. Therefore, if the diagnostic processor 110 does not return to the normal operation state by rebooting, the timer management unit 242 restarts the diagnostic processor 110 again. You can reboot and attempt to return to normal operation.

  Further, when the failure detection unit 230 detects a failure that requires the computer 300 to be powered off, and the value of the status flag is “0” (a value indicating that shutdown processing is not possible), the time margin determination unit 281. However, it is determined whether or not there is a time allowance until the computer 300 is turned off. When the time margin determining unit 281 determines that there is a time margin, the process selection executing unit 282 waits for the recovery of the diagnostic processor 110 until a predetermined time has elapsed from the determination. When the diagnostic processor 110 recovers, the process selection execution unit 282 causes the diagnostic processor 110 to perform a shutdown process.

Thus, since the process selection execution unit 282 waits for the recovery of the diagnostic processor 110, it is possible to protect the data of the computer 300 and the OS and to more safely turn off the computer 300.
On the other hand, when the diagnostic processor 110 does not recover within a predetermined time, the process selection execution unit 282 causes the power supply cutting unit 210 to turn off the computer 300. Therefore, even when the diagnostic processor 110 cannot perform the shutdown process of the computer 300, the process selection execution unit 282 can turn off the computer 300 and protect the computer 300.

When the removal signal receiving unit 260 detects removal of the diagnostic processor card 100, the flag management unit 252 sets the value of the status flag to “0” (a value indicating that shutdown processing is not possible).
Therefore, the process selection unit 280 refers to the value of the status flag in a state where the diagnostic processor mounted card 100 is removed, and performs appropriate processing such as causing the power-off unit 210 to turn off the computer 300. be able to.

Further, when the power cut-off unit 210 cuts off the power supply of the computer 300, the simple log writing unit 222 saves a record of the process of turning off the power supply (written in the data storage unit 221 in a simple log).
Therefore, the administrator of the computer system 1 can use the record to investigate the cause of the failure and take countermeasures.

Next, a minimum configuration of the present invention in the computer system 1 will be described with reference to FIG.
FIG. 5 is a schematic block diagram showing the minimum configuration of the present invention among the units shown in FIG. In the figure, among the units of the computer system 1 shown in FIG. 1, a computer 300, a failure detection unit 230, a power-off unit 210, a diagnostic processor 110, a timer unit 241, a flag storage unit 251, and a flag A management unit 252 and a process selection unit 280 are shown.

In this configuration, as described above based on the configuration illustrated in FIG. 1, the flag management unit 252 sets the value of the status flag based on whether the timer unit 241 has expired or a signal from the diagnostic processor 110. (Store in flag storage unit 251).
When the failure detection unit 230 detects a failure that requires the computer 300 to be powered off, the process selection unit 280 causes the diagnostic processor 110 to perform a shutdown process based on the value of the status flag, 210 selects whether to turn off the power supply of the computer 300 and causes the computer 300 to execute.

  Therefore, after the failure detection unit 230 detects a failure, the process selection execution unit 282 may cause the diagnostic processor 110 or the power-off unit 210 to execute the process without waiting for the watchdog timer (timer unit 241) to expire. As a result, the computer can be protected more quickly.

It is to be noted that a program for realizing all or part of the functions of relay package 200 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and executed. You may perform the process of. Here, the “computer system” includes an OS and hardware such as peripheral devices.
Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Furthermore, the “computer-readable recording medium” dynamically holds a program for a short time like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. In this case, a volatile memory in a computer system serving as a server or a client in that case, and a program that holds a program for a certain period of time are also included. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design changes and the like without departing from the gist of the present invention.

  A part or all of the above-described embodiment can be described as in the following supplementary notes, but is not limited thereto.

  (Supplementary Note 1) A computer, a failure detection unit that detects a failure that requires the computer to be powered off, a power-off unit that shuts off the computer, and shuts down the computer in a shutdown process. A diagnostic processor that detects a failure state of the diagnostic processor upon expiration of a count, a diagnostic processor status information storage unit that stores diagnostic processor status information indicating the status of the diagnostic processor, and the watchdog timer A diagnostic processor state information setting unit for setting a value of the diagnostic processor state information based on a signal indicating the expiration of the diagnostic processor and a signal indicating that the diagnostic processor is operating from the diagnostic processor, and the failure detection When the unit detects a fault that requires powering off the computer, the diagnostic processor state And a processing selection unit that selects and executes whether to cause the diagnostic processor to perform the shutdown processing or to cause the power-off unit to power off the computer based on an information value. Computer system.

  (Appendix 2) When the watchdog timer expires, a process for rebooting the diagnostic processor, a process for setting the value of the diagnostic processor status information to a value indicating that the shutdown process cannot be performed, and a resetting of the watchdog timer The computer system according to appendix 1, further comprising a timer management unit that executes processing for starting counting.

  (Additional remark 3) When the said fault selection part detects the fault which requires the power-off of the said computer, and the value of the said diagnostic processor state information is a value which shows the shutdown process impossible When a time margin determining unit that determines whether or not there is a time margin until the computer is turned off and the time margin determining unit determines that there is a time margin, a predetermined time elapses from the determination. If the value of the diagnostic processor status information is a value indicating that the shutdown processing is possible, the diagnostic processor performs the shutdown processing until the predetermined time elapses. And a process selection execution unit that causes the power-off unit to turn off the power of the computer when the value does not indicate that shutdown processing is possible. The computer system according to Supplementary Note 1 or 2, characterized in.

  (Additional remark 4) It has the extraction detection part which detects extraction of the diagnostic processor mounting card | curd in which the said diagnostic processor is mounted, The diagnostic processor state information setting part detects the extraction of the said diagnostic processor mounting card | curd. Then, the computer system according to any one of appendices 1 to 3, wherein the value of the diagnostic processor state information is set to a value indicating that shutdown processing is not possible.

  (Supplementary note 5) Any one of Supplementary notes 1 to 4, further comprising: a log writing unit that stores a record of a process of turning off the power when the power-off unit is turned off. The computer system according to one.

  (Supplementary Note 6) A fault detection unit that detects a fault that requires powering off the computer, a power source cutting unit that shuts off the power source of the computer, and a diagnostic processor that shuts off the power source of the computer in a shutdown process for the computer A watchdog timer for detecting a failure state upon expiration of a count; a diagnostic processor state information storage unit for storing diagnostic processor state information indicating a state of the diagnostic processor; a signal indicating expiration of the watchdog timer; A diagnostic processor state information setting unit configured to set a value of the diagnostic processor state information based on a signal from the diagnostic processor indicating that the diagnostic processor is operating; and the failure detection unit configured to turn off the computer Is detected on the basis of the value of the diagnostic processor status information. Tsu either by the performing the shutdown process, the power-off processing device for either the selected processing selection unit for executing to power cuts off power of the computer to, and characterized by including the.

  (Supplementary note 7) A power-off processing method of a power-off processing apparatus, comprising: a diagnostic processor that performs a shutdown process on a computer; and a power-off unit that cuts off the power of the computer. A watchdog timer step that detects a failure state of the diagnostic processor that turns off the power of the computer at the expiration of the count, a signal that indicates the expiration of the count in the watchdog timer step, and the diagnostic processor from the diagnostic processor operates A diagnostic processor status information setting step for setting a value of diagnostic processor status information indicating the status of the diagnostic processor based on a signal indicating that a fault is occurring, and a fault for detecting a fault that requires powering off the computer In the detection step and the failure detection step, When a failure that requires power-off of the machine is detected, whether to cause the diagnostic processor to perform the shutdown process or to cause the power-off unit to turn off the computer based on the value of the diagnostic processor status information A power selection processing method comprising: a process selection step for selecting and executing.

  (Supplementary note 8) A computer that controls a power-off processing device that includes a diagnostic processor that performs a shutdown process on a computer and a power-off unit that cuts off the power of the computer. A watchdog timer step for detecting a failure state of the diagnostic processor at the expiration of the count, a signal indicating the expiration of the count in the watchdog timer step, and the diagnostic processor from the diagnostic processor is operating A diagnostic processor status information setting step for setting a value of diagnostic processor status information indicating the status of the diagnostic processor, and a fault detection step for detecting a fault that requires powering off the computer In the failure detection step, the calculation When a failure requiring power-off is detected, it is selected whether to cause the diagnostic processor to perform the shutdown process or to cause the power-off unit to turn off the computer based on the value of the diagnostic processor state information And a process selection step to be executed.

DESCRIPTION OF SYMBOLS 1 Computer system 100 Diagnostic processor mounting card 110 Diagnostic processor 120 Embedded software 130 Extraction signal transmission part 200 Relay package 210 Power-off part 221 Data storage part 222 Simple log writing part 230 Fault detection part 241 Timer part 242 Timer management part 251 Flag storage Unit 252 flag management unit 260 removal signal reception unit 270 reboot processing unit 280 processing selection unit 281 temporal margin determination unit 282 processing selection execution unit 300 computer

Claims (8)

A calculator,
A fault detection unit for detecting a fault that requires powering off the computer;
A power cut-off unit for turning off the power of the computer;
A diagnostic processor for turning off the power of the computer in a shutdown process for the computer;
A watchdog timer for detecting a failure state of the diagnostic processor at the expiration of the count;
A diagnostic processor state information storage unit for storing diagnostic processor state information indicating the state of the diagnostic processor;
A diagnostic processor state information setting unit configured to set a value of the diagnostic processor state information based on a signal indicating expiration of the watchdog timer and a signal indicating that the diagnostic processor is operating from the diagnostic processor; ,
When the failure detection unit detects a failure that requires the computer to be powered off, the diagnostic processor causes the diagnostic processor to perform the shutdown process based on the value of the diagnostic processor state information, or causes the computer to turn off the computer. A process selection unit for selecting and executing whether to power off
A computer system comprising:   When the watchdog timer expires, processing for rebooting the diagnostic processor, processing for setting the value of the diagnostic processor status information to a value indicating that shutdown processing is not possible, and resetting the watchdog timer to start counting The computer system according to claim 1, further comprising a timer management unit that executes processing. The process selection unit
When the failure detection unit detects a failure that requires the computer to be turned off, and the value of the diagnostic processor state information is a value indicating that shutdown processing is not possible, the computer has to turn off the computer. A time margin determining unit for determining whether or not there is a time margin; and
When the time margin determination unit determines that there is a time margin, if the value of the diagnostic processor state information is a value indicating that shutdown processing is possible before the predetermined time has elapsed from the determination, If the diagnostic processor performs the shutdown process and the value of the diagnostic processor status information does not become a value indicating that the shutdown process can be performed before the predetermined time has elapsed, A process selection execution unit for cutting
The computer system according to claim 1, further comprising: Comprising a removal detection unit for detecting removal of a diagnostic processor mounted card on which the diagnostic processor is mounted;
The diagnostic processor state information setting unit sets the value of the diagnostic processor state information to a value indicating that shutdown processing is not possible when the removal detection unit detects removal of the diagnostic processor mounted card. The computer system according to any one of 1 to 3.   5. The log writing unit that stores a record of a process of turning off the power when the power off unit is turned off. 5. The computer system described. A fault detection unit that detects a fault that requires powering off the computer;
A power cut-off unit for turning off the power of the computer;
A watchdog timer that detects a failure state of a diagnostic processor that turns off the power supply of the computer in a shutdown process for the computer, upon expiration of the count;
A diagnostic processor state information storage unit for storing diagnostic processor state information indicating the state of the diagnostic processor;
A diagnostic processor state information setting unit configured to set a value of the diagnostic processor state information based on a signal indicating expiration of the watchdog timer and a signal indicating that the diagnostic processor is operating from the diagnostic processor; ,
When the failure detection unit detects a failure that requires the computer to be powered off, the diagnostic processor causes the diagnostic processor to perform the shutdown process based on the value of the diagnostic processor state information, or causes the computer to turn off the computer. A process selection unit for selecting and executing whether to power off
A power-off processing apparatus. A power-off processing method of a power-off processing apparatus comprising: a diagnostic processor that performs a shutdown process on a computer; and a power-off unit that cuts off the power of the computer,
A watchdog timer step of detecting a failure state of a diagnostic processor that turns off the power supply of the computer in a shutdown process for the computer at the expiration of the count;
Based on a signal indicating the expiration of the count in the watchdog timer step and a signal indicating that the diagnostic processor is operating from the diagnostic processor, a value of diagnostic processor status information indicating the status of the diagnostic processor is obtained. A diagnostic processor state information setting step to be set;
A fault detection step of detecting a fault that requires powering off the computer;
In the fault detection step, when detecting a fault that requires the computer to be powered off, based on the value of the diagnostic processor status information, the diagnostic processor performs the shutdown process or the power cutoff unit A process selection step for selecting and executing whether to turn off the power of the computer;
A power-off processing method. A computer that controls a power-off processing device, comprising: a diagnostic processor that performs a shutdown process on a computer; and a power-off unit that turns off the power of the computer.
A watchdog timer step of detecting a failure state of a diagnostic processor that turns off the power supply of the computer in a shutdown process for the computer at the expiration of the count;
Based on a signal indicating the expiration of the count in the watchdog timer step and a signal indicating that the diagnostic processor is operating from the diagnostic processor, a value of diagnostic processor status information indicating the status of the diagnostic processor is obtained. A diagnostic processor state information setting step to be set;
A fault detection step of detecting a fault that requires powering off the computer;
In the fault detection step, when detecting a fault that requires the computer to be powered off, based on the value of the diagnostic processor status information, the diagnostic processor performs the shutdown process or the power cutoff unit A process selection step for selecting and executing whether to turn off the power of the computer;
A program for running

Images