JPH04362744A - System switch controller for duplex system - Google Patents

Abstract

PURPOSE:To prevent the breakage of a switch controller and also to easily specify the area of abnormality even after occurrence of the abnormality. CONSTITUTION:When the abnormality occurs in a working system, an abnormality occurrence frequency storage means 101a stores the abnormality occurrence frequency of the working system in a nonvolatile memory 102. At the same time, a power cut-off means 101b cuts off the power supply of the working system and an abnormality informing means 101c informs a stand-by system of the occurrence of abnormality. In the stand-by system, an operation continuing means 101d turns on a power supply to start the stand-by system with the received information of the abnormality to carry on the processing of the working system as long as its own system is not abnormal. Then an operation deciding means 101e checks the abnormality occurrence frequency by reference to the memory 102. Then the means 101e turns off the power supply after the switch to the counter system when the abnormality occurrence frequency is less than a prescribed level and then turns off the power supply with no switch of systems when the abnormality occurrence frequency exceeds the prescribed level respectively.

Description

[Detailed description of the invention]

0001

[Field of Industrial Application] The present invention relates to a system switching device for a redundant system that has one system and the other system of the same system, and switches to standby system operation when an abnormality occurs in either system. .

0002

[Background Art] In order to enable continuous operation without stopping the system even if a hardware failure or abnormality occurs in a computer system, there is a method of constructing a redundant system with two identical systems. . In such a redundant system, if a failure or abnormality is detected in the active system, the standby system is powered on in the same way as the active system, so that the standby system can immediately take over the operation, making it ready for immediate operation. There is a hot standby method, and a cold standby method in which the standby system is not powered on, but after a failure or abnormality is detected in the active system, the standby system is immediately turned on and started up, and takes over the processing on the active system. .

[0003] Normally, the shorter the time during which operation is interrupted due to a failure or abnormality, that is, the system switching time, the better; therefore, in general, both systems are operated in a hot standby manner with power turned on. In addition, there are methods for detecting failures or abnormalities in an operating system and switching to the other system.
A method in which both systems are equipped with system monitoring and control devices, and when these devices monitor each system and detect a failure or abnormality in the active system, they notify the standby system or instruct it to start up, and switch the system. The standby system monitors the active system, and if a failure or abnormality is detected,
There are methods to take over the processing of the active system.

0004

[Problem to be Solved by the Invention] By the way, in the above-mentioned redundant hot standby system where both systems are always powered on, if there is a simple hardware failure, the standby system is switched over to the new active system and the process is handled. continue,
Operators and maintenance personnel then investigate the cause of the failure, identify the failure location, and repair or replace the failure location.

However, in the hot standby method described above, if the cause of the abnormality is an environmental abnormality such as an abnormal temperature inside the device, a cooling fan stopping, or an abnormality in the power supply, after switching to the standby system, the old operating system If the power of the device is left on, there is a risk of damage to the device or, in the worst case, a fire, which is dangerous. Also,
For safety reasons, when the power of a system in which an abnormality has occurred is automatically turned off after system switching, there is a problem in that the cause of the abnormality or the location of the failure cannot be easily identified. The present invention has been made in order to solve the above-mentioned conventional problems, and provides a redundant system that can prevent equipment destruction and fires in the abnormality system and easily identify the cause of the abnormality in the abnormality system. The purpose is to provide a system switching control device.

[0006]

[Means for Solving the Problems] A system switching control device for a duplex system of the present invention has one system and the other system of the same system, and when an abnormality occurs in the active system, the standby system is operated. In a system switching device of a redundant system to be switched, when an abnormality occurs in the active system, an abnormality occurrence number storage means that saves the abnormality occurrence information in a non-volatile memory up to a specified number of times, and after saving in the non-volatile memory, a power supply of the active system. an abnormality notification means for notifying the standby system of an abnormality in the active system; an operation continuation means that turns on the power of the system and continues processing of the old active system; and when the standby system is notified of an abnormality in the active system and its own system is also abnormal, refers to the nonvolatile memory. Then, it is determined whether this abnormality occurs within the specified number of times, and if it is within the specified number of times, the system is switched to the old operating system and the power of the own system is turned off.
If the number of times exceeds a predetermined number, the system is equipped with an operation judgment means that turns off the power of the own system without performing the system switching.

[0007]

[Operation] In the system switching control device for a duplex system of the present invention, when an abnormality occurs in the active system, the abnormality occurrence number storage means stores the number of times in the nonvolatile memory, and
The power cutoff means turns off the power to the system, and the abnormality notification means notifies the standby system of the abnormality. In the standby system, upon notification of the occurrence of an error in the active system, the operation continuation means turns on the power of the own system to start up, and if the own system is not abnormal, continues the processing of the active system, If the own system is also abnormal, the operation judgment means refers to the non-volatile memory to check the number of times the abnormality has occurred, and if it is within the specified number of times, it switches off the power after switching to the other system and determines whether the specified number of times has been exceeded. If so, turn off the power without performing system switching. Therefore, damage to the device can be prevented, and the location of the abnormality can be easily identified even after the abnormality has occurred.

[0008]

Embodiments Hereinafter, embodiments of the present invention will be explained in detail with reference to the drawings. FIG. 2 is a block diagram showing an example of a duplex system configuration to which a system switching control device for a duplex system according to the present invention is applied. The system shown in the figure consists of a system supervisory control device 11, a processor 12, a memory 13, input/output control devices 14, 15, a power supply 16, sensors 17, 18, and a system bus 19. The system has two systems, a system monitoring control device 21, a processor 22, a memory 23, input/output control devices 24 and 25, and a power supply 2.
6, sensors 27, 28, and a system bus 29, and these 1st and 2nd systems constitute a duplex system. Additionally, the system monitoring and control device 11 and the system monitoring and control device 21 have a system 1 abnormality notification line 31 that notifies the 2nd system of an abnormality in the 1st system, and a 2nd system abnormality notification line 3 that notifies the 1st system of an abnormality in the 2nd system.
It is connected with 2.

The system monitoring and control devices 11 and 21 are devices that monitor the occurrence of abnormalities in each system, and are comprised of a system switching control device, a nonvolatile memory, etc., which will be described later. Further, the processors 12 and 22 are devices that control the entire computer system, and the memories 13 and 23 are composed of random access memories and the like, and are main storage devices that store programs and various data of the computer system. The input/output control devices 14, 15, 24, and 25 are devices that control input/output devices connected to the computer system, respectively, and these system monitoring and control devices 11, 21 to input/output control devices 15, 25
are connected to the system buses 19 and 29, and the processor 11
, 21. Also,
The power supplies 16 and 26 are devices that supply power to the first and second systems, respectively, and are configured to be controlled by the system monitoring and control devices 11 and 21. Furthermore, sensors 17 and 18
, 27 and 28 are sensors for detecting failures and abnormalities in various parts of the computer system.

FIG. 1 shows a specific configuration of the system monitoring and control device 11. As shown in FIG. The device in the figure is a system switching control device 101.
, a nonvolatile memory 102 , an alarm holding relay circuit 103 , and a power on/off control circuit 104 . The system switching control device 101 includes an abnormality occurrence count storage means 101a, a power cutoff means 101b, an abnormality notification means 101c, an operation continuation means 101d, and an operation judgment means 1.
It consists of 01e.

[0011] When a failure or abnormality occurs in the first system and the abnormality is detected by the sensors 17 and 18, the abnormality occurrence count storage means 101a saves detailed information on the cause of the abnormality in the non-volatile memory 102 up to a predetermined number of times. It has a function. The power cutoff means 101b includes the abnormality occurrence number storage means 1
01a, when detailed information on the cause of the abnormality is saved in the non-volatile memory 102, the power on/off control circuit 104
It has the function of controlling the system in which an abnormality has occurred (here, system 1) is turned off. Abnormality notification means 101
c is means for controlling the alarm holding relay circuit 103 and notifying the second system when an abnormality is detected in the first system. The operation continuation means 101d sets the 1st system as a standby system and the 2nd system as the active system, and when an abnormality occurs, the 2nd system notifies the abnormality and the 1st system is not abnormal, turns on the power.
Controls the off control circuit 104 to turn on the power of system 1,
This is a means to continue the operation of the second system. Further, when an abnormality is notified from the second system and the first system is also abnormal, the operation judgment means 101e refers to the non-volatile memory 102, checks how many abnormalities have been stored, and calculates the number of abnormalities stored. This is a means for determining whether or not the number of times is within a specified number of times, and if it exceeds the specified number of times, turning off the power of the 1 system.

[0012] The nonvolatile memory 102 consists of a battery backup memory, etc., and has abnormality occurrence count storage means 101a.
The detailed information on the cause of abnormality is stored a specified number of times. FIG. 3 shows a memory state diagram of the nonvolatile memory. That is, the first word indicates the number of times the system was switched after detecting an error (system switching counter), and the Nth area corresponding to the number of switches (number of downs) N indicates detailed information on the cause of the error in the system down. ing.

The alarm holding relay circuit 103 has a relay contact 103a connected to the 1-system abnormality notification line 31, a relay contact 103b connected to the power on/off control circuit 104, and a circuit section 103c. When an abnormality occurs in the system, relay contacts 103a and 103b are turned on to notify the second system of the abnormality. The power on/off control circuit 104 is a circuit that controls the power supply 16, and is controlled by the system switching control device 101. Although not shown here, the system monitoring and control device 21 of the second system is also configured in exactly the same way as the system monitoring and control device 11.

Next, the system switching control operation of the duplex system having the above configuration will be explained. 3 and 4 are flowcharts showing the switching operation, with FIG. 3 showing the operation of the active system and FIG. 4 showing the operation of the standby system. Here, the operational system is 1 system,
It is assumed that the standby system is the second system and that an abnormality has occurred in the first system. Furthermore, at the start of operation, the contents of the nonvolatile memory 102 are cleared and the alarm holding relay circuit 103 is cleared.
It is assumed that the relay contacts 103a and 103b are in the off state.

First, the 1st system determines whether the 2nd system abnormality notification signal line 32 is on (step S101). Here, since no abnormality has occurred in the 2nd system, the 2nd system abnormality notification signal line 32 is off, and if no abnormality occurs in the 1st system in this state, normal operation is performed by the 1st system. However, if an abnormality occurs in the first system in this state, that is, the sensor 17, 18 or the power supply 16 detects a temperature abnormality, cooling fan stoppage, power supply abnormality, or other hardware abnormality. Then, the system switching control device 10
1 turns on the relay contact 103a of the alarm holding relay circuit 103 that holds that a system 1 abnormality (system down) has occurred (step S102), and by turning on this relay contact 103a, the system 1 abnormality notification signal line is turned on. 3
1 to notify the 2nd system of the alarm (step S10
3). Then, the abnormality occurrence count storage means 101a saves detailed information on the causes of system abnormalities such as temperature abnormalities and fan stoppages in the nonvolatile memory 102 (step S104).
), then the power cutoff means 101b turns off the power of the 1 system via the power on/off control circuit 104 (step S105).

On the other hand, the 2nd system, which is the standby system, uses the 1st system abnormality notification signal line 3 to notify the 1st system, which is the other system (active system), of an abnormality.
1 is turned on, this is detected (step S20
1) The power of the 2nd system is turned on and automatic startup is performed (step S202). Then, the alarm relay contact 203b (contact 10 in FIG.
3b) is on (step S2).
03), if it is not on, that is, if there is no abnormality in the own system, continue the operation by taking over the processing that was being performed on the old active system (
Step S204). Further, in step S203, if the alarm holding relay contact 203b is in the on state, that is, the own system is also abnormal, the relay contacts 203a, 20 of the own system
3b is temporarily turned off (reset) (step S205).
, refer to the system switching counter stored in the nonvolatile memory 202 (step S206). the result,
If the number of system switching (down) times exceeds the specified number, the relay contact 203a does not turn on again even if an abnormality factor occurs in the own system, suppresses system switching, and turns off the power to the own system. is turned off (step S211). In other words, both systems are powered off and both systems are stopped (both systems down).
let

On the other hand, in step S207, if the number of times the system has been switched is within the specified number of times, the relay contact 20 is turned on again.
3a and 203b (step S208), and instructs to start up the other system (system 1) (step S209).
Furthermore, detailed information on the cause of the abnormality is stored in the non-volatile memory 202, the system switching counter is counted up (step S210), and the power of the own system is turned off (step S210).
211).

When the first system is notified of the abnormality in the other system, the second system abnormality notification signal line 32 in step S101 is in the on state, so the power of the first system is turned on (step S101).
06). Then, similarly to the operation of the second system described above, it is determined whether the relay contact 103b of the alarm holding relay circuit 103 is on or not (step S107), and here, due to failure recovery etc., the relay contacts 103a and 103b are in the off state. That is, if the first system is normal, the operation of the other system is continued (step S108). For example, if the abnormality in system 1 mentioned above was a temperature rise, but the temperature returned to the specified temperature by temporarily stopping the operation of system 1, or if it was a malfunction due to noise etc., The startup operation returns it to a normal state.

Further, when the relay contacts 103a and 103b are in the ON state, the relay contacts 103a and 103b are temporarily turned on.
3b is reset (step S109), the system switching counter is referred to (step S110), and if this is within the specified number of times, the process returns to step S102 and the operation from turning on the relay contacts 103a and 103b is repeated. If the number of times exceeds the specified number, the process proceeds to step S105 and the power is turned off. That is, if the systems are switched and started up repeatedly within a specified number of times, and an abnormality still occurs in both systems, both systems are brought down. For example, if the cause of the abnormality is not the temperature rise mentioned above, but a failure that does not recover even after repeated system switching,
After switching within the specified number of times, both systems go down.

In the above embodiment, when an abnormality occurs in the own system, the alarm holding relay circuits 103 and 203
Contact points 103a, 103b and 203a, 203b
Although the configuration is configured such that the contacts 103a, 103b and 203a, 203b are in the on state, the present invention is not limited to this configuration. It has a similar effect.

[0021]

As explained above, according to the system switching control device for a redundant system of the present invention, when an abnormality occurs in the active system, the cause is stored in the non-volatile memory up to a specified number of times, and If an error occurs, turn on the power to the standby system to start up the system.If the own system is not abnormal, the standby system continues to operate the abnormal system, and if the own system is also abnormal. If there is, it is determined whether system switching has occurred within the specified number of times, and if the number of system switching has exceeded the specified number, the power to the own system is turned off, and if it is within the specified number of times, switching with the other system is specified. Since the process is repeated until the number of times the error occurs, the power to the device is turned off after an error occurs, which prevents problems such as device destruction or fire.Also, the cause of the error can be stored in non-volatile memory. Therefore, the location of the abnormality can be easily identified later based on the abnormality cause information.

[Brief explanation of drawings]

FIG. 1 is a block diagram of a system monitoring and control device including a system switching control device for a duplex system according to the present invention.

FIG. 2 is a block diagram of a computer system to which a system switching control device for a duplex system of the present invention is applied.

FIG. 3 is a memory state diagram of a nonvolatile memory.

FIG. 4 is a flowchart of system switching control for an abnormal system in the system switching control device of the duplex system of the present invention.

FIG. 5 is a flowchart of standby system switching control in the system switching control device of the duplex system of the present invention.

[Explanation of symbols]

101 System switching control device 101a Abnormality occurrence count storage means 101b Power cutoff means 101c Abnormality notification means 101d　Means for continuing operation 101e Operation judgment means

Claims (1)

[Claims] Claim 1: In a system switching device of a redundant system that has one system and the other system of the same system and switches to standby system operation when an abnormality occurs in the active system, an abnormality occurs in the active system. an abnormality occurrence count storage means for saving the abnormality occurrence information in a nonvolatile memory up to a predetermined number of times when the abnormality occurs; a power cutoff means for turning off the power of the active system after saving the abnormality information in the nonvolatile memory; an abnormality notification means for notifying the system; and an operation for turning on the power of the own system and continuing processing of the old active system when the standby system is notified of an abnormality in the active system and there is no abnormality in the own system. and a continuation means, when the standby system is notified of an abnormality in the active system and its own system is also abnormal, refers to the nonvolatile memory to determine whether or not this abnormality has occurred within a specified number of times, and If the number of times is within the specified number of times, the system is switched to the old active system and the power of the own system is turned off. If the number of times exceeds the specified number of times, the power of the own system is turned off without performing the system switch. A system switching control device for a redundant system, comprising a determination means.