JPH06222944A - Switching control method for duplexed electronic computer system - Google Patents

Abstract

PURPOSE:To continuously switch processing from a present electronic computer to a stand-by system without generating controlled system data being non-processed at the time of fault generation. CONSTITUTION:This system is composed of duplexed (present system and stand-by system) electronic computers 100 and 200 to be operated as present and stand-by systems and a system monitoring and controlling means 300. The system monitoring and controlling means adds an ID to the controlled system data sent from a controlled system 400, stores them in a transmission data table 310 and successively transmits them to the present system electronic computer 100. The present system electronic computer reports the ID of the processed data to the system monitoring and controlling means 300, and the system monitoring and controlling means deletes the reported data from the transmission data table. Thus, the system monitoring and controlling means always stores no-processed data at the present system electronic computer. At the time of fault generation, all these data are transmitted to the stand-by system electronic computer 200, and processing is continuously switched from the present system to the stand-by system without generating the controlled system data being non-processed.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a duplication type computer system for external control or monitoring, and more specifically to a duplication type computer system for ensuring continuity of data processing when a failure occurs. Of the switching method.

[0002]

2. Description of the Related Art As a current / preliminary switching system for a redundant computer, which is characterized in that a standby computer can continue processing, there is, for example, Japanese Patent Laid-Open No. 63-94341 "External control system for redundant computer system. There is. Figure 10
FIG. 4 is a diagram showing a switching system in a conventional duplicated electronic computer, 904 is a control target device, 920 is a control result signal, 901 is an active computer for controlling the control target device, and 902 is for the active computer. An auxiliary computer for operation monitoring, 903 is a relay switch for switching between the active and standby systems, and 951 and 952 are sent to the relay switch from the active computer and the standby computer, respectively. , 910 is an error notification signal used for system switching, and 910 is a control signal sent from the active computer to the controlled device.

A method of switching between the active computer and the standby computer in the conventional system will be described below with reference to the flowchart of FIG. At the start of control, the electronic computer determines whether or not the own computer is the active machine by the switch 903 (1100). If it is a working machine, the control command is executed (1101). The active machine sets a time-out time that shows the time required to complete the control with a margin (1
102). Control result signal 920 within the timeout time
Is received, the control is completed (1120) and the control is ended. If the time-out time is exceeded, it is determined that the signal line of the active machine has failed and the control by the active machine is no longer possible, an error notification is sent to the switch 903, and the active machine ends the control. , The standby machine starts operating as a new working machine.

If the own machine is a spare machine, the control result signal 92
A timeout time is set to the time until 0 is received (1105), and the control completion is checked by receiving the control result signal 920 (1140). If the control completion cannot be confirmed within the timeout time, the active machine fails. Occurs, it is determined that the active machine cannot send the control command signal 910 (1130), and it is determined by the switch 903 whether or not the active machine is the active machine (1150). If your machine has not yet been switched to the current machine, an error notification will be sent (1
111), switch 903, and control ends.
If the current machine reports an error due to a timeout time and the own machine has already switched to the current machine, the control command is re-executed (1101).

[0005]

In the dual computer switching system having the above-mentioned configuration, when a failure occurs in the active computer, the data processing of the standby computer is maintained consistently without any interruption. There is a problem that it is difficult to continue the processing. In addition, since the system switching trigger depends only on the control result information notified from the control target, there is a problem in that the reliability of the entire processing system is insufficient with respect to the detection of an abnormality and the notification timing. In addition, at the time of system switching, even when data that was not processed on the computer that was operating as the active system until then is taken over and executed by the standby system computer, a fine-tuned response that considers the processing priority There was a problem that I could not do it.

The present invention has been made in order to solve such a problem, and assures consistency of data processing at the time of switching from the active computer to the standby computer up to then, and at the same time, duplicated system is ensured. The purpose is to improve the reliability of the abnormality detection means in the computer switching system. Further, another object of the present invention is to perform the processing of the entire system efficiently by performing the priority control in the execution of the data processing or the re-execution of the unprocessed data after the system switching.

[0007]

The active standby switching system according to the present invention is provided with system monitor control means for monitoring the operation of the active computer, and the system monitor control means is not processed by the active computer. A transmission data table for storing certain control target data is provided, and an ID is added to the control target data for storage.

The system monitoring control means is provided with means for storing and managing the time when the control target data stored in the transmission data table is transmitted to the active computer.

Further, the system monitoring control means is provided with means for managing the amount of data stored in the transmission data table.

In addition, the system monitoring control means is provided with a data priority judging means for managing the priority of the control target data.

[0011]

In the switching system of the duplicated computer according to the present invention, the data to be controlled is stored in the transmission data table and the data transmission to the active computer is managed. Can maintain data consistency without causing data loss and continue data processing.

Further, by recording the transmission time relating to the transmission of control data in the transmission data table and managing the time interval until the processed signal is received, it is possible to promptly detect the fault occurring in the active computer. To do. Furthermore, by providing a means for controlling and managing the amount of data stored in the transmission data table, it is possible to detect a failure that has occurred in the active computer.

By providing the data priority judging means,
The control target data received from the control target later can be transmitted to the active computer in association with the processing priority.

[0014]

【Example】

Example 1. A first embodiment of the invention will be described below with reference to FIGS. 1, 2, and 3. FIG. 1 is a system block diagram showing an embodiment of the first invention. 1 in FIG.
00 and 200 are electronic computers, and 100 is currently operating as an active system and 200 as a standby system. Reference numeral 300 is a system monitoring control means. Reference numeral 400 is a control target. Three
Reference numeral 10 is a transmission data table for storing the control target data transmitted from the control target 400. 450 is control target 4
00 is a controlled object data signal for transmitting data generated by the system 00 to the system monitoring control means 300. Reference numeral 350 is a transmission data signal for sending data to be processed by the system monitoring control means 300 to the electronic computers 100 and 200. Reference numeral 320 denotes an active backup changeover switch for transmitting the transmission data signal 350 to the active computer. 150 and 250 are processed I to which the computer 100, 200 sends the ID of the processed data.
It is a D signal. Reference numerals 361 and 362 are processing start request signals which the system monitoring control means 300 sends a processing start request to the electronic computers 100 and 200 when a failure occurs in the active computer.

FIG. 2 shows the structure of the transmission data table 310 used in the embodiment of the first invention. One record corresponds to one control target data, ID,
It has two fields of controlled data. 311 is 1
It is an ID added to each control target data. 31
Reference numeral 2 is control target data sent from the control target 400. Reference numeral 315 is a transmission data pointer indicating data to be transmitted to the active computer 100 next. Reference numeral 316 is a head record of the transmission data table 310. Reference numeral 317 is the end record of the transmission data table 310.

Data processing in the embodiment of the first invention will be described with reference to the flow chart of FIG. First, the system monitoring control means 300 sets the parameters necessary for executing the control before starting the control. In order to enable simultaneous transmission of a plurality of data to the active computer 100, the system monitoring control means 300 sets the number of simultaneous data transmissions according to the processing capacity of the active computer 100 (503). Or later,
The system monitoring control means 300 uses the transmission data table 31.
It is possible to collectively transmit data from the beginning of 0 to several data simultaneous transmissions to the active computer 100.

The system monitoring control means 300 uses the transmission data table 310 based on the control target data signal 450.
The operation of updating will be described. First, the system monitoring control means 300 checks whether the control target data signal 450 has arrived (610). When the control target data signal 450 is received, the control target data is received (611) and an ID is added to the data (612). Controlled data and I
D is the end record 317 of the transmission data table 310.
Is stored as (621) and the transmission data is the control target 40.
It is stored in the order sent from 0.

The operation of the system monitoring control means 300 for transmitting the data in the transmission data table 310 to the active computer 100 will be described. System monitoring control means 300
Checks whether data exists at the transmission data pointer position 315 of the transmission data table 310 (710). If there is data to be transmitted, it is checked whether the already transmitted data has reached the data simultaneous transmission number (720). If it has reached, the active computer 100 cannot receive new data, and therefore data transmission is not executed. If data transmission is possible, the control target data 312 at the transmission data pointer position 315 and the ID 311 are sent as a transmission data signal 350 to the active computer 100 (72).
1). Since the control target data 312 of that record has been sent to the active computer 100, the send data pointer 3
15 is set to the next record (723).

Finally, the operation of deleting the record of the processed ID received from the transmission data table 310 and the operation at the time of failure will be described. The system monitoring control means 300
It is checked whether a failure has occurred in the active system (810). Also, it is checked whether the processed ID signal 150 has come (820),
If the processed ID signal 150 is received, the ID is received (8
21), and compares the ID with the ID 311 of the first record 316 of the transmission data table 310 (830). Since the active computer 100 processes the control target data in the order of reception, even if they are not equal, it is determined that a failure has occurred in the active computer 100. If no failure is detected by the above failure detecting means, the control target data 31 of the first record 316 of the transmission data table 310 which is a record of the received processed ID signal 150.
2 indicates that the processing is completed, and the transmission data table 3
10 (831), and the transmission data table 310 is deleted.
The record next to is set as the first record 316 (83
2). When the system supervisory control means 300 determines that a failure has occurred in the active computer 100, it sends a processing start request signal 362 to the standby computer 200 (835) to switch the active standby changeover switch 320,
The transmission signal 350 is transmitted to the electronic computer 200 that was the standby system (836). With this computer 20
0 is the new active system. Transmission data table 3 at that time
The records remaining in 10 are those that have not been processed, including those sent to the electronic computer 100, so the send data pointer 315 is set to the send data table 3
It is set in the first record 316 of 10 (837). Therefore, in the data transmission process after the occurrence of a failure, all unprocessed data will be sent to the new active computer 200 even if it was sent to the active computer 100. Unprocessed control target data will not be generated.

Example 2. A second embodiment of the present invention will be described based on FIGS. 4 and 5. FIG. 4 shows the structure of the transmission data table 310 used in the embodiment of the second invention. One record corresponds to one control target data, and has three fields of ID, control target data, and transmission time. 311 is an ID added to each control target data. 312 is
It is the control target data sent from the control target 400. 313 is a time when the system monitoring control means 300 transmits data to the active computer 100. 315
Is a transmission data pointer indicating data to be transmitted to the active computer 100 next. Reference numeral 316 is a head record of the transmission data table 310. Reference numeral 317 is the end record of the transmission data table 310.

Data processing in the embodiment of the second invention will be described with reference to the flowchart of FIG. First, the system monitoring control means 300 sets the parameters necessary for executing the control before starting the control. The system supervisory control means 300 sets the response time limit for judging a failure in consideration of the processing capacity of the active computer 100 (501). When the processing of the transmission data sent from the system monitoring control means 300 is completed, the active computer 100 uses the ID of the data as the processed ID signal 150 and the system monitoring control means 30.
Send to 0. The system monitoring control means 300 has processed I within the response time limit after the transmission data signal 350 is transmitted.
If the D signal 150 does not return, it is determined that the active computer 100 has a failure. Next, in order to enable simultaneous transmission of a plurality of data to the active computer 100, the system monitoring control means 300 sets the number of simultaneous data transmissions according to the processing capacity of the active computer 100 ( 503). System monitoring control means 30
0 indicates that the data from the beginning of the transmission data table 310 up to several simultaneous data transmissions are collectively processed by the active computer 10.
It becomes possible to transmit to 0.

The operation of the system monitoring control means 300 for updating the transmission data table 310 from the control target data signal 450 will be described. First, the system monitoring control means 30
For 0, it is checked whether the control target data signal 450 has come (610). When the control target data signal 450 is received, the control target data is received (611) and an ID is added to the data (612). Control target data and ID
Is stored as the last record 317 of the transmission data table 310 (621), and the transmission data is the control target 400.
It is stored in the order sent from. This process is the same as in the first embodiment.

The operation of the system monitoring control means 300 for transmitting the data in the transmission data table 310 to the active computer 100 will be described. System monitoring control means 300
Checks whether data exists at the transmission data pointer position 315 of the transmission data table 310 (710). If there is data to be transmitted, it is checked whether the already transmitted data has reached the data simultaneous transmission number (720). If it has reached, the active computer 100 cannot receive new data, and therefore data transmission is not executed. If data transmission is possible, the control target data 312 at the transmission data pointer position 315 and the ID 311 are sent as a transmission data signal 350 to the active computer 100 (72).
1). When sending the data, the system monitoring control means 300 stores the sending time in the field of the sending time 313 of the sent record of the sending data table 310 (72).
2). Next, the control target data 312 of that record is sent to the active computer 100, so the send data pointer 315 is set to the next record (723).

Finally, the system monitor control means 300
The operation of detecting a failure of the active computer 100, the operation of deleting the record of the processed ID received from the transmission data table 310, and the operation at the time of failure will be described. The system monitoring control means 300 uses the transmission data table 310.
If the processed ID signal 150 is not sent even though the response time limit has passed from the transmission time 313 of the first record 316 of the above, it is determined that a failure has occurred in the active computer 100 (812). Also processed ID signal 1
Check if 50 is coming (820), processed ID signal 15
If 0 is received, the ID is received (821) and the ID is the ID of the first record 316 of the transmission data table 310.
Compare with 311 (830). Active computer 100
Then, since the control target data is processed in the order of reception,
Even if they are not equal, the active computer 100
It is determined that a failure has occurred. If no failure is detected by the above failure detecting means, the control target data 312 at the first record position on the transmission data table 310 corresponding to the received processed ID signal 150 is regarded as the processing being completed, and the transmission data table 310 is assumed. (831), the next record in the transmission data table 310 is set as the first record 316 (832). When the system supervisory control means 300 determines that a failure has occurred in the active computer 100, it sends a processing start request signal 362 to the standby computer 200 (835), switches the active standby changeover switch 320, and transmits the transmission signal. 350 is transmitted to the electronic computer 200 that was the standby system (836). The computer 200 is now in the new active system. Since the records remaining in the transmission data table 310 at that time have not been processed including those transmitted to the electronic computer 100, the transmission data pointer 315 is set to the first record 316 of the transmission data table 310. (837). Therefore, in the data transmission process after the occurrence of the failure, the computer 10 that was the active system was used.
Even if the data is sent to 0, all unprocessed data will be sent to the new active computer 200, so that uncontrolled data to be controlled does not occur.

Example 3. A third embodiment of the present invention will be described based on FIGS. 6 and 7. Sixth
The figure shows the structure of the transmission data table 310 used in the embodiment of the third invention. Reference numeral 318 is a data limit pointer that indicates the limit of the storage amount of control target data.
Reference numeral 317 corresponds to the same reference numeral described in the first embodiment of the invention.

The data processing in the embodiment of the third invention will be described with reference to the flowchart of FIG. First, the system monitoring control means 300 sets the parameters necessary for executing the control before starting the control. In the third invention, the system monitoring control means 300
Detects a failure according to the amount of data to be processed by the active computer 100 existing in the transmission data table 310, so the data limit pointer 318 is set (50
2). When the stored data record reaches the data limit pointer 318, the system monitoring control means 300 determines that the active computer 100 has failed. Next, in order to enable simultaneous transmission of a plurality of data to the active computer 100, the system monitoring control means 300 sets the number of simultaneous data transmissions according to the processing capacity of the active computer 100 (503). . After that, the system monitoring control means 300 can collectively transmit the data from the beginning of the transmission data table 310 up to several simultaneous data transmissions to the active computer 100.

The operation of the system monitoring control means 300 for updating the transmission data table 310 from the control target data signal 450 will be described. First, the system monitoring control means 300
Checks whether the control target data signal 450 has come (610). When the control target data signal 450 is received, the control target data is received (611) and an ID is added to the data (612). Control target data and ID
Is stored as the last record 317 of the transmission data table 310 (621), and the transmission data is the control target 400.
It is stored in the order sent from. This process is the first embodiment,
Same as 2.

The operation of the system monitoring control means 300 for transmitting the data in the transmission data table 310 to the active computer 100 will be described. System monitoring control means 300
Checks whether data exists at the transmission data pointer position 315 of the transmission data table 310 (710). If there is data to be transmitted, it is checked whether the already transmitted data has reached the data simultaneous transmission number (720). If it has reached, the active computer 100 cannot receive new data, and therefore data transmission is not executed. If the data transmission is possible, the control target data 312 and the ID 311 at the transmission data pointer position 315 are sent to the active computer 100 as the transmission data signal 350 (72
1). Next, the control target data 312 of that record is sent to the active computer 100, so the send data pointer 315 is set to the next record (723). This process is the same as in the first embodiment.

Finally, the system monitoring control means 300
The operation of detecting a failure of the active computer 100, the operation of deleting the record of the processed ID received from the transmission data table 310, and the operation at the time of failure will be described. The system monitoring control means 300 first sends the transmission data table 31.
If there is data in the data limit pointer 318 of 0, it is determined that the processing is delayed due to a failure in the active computer 100 (815). Next, processed ID signal 1
Check if 50 is coming (820), processed ID signal 15
If 0 is received, the ID is received (821) and the ID is the ID of the first record 316 of the transmission data table 310.
Compare with 311 (830). Active computer 100
Since the control target data are processed in the order of reception, it is determined that a failure has occurred in the active computer 100 even if they are not equal. If no fault is detected by the above fault detecting means, the received processed ID signal 15 is received.
The control target data 312 of the first record 316 of the transmission data table 310, which is a record of 0, is deleted from the transmission data table 310 as the processing is completed (83
1), the next record of the transmission data table 310 is set as the top record 316 (832). When the system supervisory control means 300 determines that a failure has occurred in the active computer 100, it sends a processing start request signal 362 to the standby computer 200 (835), switches the active standby changeover switch 320, and transmits the transmission signal. 350 is transmitted to the electronic computer 200 that was the standby system (83
6). The computer 200 is now in the new active system. Since the records remaining in the transmission data table 310 at that time have not been processed, including those transmitted to the electronic computer 100, the transmission data pointer 31
5 is set in the first record 316 of the transmission data table 310 (837). Therefore, in the data transmission process after the occurrence of a failure, all unprocessed data will be sent to the new active computer 200 even if it was sent to the active computer 100. No unprocessed control target data is generated.

Example 4. A fourth embodiment of the present invention will be described based on FIGS. 8 and 9. FIG. 8 is a system block diagram showing an embodiment of the fourth invention, and in the drawing, 330 is a data priority judging means for judging the priority of the control target data received from the control target. Reference numerals other than the above represent constituent elements corresponding to the same reference numerals described in the first embodiment.

Data processing in the embodiment of the fourth invention will be described with reference to the flowchart of FIG. First, before the system monitoring control means 300 starts the control, the parameters necessary for executing the control are set. In order to enable simultaneous transmission of a plurality of data to the active computer 100, the system monitoring control means 300 sets the number of simultaneous data transmissions according to the processing capacity of the active computer 100 (503). After that, the system monitoring control means 300 uses the transmission data table 310.
It is possible to collectively transmit up to several pieces of data from the beginning of the data to the active computer 100. This process is the same as in the first embodiment.

The operation of the system monitoring control means 300 for updating the transmission data table 310 from the control target data signal 450 will be described. First, the system monitoring control means 30
For 0, it is checked whether the control target data signal 450 has come (610). When the control target data signal 450 is received, the control target data is received (611) and an ID is added to the data (612). System monitoring control means 3
00 determines whether the data should be processed first by the data priority determining means 330 (620). If the control target data is to be processed first, the control target data is shifted one record at a time from the transmission data pointer, and the control target data and the ID are stored at the position of the transmission data pointer (625). In the normal case, the control target data and the ID are stored as the end record 317 of the transmission data table 310 (621), and the transmission data are stored in the order sent from the control target 400.

The operation of the system monitoring control means 300 for transmitting the data in the transmission data table 310 to the active computer 100 will be described. System monitoring control means 300
Checks whether data exists at the transmission data pointer position 315 of the transmission data table 310 (710). If there is data to be transmitted, it is checked whether the already transmitted data has reached the data simultaneous transmission number (720). If it has reached, the active computer 100 cannot receive new data, and therefore data transmission is not executed. If the data transmission is possible, the control target data 312 and the ID 311 at the transmission data pointer position 315 are sent to the active computer 100 as the transmission data signal 350 (72
1). Since the control target data 312 of that record has been sent to the active computer 100, the send data pointer 315 is set to the next record (723). This processing is the same as in the first and third embodiments.

Finally, the operation of deleting the record of the processed ID received from the transmission data table 310 and the operation at the time of failure will be described. The system monitoring control means 300 checks whether a failure has occurred in the active system (810). Further, it is checked whether the processed ID signal 150 is received (820), and if the processed ID signal 150 is received, the ID is received (82).
1), the ID is compared with the ID 311 of the head record 316 of the transmission data table 310 (830). Since the active computer 100 processes the control target data in the order of reception, even if they are not equal, it is determined that a failure has occurred in the active computer 100. If no fault is detected in the above fault detecting means, the control target data 312 at the first record position on the transmission data table 310, which is a record of the processed ID signal 150 received, is regarded as having been processed, Deleted from 310 (831) and transmitted data table 3
The record next to 10 is set as the first record 316 (83
2). When the system supervisory control means 300 determines that a failure has occurred in the active computer 100, it sends a processing start request signal 362 to the standby computer 200 (835) to switch the active standby changeover switch 320,
The transmission signal 350 is transmitted to the electronic computer 200 that was the standby system (836). With this computer 20
0 is the new active system. Transmission data table 3 at that time
The records remaining in 10 are those that have not been processed, including those sent to the electronic computer 100, so the send data pointer 315 is set to the send data table 3
It is set in the first record 316 of 10 (837). Therefore, in the data transmission process after the occurrence of a failure, all unprocessed data, even those sent to the active computer 100, will be sent to the new active computer 200. No controlled data to be processed is generated. This process is the same as in the first embodiment.

[0035]

Since the present invention is constructed as described above, it has the following effects.

Since the transmission data table is provided and the data to be controlled is stored, even when a failure occurs, it is possible to continuously perform processing without generating unprocessed data.

Further, the control data stored in the transmission data table is managed at the time when it is transmitted to the active computer, and the failure is judged by the processing time of each control target data. A failure can be promptly detected in the generated control target data.
Further, since the amount of data stored in the transmission data table is managed, the failure can be easily detected.

In addition, since the priority determination means for managing the priority of the data to be controlled is provided, the data processing in consideration of the priority control becomes possible and the system processing efficiency can be improved.

[Brief description of drawings]

FIG. 1 is a system block diagram showing a first embodiment of the invention.

FIG. 2 is a diagram showing a structure of a transmission data table used in the first embodiment of the invention.

FIG. 3 is a flowchart of a process according to the first embodiment of the invention.

FIG. 4 is a diagram showing a structure of a transmission data table used in a second embodiment of the invention.

FIG. 5 is a flowchart of a process showing a second embodiment of the invention.

FIG. 6 is a diagram showing a structure of a transmission data table used in a third embodiment of the invention.

FIG. 7 is a flowchart of a process showing a third embodiment of the invention.

FIG. 8 is a system block diagram showing a fourth embodiment of the invention.

FIG. 9 is a flowchart of a process showing a fourth embodiment of the invention.

FIG. 10 is a block diagram showing a configuration of an embodiment of a conventional active backup system switching system.

FIG. 11 is a flowchart showing a control method of an embodiment of a conventional active backup switching system.

[Explanation of symbols]

 100 (current system) computer 150 processed ID signal 200 (standby system) computer 250 processed ID signal 300 system monitoring control means 310 transmission data table 320 active standby changeover switch 350 transmission data signal 361 processing start request signal 362 processing start Request signal 400 Control object 450 Control data signal

Claims (4)

[Claims] 1. When a duplicated computer operates as an active system and a standby system and a failure occurs in the active system,
In a redundant system in which the standby computer up to that point continues to execute processing in place of the active computer, system monitoring means for monitoring the operation of the active computer is provided, and the system monitoring means is the active computer. With a buffer table for storing raw data in
A switching control method for a duplicated computer system, characterized in that when a failure occurs, the data in the buffer table, including the above data, is transmitted to a standby computer so that data processing can be continued. 2. When a duplicated computer operates as an active system and a standby system and a failure occurs in the active system,
In a redundant system in which the standby computer up to that point continues to execute processing in place of the active computer, system monitoring means for monitoring the operation of the active computer is provided, and the system monitoring means is the active computer. When the response cannot be confirmed within a preset allowable time, it is considered that a failure has occurred in the active computer, and the active computer and the standby computer are switched. Switching control method for redundant computer system. 3. When a duplicated computer operates as an active system and a standby system and a failure occurs in the active system,
In a redundant system in which the standby computer up to that point continues to execute processing in place of the active computer, system monitoring means for monitoring the operation of the active computer is provided, and the system monitoring means manages the amount of data. A switching control method for a redundant computer system characterized by switching the active computer and the standby computer when the above-mentioned active computer is considered to have failed when data is received in excess of a predetermined amount. . 4. When a duplicated computer operates as an active system and a standby system and a failure occurs in the active system,
In the redundant system in which the standby computer up to that point continues to execute processing in place of the active system, a system monitoring means for monitoring the operation of the active computer is provided, and the system monitoring means is provided for processing the data to be processed. A switching control system for a duplicated computer system, comprising a priority management means and capable of processing in accordance with a data processing priority order.