JPH06131208A - Switching system between in-operation device and stand-by device - Google Patents

Abstract

PURPOSE:To provide the switching system between the in-operation device and stand-by device by recognizing whether a fault is a hardware fault or software fault and automatically remedying it in case of the software fault. CONSTITUTION:Two devices 11 and 12 which has the same function are equipped with operation state display information parts 21 and 21' which inform the opposite devices of in-operation/stand-by states, hardware fault detection parts 22 and 22' for hardware fault detection, software fault detection parts 23 and 23' for software fault detection, and software fault information holding parts 25 and 25' for holding pieces S14 and S14' of software fault information. Further, the devices are equipped with restart parts 26 and 26' for restarting software in case of the software fault, state detection parts 27 and 27' which detects the state of the opposite devices, own-device operation system setting parts 28 and 28' which determine the in-operation/stand-by states of their devices, and control parts 29 and 29' which control the respective parts 21-28 and 21'-28', and the in-operation device is switched to the stand-by device in case of fault occurrence.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a switching system for operating devices and standby devices. In a continuous operation system in which operation suspension is not allowed, a hot standby type duplex structure is adopted.

For example, in order to prevent the system from being stopped as much as possible, two host computers having the same function are installed in the host computer that manages the communication system. One of them is used as an active system and the other is used as a standby system. If so, it is switched to the standby system.

However, if a failure occurs in the system after switching after switching, both systems will be in a failure state. In this case, if it is not possible to determine whether the failure is due to hardware or software, it takes time to investigate the cause, and the service is stopped during that time.

Therefore, there is a demand for a system capable of determining whether the failure is due to hardware or software and not stopping the service as much as possible.

[0005]

2. Description of the Related Art FIG. 5 shows a diagram for explaining a conventional switching system of an operating device and a standby device, and the explanation will be given.

In the figure, the first device 1 and the second device 2 are the same device, and operation information S1 and S
1'and the standby information S2, S2 'are recognized by notifying each other via the inter-system communication unit 3. In addition, the occurrence of a failure of the own device is notified to each other by the own device failure information S3, S3 '.

At the time of initial startup, the first device 1 is in the operating state,
It is assumed that the second device 2 is in the standby state. The first device 1 in the operating state starts the operation process. When the operation of the first device 1 that has been performing this operation process becomes difficult due to a failure, the second device 2 outputs the self device failure information S3 and the standby information S2.
Send to.

The second device 2 which has received the information S2 and S3 transmits the operation information S1 'to the first device 1. After that, the second device 2 continues to perform the operation process that the first device 1 was performing.

[0009]

By the way, if a failure occurs in the second device 2 after the switching as described above, both devices 1 and 2 will be in a failure state and the system will be down.

The failure factor is either a hardware failure or a software failure. If both are down and the cause is a hardware failure, the system down state is restored unless the failure location is repaired. do not do.

If the cause is a soft fault, either device 1 or 2 may be automatically relieved.
There is a possibility that both devices 1 and 2 can be prevented from going down.

However, in the prior art, since there is no such automatic failure recovery function, if either the hardware failure or the software failure occurs in both devices 1 and 2, the system will be down and the service will be stopped for a long time. There was a problem.

The present invention has been made in view of the above circumstances, and can recognize whether it is a hardware fault or a software fault and automatically relieve it in the case of a software fault. It is an object of the present invention to provide a switching method of an operation device and a standby device that can be performed.

[0014]

In a system provided with two devices having the same function, an operating device and a standby device that switch to the standby device and continue the operation of the system when a failure occurs in the operating device In the device switching method, an operating state display notifying unit that displays the operating state or the standby state of the own device on the above-mentioned two devices and notifies the other device of the operating information and the standby information indicating the states, and the own device. Hardware failure detecting means for detecting hardware failure of the device and outputting hardware failure information, soft failure detecting means for detecting software failure of its own device and detecting software failure information, and software failure information holding for holding software failure information Means, a restart starting means for outputting a restart signal for restarting the software of the own device when the soft fault information is input, and the other device Operation information and standby information indicating the status of the partner device that is received, status detection means that detects the hardware failure information and software failure information of the partner device, and outputs a status detection signal when this is detected, and sets the own device to the operation status. It is configured to include a self-device operation system setting means that outputs a setting signal indicating either of the states and a control means that controls each of the above-described means. is there.

[0015]

According to the present invention described above, the soft fault detecting means and the hard fault detecting means can recognize whether the generated fault is a soft fault or a hard fault.

Also, for example, when the two devices are powered on,
Or, at the time of restarting when a software failure occurs, if the software failure information holding means does not hold the software failure information, if the own device is the active system, it is set to the operating state and If the device is a standby system, it is set to a standby state.

When the soft fault information is held, the control means recognizes the operating state / standby state of the partner device from the state detection signal. If the device is in the standby state, the own device is set to the operating state.

That is, in the case of a software failure, either device can be rescued by restarting the software. In addition, since it is possible to recognize whether it is a hard failure or a soft failure, it is not necessary to pursue whether the cause of the failure is hard or soft as in the past, and when it is a hard failure, it is immediately detected. It is possible to shift to work to recover.

[0019]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings. FIG. 2 is a diagram for explaining a switching system of the operating device and the standby device according to an embodiment of the present invention.

In the figure, 11 is a first device and 12 is a second device. Both devices 11, 12 have the same function,
It is connected by the inter-system communication unit 13. However, since the respective units in the first and second devices 11 and 12 have the same functions, the same reference numerals are given, but the reference numbers relating to the second device 12 are distinguished by adding'to the upper right.

In the first device 11, reference numeral 21 is an operation status display notifying unit, which displays whether the device itself is in the operation status or in the standby status, and displays the status in the operation information S11 and the standby information S12. Is to be notified by.

Reference numeral 22 denotes a hardware fault detecting section, which detects a hardware fault and outputs the hardware fault information S13. Reference numeral 23 denotes a soft fault detecting unit, which detects a soft fault and outputs the soft fault information S14.

The hardware fault information S13 and the soft fault information S14 are notified to the second device 12 via the OR circuit 24. Reference numeral 25 denotes a soft fault information holding unit, which holds the soft fault information S14.

Reference numeral 26 is a restart starter, which outputs a restart signal S15 for restarting the own device when the soft fault information S14 is input. Two
Reference numeral 7 is a state detection unit, which is operation information S11, standby information S12, and hardware failure information S1 sent from the second device 12.
3. The soft fault information S14 is detected, and the state detection signal S16 is output at the time of detection.

Reference numeral 28 denotes an own device operation system setting unit, which determines whether the own device is in an operating state or a standby state, and outputs a setting signal S17 when any one of the states is determined. A central control unit 29 controls the above-mentioned respective units.

The description of each part of the second device 12 is omitted. Next, the switching operation of the operation device and the standby device with such a configuration will be described in (1) to (7) below.

(1) The operation when the system is initially started up will be described. It is assumed that the first device 11 is powered on in step F1 shown in the flowchart of FIG.

At this time, in step F2, the central control unit 29 causes the soft fault information holding unit 25 to store the soft fault information S.
Check if 14 is set. If the confirmation result is NO (N), the process proceeds to step F3 and YES.
If (Y), the process proceeds to step F4.

In this case, since the first device 11 does not have the soft fault at the initial startup and the soft fault information S14 is not set, the process proceeds to step F3. In step F3, the own device operation system setting unit 28 determines whether or not the own device is set to the operation system. If the result of this determination is YES, the process proceeds to step F5, and if NO, the process proceeds to step F6.

At the time of initial startup, the first device 11 is set to the active system, and therefore the process proceeds to step F5. In step F5, the operation setting signal S for the own apparatus operation system setting unit 28 to set the operation of the own apparatus.
17 is output to the central control unit 29. As a result, the central control unit 29 brings its own device into the operating state as shown in step F7.

When the operating state is set in this way, the operating state display notifying section 21 displays it and notifies the second device 12 of the operating information S11. On the other hand, at the time of this initial startup, the second device 12 is similarly powered on in step F1.

Then, in step F2, it is confirmed whether or not the soft fault information S14 'is set,
In step F3, the own device operation system setting unit 28 determines whether or not the own device is set to the operation system.

If the second device 12 is set to the standby system at the initial startup, step F6
Will proceed to. In step F6, the operation setting signal S for the own apparatus operation system setting unit 28 'to set the own apparatus on standby.
17 'is output to the central control unit 29'. As a result, the central control unit 29 'places itself in a standby state as shown in step F8.

When the standby state is set in this way, the operating state display notifying section 21 'displays it and also notifies the first device 11 of the standby information S12'. The state detection units 27 and 27 'of the respective devices 11 and 12 detect the notified operation information S11 and standby information S12' and detect the respective central control units 29 and 29 '.
The state detection signals S16 and S16 'are used for notification.

As a result, each of the devices 11 and 12 recognizes that the other party is in the operating state or the standby state. (2) The operation when a soft failure occurs in the second device 12 which has been in the standby state will be described.

Step F9 shown in the flow chart of FIG.
In, the second device 12 is in the standby state, and in step F10, it is determined whether or not the soft fault of the self device is detected by the soft fault detection unit 23 '. If this determination result is YES, the process proceeds to step F11, N
If it is O, the process proceeds to step F12.

If a soft fault is detected, the soft fault information S14 'is set in the soft fault information holding section 25' in step F11, and the soft fault information S14 'is set in step F1.
In step 3, the first device 11 is notified of the soft fault information S14 via the OR circuit 24 'and the inter-system communication unit 13.

Then, in step F14, the software fault information S14 'is input to the restart activation section 26', whereby the restart signal S15 'is output to the central control section 29' and the software is restarted. It

Here, the process returns from the flowchart shown in FIG. 2 to step F2. In step F2, it is judged whether or not the soft fault information S14 'is set, but since it is set here, the process proceeds to step F4.

In step F4, the soft fault information S
14 is cleared, and in step F15, the central control unit 29 'judges whether or not the other party is in the operating state by looking at the state detection signal S16'. If the determination result is YES, the process proceeds to step F6, and if the determination result is NO, step F16.
Go to.

Since the state detection signal S16 'here indicates that the first device 11 is in the operating state, the process proceeds to step F6. In step F6, the operation setting signal S17 'is output from the own apparatus operation system setting unit 28' to the central control unit 29 'so that the own apparatus is set to standby.

Then, in step F8, the central control unit 29 'receiving the operation setting signal S17' puts itself in a standby state. On the other hand, the state detection signal S16 'indicates that the first device 11 is in the standby state, and if the result of the determination in step F15 is NO, in step F16, the operation setting of the own device is performed. The setting signal S17 'is output to the central control unit 29' and step F1
The operation state is set in 7.

(3) Second device 12 in standby state
The operation when a hardware failure occurs will be described. In step F10 of FIG. 3, when no soft fault is detected, the process proceeds to step F12, and it is determined whether or not a hard fault of the own device is detected by the hard fault detection unit 22 '. If the determination result is YES, the process proceeds to step F18, and if the determination result is NO, the process proceeds to step F19.

If YES, step F18
At, the hardware failure information S13 'is notified to the first device 11 in the operating state. Then, in step F20, the work of recovering the faulty part is performed.

On the other hand, if the decision result in the step F12 is NO, the process advances to a step F19, and it is decided whether or not the other party, the first device 11, is in the operating state. If the determination result is YES, the process returns to step F10.

In this case, since the first device 11 is in the operating state, the device itself is in the standby state and is in the state of detecting the software fault and the hardware fault. If the decision result in the step F19 is NO, the process advances to the step F21, and in the step F21, the own device is set to the operation system, and the step F21 is executed.
The operation state is set at 22.

(4) The first device 11 in the operating state
After a hardware failure occurs in the second device 12 and the operating state shifts to the second device 12, the operation in the case where the second device 12 in the operating state experiences a soft error without the hardware error of the first device 11 being recovered will be described. To do.

Step F2 shown in the flow chart of FIG.
In step 3, the first device 11, which is in the operating state, determines in step F24 whether or not the soft fault of the self device is detected by the soft fault detection unit 23. If the result of this determination is NO, then the processing advances to step F25, where YE
If S, go to step F26.

In the case of NO, the routine proceeds to step F25, where it is judged whether or not the hardware failure detecting section 22 has detected the hardware failure of the own device. If the result of this determination is NO, the process returns to step F24, and a state in which a soft fault and a hard fault have been detected is entered.

On the other hand, the determination result in step F25 is YES.
In the case of, the hardware failure information S13 is notified to the second device 12. Further, the process proceeds to step F27, and the first device 11
Is set as a standby, and the standby information S12 is notified to the second device 12 in the standby state. Then, in step F28, the work of recovering the faulty portion is performed.

At this time, the second device 12 in the standby state is
The hardware failure information S13 and the standby information S12 sent from the device 11 are detected by the state detection unit 27 ', and the detected contents are sent to the central control unit 2 by the state detection signal S16'.
Notify 9 '.

As a result, the second device 12 shifts from the standby state to the operating state, and the operation process performed by the first device 11 is executed. At this time, the operating state display notifying section 21 'displays that the second device 12 is in the operating state, and
The operation information S11 is notified to the device 11.

Here, it is assumed that a soft fault occurs in the second device 12 in the operating state, and the soft fault is detected by the soft fault detecting section 23 '. In this case, soft fault information S14 '
And the standby information S12 'is notified to the first device 11, and the state detection unit 27 of the first device 11 detects them.

However, since the first device 11 is recovering from the hardware failure, it continues to be in the standby state. In addition, the second device 12
Then, the restart activation unit 26 'to which the soft fault information S14 is input sends the restart signal S15' to the central control unit 2.
The software is restarted by outputting to 9 '.

This time, since the soft fault information S14 'is set in the soft fault information holding unit 25', the central control unit 29 'recognizes the standby information from the first device 11 in the state detection signal S16'. , Put the second device 12 in the operating state,
Perform operation processing.

(5) First device 11 in operation
An operation when a hardware failure occurs in the second apparatus 12 in the operating state after a soft failure occurs in the second apparatus 12 and the operating state shifts to the second apparatus 12 will be described.

Step F2 shown in the flow chart of FIG.
4, it is assumed that a soft failure has occurred in the first device 11 in the operating state, the determination result in step F24 is YES.
Therefore, the process proceeds to step F26.

In step F26, the soft fault information S14 is set in the soft fault information holding section 25. The soft fault information S14 is notified to the second device 12. In step F29, the first control is performed by the control of the central control unit 29.
When the device 11 is set to the standby state, the operation state display notification unit 21 displays the operation state, and the second device 12 is notified of the standby information S12 informing the operation state.

As a result, the second device 12 becomes the first device 1
Since it recognizes that a soft failure has occurred in No. 1 and has entered the standby state, it shifts to the operating state and executes the operation processing that the first device 11 was performing. Then, the first device 11 is notified of the operation information S11 'to notify that it is in the operation state.

On the other hand, the first device 11 is in a standby state due to the above-mentioned soft fault, but when the soft fault information S14 is input to the restart starting unit 26, the first control unit 29 returns to the central control unit 29. The start signal S15 is input and the process is restarted as shown in step F30.

After that, in the flowchart, FIG.
The process proceeds to step F2, which has already been described, by following the flow chart path indicated by. At this time, since the soft fault information S14 is set in the soft fault information holding unit 25, the operating state of the second device 12 which is the switching destination is checked.

Since the second device 12 is still in the operating state immediately after the switching, the first device 11 is in the standby state. Here, it is assumed that a hardware failure has occurred in the second device 12 in the operating state.

When this is detected by the hardware fault detecting section 22 ', the hardware fault information S13' is sent to the first device 11 '.
At the same time, the self-device is placed in a standby state, and the standby information S12 ′ is notified to the first device 11.

Then, the second device 12 starts the hard failure recovery work. When the first device 11 detects that a hardware failure has occurred in the second device 12, the first device 11 shifts to the operating state and executes the operation process.

(6) First device 11 in operation
An operation when a soft failure occurs in the second device 12 in the operating state after a soft failure occurs in the second apparatus 12 and the operating state shifts to the second device 12 will be described.

If a soft fault occurs in the operating first device 11, the soft fault detecting section 23 detects it. The soft fault information S14 is notified to the second device 12.

Further, when the soft fault information S14 is set in the soft fault information holding section 25 and the first device 11 is set to the standby state, the standby information S12 for notifying this is the second.
The device 12 is notified.

As a result, the second device 12 becomes the first device 1
Since it recognizes that a soft failure has occurred in No. 1 and has entered the standby state, it shifts to the operating state and executes the operation processing that the first device 11 was performing. Then, the first device 11 is notified of the operation information S11 'to notify that it is in the operation state.

On the other hand, the first device 11 is in a standby state due to the soft fault described above, but the soft fault information S14 is input to the restart activation unit 26, so that the restart signal S15 is transmitted to the center. It is input to the control unit 29 and restarted.

At this time, since the soft fault information S14 is set in the soft fault information holding section 25, the operating state of the second device 12 which is the switching destination is checked. Second device 12
Immediately after the switching, the first device 11 is in the standby state because it is still in the operating state.

Here, it is assumed that a soft failure has occurred in the second device 12 in the operating state. This is the soft failure detection unit 2
When detected by 3 ', the soft fault information S14' is notified to the first device 11, the own device is put in the standby state, and the standby information S12 'is notified to the first device 11.

By this notification, the first device 11 is put into the operating state and the operation processing is performed. In addition, the second device 12 is restarted although it is in a standby state due to a soft failure.

At this time, since the soft fault information S14 'is set in the soft fault information holding section 25', the operating state of the first device 11 which is the switching destination is checked. Since the first device 11 is in the operating state, the second device 12 is in the standby state.

(7) First device 11 in operation
An operation will be described in the case where a hard failure occurs in the second device 12 in the operating state after a hard failure occurs in the second apparatus 12 and the operating state shifts to the second device 12.

If a hardware failure occurs in the operating first device 11, the hardware failure detecting unit 22 detects it. The hardware failure information S13 is notified to the second device 12.

Further, the central control unit 29 is set in the standby state, the operating state display notifying unit 21 displays it, and the second device 12 is notified of the standby information S12 notifying it. Since the first device 11 in the standby state is caused by a hardware failure, a recovery operation is started.

Further, since the second device 12 recognizes that the first device 11 has a hardware failure and is in a standby state, the second device 12 shifts to the operating state and executes the operation processing performed by the first device 11. Run. Then, the operation information S1 is sent to the first device 11.
By notifying 1 ', it informs that it is in the operational state.

Here, it is assumed that a hardware failure has occurred in the second device 12 in the operating state. This is the hardware failure detection unit 2
When detected by 2 ', the hardware failure information S13' is notified to the first device 11, the own device is put in the standby state, and the standby information S12 'is notified to the first device 11.
Then, the second device 12 starts the hard failure recovery work.

According to the switching system of the operation device and the standby device described above, when a failure occurs in the operation device performing the operation process and the operation process is switched to the standby device, the operation destination device is switched to the standby device. Also, when a failure occurs, if the failure is a soft failure, restarting the software can rescue any of the devices, so that the system service can be continued. Therefore, a more reliable system can be constructed.

Further, since it is possible to recognize whether it is a hardware failure or a software failure, in the case of a hardware failure, it is possible to immediately shift to the work of recovering it. In the past, since the type of failure could not be identified, it was necessary to start by pursuing the cause of failure, which required time to recover and the service was stopped for a long time.

[0081]

As described above, according to the present invention,
There is an effect that it is possible to recognize whether it is a hardware failure or a software failure and automatically remedy it in the case of a software failure.

Further, even in the case of a hardware failure, it can be specified in advance, so that it is possible to save the trouble of pursuing the failure as in the conventional case and to shorten the time required for recovery.

[Brief description of drawings]

FIG. 1 is a diagram for explaining a switching system of an operation device and a standby device according to an embodiment of the present invention.

FIG. 2 is a flowchart illustrating an operation of the operation device and the standby device shown in FIG. 1 at the time of initial startup.

FIG. 3 is a flowchart illustrating an operation when a soft failure and a hardware failure occur in the standby device shown in FIG.

FIG. 4 is a flowchart illustrating an operation when a software fault and a hardware fault occur in the operation device shown in FIG.

FIG. 5 is a diagram for explaining a conventional switching system between an operation device and a standby device.

[Explanation of symbols]

 11 1st apparatus 12 2nd apparatus 21, 21 'Operation status display notifying section 22, 22' Hard failure detection section 23, 23 'Soft failure detection section 25, 25' Soft failure information holding section 26, 26 'Restart activation section 27, 27 'Status detection unit 28, 28' Own device operation system setting unit 29, 29 'Central control unit S11, S11' Operation information S12, S12 'Standby information S13, S13' Hard failure information S14, S14 'Soft failure information S15, S15 'Restart signal S16, S16' State detection signal S17, S17 'Own device operating system setting signal

Claims (8)

[Claims] 1. A standby device (1) having the same function as that of the operating device (11) when a failure occurs in the operating device (11).
In the switching method of the operation device and the standby device that switch to 2) and continue the operation of the system, the operation state or standby state of the own device is displayed on the two devices (11, 12), and the operation indicating the states is displayed. Information (S11, S11 ') and standby information (S12, S1
2 ') is notified to the partner device by the operation status display notification means (21, 2
1 ′) and a hardware failure of its own device is detected and hardware failure information (S13, S1
3 ') to output the hardware fault detection means (22, 22') and the software fault of its own device to detect the soft fault information (S14, S1
4 ') for detecting the soft fault, (23, 23') soft fault information holding means (25, 25 ') for holding the soft fault information (S14, S14'), and the soft fault information (S14, S14 '). , S14 ′) is input, the restart signal (S15, S
15 ') for restart activation means (26,26'), operation information (S11, S11 ') indicating the status of the partner device sent from the partner device, and standby information (S12, S12'). , The hardware fault information (S13, S13 ') and the soft fault information (S14, S14') of the partner device are detected, and the state detection signal (S
16, S16 ') output state detection means (27, 27') and whether the own device is in the operating state or the standby state,
A setting signal (S17, S17 ') indicating either state at the time of this determination
Device operating system setting means (28, 28 ') for outputting the above, and control means for controlling the respective means (21 to 28, 21' to 28 ')
(29, 29 '), and a switching system between the operating device and the standby device, characterized in that when a failure occurs in the operating device (11), it switches to the standby device (12). . 2. The soft fault information holding means (25, 25 ') is stored in the soft fault information holding means (25, 25') either when the power of the two devices (11, 12) is turned on or when the power is restarted. ) Is not held, the device is set to the operating state if it is the active system and is set to the standby state if the device is the standby system, and the soft fault information (S14, S14 ') is held. Control means (29, 29 '), the state detection signal (S1
6, S16 ') recognizes the operating status / standby status of the partner device,
2. The switching system between the operating device and the standby device according to claim 1, wherein when the partner device is in the operating state, the device itself is set to the standby state, and when the partner device is in the standby state, the device itself is set to the operating state. 3. A soft fault information (S1) obtained by detecting the soft fault by the soft fault detecting means (23 ') when a soft fault occurs in the standby device (12).
4 ') is notified to the partner device (11) and is held in the soft fault information holding means (25'), and the soft fault information (S1
The central control means (29 ') restarts the software of its own device (12) by the restart signal (S15') output by the restart starting means (26 ') by the input of 4'), and The operating status / standby status of the partner device (11) is confirmed from the operation information (S11 '), and if the partner device (11) is in the working status, it is output from the own device operating system setting means (28'). The own device (12) is set to the standby state according to the setting signal (S17 '), the standby state is displayed by the operating state display notifying means (21'), and the standby information (S1) is sent to the partner device (11).
2 ') is notified.
Switching method between the operating device and the standby device described. 4. When a hardware failure occurs in the standby device (12), the hardware failure information (S1) obtained by the hardware failure detection means (22 ') detecting the hardware failure.
3 ') is notified to the partner device (11), and the control means (29')
2. The switching system between the operation device and the standby device according to claim 1, wherein the device itself sets the device (12) in a failure recovery state. 5. A hardware failure occurs in the operating device (11), and after the operating status is transferred to the partner device (12), a soft error occurs in the newly operating device (12). The soft fault detecting means of the device (12) in which the soft fault has occurred
(23 ') notifies the partner device (11) of the soft fault information (S14') obtained by detecting the soft fault, and holds it in the soft fault information holding means (25 '). The control means (29 ') restarts the software of its own device (12) by the restart signal (S15') output by the restart starting means (26 ') by the input of (S14'), and By checking the status of the partner device (11) from the status detection signal (S16) and recognizing that the partner device (11) is in a standby state due to a hardware failure, the own device (12) is in the operating state. The operation system and the standby device switching method according to claim 1, wherein the operation processing is performed by setting the operation mode. 6. When a software failure occurs in the operating device (11) and the operating status is transferred to the partner device (12), and then a hardware error occurs in the newly operating device (12). The hardware failure detecting means of the device (12) in which a hardware failure has occurred
(22 ') notifies the partner device (11) of the hardware fault information (S13') obtained by detecting the hardware fault and the standby information (S12 ') obtained by entering the standby state at the time of the hardware fault. However, according to this notification, the control means (29) of the device (11) in the standby state after the restart process is performed due to the occurrence of the soft fault causes the partner device (1
When the hardware failure occurs in 2) and it is recognized that the device has entered the standby state, the device (11) is set to switch from the standby state to the operating state.
Switching method between the operating device and the standby device described. 7. A soft failure occurs in a device (11) in the operating state, and after the operating status is transferred to the partner device (12), a soft failure occurs in the device (12) newly in the operating state. , Soft fault information (S14 ') obtained by the soft fault detecting means (23') of the device (12) in which this soft fault has occurred, and the soft fault information (S14 ') obtained by entering a standby state at the time of a soft fault. The standby information (S12 ') is notified to the partner device (11), and by this notification, the control means of the device (11) in the standby state after the restart processing is performed due to the occurrence of a software failure. (29) is the partner device (1
When a software failure occurs in 2) and it is recognized that it has entered the standby state, the device (11) is switched from the standby state to the operating state and the operation information (S11) is set to the partner device (12). )
The other device (12) that received this notification
2. The switching system between the operation device and the standby device according to claim 1, wherein the switch is set to a standby state. 8. A hardware failure occurs in the operating device (11), and after the operating status is transferred to the partner device (12), a hardware error occurs in the newly operating device (12). The hardware failure detecting means (22 ′) of the device (12) in which the hardware failure has occurred detects the hardware failure, and the control means (29
′) Sets its own device (12) in the failure recovery state,
The switching system between the operation device and the standby device according to claim 1, characterized in that both devices (11, 12) are set in a failure recovery state.