JPH09146796A - Hardware cycle interrupt circuit failure recovery method - Google Patents

Abstract

(57) [Abstract] [Problem] To detect a failure of a hardware timer circuit only by a control program without increasing the amount of hardware,
A failure recovery method for a hardware cycle interrupt circuit, which performs recovery processing and allows the control program to continue timer processing when recovery is not possible. SOLUTION: A periodic interrupt generation circuit generates a periodic interrupt signal of hardware to a processor unit at a constant period, and a control program of the processor unit is a timer of a timer interrupt routine activated by a periodic interrupt signal from the periodic interrupt generation circuit. The counter of the control program is decremented or added by processing, the prescribed control is activated by the decremented value / added value, and the control program monitors the interruption and stop of the counter decrement / addition due to the failure of the hardware cycle interrupt generation circuit. , Detect failure based on the monitoring result and try recovery.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a failure recovery method for a hardware cycle interrupt circuit for time monitoring by hardware and a control program.

[0002]

2. Description of the Related Art Conventionally, as a failure detection method for a hardware timer circuit, there has been a method for duplicating the timer circuit shown in FIG. In FIG. 2, the count values of the timer 1 (201) and the timer 2 (202) are compared by the comparator (203), and if they match, it is determined that the timer is normal and the processor unit (204) is interrupted to execute the control program processing. To do.

Further, in the timer failure detection method disclosed in Japanese Patent Laid-Open No. 2-297226, a single timer clock is shared among a plurality of processing devices, each processing device has an independent timer circuit, and the timer stepping is performed. A synchronization signal for comparison is generated, and timer progress is compared at regular intervals to detect a timer failure.

[0004]

In the prior art, as described above, there is a method of duplicating the hardware for the timer or a method of monitoring the progress of the timer among a plurality of processing devices. Further, in connection with a communication line, there is a method in which the other party of the connection monitors the time, so that the time monitoring is continued even when the timer circuit of the other device fails.

At this time, in the case of duplication and the monitoring system between a plurality of processing devices, the number of circuit components increases and the cost increases.

Further, in any of the above, a hardware circuit failure is treated as a permanent failure. The hardware may experience a temporary operational failure and has the potential to recover by being initialized.

Further, when a permanent failure occurs, there is a problem that the operation of the device must be stopped until the hardware is replaced or the spare circuit is switched.

According to the present invention, the above problems are detected only by the control program without adding any hardware, the dedicated hardware is made unnecessary, the temporary failure recovery processing and the apparatus operation continuation at the time of permanent failure are realized. It is a thing.

[0009]

SOLUTION: This processing time is counted a plurality of times with the shortest one-round processing time of a main routine of a control program as one unit, and the total time is equal to or longer than a fixed cycle time for a timer of a hardware circuit. Then, the fault is detected by monitoring the generation of a fixed period interrupt signal of the hardware by the control program. The processor, which is the execution unit of the control program, is monitored by a known watchdog timer or the like.

Without adding any hardware, the control program alone monitors the interrupt interval of a fixed period by the hardware timer circuit. If no hardware interrupt occurs within this monitoring time, it is determined that a hardware failure has occurred. Recognize and perform hardware initialization processing, maintenance information collection / report of hardware failure occurrence, and timer monitoring processing.

[0011]

Embodiments of the present invention will be described below in detail with reference to the drawings.

FIG. 3 shows a line control system composed of a microprocessor.
1) is controlled by the control program stored in the main memory (302). Periodic interrupt generation circuit (30
3) and the interrupt signal (304) from the line controller, the interrupt controller (305) receives and notifies the microprocessor unit (301). The control program performs processing according to the notified interrupt content.

FIG. 4 shows a main routine in a conventional control program. The main routine constantly monitors processing requests from the outside and inside of the processor, and when there is a processing request, starts the corresponding processing unit (402) and returns to the processing request monitoring again at the end of processing or when there is no processing request. This is a loop (403) method program.

FIG. 5 shows the main routine of the control program in this embodiment. This routine adds processing after the subtraction (503) of the periodic interrupt monitoring counter after there is no processing request in the conventional processing (400). This subtraction process determines that the remaining counter value is 0 (50
At 4), it is recognized that some failure has occurred in the periodic interrupt generation circuit (303), and the periodic interrupt generation circuit monitoring failure detection processing (510) is performed. In the periodic interrupt generation circuit monitoring failure detection processing (510), it is first determined whether the periodic interrupt generation circuit has a permanent failure (511). During the permanent failure, the initialization (513) for recovering the periodic interrupt generation circuit is not performed, and the control program timer process (51
Execute 5).

In the detection of a permanent failure, the remaining value of the counter for periodic interrupt monitoring = 0 is generated, and the control program timer process (5) is performed by the periodic interrupt generation circuit monitoring fault detection process (510).
After initializing the counter in step 15), when the hardware periodic interrupt does not occur once and the residual value of the periodic interrupt monitoring counter reaches 0 (512), it is recognized as a permanent fault and a permanent fault occurs. Is stored inside the control program and is reported to the administrator of the device (516).

FIG. 6 shows a timer interrupt routine. A timer process (601) for starting a predetermined control, triggered by a hardware periodic interrupt signal (303)
After that, the periodic interrupt monitoring counter (counter value subtraction in (503)) is initialized and the continuous generation flag (flag set in (514)) is reset.

FIG. 7 correlatively shows the generation timing of the interrupt signal in the normal state of the periodic interrupt generation circuit (303) and the execution of the timer interrupt routine associated with the timing, and the state of the periodic interrupt monitoring counter remaining value. It is a thing. As shown in this figure, the periodic interrupt generation circuit (3
03) During normal operation, an interrupt signal is generated periodically (70
1) Yes. The timer interrupt routine ((600) and (702)) is executed upon the occurrence of the interrupt signal, and the periodic interrupt monitoring counter is initialized (602) during the execution. It cannot be 0 (703).

FIG. 8 is a correlation diagram when the periodic interrupt generation circuit (303) fails in contrast to FIG. If an interrupt signal is not generated due to a failure of the periodic interrupt generation circuit (303) (801), the periodic interrupt monitoring counter is not initialized (602), so the counter is decremented (50
3) is continued, the counter residual value reaches 0 (802), and the periodic interrupt generation circuit monitoring failure detection processing ((510) and (803)) is started.

The above processing contents will be described below with reference to the drawings.

The shortest processing path of the main routine is (50
1 (N; no request) → (503) → (504 (N; residual value ≠ 0)) is executed and the process returns to (501) again (520). The time required for one shortest processing route is set as the shortest loop time, and the value is set as Tm. The real time of Tm can be easily calculated from the number of program steps and the hardware performance of executing the program.

The subtraction (503) of the hardware periodic interrupt monitoring counter is executed once for each loop of the main routine. The initial value Ni of the periodic interrupt monitoring counter is determined by the following equation.

Ni> T1 / Tm where T1 is the periodic interrupt interval time (7
01). The initial value Ni is the time (Tm × N) when the process of the shortest route of the main routine is executed continuously Ni times.
Set a value such that i) is greater than T1 time.

With the above settings, the timer interrupt routine ((60) is activated by the periodic interrupt while the periodic interrupt generation circuits ((101) and (303)) are operating normally.
0) and (702)) resetting the initial value Ni by initializing the hardware cycle interrupt monitoring counter (602) prevents the hardware cycle interrupt monitoring counter from having a residual counter value of 0. No (703).

When some trouble occurs in the periodic interrupt generation circuits ((101) and (303)) and the hardware periodic interrupt signals ((102) and (304)) cannot be generated (801), the timer interrupt routine ( 6
00) is not started, and the periodic interrupt monitoring counter is not initialized. Therefore, the counter has a residual value =
It is subtracted to 0 (802). When the remaining value of the counter becomes 0, the control program recognizes that a hardware periodic interrupt generation circuit fault has occurred, and starts the periodic interrupt generation circuit monitoring fault detection processing ((510) and (803)).

In the periodic interrupt generation circuit monitoring fault detection processing ((510) and (803)), as described above with reference to FIG. There is also a method in which this is provided with a counter for the number of consecutive occurrences, and a permanent failure occurs when the counter value is consecutive.

If it is not a permanent failure, there is a possibility of a temporary failure of the cyclic interrupt generation circuits ((101) and (303)) and initialization is performed to recover the cyclic interrupt circuit (51).
Perform 3). Next, the continuous occurrence monitoring flag for permanent failure monitoring is set (514). This flag may be the above-mentioned continuous occurrence number counter.

When the hardware temporarily fails, the initialization is restored (804), and the periodic interrupt can be restarted.

The control program timer process (515) is
Timer processing of the timer interrupt routine (601) and initialization of the counter for periodic interrupt monitoring (602) are performed as if the periodic interrupt signals ((102) and (3
04)) is executed. As a result, the timer processing is performed based on the equation of the initial value Ni of the periodic interrupt monitoring counter described above from the hardware interrupt period T1 to the total period interrupt monitoring time by the control program [Tm × N].
i] becomes larger, the interval of the control program timer processing is extended and the timer accuracy is lowered, but the processing of the apparatus can be continued.

[0029]

According to the present invention, the hardware timer circuit for generating a periodic interrupt has a simple structure, and a temporary failure of the hardware circuit for generating a periodic interrupt can be recovered. Control operation can be continued.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating the concept of the present invention.

FIG. 2 is a diagram illustrating an example of a conventional timer duplication circuit.

FIG. 3 is a configuration diagram of a line control system according to an embodiment of the present invention.

FIG. 4 is a diagram illustrating an outline of operation of a general main routine of a control program according to an embodiment of the present invention.

FIG. 5 is a flowchart of a main routine of a control program in the embodiment.

FIG. 6 is a flowchart of a timer interrupt routine activated by the cyclic interrupt generation circuit of the embodiment.

FIG. 7 is a diagram illustrating a timing of generating a hardware cycle interrupt signal and time monitoring (during normal operation) by a timer routine of a control program according to the embodiment.

FIG. 8 is a diagram illustrating a recovery process by a control program when a hardware cycle interrupt signal of the embodiment is stopped.

[Explanation of symbols]

100 ... A device having a hardware interrupt generation circuit, 10
DESCRIPTION OF SYMBOLS 1 ... Hardware interrupt generation circuit, 102 ... Periodic interrupt signal, 103 ... Processor part, 200 ... Device having a circuit in which a hardware timer is duplicated, 201 ... Hardware timer circuit, 202 ... Hardware timer circuit, 20
3 ... Comparison circuit, 204 ... Processor section, 300 ... Line control system, 301 ... Microprocessor section, 302 ...
Main memory, 303 ... Periodic interrupt generation circuit, 304 ...
Interrupt signal, 305 ... Interrupt control unit.

Claims (1)

[Claims] 1. A cyclic interrupt generation circuit generates a hardware cyclic interrupt signal to a processor unit at a constant cycle, and a control program of the processor unit is a timer interrupt activated by a cyclic interrupt signal from the cyclic interrupt generation circuit. The counter of the control program is subtracted or added by the timer processing of the routine, predetermined control is activated by the subtracted value / added value, and the interruption / stop of the counter subtraction / addition due to the failure of the hardware cycle interrupt generation circuit is performed. A failure recovery method for a hardware cycle interrupt circuit, which comprises monitoring by a control program, detecting a failure based on the monitoring result, and attempting recovery.