JPH1078896A - Industrial electronic computer - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an industrial electronic computer in which a time required for restoring operational failure can be sharply shortened. SOLUTION: First, second, and third counters 4A, 4B, and 4C operate count-up synchronously with a clock signal from a clock circuit 2. When software is in a normal state, a count value is reset by a reset signal R-WDT from a reset circuit 3 after each lapse of a fixed time, and when operational failure is generated, the reset signal R-WDT is not outputted from the reset circuit 3. When a set time passes since the reset signal R-WDT is finally outputted, the counter 4A outputs a signal RST1. Then, an interruption controlling circuit 5 operates interruption communication for resorting the operation. When the operation is not restored, the counter 4B outputs a signal RST1, and a system reset circuit 7 performs a reset operation. When the operation is still not restored, the counter 4C outputs a signal RST3, and a process control circuit 9 temporarily turns off a system power source, and then turns it on.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an industrial computer having a watchdog timer.

[0002]

2. Description of the Related Art A computer sometimes loses its normal operation due to a hardware failure, a bug in software or firmware, or the like. In order to remove these faults, it is first important to detect the operation fault. Conventionally, a technique using a watchdog timer has been known as a means for detecting a computer fault.

FIG. 5 is a block diagram of an operation failure recovery mechanism having the watchdog timer. In FIG. 1, a watchdog timer 1 includes a clock circuit 2, a reset circuit 3, and a counter 4. The counter 4 counts up the time measurement count in synchronization with the clock signal from the clock circuit 2. Then, a reset signal is input from the reset circuit 3 every time a predetermined time elapses, and the count is reset.

If the software is working properly,
The counter 4 repeats such a count operation and a reset operation. However, when a failure occurs in which the software cannot operate normally, the reset signal from the reset circuit 3 is not input to the counter 4. Then, when the set time has elapsed since the last time the reset signal was input to the counter 4, the counter 4 outputs an operation failure detection signal.

[0005] When the operation failure detection signal is inputted, the interrupt control circuit 5 generates an interrupt in software and executes a predetermined program for restoring the operation failure.
Alternatively, a configuration may be adopted in which a system reset circuit (not shown) inputs the operation failure detection signal and causes hardware to perform a reset operation.

[0006]

Conventionally, when an operation failure is detected, the above-mentioned predetermined program operation or reset operation is uniformly performed as an operation for restoring the failure. It was only. this is,
Why the software is not working properly,
The reason why the operation failure is recovered by performing the reset operation or the like has not yet been elucidated so far, so that the processing has to be performed uniformly.

However, the time required for an operation to recover from a failure is not always the same for all operations. For example, when the hardware performs a reset operation, it is necessary to allow a considerable time for detecting whether or not the operation has been restored to a normal operation, and it is also necessary to execute an initialization process. It takes a considerable amount of time to return to the operation state. Therefore, the conventional uniform technique for recovery from operation failure still has room for improvement from the viewpoint of shortening the recovery time.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and has as its object to provide an industrial computer capable of minimizing the time required for recovery from an operation failure.

[0009]

As means for solving the above-mentioned problems, the invention according to the first aspect of the present invention is to reset a count by inputting a reset signal every time a predetermined time elapses, and to reset a count after a set time has elapsed. A watchdog timer having a time measurement counter for outputting an operation failure occurrence signal when the reset signal is not input, and a failure restoration operation for performing a failure restoration operation based on the input of the operation failure occurrence signal from the watchdog timer. And a circuit for outputting a first operation failure generation signal when the reset signal is not input even after the first set time has elapsed, in the timepiece counter of the watchdog timer. A first counter configured to generate a second operation failure when a reset signal is not input even after a second set time longer than the first set time has elapsed; A second counter for outputting a signal,
A third counter for outputting a third operation fault occurrence signal when a reset signal is not input even after a third set time longer than a second set time elapses, the fault recovery operation circuit being formed. A first failure recovery operation circuit that performs a first failure recovery operation when the first operation failure occurrence signal is input, and a case where both the first and second operation failure occurrence signals are input. A second failure recovery operation circuit for performing a second failure recovery operation, and a third failure recovery operation for performing a third failure recovery operation when both the second and third operation failure occurrence signals are input.
And a fault recovery operation circuit.

According to a second aspect of the present invention, in the first aspect, the third failure recovery operation circuit performs an operation of once turning off the system power supply and then turning on the system power supply as a third failure recovery operation. The watchdog timer outputs a fourth operation failure occurrence signal when a power supply is backed up by a battery and a reset signal is not input even when a fourth set time longer than the third set time has elapsed. A fourth counter for outputting,
The failure recovery operation circuit includes a system stop circuit that stops all functions of the system when both the third and fourth operation failure occurrence signals are input.

According to a third aspect of the present invention, a reset signal is input every time a predetermined time elapses to reset the count, and an operation failure occurrence signal is output when the reset signal is not input even after a set time has elapsed. An industrial computer comprising: a watchdog timer having a time measurement counter; and a failure recovery operation circuit that performs a failure recovery operation based on an input of an operation failure occurrence signal from the watchdog timer. The counter is formed by first to N-th N counters. When an arbitrary one of the second to N-th counters is an Nn-th counter, the first counter sets a first set time. When the reset signal is not input even after the lapse of time, the first operation failure occurrence signal is output.
When the reset signal is not input even after the Nn-th set time longer than the set time of 1, the Nn-th operation fault occurrence signal is output. Formed by N fault recovery operation circuits,
When any one of the second to Nth failure recovery operation circuits is the Nnth failure recovery operation circuit,
The first failure recovery operation circuit performs the first failure recovery operation when the first operation failure occurrence signal is input, and the Nn-th failure recovery operation circuit includes both the Nth-1 and the N-th failure recovery operation circuits. The Nn-th failure recovery operation is performed when the operation failure occurrence signal is input.

According to a fourth aspect of the present invention, in the third aspect of the present invention, the Nn-th fault recovery operation circuit comprises the Nn-th
As a fault recovery operation, the system power supply is once turned off and then turned on again, and the watchdog timer is configured to operate the (Nn + 1) th power supply whose power is backed up by a battery and which is longer than the Nnth set time. If the reset signal is not input even after the set time
an (N + 1) th counter for outputting an (n + 1) th operation failure occurrence signal; and the failure recovery operation circuit receives both the (Nn) th and (Nn + 1) th operation failure occurrence signals. A system stop circuit for stopping all functions of the system in such a case.

[0013]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, first and second embodiments of the present invention will be described. The outline of the first embodiment is as follows. That is, the shorter the time from the detection of the operation failure to the recovery, the better. Therefore, in order to detect a plurality of operation failures, a plurality of watchdog timer counters are prepared, and each watchdog timer is caused to detect an operation failure at a different time. A counter that detects an operation failure in a short time is associated with a process that can be recovered in a time as short as possible (a process that is unlikely to be recovered). For example, recovery is performed by a failure notification interrupt to software. On the other hand, a counter for detecting an operation failure in a long time is associated with a process for performing a recovery in a long time (a process with high reliability of recovery). For example,
Restoration is performed by resetting hardware, or restoration is performed by operating a sequence of turning on, turning off, and turning on the system power. In addition, in general, in the case of a process with high recovery certainty, the influence of a malfunction is great, so a configuration that can confirm whether or not the condition that a process with low certainty has already been executed is established as a reliable Try to increase the sexuality.

FIG. 1 is a block diagram showing the configuration of the first embodiment. In this figure, a watchdog timer 1 'has a clock circuit 2, a reset circuit 3, and first, second, and third counters 4A, 4B, and 4C. These first, second and third counters 4A, 4B, 4
C counts up in synchronization with the clock signal from the clock circuit 2 and the reset signal R from the reset circuit 3
When -WDT is input, the count value is set to zero. If the reset signal has not been input even after the set time has elapsed since the last input of the reset signal R-WDT, these counters output the operation failure occurrence signals RST1, RST2, and RST3, respectively. Has become. Regarding the set time of each counter, the counter 4A is the shortest, the counter 4B is longer, and the counter 4C is the longest.

The signal RST1 from the counter 4A is output to an interrupt control circuit (first failure recovery operation circuit) 5. The signal RST1 and the signal RST2 from the second counter 4B are output to the AND circuit 6, and the AND circuit 6 outputs the H signal to the system reset circuit (second failure recovery operation circuit) 7 when the AND condition is satisfied. It is supposed to. The signal RST2 and the signal RST3 from the third counter 4C are output to the AND circuit 8, and
The circuit 8 outputs an H signal to the process control circuit (third failure recovery operation circuit) 9 when the AND condition is satisfied.

Next, the operation of FIG. 1 will be described based on the time chart of FIG. The first to third counters 4A to 4C count up in synchronization with the clock signal from the clock circuit 2, and input the reset signal R-WDT from the reset circuit 3 every time a predetermined time t0 elapses to count the count value. Reset. This reset signal R-WDT is output based on an instruction periodically issued from a specific process of the basic software.

Now, since an operation failure occurs in the basic software and the reset signal R-WDT is finally output, t
Reset signal R-WDT from reset circuit 3 for only 1 second
Is not output. Here, t1 second is t
1> t0, which is an impossible time interval when an instruction on the reset signal R-WDT is normally issued from a specific process of the basic software.

When the time t1 has elapsed, the counter 4A
Outputs the operation failure occurrence signal RST1 and outputs the interrupt control circuit 5
Start Then, the interrupt control circuit 5 controls the predetermined operation to recover the operation failure. As a result, when the operation returns to normal, the reset signal R-WDT is output again from the reset circuit 3 at intervals of t0 seconds. However, in the present embodiment, it is assumed that the operation failure still does not recover.

When t1 seconds have elapsed and t2 seconds have elapsed, the counter 4B outputs an operation failure occurrence signal RST2. Since the signal RST1 is continuously output from the counter 4A, the AND circuit 6 outputs an H signal to the system reset circuit 7. Here, t2 seconds is a time larger by a margin than the time from when the interrupt of the interrupt control circuit 5 becomes valid and the instruction about the reset signal R-WDT is periodically issued from a specific process of the basic software. .

The system reset circuit 7 includes an AND circuit 6
When the system is activated by the H signal from the system, the system is reset to recover the operation failure. That is, an initialization signal for the hardware is generated, and a reboot of the system is started. When this processing is enabled, a reset signal R-
An instruction for WDT is issued periodically, and the system is restored. However, in this embodiment, it is assumed that the operation failure still does not recover.

When t3 seconds have elapsed after t2 seconds have elapsed, the counter 4C outputs an operation failure occurrence signal RST3. From the counters 4A and 4B, signals RST1 and RS
T2 is continuously output, and the H signal is continuously output from the AND circuit 6, so that the condition of the AND circuit 8 is satisfied, and the AND circuit 8 outputs the H signal to the process control circuit 9. Here, t3 seconds is a time that is larger by a margin than the time from when the process of rebooting the system reset circuit 7 becomes valid and the instruction about the reset signal R-WDT is periodically issued from a specific process of the basic software. is there.

When activated by the H signal from the AND circuit 8, the process control circuit 9 once turns off the power supply of the system which is currently on, and then turns on the power supply again in order to recover the operation failure. The reason why the power of the system is once turned off is that it is empirically known that the system is effective for a failure of the hardware or a portion where the reset signal of the hardware is not connected. When such processing becomes effective, an instruction on the reset signal R-WDT from a specific process of the basic software is periodically issued, and the system is restored.

As described above, the set time of the first counter 4A is t1, and the set time of the second counter 4B is t1 + t.
2. The set time of the third counter 4C is set to t1 + t2 + t3.
In response to these set times, the interrupt control circuit 5, the system reset circuit 7, and the process control circuit 9 are sequentially activated in ascending order of processing time. It can be performed efficiently and the time required for recovery can be reduced.

FIG. 3 is a block diagram showing the configuration of the second embodiment. In the first embodiment, the O
Processing for operating a sequence of N → OFF → ON is performed. However, in the case of a hardware failure that cannot be recovered by such processing, this processing is repeatedly performed many times, and stress is applied to a part that has not failed. Thus, the present embodiment is configured to prevent the same failure recovery operation from being performed twice or more within a predetermined time.

Watchdog timer 1 "in FIG.
Is obtained by adding a clock circuit 10 and a fourth counter 4D to the watchdog timer 1 'in FIG. The clock circuit 10 and the fourth counter 4D
The power is backed up by a battery (not shown). Then, the H signal from the AND circuit 8 and the signal RST4 from the fourth counter 4D are output to the AND circuit 11, and the AND circuit 11 outputs the H signal to the system stop circuit 12 when the AND condition is satisfied. It has become. Also, first to fourth counters 4A to 4D
The operation is stopped by a stop command from the system stop circuit 12.

Next, the operation of FIG. 3 will be described based on the time chart of FIG. Now, assuming that an operation failure has occurred in the basic software, t1 + t2 after t1 seconds from the last output of the reset signal R-WDT from the reset circuit 3.
Then, after t1 + t2 + t3 seconds, the interrupt control circuit 5,
The system reset circuit 7 and the process control circuit 9 are activated. The operation at this time is the same as that described with reference to FIG.
Once the system is turned off after t1 + t2 + t3 seconds, the continuity of the counts of the counters 4A, 4B, and 4C is lost. However, since the clock circuit 10 and the counter 4D are backed up by a battery, the counter 4D The continuity of counting is guaranteed.

After elapse of t1 + t2 + t3 seconds, the counter 4D
Starts counting t4 seconds. During this t4 seconds, the system power supply is turned ON → OFF → ON by the process control circuit 9.
This is a time sufficient to confirm whether or not the reboot based on the above is effective and the instruction about the reset signal R-WDT from the specific process of the basic software is periodically issued.

In this embodiment, the operation failure is not recovered after the elapse of t4 seconds.
After a lapse of 1 + t2 seconds and a lapse of t1 + t2 + t3 seconds, the interrupt control circuit 5, the system reset circuit 7, and the process control circuit 9 are activated again to try to recover from the operation failure. However, since the operation failure was not recovered by this, t
After the elapse of the 5 second margin time, the counter 4D outputs the signal RST4. At this time, the AND circuit 8 outputs H
Since the signal is output, the condition of the AND circuit 11 is satisfied, and the AND circuit 11 outputs an H signal to the system stop circuit 12. Then, the system stop circuit 12 outputs the counter 4
A stop command is output to A to 4D to stop all functions. Therefore, it is possible to prevent a situation in which a useless failure recovery operation is repeatedly performed even though there is no possibility of failure recovery, and an excessive stress is applied to a part that has not failed.

In each of the above embodiments, the case where the number of time measurement counters and fault operation recovery circuits are three has been described. However, these numbers are not limited to three, but may be increased or decreased as appropriate. It is possible to

[0030]

As described above, according to the present invention, it is possible to provide an industrial computer capable of shortening the time required for restoring an operation failure as much as possible.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a first embodiment of the present invention.

FIG. 2 is a time chart for explaining the operation of FIG. 1;

FIG. 3 is a block diagram showing a configuration of a second embodiment of the present invention.

FIG. 4 is a time chart for explaining the operation of FIG. 3;

FIG. 5 is a block diagram showing a configuration of a conventional device.

[Explanation of symbols]

1,1,1 ″ watchdog timer 2,10 clock circuit 3 reset circuit 4A, 4B, 4C, 4D first, second, third, fourth counter 5 interrupt control circuit (first failure recovery operation circuit) 7) System reset circuit (second failure recovery operation circuit) 9 Process control circuit (third failure recovery operation circuit) 12 System stop circuit R-WDT reset signal RST1, RST2, RST3, RST4 First, second, and second Third, fourth operation failure occurrence signal

Claims (4)

[Claims] A counter for resetting the count by inputting a reset signal every time a predetermined time elapses and outputting an operation failure occurrence signal when the reset signal is not input even after a set time has elapsed. An industrial computer comprising: a watchdog timer; and a fault recovery operation circuit that performs a fault recovery operation based on an input of an operation fault occurrence signal from the watchdog timer. A first counter that outputs a first operation failure occurrence signal when a reset signal is not input even after the first set time has elapsed, and a second set time that is longer than the first set time has elapsed. A second counter that outputs a second operation failure occurrence signal when a reset signal is not input, and a third set time longer than the second set time Third outputting the third operation failure signal to If after not enter the reset signal
A first failure recovery operation circuit that performs a first failure recovery operation when the first operation failure occurrence signal is input; and a first failure recovery operation circuit that performs the first failure recovery operation when the first operation failure occurrence signal is input. The second fault recovery operation is performed when both of the two operation fault occurrence signals are input.
And a third failure recovery operation circuit that performs a third failure recovery operation when both of the second and third operation failure occurrence signals are input. Industrial electronic computer. 2. The industrial computer according to claim 1, wherein the third failure recovery operation circuit performs, as a third failure recovery operation, an operation of once turning off the system power supply and then turning on the system power supply again. The watchdog timer includes a fourth power supply whose power is backed up by a battery and which is longer than the third set time.
And a fourth counter for outputting a fourth operation failure occurrence signal when the reset signal is not input even after the set time elapses. Further, the failure recovery operation circuit includes the third and fourth failure recovery circuits. An industrial computer comprising: a system stop circuit for stopping all functions of the system when both of the operation failure occurrence signals are input. 3. A time measuring counter for resetting the count by inputting a reset signal every time a predetermined time elapses and outputting an operation failure occurrence signal when the reset signal is not input even after a set time has elapsed. An industrial computer comprising: a watchdog timer; and a failure recovery operation circuit that performs a failure recovery operation based on an input of an operation failure occurrence signal from the watchdog timer. The first counter is formed of N counters, and when any of the second to Nth counters is the Nnth counter, the first counter outputs the reset signal even after the first set time has elapsed. Is not input, the first operation failure occurrence signal is output, and the Nn-th counter passes the Nn-th set time longer than the N-th set time. Even if a reset signal is not input, an Nn-th operation failure occurrence signal is output. The failure recovery operation circuit is formed by first to N-th N failure recovery operation circuits. When any one of the Nth failure recovery operation circuits is the Nnth failure recovery operation circuit, the first failure recovery operation circuit receives the first operation failure occurrence signal when the first failure recovery operation circuit receives the first operation failure occurrence signal. The first failure recovery operation is performed, and the Nn-th failure recovery operation circuit performs the Nn-th failure recovery operation when both the (Nn-1) th and the N-th operation failure occurrence signals are input. An industrial computer characterized by that: 4. The industrial computer according to claim 3, wherein the Nn-th failure recovery operation circuit performs an operation of turning off the system power supply and then turning it on again as the Nn-th failure recovery operation. In the watchdog timer, when the power is backed up by a battery and the reset signal is not input even after the Nn + 1th set time longer than the Nnth set time, the Nth + 1th operation failure occurs. Nn + that outputs a signal
And the fault recovery operation circuit includes the Nth and Nth
An industrial computer, comprising: a system stop circuit for stopping all functions of the system when both n + 1 operation failure occurrence signals are input.