JP3663196B2 - Supervisory control device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a monitoring control apparatus that monitors an abnormality of a communication path or the like of a device having a redundant configuration communication path.
[0002]
In recent years, as communication services have been diversified, communication devices have become larger in capacity and complicated. In connection with this, the improvement of the reliability of a communication apparatus is calculated | required. Therefore, it is necessary to monitor and control a communication package having a redundant configuration in a device in which a CPU package having an LSI having a communication function with the CPU communicates with a subordinate package via a communication package having a redundant configuration. It is said.
[0003]
FIG. 1 is a diagram showing such a device configuration. As shown in the figure, in this apparatus, the CPU package 4 is connected via communication lines to communication packages 51 and 52 having a redundant configuration of the active system (active system) / standby system (non-operating system). The packages 51 and 52 are connected to the subordinate packages 61, 62, 63,.
[0004]
The CPU package 4 includes a CPU (central processing unit) 41 and a communication LSI 42 having a communication function, and has a selector 43 for selecting the active / standby communication packages 51 and 52. Each of the communication packages 51 and 52 transmits a command from the CPU package 4 to each subordinate package 61, 62, 63..., And the response result from each subordinate package 61, 62, 63. Send to package 4. The subordinate packages 61, 62, 63,... Have a function of returning a response to the command from the communication package 51 or 52, and have selectors 611, 621, 631,. The CPU package 4 and the subordinate packages 61, 62, 63... Select one of the communication packages 51, 52 having a redundant configuration with a selector, and select the selected system as an active system (also referred to as an operational system). A system that is not used is a standby system (also referred to as a non-operational system).
[0005]
The redundancy switching of the communication packages 51 and 52 is performed by checking the presence / absence of a failure in the active / standby communication packages 51 and 52, and selecting the selector 43 of the CPU package 4 when the active system is faulty and the standby system is normal. Are switched by selectors 611, 621, 631... Of subordinate packages 61, 62, 63. For example, when the 0-system communication package 51 is the active system, the communication route of FIG. 2 is taken, and when the redundancy switching occurs, the communication route of FIG. 3 is taken.
[0006]
However, for example, as shown in FIG. 2, when the 0-system communication package 51 is the active system, the selector 43 of the CPU package 4 faces the active communication package 51. The failure state of the standby communication package 52 cannot be detected directly through the communication path between the communication packages 52, and the CPU package 4 communicates with the standby communication package 51 via the active communication package 51. The failure state of the standby communication package 52 is determined from the communication result to 52.
[0007]
In the conventional redundant switching of the communication package, for example, when the communication package 51 is the active system, even if there is a failure in the communication path between the CPU package 4 and the standby system communication package 52, the active communication is performed from the CPU package 4. Since there is no abnormality in the communication to the standby communication package 52 via the communication package 51, the failure of the standby communication package 52 (the communication path failure between the CPU package 4 and the communication package 52) is the CPU. Invisible on package 4.
[0008]
As a result, when there is some failure in the active communication package 51, the standby system is determined to be normal, and the communication package is switched. Then, the failure between the CPU package 4 and the communication package 52 is known for the first time. However, at this point, the communication packages 51 and 52 of both systems have already failed, the switching operation itself is useless, and the normality of the communication of the subordinate packages 61, 62, 63. I can't expect anything. In addition, even if there is an abnormality in the communication path between the standby communication package 52 and each of the subordinate packages 61, 62, 63... Can not do it.
[0009]
In addition, there may be a communication path in which a failure state is not visible due to redundant switching of communication packages. For example, when the 0-system communication package 51 is the active system, the communication route of FIG. 2 is taken. At this time, if there is an abnormality in the communication path between the 0-system communication package 51 and the subordinate package 61, redundant switching of the communication package occurs. After the switching, the communication between the 0-system communication package 51 and the subordinate package 61 occurs. Since the communication path is not used, the failure state cannot be monitored.
[0010]
Therefore, an object of the present invention is to improve the monitoring control performance by allowing the normality of the communication path between the CPU package and the standby communication package to be confirmed in advance.
[0011]
[Means for solving problems]
In order to solve the above-mentioned problems, in the present invention, as one form, a main unit equipped with a CPU, a communication unit having a redundant configuration, and a subordinate unit under the communication unit are provided. A supervisory control device for switching redundantly to a standby communication unit when there is a failure in the standby communication unit, the main unit switching the communication path from the active communication unit to the standby communication unit A command is sent and the response from the standby communication unit is inspected to check whether there is an abnormality in the communication path between the main unit and the standby communication unit, and then the communication path to the original working communication unit There periodically row reverse process of returning the, than the frequency of the reverse processing operation immediately after the standby system communication unit is mounted is performed when the unstable state, it than Configuration the monitoring control device is provided performed when the stable state so as to reduce the frequency of the reverse process.
By performing the reverse processing in this way, the normality of the communication path between the main unit and the standby communication unit can be confirmed in advance, so that the monitoring control performance can be improved. In addition, since the frequency of the reverse processing is set to be lower in the other stable state than in the case where the operation immediately after the standby communication unit is mounted is unstable, the monitoring control performance It is possible to prevent unnecessary switching while maintaining the above.
[0012]
In the above monitoring and control apparatus, the main unit can be configured to mask the other interrupts and perform the highest priority in the reverse process when performing the reverse process. In this way, in the case of a device configuration in which processing with higher priority than reverse processing may interrupt, the highest processing priority is set so that other commands do not skip during reverse processing. Thus, abnormal communication operation can be prevented.
[0013]
The above supervisory control device, current communication path between the reverse-process the primarily engaged unit replacement system communication unit before performing the redundant switch in the standby system communication unit due to a failure of the current for system communication unit It can be configured to check whether there is any abnormality. By doing so, it is possible to prevent unnecessary switching while reducing the frequency of reverse processing and maintaining the monitoring control operation performance.
[0015]
Further, the above monitoring control apparatus can be configured not to perform the reverse process when the standby communication unit already has some failure. By doing in this way, the frequency of reverse processing can be lowered and the monitoring control operation performance can be maintained.
[0016]
In addition, the above monitoring and control device is configured so that information on the communication path error between the communication unit and subordinate unit that was the active system before redundancy switching is held in the communication path error table until the subordinate unit is not installed. it can. By doing this, a communication path error between the communication unit and subordinate unit that was the active system before switching becomes a communication path that is not used when switching occurs, so the subordinate unit can be monitored even if the failure status is monitored Therefore, by maintaining the failure state until the subordinate unit is not mounted, it can be handled as a failure regardless of whether or not the communication unit is switched.
[0017]
In the above monitoring and control apparatus, when determining whether or not the subordinate unit has a failure , the subordinate unit has a failure only when the response to the command to the communication unit is normal and the response to the command to the subordinate unit is abnormal. When the response to the command to the communication unit is abnormal, the failure location can be limited by not making a failure except when the communication path abnormality information is held in the communication path abnormality table . By doing in this way, a failure location can be limited.
[0018]
DETAILED DESCRIPTION OF THE INVENTION
Examples of the present invention will be described below.
The apparatus configuration of the embodiment apparatus is as shown in FIG. It is assumed that the apparatus is now operated with the 0-system communication package 51 as the active system. When the CPU package 4 monitors the presence / absence of a failure in the active / standby communication packages 51, 52, the selector 43 of the CPU package 4 is in standby communication while the CPU package 4 is not communicating with the active communication package 51. The temporary package 52 is temporarily switched, and a command is transmitted to the standby communication package 52. When a response is returned from the standby communication package 52 to this command, the response is analyzed to determine whether there is an abnormality in the communication path between the CPU package 4 and the standby communication package 52. After this processing, the selector 43 of the CPU package 4 is returned to the active communication package 51 again. Hereinafter, this processing is referred to as reverse processing.
[0019]
FIG. 4 is a flowchart showing a processing procedure of reverse processing, and FIG. 6 is a flowchart of a device monitoring control processing procedure periodically executed by the CPU package 4. This reverse processing is executed in the apparatus monitoring control processing procedure. Each process will be described below by taking as an example the case where the 0-system communication package 51 is the active system.
[0020]
The reverse processing of FIG. 4 is performed only when the standby communication package is normal. Therefore, it is determined whether the standby communication package 52 is normal (step S1). If normal, an interrupt mask for masking interrupts of other high-priority processes is performed (step S2), the selector 43 of the CPU package 4 is switched to the standby side (step S3), and a command is sent to the standby communication package 52. It transmits (step S4), and if there is a response, the response is analyzed (step S5). As a result of the analysis, it is determined whether the response is normal or abnormal (step S6). If the response is abnormal, the reverse failure flag is set to “1” (step S7). Thereafter, the selector 43 is switched to the original working side (step S8), the interrupt mask is released (step S9), and the reverse process is finished.
[0021]
As described above, in the reverse process, a process for masking interrupts of other high priority processes and a process for canceling the mask are performed at the beginning and end of the process. The mask process is performed in this way for the following reason. That is, in the case of a processing configuration in which another process may interrupt and enter while the selector 43 selects the standby communication package 52, immediately in response to the interrupting process. When a command is transmitted to the subordinate packages 61, 62, 63..., It differs from the normal communication route of the CPU package 4, the active communication package 51, the subordinate packages 61, 62, 63. There is a case where a problem is caused by communicating with the subordinate package through a communication route (that is, a communication route passing through the standby communication package 52). Also, if interrupt processing is entered when the selector 43 is operating, the normality of communication at that time cannot be guaranteed. In order to avoid this, the process of performing the inversion operation of the selector 43 is made the process with the highest priority by performing the mask process.
[0022]
Next, the apparatus monitoring control process flow of FIG. 6 will be described. The CPU package 4 collects failure information of the communication packages 51 and 52 via the CPU package 4 and the active communication package 51 (step S11). The failure communication information and the standby communication package obtained by the reverse processing are collected. A logical sum of the presence / absence of communication path abnormality 52 is taken to make a failure state between the active system and the standby system (step S12). In other words, if the abnormality is detected in the active system based on the failure information collected from the active system side, the backup system has an error when either the result of reverse processing or the result of failure information collection through the active system is abnormal. It is considered abnormal.
[0023]
Next, in order to determine whether it is necessary to switch between the active system and the standby system, it is checked whether there is a failure in the active system and whether there is a failure in the standby system. If the active system is faulty and the standby system is normal, the reverse process of FIG. 4 is performed (step S13). In the reverse processing performed here, before switching the operation of the communication package from the current active communication package 51 to the standby communication package 52, the switching destination standby system is confirmed again to increase the reliability. It is. If there is no abnormality in the communication path as a result of the reverse process (step S15), the communication package switching process is performed (step S16). If there is any failure in the standby communication package 52, the reverse process is not performed because the reverse process is meaningless (step S13).
[0024]
Then, the subordinate packages 61, 62, 63,... Are connected via the active communication package 51 (if the active / standby system is switched, the communication package 52 becomes the active system after switching, the same applies hereinafter). The monitoring control process is performed (step S17). First, it is checked whether or not there is a communication path abnormality in the active communication package 51 (step S18). If there is no abnormality, then it is checked whether there is an abnormality in the communication paths of the subordinate packages 61, 62, 63. Only when there is no communication path abnormality in the active communication package 51 and there is a communication path abnormality in the subordinate package, an abnormality is set in the communication path abnormality table shown in FIG. 5 (step S20). On the other hand, if there is a communication path abnormality in the active communication package 51, the subordinate package also becomes abnormal based on the communication path abnormality, so the communication path abnormality table is not set.
[0025]
This communication path abnormality table has storage areas respectively corresponding to the subordinate packages 61, 62, 63..., And the communication path abnormality / normal data of each subordinate package 61, 62, 63. It is what you entered. An abnormality in the communication path abnormality table is treated as a subordinate package failure.
[0026]
Once the communication path abnormality table is set as having an abnormality, the communication path abnormality table is not cleared until the abnormal package is removed for repair or the like and is not mounted. That is, the subordinate packages 61, 62, 63... Are checked for any unmounted packages (step S21). If any of the subordinate packages 61, 62, 63. The data in the corresponding area is cleared (step S22).
[0027]
This is handled for the following reason. That is, an abnormal communication path between the active communication package 51 and the subordinate packages 61, 62, 63... Can be seen in communication with the subordinate packages 61, 62, 63. 61, 62, 63... Is not visible, so a failure under the active communication package 51 maintains the failure state even when a redundant switching of the communication package occurs. The fault state is maintained until mounting.
[0028]
When determining whether there is a failure in the subordinate package (after step S17 in FIG. 6), the response to the command to the communication package is normal (“NO” in step S18), and the response to the command to the subordinate package is received. If it is abnormal (“YES” in step S19), it is determined that the subordinate package has failed. If the response to the command to the communication package is abnormal (“YES” in step S18) , before this communication package becomes abnormal It is treated as a subordinate package failure only if there is an error in the subordinate package communication path (that is, the subordinate package communication path error is entered in the communication path error table). By not doing so, the failure location is limited.
[0029]
Next, in the part indicated by 3) in the flowchart, immediately after the standby system is replaced from unmounted by replacement, etc., reverse processing is performed five times at the same cycle as the device monitoring control processing flow, and thereafter the device monitoring control processing is performed. Reverse processing is performed at a rate of once every 10 cycles.
[0030]
The reason for handling in this way is as follows. In other words, the reverse processing is essentially useless processing when the active and standby communication packages are normal, and therefore, the overall monitoring control capability is higher when the processing frequency is low. Therefore, the frequency of reverse processing is increased when the state of the package is unstable immediately after the standby communication package is mounted, and the frequency of processing is decreased when the package is stable. As a result, the failure detection rate of the standby communication package decreases after entering the stable state, so as described above, the reverse process must be performed before attempting to switch the standby communication package to the active system. This is performed (step S14).
[0031]
The part 3) will be described in detail. If the standby system communication package 52 is mounted a new standby system communications package 52 after a withdrawn by not implemented in the repair or the like, when it is its implementation is determined (step S 23), Reverse Counter A = 4, reverse counter B = 9, and reverse failure flag = 0 are respectively initialized (step S24). Here, the reverse counter A is a counter that manages the frequency of reverse processing performed immediately after mounting of the standby communication package, and the reverse counter B is a counter that manages the frequency of reverse processing after entering a stable state after mounting. .
[0032]
First, it is determined whether the reverse counter A is A ≧ 0 (step S25) . If the result is affirmative, a reverse process is performed (step S26), and the content of the reverse counter A is decremented by one (step S27) . Accordingly, when the apparatus monitoring control process flow is repeated five times after the standby communication package 52 is mounted, the reverse counter A becomes A <0, and thereafter no reverse process is performed.
[0033]
Next, it is determined whether or not the reverse counter B = 0 (step S28). If the determination is negative, the content of the reverse counter B is decremented by one (step S31). When B = 0, reverse processing is performed (step S29), and B = 9 is reset in the reverse counter B (step S30). Therefore, after the standby communication package 52 is mounted, the reverse process is executed once every time the apparatus monitoring control process flow is repeated 10 times.
[0034]
When a package having a failure is found by the above processing, the maintenance person is informed of the failure by turning on a lamp that is visible to the outside of the package having the failure (step S32).
[0035]
As described above, in the apparatus according to the present embodiment, it is possible to know in advance whether there is an abnormality in the communication path between the CPU package and the standby communication package, which cannot be known unless switching is performed. Since the reverse process is a useless process if there is no abnormality, the frequency of the reverse process can be reduced so that the effect is not reduced compared to the case where the reverse process is performed every cycle of the monitoring control process. By holding the failure state of a package having a communication path abnormality until the corresponding package is not mounted, it is possible to prevent the failure from appearing to be recovered by switching. By limiting the conditions of the communication path abnormality of the subordinate package, the failure location can be limited.
[0036]
【The invention's effect】
As described above, according to the present invention, by performing the reverse process, the normality of the communication path between the main unit and the standby communication unit can be known in advance, and the standby communication unit is replaced. Because it is possible to take this measure, the effect on maintenance is great. Further, it is possible to prevent the deterioration of the monitoring control performance due to the reverse process as much as possible. Moreover, by maintaining the failure state and limiting the failure location, it is possible to promote an accurate maintenance operation.
[Brief description of the drawings]
FIG. 1 is a diagram showing a configuration of an embodiment of a monitoring control apparatus according to the present invention.
FIG. 2 is a diagram for explaining a communication path when the 0 system in the embodiment apparatus of the present invention is the active system.
FIG. 3 is a diagram illustrating a communication path when one system in the apparatus according to the embodiment of the present invention is an active system.
FIG. 4 is a flowchart showing a procedure of reverse processing in the embodiment apparatus of the present invention.
FIG. 5 is a diagram showing a configuration example of a communication path abnormality table in the embodiment apparatus of the present invention.
FIG. 6 is a flowchart showing a procedure of apparatus monitoring control processing in the present invention.
[Explanation of symbols]
4 CPU package 41 CPU
42 Communication LSI
43 Selector 51, 52 Communication package 61, 62, 63 ... Subordinate package 611, 621, 631 Selector

Claims (6)

A monitoring control device for a device comprising a communication unit having a redundant configuration with a main unit and a subordinate unit under the communication unit, wherein the main unit performs redundant switching to the standby communication unit when there is a failure in the active communication unit Because
The main unit switches the communication path from the active communication unit to the standby communication unit, sends a command, and checks the response from the standby communication unit to check the response between the main unit and the standby communication unit. the presence or absence of an abnormality monitoring communication path, then have periodically row reverse process of returning a communication path based on the working communication unit,
Monitoring configured so that the frequency of reverse processing performed in other stable states is lower than the frequency of reverse processing performed when the operation immediately after the standby communication unit is mounted is unstable. Control device.   2. The monitoring control apparatus according to claim 1, wherein the main unit is configured to mask the other interrupts and to make the priority of the reverse processing highest when performing the reverse processing. To confirm the presence or absence of abnormality of the current communication path between the reverse-process the primarily engaged unit replacement system communication unit before performing the redundant switch in the standby system communication unit due to a failure of the current use system communication unit The monitoring and control device according to claim 1 or 2 configured as described above. The monitoring control device according to any one of claims 1 to 3 , wherein reverse processing is not performed when the standby communication unit already has some failure. Communication path abnormality of information between the working system and a communication for unit subordinate unit redundancy switching before any of claims 1 to 4, wherein the subordinate unit is configured to hold the communication path abnormality table until unmounted The monitoring control device according to any one of the above. When determining whether there is a failure in the subordinate unit, the subordinate unit will fail only when the response to the command to the communication unit is normal and the response to the command to the subordinate unit is abnormal, and the response to the command to the communication unit The monitoring control device according to claim 5 , wherein when there is an abnormality , the failure location is limited by not causing a failure except when the communication path abnormality information is held in the communication path abnormality table .

Images