JPS6132702B2 - - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to a composite microcomputer failure detection method in a shared memory type composite microcomputer system.

Conventionally, the operation or non-operation of a microcomputer has been detected by periodically starting a watchdog timer installed outside the microcomputer based on a command from the microcomputer, and when a failure occurs in the microcomputer, the watchdog timer is activated. Non-operation of the microcomputer was detected by stopping commands to the timer and causing the watchdog timer to time out.

However, although this method is effective for detecting non-operation of a single microcomputer, in a composite microcomputer in which multiple microcomputers are combined, the microcomputers must mutually detect non-operation. It wasn't enough.

The present invention provides reliable detection of inactive microcomputers in a complex microcomputer, which was impossible with a single watchdog timer, in a shared memory common to each microcomputer without using special hardware. The object of the present invention is to provide a fault detection method for a complex microcomputer that can be easily carried out by periodically sampling data indicating an incremental state from an operation monitoring counter and comparing the values.

Hereinafter, the present invention will be explained based on embodiments shown in the drawings.

FIG. 1 shows a composite microcomputer in which a plurality of microcomputers are interconnected through a shared memory that can be called in common from each microcomputer. 1 ₁ , 2 ₂ , 3
₃ , ..., 1n are microcomputers, respectively, and these microcomputers 1 ₁ , 2
₂ , 3 ₃ , ..., 1n are the main memories 2 ₁ , 1n, respectively.
2 ₂ , 2 ₃ , ..., 2n are provided. 3 is each microcomputer 1 ₁ , 1 ₂ , 1 ₃ , ... 1n
A shared memory that can be commonly accessed from each microcomputer 1 ₁ , 1 ₂ , 1 ₃ , ...,
Operation monitoring counters C ₁ , C ₂ , C ₃ , ..., Cn corresponding to 1n and incremented by the commands respectively
has been established. These operation monitoring counters C ₁ ,
C ₂ , C ₃ , . The increment is made by storing to the same memory location above.

On the other hand, microcomputers 1 ₁ , 1 ₂ , 1
₃ , ..., 1n main memories 2 ₁ , 2 ₂ , 2 ₃ , ...
..., 2n are provided with a new data area ND and an old data area OD that store data corresponding to each microcomputer except for itself, and each new data area ND stores data corresponding to each microcomputer on the shared memory 3. The value of the monitoring counter C is periodically sampled and stored, and each old data area OD transfers and stores the previous sampling value in the new data area. The values of each new data area and the old data area are then compared to detect whether each microcomputer is operating or not. Therefore, for example, in the microcomputer ₁₁ , the main memory ₂₁ contains the microcomputer 1.
New data area corresponding to ₂ , 1 ₃ , ..., 1n
ND ₂ , ND ₃ , ..., NDn and old data area OD ₂ ,
OD ₃ , . . . , ODn are provided, and the operation or non-operation of the microcomputers 1 ₂ , 1 ₃ , . . . , 1n is detected by comparing the values of these data areas.

Note that the relationship between the increment period of the operation monitoring counter C on the shared memory 3 and the period at which the values of these operation monitoring counters C are sampled on the microcomputer side is such that the operation monitoring can be performed by setting the sampling period longer than the increment period. The counter is incremented once to avoid sampling more than once.

Next, based on FIG. 2, the means for detecting an inoperable microcomputer according to the present invention will be specifically explained. Figure 2 shows each microcomputer 1 ₁ , 1
_{2 , 1 3 , .}
samples the values of the operation monitoring counters _{C 2 ,} C ₃ , . This shows a state in which the value of the area is being compared with the value of the old data area that was sampled last time. As will be described later, FIG. 2 shows an example in which the microcomputer Cn has failed and is in an inoperable state.

Each microcomputer 1 ₂ , 1 ₃ , ..., 1
n is each operation monitoring counter during the sampling period.
If the count values for incrementing C ₂ , C ₃ , ..., Cn are 2 for microcomputer 1 ₂ , 4 for microcomputer 1 ₃ , and 2 for microcomputer 1n, then the new data area ND at sampling timings t ₂ and t _{3 2} , ND ₃ , ..., NDn and the old data area OD ₂ , OD ₃ , ..., ODn, that is, the operation monitoring counter C ₂ , C ₃ , ...,
The count values of Cn are 2, 4, and 2, respectively.
Each microcomputer 1 ₂ , 1 ₃ , ..., 1n
indicates that it is working properly. However, at sampling time _t4 , the count values of the operation monitoring counters _C2 and _C3 are 2 and 4, respectively, but the count value of the operation monitoring counter Cn is
Since it is in a state of zero and has not been counted since the previous sampling time _t3 , this indicates that microcomputers 1, ₂ , and 1, _{and 3} are operating normally, but microcomputer 1n is not operating normally. There is. Therefore, with this, microcomputer 1 ₁ becomes microcomputer 1
Detect n's non-operation. In this case, although not explained, each microcomputer 1 ₂ ,
1 ₃ ,...,1n _-1 is also a microcomputer 1n
Detects non-operation.

Note that data is transferred from the new data area ND to the old data area OD at the same time as the values in both data areas are compared, so errors in count values due to transfer timing may occur. do not have.

Furthermore, when the counter value is smaller than the normal value as shown by the chain line in Figure 2, it is assumed that the microcomputer is operating normally, but in some cases it may be assumed that it is in an inactive state. .

As described above, according to the present invention, in a composite microcomputer system in which a plurality of microcomputers are interconnected via a shared memory that can be called in common from each microcomputer, the operating status of each microcomputer can be checked using a special hardware. Since each microcomputer can mutually monitor each other without using any hardware or the like, there is no need to provide a watchdog timer for each microcomputer, and an inactive microcomputer can be easily and reliably detected. This fault detection method can provide a basic means for relieving the problem with other microcomputers when any one of the microcomputers in the complex microcomputer system becomes faulty.

[Brief explanation of the drawing]

Fig. 1 is a conceptual diagram of this method in a composite microcomputer in which multiple computers are connected via a shared memory that can be commonly called from each computer, and Fig. 2 is an explanatory diagram of the method for detecting an inactive computer using this method. It is. 1 ₁ , 1 ₂ , 1 ₃ , ..., 1n: Microcomputer, 2 ₁ , 2 ₂ , 2 ₃ , ..., 2n: Main memory, ND ₁ , ND ₂ , ND ₃ , ..., NDn: New data Area, OD ₁ , OD ₂ , OD ₃ , ..., ODn: Old data area, 3: Shared memory, C ₁ , C ₂ , C ₃ , ...,
Cn: Operation monitoring counter.

Claims (1)

[Claims] 1. In a shared memory composite microcomputer system in which a plurality of microcomputers are interconnected via a shared memory common to each of these microcomputers, each of the microcomputers has a new A main memory including a data area and an old data area for transferring and storing immediately preceding data in the new data area is provided, and on the shared memory,
A microcomputer operation monitoring counter that can be incremented by a command from each microcomputer is provided corresponding to each microcomputer, and each of the microcomputers stores the contents of each operation monitoring counter other than the operation monitoring counter corresponding to itself. sampling at a cycle longer than the increment cycle of the operation monitoring counter and storing it in each of the new data areas of its own microcomputer, and at the same time comparing the values of each of the new data areas with the values of each of the old data areas; The microcomputer with a predetermined difference in the comparison result is determined to be in operation,
A failure detection method for a composite microcomputer that detects an inoperable microcomputer in the composite microcomputer by determining that the microcomputers with no difference in comparison results are inoperable.