JP2007233809A - Network device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To certainly restart a network device to significantly improve maintenance performance of the device even when trouble occurs in a boot program of the network device. <P>SOLUTION: In this network device, when programs stored in a boot program storage part 22 of an active system and a boot program storage part 23 of a standby system are updated by the program having the trouble, booting by the programs of the active system and the standby system is repeated. A repetition frequency of the booting is counted by a reset counter 32, and an index designating an emergency program storage part 31 is written in a next-time boot system storage part 25 when the repetition frequency reaches a prescribed frequency. A reset circuit 28 is operated by a reset requirement signal from the reset counter 32, and a reset signal is outputted to a program boot part 21. The program boot part 21 reads an emergency program stored in the emergency program storage part 31 according to the index stored in the next-time boot system storage part 25, and reboots the device. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a network device to which a remote control instruction is given from an opposite device, and more particularly to a network device having an autonomous recovery function when a failure occurs due to a malfunction of an activation program.

  Conventionally, in a network device that does not have a redundant configuration that is remotely monitored and controlled by an opposite device, such as a mobile phone base station, the activation program storage unit stores the activation program for the active system and the standby system, and the activation of one system Even if the program fails and the device cannot be started, the other system startup program enables the device to recover autonomously.

FIG. 3 is a block diagram showing a configuration of the conventional network device.
In FIG. 3, reference numeral 11 denotes a program boot unit, which stores a basic program for startup that will not be rewritten in the future. The program boot unit 11 includes an active (N system) startup program storage unit 12, a standby system (E system) startup program storage unit 13, a current startup system storage unit 14, a next startup system storage unit 15, and an active system. The storage unit 16, the activation program operation area 17, and the reset circuit 18 are connected. The reset circuit 18 is connected to a watchdog timer (WDT) 19 for monitoring the activation operation time, and a reset request signal is sent from the watchdog timer 19 to the reset circuit 18.

  Although not shown, the network device includes a communication device, and the communication device communicates with an opposite device such as a base station via the network.

  In the above configuration, the program boot unit 11 reads the activation program selection index B instructed by the next activation system storage unit 15 and designates the active activation program storage unit 12 or the standby activation program storage unit designated thereby. One of the 13 startup programs is expanded in the startup program operation area 17. In this case, the program boot unit 11 copies the activation program selection index B, which is the program system information to be activated, to the active system storage unit 16, which is a temporary save area, and performs operation results before performing the above processing. The activation program selection index A in the current activation system storage unit 14 indicating a certain program is copied to the next activation system storage unit 15.

Here, the next activation system storage unit 15 can be rewritten as designation information for the next activation system by an instruction from the opposite device even during operation of the apparatus.
The program transferred to the activation program operation area 17 starts autonomously, starts operation as a device, confirms that the program has been activated normally, and then starts the active system held in the active system storage unit 16 Is stored in the current activation system storage unit 14.

  In the initial state of the apparatus, a program that has been confirmed to be activated in advance is written into the active activation program storage unit 12 and the standby activation program storage unit 13, and is stored in the current activation system storage unit 14 and the next activation system storage unit 15. There is no problem if an index indicating the current system (N system) is written.

  Further, since the contents of the active system storage unit 16 are determined immediately after being activated by the program boot unit 11 regardless of the contents of the initial state, an indefinite value may be used in the initial state.

  When the program is changed, for example, it is assumed that the current system (N system) is currently activated, and the update program is transferred and stored remotely in the standby activation program storage unit 13 from the opposite device. After that, the information in the next activation system storage unit 15 is set as a standby system (E system) instruction, and then reset by remote control, so that the program stored in the standby system activation program storage unit 13 is activated. Become. In the unlikely event that the program stored in the standby activation program storage unit 13 is defective and cannot be normally activated, the program itself that has recognized the alarm state operates the reset circuit 18 to program the reset signal. By outputting to the boot unit 11, the apparatus is restarted. At this time, in consideration of a situation in which the alarm state cannot be recognized due to a program fault situation, the device is restarted by operating the reset circuit 18 by the watchdog timer 19.

  By the series of operations, the startup system storage unit 15 stores the startup program selection index B indicating the active system (N system) having a normal startup record at the start-up that is restarted. It is possible to recover to the previous state where it was started, and it is possible to continue recovery of the remote maintenance monitoring operation such as transferring the program that solved the problem to the standby startup program storage unit 13.

Further, as a known technique related to the present invention, there is a processor monitoring device that monitors the operation of a main CPU and a sub CPU in a control device composed of a main control device and a sub control device. And a power supply abnormality detection function for detecting the occurrence of power supply voltage abnormality. When a malfunction or power supply abnormality of the sub CPU is detected, the main CPU and the sub CPU are There is known a processor monitoring device having a reset circuit that generates a reset signal to a sub CPU so that processing is synchronized (see, for example, Patent Document 1).
JP 2005-148890 A

  However, in the above-described conventional network device, when both the active (N system) and standby (E system) startup programs are updated with faulty startup programs due to human error during operation, for example. Causes a problem that it cannot be started normally by repeatedly starting with a defective program. In addition, when the fault state of the program to be started does not reach the time-out of the watchdog timer 19 and the occurrence of an alarm and there is a fault in the line connection with the opposite device, the normal operation is performed by cutting off the communication with the opposite device. It may not be possible. Therefore, the conventional method has a drawback that a significant deterioration in maintenance performance can be caused such that the remote monitoring control state cannot be recovered.

  The present invention has been made to solve the above-described problems, and provides a network device that can be reliably restarted to significantly improve the maintenance performance of the device even when a failure occurs in two systems of startup programs. With the goal.

  The present invention provides a network device to which a remote control instruction is given from an opposite device, a first activation program storage unit that stores a first activation program, and a second activation program storage that stores a second activation program. , An emergency program storage unit storing an emergency program, a next activation system storage unit storing an index indicating a system of a program to be activated next, and an index stored in the next activation system storage unit The startup processing means for reading the startup program stored in the first startup program storage unit or the second startup program storage unit and executing the startup process, and the first startup program and the second startup program And a reset counter that counts the number of times the startup is repeated due to a malfunction. And wherein said reset the activation processing unit together with provide an indication to specify the emergency program storage unit that is executing the boot process by the emergency program when it reaches the value.

  According to the present invention, the emergency stored in the emergency program storage even when both the first startup program storage and the startup program stored in the second startup program storage are defective. The apparatus can be reliably restarted using a program, and the maintenance performance of the apparatus can be significantly improved.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a configuration of a network device according to an embodiment of the present invention.

  In the figure, reference numeral 21 denotes a program boot unit which stores a basic program for startup that will not be rewritten in the future. The program boot unit 21 is connected to, for example, an active (N-system) startup program storage unit 22, a standby (E-system) startup program storage unit 23, and an emergency program storage unit 31. The active system startup program storage unit 22 and the standby system startup program storage unit 23 are provided to store the apparatus operation program, and have a redundant configuration in preparation for an unexpected failure operation at the time of program change. Yes. The emergency program storage unit 31 stores an emergency program that can reliably perform program re-storage and device reset control in the active system startup program storage unit 22 and the standby system startup program storage unit 23. Is done. This emergency program has been confirmed in advance to operate normally, and cannot be rewritten in the future.

  The program boot unit 21 is connected to a current activation system storage unit 24, a next activation system storage unit 25, an activation program operation area 27, a reset circuit 28, and a reset counter 32. Connected to the reset circuit 28 is a watchdog timer (WDT) 29 for monitoring the operating time of activation.

  In the startup program operation area 27, the startup program stored in the active startup program storage unit 22 or the standby startup program storage unit 23 based on the index stored in the startup system storage unit 25 next time during normal times. Is set.

  The reset counter 32 outputs the selection index C to the program boot unit 21 according to the count value, but in the initial state, the count value is “0” and the selection index C is “1” (Hi: normal activation). . The reset counter 32 counts the number of times of activation when the activation by the active system and the standby system program is repeated due to a malfunction of the active system and the standby system program, and the count value is a predetermined number of times (for example, 5). In the case of reaching, the selection indicator C is activated in an emergency (“0”: Lo), and a reset request signal is output to the reset circuit 28. The reset counter 32 is cleared when the program starts normally and remote control communication with the opposite device becomes possible.

  When the selection index C is reset by the reset signal from the reset circuit 28, the program boot unit 21 reads the emergency program from the emergency program storage unit 31 and develops it in the startup program operation area 27. The program boot unit 21 reset in a state where the selection index C indicates the normal time (“1”: Hi) operates based on the index stored in the next activation system storage unit 25.

  In FIG. 1, reference numeral 33 denotes a remote signal communication state counter which detects that the communication disconnection state with the opposite apparatus has exceeded a certain time. When it is detected by the remote signal communication state counter 33 that the communication disconnection state with the opposite device has exceeded a certain time, an index for designating the emergency program storage unit 31 is written to the next activation system storage unit 25. At the same time, a reset request signal is output to the reset circuit 28. In this case, since the emergency program is always started in a situation where the counter device is not connected, the switch 34 for limiting the operations of the reset counter 32 and the remote signal communication state counter 33 for testing and the like, and It is desirable that an autonomous reset ON / OFF signal for controlling the operation of the switch 34 is provided. The autonomous reset ON / OFF signal is given by, for example, DIP-SW. By controlling the operation of the switch 34 with the autonomous reset ON / OFF signal, it is possible to determine whether or not the remote signal communication state counter 33 enters the reset operation autonomously for testing or the like.

  Although not shown, the network device includes a communication device, and the communication device communicates with an opposite device such as a base station via the network.

  In the above configuration, the program boot unit 21 reads the activation program selection index B instructed by the next activation system storage unit 25 unless the activation program selection index indicates an emergency, and activates the active system designated by this. The activation program in either the program storage unit 22 or the standby activation program storage unit 23 is read and expanded in the activation program operation area 27. In this case, the program boot unit 21 copies the activation program selection index B, which is the program system information to be activated, as the activation program selection index A to the current activation system storage unit 24 before performing the above processing, Information indicating a system different from the system to be activated is written in the next activation system storage unit 25 as the activation program selection index B.

  Here, the next activation system storage unit 25 can be rewritten as the designation information of the next activation system by an instruction from the opposite device even during the operation of the apparatus.

  The activation program transferred to the activation program operation area 27 starts autonomously and starts operation as a device. In the initial state, the activation program that has been confirmed to be activated in advance is written to the active activation program storage unit 22 and the standby activation program storage unit 23, and is stored in the current activation system storage unit 24 and the next activation system storage unit 25. There is no problem if an index indicating the current system (N system) is written.

  At the time of program change, for example, assuming that the system is currently activated in the active system (N system), the update program is transferred and stored remotely in the standby system activation program storage unit 23 from the opposite device. After that, the information in the next activation system storage unit 25 is set as a standby system (E system) instruction, and then reset by remote control, so that the program stored in the standby system activation program storage unit 23 is activated. Become. In the unlikely event that the program stored in the standby startup program storage unit 23 is faulty and cannot be started up normally, the program itself that has recognized the alarm state operates the reset circuit 28 and sets the reset signal to program boot. The output to the unit 21 is intended to restart the apparatus. At this time, in consideration of a situation where the alarm state cannot be recognized due to a program malfunction situation, the reset circuit 28 is operated by the watchdog timer 29 to restart the apparatus. When the apparatus is normally activated, the watchdog timer 29 is cleared by the activation program developed in the activation program operation area 27.

  As a result of this series of operations, the startup system storage unit 25 stores the startup program selection index B indicating the system opposite to the system that failed to start (N system) at the start-up for restarting. Therefore, it is highly possible to recover to the previous state where it started normally, and it is possible to continue recovery of remote maintenance monitoring operations such as transferring a program that solves the problem to the standby startup program storage unit 23. .

  And, for example, when both the active system (N system) and the standby system (E system) are updated with a faulty program due to a mistake during operation, the device is changed to the active system (N system). Since the activation by the standby (E system) program is repeated, the repetition of the activation is counted by the reset counter 32.

  As shown in the state transition diagram of FIG. 2, the reset counter 32 has a counter value of “0” in the initial state and a selection index C to the program boot unit 21 of “1” (Hi: normal activation). . The reset counter 32 sequentially counts up when the active system (N system) and the standby system (E system) are repeatedly activated as described above, but the program starts normally. The count value is cleared when remote control communication with the opposite device becomes possible.

  However, when the active system (N system) and the standby system (E system) are repeatedly activated and the value of the reset counter 32 reaches the specified number of times, the program boot unit 21 sets the value of the reset counter 32 to the specified value. Since the selection index C indicates an emergency (“0”: Lo) by reaching the number of times, the emergency program storage unit 31 is designated.

  On the other hand, the communication state with the opposite device is monitored by the remote signal communication state counter 33, and when the communication interruption state with the opposite device exceeds a preset time, a reset request signal is output to the reset circuit 28.

  As a result, the program boot unit 21 executes the restart operation. In this case, since the index for designating the emergency program storage unit 31 is given as described above, the program boot unit 21 is stored in the emergency program storage unit 31. The emergency program is expanded in the start program operation area 27 and the apparatus is restarted. Since the emergency program has been confirmed to operate normally in advance, the apparatus can be reliably restarted.

  In the state where the network device is restarted and remote control communication is possible with the opposite device as described above, a normal program is transferred from the opposite device, and the active start program storage unit 22 and the standby start program are transferred. By storing in the storage unit 23, the apparatus can be restored.

  Therefore, for example, even when the activation programs stored in the active activation program storage unit 22 and the standby activation program storage unit 23 are both updated with defective programs, the emergency program is used to switch the device. Rebooting can be ensured, and maintenance performance can be significantly improved.

  In addition, when the failure state of the program for starting the device does not reach the time-out of the watchdog timer 29 and the occurrence of an alarm, and there is a failure in the line connection with the opposite device, for example, initialization failure of the communication line device, There is a possibility that an error has occurred in the software, for example, when a clear signal for the watchdog timer 29 is normally output but the termination task of the communication line is operating abnormally.

  If there is a problem with the line connection with the opposite device as described above, the communication state with the opposite device is monitored by the remote signal communication state counter 33, and the communication disconnection state with the opposite device is set for a predetermined time. If exceeded, a reset request signal is output to the reset circuit 28. As a result, in the same way as when both the active and standby programs fail, the device is restarted by the emergency program stored in the emergency program storage unit 31 and the remote monitoring control state is restored. Can do.

  According to the above-described embodiment, even when a failure occurs in both the active system startup program storage unit 22 and the standby system startup program storage unit 23, the emergency program storage unit 31 stores them. The apparatus can be reliably restarted by using the emergency program, and the maintenance performance of the apparatus can be significantly improved.

  Further, even when a problem occurs in the line connection with the opposite device, the communication state with the opposite device is monitored by the remote signal communication state counter 33, and the emergency program stored in the emergency program storage unit 31 is used. By restarting the apparatus, the remote monitoring control state can be restored normally.

  In the above embodiment, since the emergency program is always activated when not connected to the opposite device, the reset counter 32 and the remote signal communication state counter are used for testing as described above. It is preferable to provide a switch 34 for limiting the operation of 33 and an autonomous reset ON / OFF signal. The switch 34 is configured using, for example, an OR circuit, and an autonomous reset ON / OFF signal is given to the OR circuit to control its output state. That is, when the reset counter 32 and the remote signal communication state counter 33 are operated, a low level signal is given to the OR circuit as an autonomous reset ON / OFF signal, and a reset request signal output from the remote signal communication state counter 33 is received. It is sent to the reset circuit 28. When the operations of the reset counter 32 and the remote signal communication state counter 33 are restricted for testing or the like, a high level signal is given to the OR circuit as an autonomous reset ON / OFF signal, and the output signal is set to high. The reset request signal output from the remote signal communication state counter 33 is blocked by the OR circuit.

  Further, the present invention is not limited to the above-described embodiments as they are, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage.

It is a block diagram which shows the structure of the network apparatus which concerns on one Embodiment of this invention. It is a state transition diagram of the reset counter in the same embodiment. It is a block diagram which shows the structure of the conventional network device.

Explanation of symbols

  21 ... Program boot unit, 22 ... Active system startup program storage unit, 23 ... Standby system startup program storage unit, 24 ... Current startup system storage unit, 25 ... Next startup system storage unit, 27 ... Startup program operation area, 28 DESCRIPTION OF SYMBOLS ... Reset circuit, 29 ... Watchdog timer (WDT), 31 ... Emergency program storage part, 32 ... Reset counter, 33 ... Remote signal communication state counter, 34 ... Switch.

Claims (1)

In a network device to which a remote control instruction is given from the opposite device,
A first activation program storage unit in which a first activation program is stored;
A second boot program storage unit for storing a second boot program;
An emergency program storage unit for storing an emergency program;
Next-time startup system storage unit that stores an index indicating a program system to be started next;
An activation processing means for reading the activation program stored in the first activation program storage unit or the second activation program storage unit according to the index stored in the next activation system storage unit and executing the activation process;
A reset counter that counts the number of times that the first start program and the second start program are caused by a failure of the first start program,
When the count value of the reset counter reaches a specified value, an index for designating the emergency program storage unit is provided, and the activation processing unit is reset to execute activation processing by the emergency program. Network device.

Images