JP2013242811A - Information processing apparatus, and abnormality processing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an image forming apparatus capable of reducing down time of the entire system when abnormality is detected in any of a plurality of CPUs.SOLUTION: An information processing apparatus comprises a plurality of information processing units, and includes: a processor; a detection unit that detects abnormality of software; a restarting unit that restarts a processor that executes the software whose abnormality was detected; an error notification unit that notifies, when abnormality of the software is detected, other information processing apparatuses of the occurrence of abnormality; an error measurement unit that measures abnormality determination value indicating the degree of abnormality of the software; a determination value acquisition unit that acquires an abnormality determination value measured in the information processing unit whose abnormality was detected; a restoration determination unit that determines whether or not to restore the information processing unit whose abnormality was detected by comparing the acquired abnormality determination value with a predetermined threshold value; and a restart instruction unit that instructs, when the information processing unit is determined to be restored, a restart unit of the information processing unit whose abnormality was detected to restart the processor.

Description

  The present invention relates to an information processing apparatus having a plurality of information processing units capable of detecting software runaway.

  In recent image forming apparatuses, a multi-processor technology in which a plurality of CPUs are mounted on one device, and each CPU controls each function to be controlled in cooperation with another CPU, thereby improving the performance of the entire device. Is adopted. Each CPU is responsible for specific processing, and an overall control configuration is realized by data communication with the CPU for integrated management (see, for example, Patent Document 1).

  Patent Document 1 discloses a multiprocessor system in which a plurality of processors are managed by a management processor, and access to the shared memory is controlled by a bus control device. A multiprocessor for recording the cooperative operation of processors is disclosed.

  And in patent document 1, in order to memorize | store the information at the time of a failure in order to cope with a malfunction, when each processor detects a failure, it stops collection of its own travel history information, and other processors are troubled. Notify detection. Each processor stops collecting its own travel history information, and then stores the travel history information in a non-volatile memory provided in addition to the shared memory.

  However, in a device equipped with a plurality of CPUs, there is a possibility that the frequency of occurrence of defects increases as the number of CPUs increases. A general CPU is equipped with a monitoring function such as a watchdog timer in order to monitor software runaway, and can be restored by automatically resetting the CPU during software runaway. However, in an image forming apparatus equipped with a plurality of CPUs, if a failure is detected in any one of the CPUs, it is difficult to resume printing without resetting only the CPU in which the failure is detected. It is.

  For example, when the CPU 1 controls the paper feed and the other CPU 2 controls the fixing device, when a malfunction of the CPU 1 is detected, the CPU 2 should continue the fixing process to stop the fixing device. I can't judge. Since the fixing device is at a high temperature, it is generally preferable to stop the fixing device even if there is no problem with the CPU 2. Therefore, after confirming that the system is normal after resetting the entire system, the image forming apparatus restarts printing from the beginning. If each CPU is reset in this way, there is a problem that the entire system goes down until it returns, and nothing can be operated.

  In the case where a plurality of CPUs are mounted, the CPU in which the defect is detected in order for the image forming apparatus to resume printing by resetting only the CPU in which the defect is detected or the information processing unit in which the CPU is mounted. It is necessary to control such that other CPUs grasp the situation.

  In view of the above problems, an object of the present invention is to provide an information processing apparatus that can reduce downtime of the entire system when an abnormality is detected in any of a plurality of CPUs.

  In order to solve the above-described problems and achieve the object, the present invention provides an information processing apparatus including a plurality of information processing units, the information processing unit including a processor that executes software and an abnormality of the software. A detection unit that detects, a restart unit that restarts the software that has detected an abnormality, and an error notification unit that notifies the other information processing unit of the occurrence of an abnormality when an abnormality of the software is detected, An error measurement unit that measures an abnormality determination value indicating the degree of abnormality of the software, a determination value acquisition unit that acquires the abnormality determination value measured in the information processing unit in which the abnormality is detected, and the acquired abnormality determination A restoration determination unit that determines whether or not to restore the information processing unit in which the abnormality is detected by comparing a value with a predetermined threshold value; And when it is determined, characterized by a restart instruction unit for instructing that to restart the software to the restart of the information processing unit generated the anomaly.

  According to the present invention, when an abnormality is detected in any of a plurality of CPUs, the downtime of the entire system can be reduced.

FIG. 1 is an overall configuration diagram of an image forming apparatus according to an embodiment. FIG. 2 is a block diagram of a control system of the image forming apparatus. FIG. 3 is a configuration diagram of an arbitration circuit according to the embodiment. FIG. 4 is a configuration diagram of an arbitration circuit according to the embodiment. FIG. 5 is a configuration diagram of the arbitration circuit of the embodiment. FIG. 6 is a configuration diagram of an arbitration circuit according to the embodiment. FIG. 7 is a sequence diagram illustrating a processing flow when an abnormality occurs according to the embodiment. FIG. 8 is a diagram illustrating an example of the operation determination table according to the embodiment. FIG. 9 is a flowchart showing a flow of self-diagnosis processing of the embodiment.

  Hereinafter, an embodiment in which an information processing apparatus of the present invention is embodied in an image forming apparatus will be described with reference to the drawings. In addition to the image forming apparatus, the information processing apparatus can be applied to a computer or other apparatus as long as it is a multiprocessor processing apparatus driven by a plurality of CPUs. FIG. 1 shows an example of an overall configuration diagram of the image forming apparatus 100. The image forming apparatus 100 includes an automatic document feeder (ARDF) 140, a document reading unit 130, a writing unit 120, an image forming unit 110, and a paper feeding unit 150.

  The ARDF 140 transports the originals stacked on the original feeder on the contact glass of the image reading unit 130 one by one by the ARDF motor, and after reading the image data of the originals, the ARDF motor places the originals on the discharge tray. To discharge. A single ARDF 140 is equipped with a plurality of ARDF motors.

  The document reading unit 130 includes a contact glass 11 for placing a document and an optical scanning system, which includes an exposure lamp 41, a first mirror 42, a second mirror 43, a third mirror 44, and a lens. 45 and a full-color CCD 46. The exposure lamp 41 and the first mirror 42 are mounted on the first carriage, and the first carriage moves in the sub-scanning direction at a constant speed by a scanner motor when reading a document. The second mirror 43 and the third mirror 44 are mounted on the second carriage, and the second carriage moves at a speed approximately half that of the first carriage by the scanner motor when reading the document. Then, the image plane of the original is optically scanned by moving the first carriage and the second carriage, and the read data is imaged on the light receiving surface of the full-color CCD 46 by the lens 45 and subjected to photoelectric conversion.

  Next, the image data photoelectrically converted to each color of red (R), green (G) and blue (B) by the full color CCD (or full color line CCD) 46 is A / D converted by an image processing circuit (not shown). After that, various image processing (correction, color conversion, image separation, gradation correction, etc.) is performed by the image processing circuit.

  When the user instructs a copying operation or when the image forming apparatus 100 is used as a printer, the image forming unit 110 forms latent images on the photosensitive drums 27y, 27m, 27c, and 27K for each color. In the figure, four photosensitive units 13 (13y for yellow, 13m for magenta, 13c for cyan, and 13K for black) are arranged in parallel along the conveyance direction of the intermediate transfer belt 14. The photosensitive units 13y, 13m, 13c, and 13K include drum-shaped photosensitive drums 27y, 27m, 27c, and 27K that are image carriers, and a charging device 48y that charges the photosensitive drums 27y, 27m, 27c, and 27K. 48m, 48c, 48K, exposure devices 47y, 47m, 47c, 47K, developing devices 16y, 16m, 16c, 16K and cleaning devices 49y, 49m, 49c, 49K.

  The exposure devices 47y, 47m, 47c, and 47K include, for example, a light emitting diode (LED) array and a lens array arranged in the axial direction (main scanning direction) of the photosensitive drums 27y, 27m, 27c, and 27K in the illustrated example. Exposure is performed using an LED writing method. The exposure devices 47y, 47m, 47c, and 47K emit LEDs according to the image data photoelectrically converted for each color to form electrostatic latent images on the photosensitive drums 27y, 27m, 27c, and 27K. In the developing devices 16y, 16m, 16c, and 16K, the developing roller that carries the developer rotates and visualizes the electrostatic latent image formed on the photosensitive drums 27y, 27m, 27c, and 27K with toner, so that each color is displayed. A toner image is formed every time.

  The toner images formed on the photosensitive drums 27y, 27m, 27c, and 27K are intermediate transfer belts at positions where the photosensitive drums 27y, 27m, 27c, and 27K are in contact with the intermediate transfer belt 14 (hereinafter referred to as primary transfer positions). 14 is transferred. Intermediate transfer rollers 26y, 26m, 26c, and 26K are disposed on the photosensitive drums 27y, 27m, 27c, and 27K in pairs with the photosensitive units 13y, 13m, 13c, and 13K through the intermediate transfer belt 14, respectively. . Each of the intermediate transfer rollers 26y, 26m, 26c, and 26K is in contact with the inner peripheral surface of the intermediate transfer belt 14, and moves upward during intermediate transfer to bring the intermediate transfer belt 14 into contact with the surface of each photoconductor. . By applying a voltage to each of the intermediate transfer rollers 26y, 26m, 26c, and 26K, an intermediate transfer electric field for transferring the toner images on the photosensitive drums 27y, 27m, 27c, and 27K to the intermediate transfer belt 14 is generated. To do. A toner image is formed on the intermediate transfer belt 14 by the action of the intermediate transfer electric field. The toner images of the respective colors are superimposed and transferred, and a full color toner image is formed on the intermediate transfer belt 14.

  When image formation and transfer of all colors have been completed, the paper feed rotor feeds the recording paper 53 from the paper feed tray 22 in synchronization with the intermediate transfer belt 14, and the secondary transfer unit 50 uses the intermediate transfer belt. The toner images are secondarily transferred to the recording paper 53 simultaneously from the four colors of 14.

  The recording paper 53 is selected from any of the first tray 22a, the second tray 22b, the third tray 22c, the fourth tray 22d, the manual feed tray, or the duplex unit. Each of the paper feed trays 22a to 22d individually feeds a plurality of recording papers 53 that have been multi-fed by the paper feed roller 28 and the paper feed roller 28 that sequentially feed the recording paper 53 accommodated therein from the top. A separation roller 31 is provided that is separated and sent to the conveyance path 23. As a result, the recording paper 53 is started to be transported toward the transport path 23. This series of paper feed rollers 28 is driven by a paper feed motor.

  The sheet feeding unit 150 includes a plurality of conveyance roller pairs 29 and the like appropriately provided in the middle of the conveyance path 23. A pair of transport rollers 29 driven by a paper feed motor feeds the recording paper 53 transported from the paper feed tray 22 toward the transport roller pair 29 at the subsequent stage and the paper feed path 32 of the image forming unit 110. The recording paper 53 fed into the paper feed path 32 is abutted against the registration roller 33 and temporarily stops after a predetermined time has elapsed after its leading edge is detected by the registration sensor 51. The registration roller 33 is driven by a registration motor and feeds the sandwiched recording paper 53 to the position of the secondary transfer roller 18 at a predetermined timing (in synchronization with the sub-scanning effective period signal (FGATE)). The predetermined timing is a timing at which the full-color superimposed toner image is conveyed to the position of the secondary transfer roller 18 by the rotation of the intermediate transfer belt 14.

  The secondary roller 18 is disposed opposite to the repulsive roller 17. The image forming apparatus 100 causes the secondary transfer roller 18 to contact the intermediate transfer belt 14 during printing. The secondary roller 18 is controlled by a secondary motor so that the outer peripheral speed of the secondary motor is the same as the surface speed of the intermediate transfer belt 14.

  The recording paper 53 is separated from the intermediate transfer belt 14 by a separator (not shown) and then conveyed to the fixing device 19 by the conveying belt 24, and the fixing device 19 fixes the toner image on the recording paper 53. In the case of single-sided printing, the recording paper 53 after fixing is discharged onto the paper discharge tray 21 by a paper discharge roller driven by a paper discharge motor.

  Although FIG. 1 illustrates the image forming apparatus 100 that forms an image on the recording paper 53 by the electrophotographic method, the image forming method includes an ink jet method that discharges ink droplets to form an image, a sublimation thermal transfer method, and a dot impact. A type image forming apparatus may be used.

  FIG. 2 shows an example of a block diagram of a control system of the image forming apparatus 100. The image forming apparatus 100 includes a read control unit 230, an engine control unit 220, and a write control unit 240 connected to the controller control unit 210 via the PCI bus 280. Further, the reading control unit 230, the engine control unit 220, and the writing control unit 240 are respectively a paper conveyance control unit 250, a fixing control unit 260, a power supply control unit 300, and an image formation control unit 270, and a local bus or serial bus (hereinafter referred to as a “bus”). The external bus 290). Hereinafter, the reading control unit 230, the engine control unit 220, the writing control unit 240, the paper conveyance control unit 250, the fixing control unit 260, the power supply control unit 300, and the image formation control unit 270 may be simply referred to as “control unit”. . The white double-sided arrow line shown in the figure indicates the flow of image data, and the thick double-sided arrow line indicates the external bus 190 for the control unit to communicate with each other. The signal line 291 connects each control unit directly, and enables transmission / reception of a High or Low signal. The signal line 291 is not always necessary.

  The controller control unit 210 receives the setting of the image forming operation, generates operation information for image formation (including at least the job ID), and transmits the operation information to other control units. The controller control unit 210 is mainly used for an ASIC that performs image processing, a CPU that controls various processing operations, a ROM that permanently stores a control program, a RAM that temporarily stores various information, and an operation of a digital copying machine. An NV-RAM or the like for storing parameters to be used is included. In addition, a LAN interface (not shown) that transmits and receives information from an external device via a network such as a LAN, an operation unit control unit 211 that controls an operation panel 214 serving as a user interface, an HDD 212 that stores image data to be processed, and a FAX It is connected to the FCU 213 that performs communication.

  The controller control unit 210 receives an image forming operation setting from the operation unit control unit 211 or an external device via the LAN interface, and requests the engine control unit 220 to perform image processing.

  The engine control unit 220 controls each control unit of the reading control unit 230, the writing control unit 240, the paper conveyance control unit 250, the fixing control unit 260, the power supply control unit 300, and the image forming control unit 270. The engine control unit 220 performs transfer of image data, an operation request to each control unit according to the contents of the job, progress management, and the like. Each of these control units corresponds to an information processing unit.

  The reading control unit 230 is connected to the ARDF 140 and controls the document reading unit 130. The ARDF 140 detects the standard paper size of the set original, and automatically discriminates even when originals having different paper sizes are mixedly loaded. The ARDF 140 detects the presence of a document, and automatically supplies the document to the document reading unit 130 one by one while the document is present.

  The reading control unit 230 controls the document reading unit 130 to generate document image data. When the user instructs the operation unit control unit 211 to start reading, the reading control unit 230 instructed by the engine control unit 220 turns on the exposure lamp, and positions of the first carriage and the second carriage included in the document reading unit 130. Is moved to the left edge of the contact glass. When the first carriage and the second carriage come to the left end, the reading control unit 230 causes the ARDF 140 to supply one document to the contact glass. When detecting the contact glass document, the reading control unit 230 reads the document surface while moving the first and second carriages. After reading, the ARDF 140 is supplied with the next original, and the positions of the first carriage and the second carriage are moved to the left end of the contact glass, and the reading of the original data is repeated.

  The reading control unit 230 performs basic image quality processing such as shading correction, MTF correction, gamma correction, black image generation, color image generation, binarization processing, and multilevel processing, and outputs the result to the engine control unit 220. The engine control unit 220 transmits image data to the controller control unit 210 in the case of a job only for reading a document. In this case, the controller control unit 210 stores the image data in the HDD 212 and transmits it to a destination designated via the network if necessary. In the case of a copy job, the engine control unit 220 transmits image data to the write control unit 240.

  The writing control unit 240 controls the writing unit 120. The image data read by the reading control unit 230, the image data acquired from the FCU 213 by the controller control unit 210, or a PC (Personal Computer) is transmitted to the writing control unit 240, and the controller control unit 210 converts the image data into image data. Image data is transmitted. The writing control unit 240 modulates (on / off) a laser diode (not shown) based on the image data, and controls laser light irradiation. The laser light is reflected by the polygon mirror, passes through the lens, and forms an electrostatic latent image on the photosensitive drums 27y, 27m, 27c, and 27K.

  The writing control unit 240 detects the start of scanning and the end of scanning by using photodetectors arranged at both ends outside the image area of the laser light. The pair of photodetectors converts the incident laser light into a synchronization signal. The writing control unit 240 measures a time interval during which the laser beam scans between the two PDs based on the pair of synchronization signals, and sets the pixel clock so that a predetermined number of clocks (resolution) predetermined in the time interval can be accommodated. Generate. The writing control unit 240 generates laser drive data (on / off modulation data) corresponding to the image data in synchronization with the pixel clock. Thereby, electrostatic latent images are formed on the photosensitive drums 27y, 27m, 27c, and 27K.

  The image forming control unit 270 controls the image forming unit 110 to form a color toner image on the intermediate transfer belt 14. The image forming control unit 270 controls the rotation of the photosensitive drums 27y, 27m, 27c, and 27K so that the surface speeds of the intermediate transfer belt 14 are equal. When the leading edge of the K electrostatic latent image reaches the developing position of the K developing device of the developing device, the K latent image begins to be developed with K toner, and the trailing edge of the K electrostatic latent image passes through the developing position. Then, a K toner image is formed.

  The image forming control unit 270 applies a predetermined bias voltage to the intermediate transfer belt 14 when the photosensitive drums 27y, 27m, 27c, and 27K come into contact with the intermediate transfer belt 14, thereby transferring the toner image to the intermediate transfer belt 14. Transcript to. Residual toner on the photoconductive drums 27y, 27m, 27c, and 27K is cleaned as described above, and the photoconductive drums 27y, 27m, 27c, and 27K are neutralized by a neutralizing lamp.

  Similarly, the image forming control unit 270 transfers the C, M, and Y toner images to the intermediate transfer belt 14, and the writing control unit 240 uses laser light so that the positions of the toner images of the respective colors coincide with each other. The timing to start writing is adjusted.

  The paper transport control unit 250 controls the paper feed unit 150. The paper transport control unit 250 turns on the solenoid of the paper feed tray 22 instructed by the controller control unit 210 to bring the paper feed roller 28 into contact with the recording paper 53. Further, the paper feeding roller 28 is driven to rotate, and the recording paper 53 is sent out to the conveyance path. The paper conveyance control unit 250 rotates the conveyance roller pair 29 in the conveyance path, detects the leading edge of the recording paper by the registration sensor, abuts against the registration roller 33, and stops once. Then, in synchronization with the sub-scanning effective period signal (FGATE), the registration roller 33 is driven and sent to the position of the secondary transfer roller 18.

  The paper conveyance control unit 250 brings the secondary transfer roller 18 into contact with the intermediate transfer belt 14 before and after driving the registration roller 33. The paper conveyance control unit 250 controls the surface speed of the secondary transfer roller 18 to be the same as the surface speed of the intermediate transfer belt 14.

  The fixing control unit 260 controls the fixing device 19. When instructed by the engine control unit 220, the fixing control unit 260 controls the temperature of the fixing heater to a predetermined temperature. During operation of the fixing unit, the fixing unit is always adjusted to a desired temperature. The fixing heater is a heating unit that heats the fixing unit, and the fixing unit presses and fixes the toner to the transfer paper.

  The power supply control unit 300 rectifies an AC power supply 310 supplied from a commercial power supply or a private power generator into a direct current, steps down the voltage to a predetermined voltage by a DCDC converter, and supplies the voltage to each control unit. The power supply control unit 300 can reduce power consumption by turning off the power supply according to an instruction from the controller control unit 210 or the like.

  Each control unit has a substantially common configuration. In the figure, the engine control unit 220 and the paper conveyance control unit 250 will be described, but the configurations of the other control units are the same. Each control unit may have a unique IC or function.

  Each control unit includes a CPU 201, a RAM 202, a ROM 203, a software monitoring unit 204, and an I / F 205 connected via a bus, and further connected to an arbitration circuit 206 and an arbitration circuit 206 connected to the I / F 205. Storage device 207. The CPU 201 executes a program stored in the ROM 203 by using the RAM 202 as a working memory and performs processing specific to each control unit.

  The I / F 205 is a serial interface for the CPU 201 to communicate with other control units when the arbitration circuit 206 connects the CPU 201 side and the external bus 290. The software monitoring unit 204 is a watchdog timer, for example, and is a software runaway monitoring circuit executed by the CPU 201. When the software monitoring unit 204 detects an abnormality in software executed by the CPU 201 (hereinafter also referred to as “runaway”), the software monitoring unit 204 resets only the control unit on which the runaway CPU 201 is mounted. The software monitoring unit 204 includes a runaway counter 406 and an operation time counter 407. The runaway counter 406 counts the cumulative number of times that the software has runaway, and is not automatically reset. The operation time counter 407 counts the time that has elapsed since the control unit recovered after the previous runaway of software. Therefore, the operation time counter 407 is reset upon recovery from software runaway. The arbitration circuit 206 switches the communication destination of the external bus 290 to any one of the CPU 201, the storage device 207, and the runaway notification command output unit 403. Details will be described later. The storage device 207 is a non-volatile memory (NVRAM, EEPROM, etc.) that stores job execution information.

  The software monitoring units 204 of each control unit are connected to each other via a signal line 291. When the software monitoring unit 204 detects a runaway of the CPU 201 of its own device, the software monitoring unit 204 interrupts and notifies the CPU 201 of each other control unit via the diode 208. The runaway of the CPU 201 detected by the software monitoring unit 204 of the other control unit is notified by interrupting the CPU 201 of its own device via the diode 209 (see FIG. 2). Specifically, an interrupt controller (not shown) manages interrupts to the CPU 201, and interrupts with lower priority are masked. Therefore, each control unit executes processing with lower priority than recovery processing. An interrupt is accepted only when it is present (mainly in standby). The detection unit, restart unit, error notification unit, determination value acquisition unit, recovery determination unit, restart instruction unit, communication cutoff instruction unit, self-diagnosis unit, and self-diagnosis instruction unit described in the claims in the present embodiment Although implemented by each hardware including the arbitration circuit described above, these processes can be replaced by software. Details will be described later.

  In the present embodiment, it is difficult for the control unit on the side where the CPU 201 has runaway to perform a software restoration process. For this reason, another control unit in which the CPU 201 has not runaway executes a program different from the normal mode in which the inherent processing is performed, and the control unit in which the runaway CPU 201 is mounted is restored. Hereinafter, a control unit in which the CPU 201 has runaway is referred to as a “running process control unit”, and a control unit that performs a recovery process on the runaway process control unit is referred to as a “restoring process control unit”.

  3 to 6 show an example of a configuration diagram of the arbitration circuit 206 of the control unit in which software runaway has occurred. The arbitration circuit 206 includes a switch 401, a switch 404, a runaway notification command output unit 403, and a switching circuit 402.

  3 shows a normal state where no runaway is detected, FIG. 4 shows a state of the switching circuit immediately after the runaway is detected, and FIG. 5 shows a state when the recovery control unit reads the abnormality determination value from the storage device 207. FIG. 6 shows states when the control unit that has runaway notifies the result of the self-diagnosis processing to other control units.

  The switch 401 switches the connection destination of the external bus 290 to any of the I / F 205, the runaway notification command output unit 403, and the storage device 207. The switch 404 connects and disconnects the storage device 207 and the I / F 205 or the software monitoring unit 204. The switch 404 is used to prevent the CPU 201 from writing erroneous data to the storage device 207 due to software runaway. In addition, by connecting the software monitoring unit 204 and the storage device 207, each value counted by the software monitoring unit 204 can be written to the storage device 207. The switching circuit 402 controls the states of the two switches 401 and 404.

  As shown in FIG. 3, immediately after the control unit is activated, the switching circuit 402 controls the switch 401 so as to connect the external bus 290 and the I / F 205, and the switch 404 so that the storage device 207 and the I / F 205 are connected. To control. Therefore, the CPU 201 can access the storage device 207 and the external bus 290 if no runaway is detected.

  First, when the CPU 201 runs away due to an external interrupt or noise, the counter of the software monitoring unit 204 cannot be periodically cleared. The software monitoring unit 204 detects the runaway of the CPU 201 by the counter overflow. When the software monitoring unit 204 detects a runaway, the software monitoring unit 204 supplies a reset signal to the CPU 201.

  While the software monitoring unit 204 activates the reset signal, the runaway CPU 201 enters a stopped state (waiting for restart), and restarts when the switching circuit 402 receives the recovery command. The recovery command is transmitted from another control unit that performs recovery processing.

  Note that the external interrupt is to interrupt the CPU 201 in order for a sensor or the like to notify the detection value. The software runaway due to an external interrupt is based on the assumption that the CPU 201 is occupied by the interrupt processing because the port that the sensor notifies the CPU 201 of the interrupt sticks to the interrupt side.

  Further, when the software monitoring unit 204 detects the runaway of the CPU 201, the software monitoring unit 204 notifies the switching circuit 402 that the runaway has been detected. As shown in FIG. 4, the switching circuit 402 controls the switch 401 so that the external bus 290 and the runaway notification command output unit 403 are connected. In addition, the switching circuit 402 controls the switch 404 so that the storage device 207 and the software monitoring unit 204 are connected. By connecting the external bus 290 and the runaway notification command output unit 403, the runaway notification command output unit 403 can transmit the runaway notification command to each control unit. In addition, by connecting the storage device 207 and the software monitoring unit 204, the values counted by the runaway number counter 406 and the operation time counter 407 of the software monitoring unit 204 can be written to the storage device 207. And these values are written. The value written in the storage device 207 can be read from another control unit through the external bus 290. The runaway notification command output unit 403 continuously issues a runaway notification command while the switch 401 is connected to the runaway notification command output unit 403.

  Here, the runaway notification command is a function that can replace the signal line 291. That is, each control unit may notify the runaway via the signal line 291 instead of the runaway notification command. In this case, since the runaway notification command output unit 403 is unnecessary, the external bus 290 is not connected to either the I / F 205 or the storage device 207 in the state of FIG.

  Each control unit that has received the runaway notification command compares the priority of the runaway notification command with the priority of the process during operation. When the operation is in progress, the operation is interrupted but the recovery process is not performed. Therefore, the interruption process is performed when the operation is in progress. All the control units that have received the runaway notification command are in a standby state after the interruption process. When the standby state is entered, the standby state is continued until the CPU 201 acquires a notification release from the control unit during the runaway process in which the CPU 201 has runaway.

  When another control unit that has received a notification from the runaway control unit is waiting, the control unit issues a data read command to the switching circuit 402 of the runaway processing control unit that has transmitted a runaway notification command to the external bus 290. To do. The control unit that has issued the data read command earliest performs processing for recovery. Upon receiving this data read command, the control unit during the runaway process enters the state shown in FIG. 5, and the switching circuit 402 of the arbitration circuit 206 switches the switch 401 so that the external bus 290 and the storage device 207 are connected. . At this time, the switching circuit 402 opens the switch 404 to release the connection between the storage device 207 and the software monitoring unit 204. Since the connection between the external bus 290 and the storage device 207 is released by switching the switch 401, the runaway notification command is not output to the external bus 290. For this reason, control units other than the control unit during recovery processing that first received the runaway notification command do not output a data read command. Thereafter, the controller during recovery processing reads the abnormality determination value from the storage device 207.

  The recovery processing control unit that has issued the data read command can read the abnormality determination value from the storage device 207 of the runaway processing control unit. The abnormality determination value is a numerical value for determining whether or not the control unit during the runaway process is restored. In this embodiment, the values counted by the runaway number counter 406 and the operation time counter 407 are the values. Applicable. As the abnormality determination value, only one of these numerical values may be used for determination for restoration, or may be replaced by another parameter indicating the degree of abnormality.

  The control unit during restoration processing has a threshold value for abnormality determination in advance, and performs determination by comparing the abnormality determination value acquired from the control unit during runaway processing with the threshold value.

  If it is determined by the recovery processing control unit that the recovery is possible, the recovery processing control unit issues a recovery command to the runaway processing control unit. The control unit during the runaway process that has received the recovery command returns to the state of FIG. 3 and the switching circuit 402 of the arbitration circuit 206 of the control unit during the runaway process switches the switch 401 so that the external bus 290 and the I / F 205 are connected. Switch. In addition, the switching circuit 402 closes the switch 404 so that the storage device 207 and the I / F 205 are connected. Furthermore, the switching circuit 402 notifies the software monitoring unit 204 that the recovery command has been received, and the CPU 201 is restarted by releasing the reset to the CPU 201.

  The CPU 201 of the control unit during the runaway process reads the program in the ROM 203 after canceling the reset, and resets the operation based on the job execution information. For example, an I / O check or the like is performed to set parameters necessary for specifying the motor rotation speed. In this embodiment, each control unit resumes the job read from the control unit during the runaway process. As described above, by reading the job execution information from the storage device 207, the job before the runaway state can be resumed. The control unit during the runaway process notifies the other control units that the start of the job being processed has been completed. This is a release notification of the runaway notification command, and the other control units resume processing together. In addition, the control unit during the recovery process originally in the standby state shifts to the standby state after transmitting the recovery command to the control unit during the runaway process. If it is not originally in the standby state, the recovery processing control unit resumes the software job read from the runaway processing control unit after transmitting a recovery command to the runaway processing control unit.

  On the other hand, if it is determined that an error has occurred in the control unit during the runaway process and it cannot be recovered as a result of the determination, the recovery command is not sent, and an error is A command for instructing the transition to the function-restricted mode for maintaining the control unit that performs processing linked to the generated control unit in the suspended state is output. In addition, the recovery process control unit outputs a self-diagnosis execution command to the runaway process control unit. The contents of the self-diagnosis process will be described later.

  Next, the flow of processing after a software runaway occurs will be described with reference to the sequence diagram of FIG. FIG. 7 shows a case where runaway is detected in the paper conveyance control unit 250. As shown in FIG. 7, first, when a software runaway occurs in the CPU 201 (step S101), the software monitoring unit 204 detects the runaway (step S103). The CPU 201 is reset when the software runaway occurs, and the processing is stopped (step S102). This reset state continues until a recovery command is transmitted from the controller during the recovery process.

  Next, the software monitoring unit 204 updates the values of the runaway number counter 406 and the operation time counter 407 when the runaway is detected (step S104). The value of the runaway counter 406 is incremented by 1 for the cumulative number of runaways. In addition, the operation time counter 407 stops counting when a runaway is detected, and determines the continuous operation time from the time when the runaway detection at that time is restored.

  Next, the software monitoring unit 204 sends an instruction to switch the switches 401 and 404 to the switching circuit 402 (step S105). Upon receiving the instruction, the switching circuit 402 switches the switch 401 so that the runaway notification command output unit 403 is connected to the external bus 290 (step S106). The switching circuit 402 switches the switch 404 so that the storage device 207 is connected to the software monitoring unit 204 (step S107). In this state, the runaway notification command output unit 403 can transmit a runaway notification command to other control units in which no runaway has occurred (step S109).

  When the switch 404 is switched to the software monitoring unit 204 side, the software monitoring unit 204 writes the updated value of each counter in the storage device 207 (step S108). After the counter value is written, the process waits until a counter data read command is received from another control unit.

  The other control unit that has received the runaway notification command determines whether or not it is operating (step S110). When the control unit that has received the runaway notification command is operating (step S110: Yes), the processing operation is interrupted, the process enters a standby state, and the process ends (step S111). On the other hand, when the control unit that has received the runaway notification command is on standby (step S110: No), the control unit becomes the control unit that performs the recovery process of the paper transport control unit 250 and the counter of each counter that becomes the abnormality determination value. A data read command is transmitted to the paper conveyance control unit 250 in order to acquire the value (step S113). Upon receiving the data read command, the switching circuit 402 of the paper transport control unit 250 switches the switch 401 to the storage device 207 side (step S114). Similarly, the switching circuit 402 switches the switch 404 to the open state, and disconnects the connection between the software monitoring unit 204 and the storage device 207 (step S116).

  When the switch 401 is switched to the storage device 207 side, the recovery processing in-progress control unit acquires each counter value (step S115). The control unit during restoration processing determines whether or not the value of the cumulative number of runaways is smaller than a predetermined abnormality determination threshold value among the acquired counter values (step S117). Similarly, the controller during recovery processing determines whether or not the value of the continuous normal operation time is longer than the predetermined abnormality determination threshold value among the acquired counter values (step S118).

  When the value of the cumulative number of runaways is smaller than a predetermined abnormality determination threshold (step S117: Yes), or when the continuous normal operation time value is longer than a predetermined abnormality determination threshold (step (S118: Yes), the controller during the recovery process continues the recovery process, and transmits a recovery command to the paper transport control unit 250 (step S119). In the paper conveyance control unit 250 that has received the recovery command, the switching circuit 402 switches the switch 401 so that the I / F 205 and the external bus 290 are connected (step S120). Then, the CPU 201 restarts (step S121), and a return process is performed when the CPU 201 is stopped in the middle of the interrupted process (step S122).

  On the other hand, when the value of the cumulative number of runaways is larger than a predetermined abnormality determination threshold value (step S117: No), the continuous normal operation time value is shorter than the predetermined abnormality determination threshold value. In the case (step S118: No), the control unit during the recovery process instructs the paper conveyance control unit 250 to block communication (step S123). Then, the control unit during the recovery process instructs another control unit in which no abnormality has occurred to shift to the function limited mode (step S124), and also shifts to the function limited mode and ends the process ( Step S125).

  The function limited mode is a mode for preventing processing performed by the control unit in which an abnormality has occurred. There are the following three types of function limitation modes.

(i) Function-limited mode: Read control unit can operate
(ii) Function-limited mode: Write control unit, paper transport control unit, fixing control unit, and image formation control unit can operate
(iii) Function-limited mode: The controller controller can operate
(i) is a state in which only the original can be read, and one or more control units for printing cannot be operated. (ii) is a state in which the reading control unit cannot operate. (iii) is a state where neither reading nor printing is possible.

  Each control unit diagnoses its own state, but the type of the function limited mode is determined by the controller control unit 210 that has obtained the diagnosis result from each control unit. The controller control unit 210 displays an error message on the operation panel 214 or restricts user operations according to the type of the operation restriction mode.

  In determining whether to enter any function-restricted mode, each control unit has an operation decision that registers whether to continue or interrupt the operation depending on the control unit during runaway processing that sent the runaway notification command. Use a table. FIG. 8 shows an example of the operation determination table.

An example of the operation determination table is as follows. Note that “operation interruption” indicates a case where the operation of the control unit is interrupted and the mode is shifted to the function limited mode, and “operation continuation” indicates that even when an abnormality occurs in the control unit. This shows a case where the processing is continuously performed.
-Engine control unit operation interruption: None (No operation interruption by other control)
Operation continuation: One or more of all control units runaway notification / reading control unit operation interruption: Engine control unit runaway notification operation continuation: One of writing control unit, paper transport control unit, fixing control unit, image formation control unit The above is the runaway notification / writing control unit operation interruption: one or more of the engine control unit, paper conveyance control unit, fixing control unit, and image formation control unit continues the runaway notification operation: the reading control unit is the runaway notification / paper conveyance control unit Operation interruption: One or more of the engine control unit, write control unit, fixing control unit, and image formation control unit runaway notification operation continuation: Read control unit runs out of control / fixing control unit Operation interruption: engine control unit, write control unit One or more of the paper conveyance control unit and the image formation control unit continue the runaway notification operation: the read control unit performs the runaway notification / image formation control unit operation interruption: the engine control unit, the writing control unit, the paper conveyance control unit, the fixing device One or more of Run the notification operation continued: reading control unit runaway notification

  Each control unit refers to its own operation determination table and determines whether to interrupt or continue the operation when a runaway notification command is received.

  Also, in the paper conveyance control unit 250 that has been instructed to block communication, the arbitration circuit 206 performs a communication blocking process (step S126). And CPU201 performs a self-diagnosis process (step S127), and complete | finishes a process.

  Hereinafter, the flow of the self-diagnosis process performed in the control unit in which an abnormality has occurred will be described with reference to FIG. As shown in FIG. 9, the paper conveyance control unit 250 determines whether there is a past execution history of self-diagnosis processing (step S201). When it is determined that there is no self-diagnosis process execution history in the past (step S201: No), the control unit changes the external interrupt input terminal to a general-purpose port (step S202). The reason for changing to a general-purpose port is that when an interrupt port that permits interrupts is used, an interrupt signal may be input to the CPU 201, and thus the number of input signals of a connected device cannot be detected accurately. It is. Next, the control unit measures the number of detections of the input signal to the changed input terminal within a predetermined time, and stores the number of times (step S203). And a control part determines whether the frequency | count of detection is smaller than a predetermined threshold value (step S204).

  When it is determined that there is an execution history of the self-diagnosis process in the past (step S201: Yes), it is determined that the control unit itself is out of order because the control unit has occurred abnormally many times. (Step S205). Similarly, when the number of times of detection is smaller than the predetermined threshold (step S204: Yes), it can be determined that there is a problem with the control unit itself, rather than a problem with the device connected to the control unit. It is determined that the control unit itself has failed (step S205). In the case where the control unit is out of order, the state interrupted in step S126 is maintained as it is.

  On the other hand, when the number of times of detection is larger than the predetermined threshold (step S204: No), the input signal is continuously input, so the control unit fails in the device that transmits the input signal to the general-purpose port. (Step S206). The device is different for each control unit, for example, a sensor for detecting the position of the paper, a driving motor, or the like. Then, after the diagnosis of the faulty part is completed, the control unit switches the switch 401 to the I / F 205 side so that communication with other control units is possible (step S207). The state of the control unit at this time is shown in FIG. And if there is an abnormality in the connected device, there is no abnormality in the control unit itself, so the control unit in which the abnormality has occurred The site is notified and the self-diagnosis process is terminated (step S208). In other control units that have received this notification, the above-described function restriction mode may be canceled.

  In the image forming apparatus described above, as described above, the image forming apparatus 100 according to the present exemplary embodiment resets only the CPU 201 even if the CPU 201 of a certain control unit runs out of control. Can be recovered in a shorter time than restarting.

  In addition, even if an abnormality occurs in a certain control unit, it is possible to determine the degree of the abnormality that has occurred and determine whether to restore it in another control unit that is operating normally. Even if this occurs, the recovery process can be automatically performed automatically at an early stage when it is not always necessary to keep the stop state.

  In addition, by adopting the function-limited mode, other functions can be used as much as possible when the CPU of the standby control unit runs out of control, and the operation is performed when the CPU of the operating control unit runs out of control. By suspending, it can be reliably maintained.

  In addition, self-diagnosis processing can be performed to determine whether the cause of the abnormality is in the control unit itself or in another member, and if it is determined that there is no abnormality in the control unit, the control unit itself The processing to be performed can be restored and executed.

  Note that the abnormality determination value is acquired by the control unit during recovery processing being read from the control unit during runaway processing, but the control unit during runaway processing sends it to the control unit during recovery processing after updating the counter. By doing so, the same function can be realized.

  In the above embodiment, the image forming apparatus according to the present invention is described by taking an example in which the image forming apparatus is applied to a multifunction machine having at least two functions among a copy function, a printer function, a scanner function, and a facsimile function. The present invention can be applied to any image forming apparatus such as a printer, a scanner apparatus, and a facsimile apparatus.

DESCRIPTION OF SYMBOLS 100 Image forming apparatus 110 Image forming unit 120 Writing unit 130 Document reading part 140 ARDF
150 Paper Feed Unit 201 CPU
202 RAM
203 ROM
204 Software monitoring unit 205 I / F
206 Arbitration circuit 207 Storage device 208, 209 Diode 210 Controller control unit 220 Engine control unit 230 Reading control unit 240 Write control unit 250 Paper conveyance control unit 260 Fixing control unit 270 Image forming control unit 280 PCI bus 290 External bus 300 Power supply control unit 401, 404 switch 402 switching circuit 403 runaway notification command output unit

JP 2006-259869 A

Claims (8)

An information processing apparatus including a plurality of information processing units,
The information processing unit
A processor running software;
A detection unit for detecting an abnormality of the software;
A restart unit that restarts the processor that executes the software that has detected an abnormality;
An error notification unit that notifies the other information processing unit of the occurrence of an abnormality when an abnormality of the software is detected;
An error measurement unit that measures an abnormality determination value indicating an abnormality degree of the software;
A determination value acquisition unit that acquires the abnormality determination value measured in the information processing unit in which the abnormality is detected;
A recovery determination unit that determines whether to restore the information processing unit in which the abnormality is detected by comparing the acquired abnormality determination value with a predetermined threshold;
A restart instruction unit that instructs the restart unit of the information processing unit in which the abnormality has occurred to restart the processor when it is determined to be restored;
An information processing apparatus comprising: When the restoration determination unit determines not to restore the information processing unit in which the abnormality is detected, the abnormality has occurred with an instruction to block communication between the information processing unit and the other information processing unit The information processing apparatus according to claim 1, further comprising: a communication cutoff instruction unit that sends the information to the information processing unit. The information processing unit
A self-diagnosis unit for performing a self-diagnosis process for determining which part has an abnormality;
A self-diagnosis instruction unit that causes the self-diagnosis unit of the information processing unit in which the abnormality is detected to execute the self-diagnosis process when the recovery determination unit determines not to restore;
The information processing apparatus according to claim 1, further comprising: The self-diagnosis unit counts the number of detections of a signal input into the information processing unit in which the abnormality is detected within a predetermined time after the start of the self-diagnosis process, and the counted number of detections If the predetermined number of times has been exceeded, it is determined that the device that transmitted the signal has failed. If the number of detections is less than a predetermined number, the information processing unit has failed. The information processing apparatus according to claim 3, wherein a determination is made. The self-diagnosis unit, when the counted number of times of detection exceeds a predetermined number of times, causes the restarting unit to restart the processor and the information processing unit in which the abnormality has occurred The information processing apparatus according to claim 4, wherein communication with the information processing unit is enabled. The self-diagnosis unit
When the counted number of times of detection exceeds a predetermined number of times, a diagnostic result notifying unit that notifies the other information processing unit that there is no abnormality,
The information processing apparatus according to claim 1, further comprising: When the recovery determination unit determines not to restore the information processing unit, the information processing unit that performs processing in conjunction with the information processing unit in which an abnormality is detected is stopped among the other information processing units. The information processing apparatus according to claim 1, further comprising a stop notification unit that notifies the other information processing unit. An abnormality processing method for an information processing apparatus including a plurality of information processing units,
A detection step in which the information processing unit detects a software abnormality;
A restarting step of restarting a processor that executes the software for which the information processing unit has detected an abnormality;
An error notifying step in which when the software abnormality is detected, the information processing unit notifies the other information processing unit of the occurrence of the abnormality;
An error measurement step in which the information processing unit measures an abnormality determination value indicating the degree of abnormality of the software;
A determination value acquisition step in which the other information processing unit notified of the occurrence of the abnormality acquires the abnormality determination value measured in the information processing unit in which the abnormality is detected;
The other information processing unit determines whether to restore the information processing unit in which the abnormality is detected by comparing the acquired abnormality determination value with a predetermined threshold value. Recovery judgment step;
A restart instruction step that instructs the restart unit of the information processing unit in which the abnormality has occurred to restart the software when it is determined that the other information processing unit is to be restored. An abnormality processing method characterized by the above.

Images