JP2578985B2 - Redundant controller - Google Patents

Description

Description: TECHNICAL FIELD The present invention relates to a fault monitoring method for a communication control device operating in a duplex configuration, and more particularly to a fault monitoring method capable of reliably detecting a fault even when there is a large change in the processing amount due to the nature of the system. The present invention relates to an improvement of a redundant control device which is required to perform a recovery.

[Prior art] Conventionally, fault monitoring of a communication control device of this type of duplex configuration is performed mainly by a watchdog timer that notifies a fault of the partner system to its own system when a check signal from the partner system is interrupted for a certain period of time. I was

[Problems to be Solved by the Invention] In the fault monitoring using the watchdog timer or the like described above, there is no room for confirming the fault, and when a fault is notified from the counterpart system, it must be accepted as a real fault. Absent. Therefore, if a malfunction occurs due to a hardware failure of a watchdog timer or the like, or a malfunction occurs due to a delay in sending a check signal from the partner system due to a peak in the processing amount of the partner system, the system operates normally. Nevertheless, there is a drawback that the operation shifts to a failure handling operation.

Also, since there is only one method of fault detection, if the main unit falls into an inoperable state as a system, a condition occurs in which the sub unit is not notified (hardware failure such as a watchdog timer, etc. Dynamic loop formation state), and the system falls into a state where it cannot perform its function.

[Means for Solving the Problems] A redundant control device according to the present invention comprises a watchdog timer means for notifying a partner system of a fault in the self system, and a health check for notifying the partner system that the self system is operating. Means, loop monitoring means for monitoring the failure of the local system in the local system, inter-system communication status monitoring means for monitoring the status of the communication function between the local system and the remote system, and communication between the local system and the remote system. It has line switching device monitoring means for monitoring the line switching device that performs switching, and reports the occurrence of abnormalities performed by each of these means, and the current status of its own system (whether or not it is the current main unit, if any other abnormalities have already occurred). The system is characterized in that the failure is determined in accordance with whether the notification of occurrence has been received and the recovery process is promptly performed.

Next, the present invention will be described with reference to the drawings. First
FIG. 1 is a configuration diagram of software and hardware according to an embodiment of the present invention.
One operates as the main engine and the other operates as the sub-engine.

Reference numeral 1 denotes a watchdog timer, reference numeral 2 denotes a task for sending a signal to the watchdog timer, and reference numeral 3 denotes hardware (PIO) for receiving an interrupt from the watchdog timer of the partner system.

In the watchdog timer 1, if the signal from the task 2 of the own system that sends a signal to the watchdog timer is interrupted for 1 second or more, an interrupt notification is sent to the PIO3 of the other system. Note that PIO3 receives not only an interrupt from the partner watchdog timer 1 but also an abnormal interrupt from the line switching device 30. These interrupt notifications are passed to the fault monitoring main task 5 through the task 4 receiving the interrupt notification. The fault monitoring main task 5 includes a health check means for transmitting health check data to the other system every 6 seconds, a health check monitoring means for performing a health check timeout when no health check data is received from the other system for 8 seconds, There are inter-system communication status monitoring means for monitoring the inter-system communication status with other systems, guard timer means for waiting for a watchdog timer interrupt from the partner system when a health check timeout or inter-system communication status error is detected, etc. At the time of occurrence of each event, a failure is determined by the matrix shown in FIG. In FIG. 2, no processing is performed on the blank portion.

Reference numeral 6 denotes a first loop monitoring task which operates at the highest level among all application tasks in the system. 7
Operates at the lowest level among all the application tasks in the second loop monitoring task 7. 8 is a loop monitoring flag. The second loop monitoring task 7 sets the loop monitoring flag 8 every 0.5 seconds, and the first loop monitoring task 6 resets the loop monitoring flag 8 every 8 seconds.
At this time, if the loop monitoring flag 8 has already been reset, the system determines that the system has entered a dynamic loop formation state, and stops its function (suicide).

Next, a description will be given with reference to FIG. 2 which is a state transition diagram in the device of the present invention.

When the own system is the main machine, the user selects either the sub machine failure or the self system stop for the occurrence of the event regardless of the state. Note that a blank column indicates that nothing is performed, and a hatched line indicates that the corresponding event cannot occur. That is, the guard timer does not operate in the main engine.

On the other hand, when the own system is the sub-machine, each box means the following.

“Move to watchdog timer interrupt”: Change the status to “watchdog timer interrupt”.

"Guard timer start": Sets the guard timer and sets the status to "guard timer is operating".

“Release during watchdog timer interrupt”: Returns the status to “normal”.

“Guard timer cancel”: Sets the guard timer and returns the state to “normal”.

The matrix shown in FIG. 2 is obtained by changing the partner failure determination conditions of the main unit and the sub unit so that the redundant system does not detect the partner failure due to a failure in the common part such as the inter-system communication path. I have. Specifically, the judgment condition of the main engine failure as seen from the sub-machine is strict when two abnormalities are detected.

For example, if the status is “sub-machine” and the event is “guard timer timeout”, as described above, it is not possible to determine the failure of the main machine only by the health check timeout or inter-system communication status abnormality. It is set and waits for an interrupt from the watchdog timer, but if there is no interrupt, the sub-machine that cannot communicate between systems is not established as a sub-machine of the redundant system, so the self-system is stopped.

[Effects of the Invention] As described above, the present invention is further improved by the combination of the five fault monitoring means of the watchdog timer, the health check means, the loop monitoring means, the inter-system communication state monitoring means, and the line switching device monitoring means. There is an effect that accurate and quick failure monitoring can be realized.

The following is a part of an example in which troubleshooting according to the present invention has become more reliable.

1. The watchdog timer interrupt is issued by sending the next health check data sent to the submachine when the watchdog timer is erroneously notified to the submachine due to the peak processing amount of the main machine or the malfunction of the watchdog timer. Since the middle state is canceled, switching between the main unit and the sub unit does not occur unnecessarily.

2. When the main unit or sub unit enters the loop formation state, it is detected by the loop monitoring task and stopped.
A failure is reliably notified to the partner system, and devices that cannot continue to operate as a system are promptly excluded.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a configuration diagram of software and hardware of the present invention, and FIG. 2 is a matrix showing processing when an event occurs in a main unit and a sub unit. 1: Watchdog timer, 2: Task, 3: PIO, 4: Task, 5:
Fault monitoring main task, 6: first loop monitoring task, 7: second loop monitoring task, 8: loop monitoring flag.

Claims (1)

(57) [Claims] In a communication control apparatus operating in a redundant configuration, each communication control apparatus includes a watchdog timer means for notifying a partner system of a fault in the local system, and a countermeasure that the local system is operating with respect to the partner system. A health check unit for notifying, a loop monitoring unit for monitoring a failure of the local system in the local system, an inter-system communication state monitoring unit for monitoring a state of a communication function between the local system and a partner system,
It has line switching device monitoring means for monitoring the line switching device that switches the line between its own system and the partner system. It notifies the occurrence of abnormalities and the current status of its own system. A redundant control device, which also determines a failure and performs a recovery process.