JPH0588942A - Driving system controller - Google Patents

Abstract

PURPOSE:To more surely protect a driving system controlled by firaware. CONSTITUTION:It is checked whether abnormality occurs in the level of the driving system or not. If abnormality occurs in the level of the driving system, error is decided to perform the protection processing of the driving system; but otherwise, it is checked whether the driving system is operating or not by CNTX. When CNTX is not 0, it is discriminated that the driving system is operating, and CNTX is decremented. When CNTX is 0, the driving system is forcibly turned off. Finally, WDT is restarted. If WDT is not restarted for a certain time, it expires, and a nonmaskable interrupt is generated to perform the protection processing of the driving system.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a drive system controller for program-controlling a drive system.

[0002]

2. Description of the Related Art Conventionally, in this type of drive system control device, most of the drive system protection measures use a protection circuit composed of hardware such as a fuse, and the protection using firmware which is software. As a countermeasure, a watchdog timer (hereinafter referred to as WDT) is used. When a program runaway occurs due to noise or the like and the CPU malfunctions, the WDT times up and a non-maskable interrupt occurs, causing a drive system error. An error process for performing a protection process has been executed. That is, if the program is operating normally, the WDT is restarted before the WDT times out due to an interrupt, and if the program goes out of control and no interrupt occurs for a certain period of time or more, the WDT times out and a non-maskable interrupt occurs. It is supposed to occur.

[0003]

However, in such an apparatus, when an abnormality in the drive system occurs during the occurrence of an abnormal state of the firmware or noise, the WDT times up and a non-maskable interrupt occurs to protect the drive system. However, it takes time until the drive system is actually protected by this error process, and as a result, sufficient protection measures cannot be taken for the drive system.
Therefore, the present invention aims to provide a drive system control device capable of more reliably protecting the drive system. Another object of the present invention is to provide a drive system control device that can more surely detect runaway of firmware and more surely protect the drive system.

[0004]

The invention according to claim 1 is
When the program routine that controls the drive system is functioning normally, it is restarted regularly by an interrupt without timing out, and if the program routine does not function normally due to program runaway, restarting is stopped and the time is up. A watchdog timer is provided,
In the drive system controller that generates a non-maskable interrupt to protect the drive system by the time-out of this timer, the drive system operating counter that sets the value corresponding to the time required for the drive system operation and the watchdog timer A means to be incorporated into the restart interrupt routine to perform a decrement process for the count value of the drive system operating counter when the count value is not zero, and a process to forcibly turn off the drive system when the count value is zero. It is provided.

According to a second aspect of the present invention, a plurality of drive system operating counters for setting the same numerical value corresponding to the time required for the drive system to operate are provided and are incorporated in the restart interrupt routine of the watchdog timer. A program runaway detecting means for comparing the count values of the respective counters and detecting a program runaway and making an error when they do not match is provided.

[0006]

In the present invention having such a structure, the watchdog timer is periodically restarted by an interrupt without time-up when the program routine is functioning normally. However, if the program routine does not function normally due to program runaway, the restart of the watchdog timer is stopped, and the watchdog timer will eventually time out. As a result, a non-maskable interrupt is generated and drive system protection processing is performed.

Further, a numerical value corresponding to the time taken for the drive system to operate is set in the drive system operating counter, and the count value of the counter is judged in the restart interrupt routine of the watchdog timer. When the count value is other than zero, the counter is decremented. When the count value is zero, the drive system is forcibly turned off.

Further, in the present invention, the same numerical value corresponding to the time required for the operation of the drive system is set in the plurality of drive system operating counters, and the count value of each counter is set in the restart interrupt routine of the watchdog timer. Be compared. When the count values of the respective counters do not match, program runaway is detected and error processing is performed.

[0009]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings. In this embodiment, a dot printer to which the present invention is applied will be described.

In FIG. 1, reference numeral 1 is a C which constitutes the main body of the control unit.
PU (Central Processing Unit), 2 is a ROM (Read Only Memory) in which program data for the CPU 1 to control each unit is stored, and 3 is data for various processes performed by the CPU 1 for drive system control. A RAM (random access memory) provided with various memories and counters, 4 is an interface for controlling information communication with an external device such as a host computer, and 5 is an I / O port connected to the drive circuit 6.

When the program routine is functioning normally in the CPU 1, the CPU 1 is periodically restarted by an interrupt without time-up, and when the program routine fails to function normally due to program runaway, the restart is stopped and the time is restarted. A watchdog timer (hereinafter referred to as WDT) 1a that is up and this WDT 1a
There is provided a timer 1b or the like for executing the restart interrupt routine of (1) in a cycle sufficiently shorter than the time-out of the WDT 1a. The RAM 3 is provided with a drive system operating counter (hereinafter referred to as CNTX) 3a in which a numerical value corresponding to the time required for the drive system to operate is set.

The drive system circuit 6 is connected with a feed motor 7 for controlling paper feed, a dot head 8, and a carriage motor 9 for controlling reciprocating movement of a carriage equipped with the dot head 8 along a platen. The drive is controlled by the system circuit 6.

The CPU 1 executes I / O by firmware.
The drive system circuit 6 is controlled through the O port 5 to operate the feed motor 7, the dot head 8 and the carriage motor 9 at a predetermined timing.

Further, the CPU 1 is adapted to periodically execute the restart interrupt routine of the WDT 1a shown in FIG. 2 by the timer 1b. This first checks whether or not the drive system level is abnormal.
This is done by a signal from a sensor provided in the drive system. For example, there is a sensor that detects the temperature of the dot head 8. If there is an abnormality in the drive system level, an error is set and the drive system protection process is performed.

If no abnormality occurs in the level of the drive system, it is subsequently checked whether the drive system is operating. This is checked by checking whether CNTX3a is "0". That is, when the drive system is in operation, CNTX3a contains some count value. If CNTX is not 0, it is determined that the drive system is operating, and CNT is simply
Decrement X3a. That is, count down by one.

If CNTX = 0, the drive system is forcibly turned off. That is, the drive system is forcibly turned off. That is, the output data to the dot head 8 is cleared, the voltage supplied to the drive circuit of the feed motor 7 is cut, and the excitation phase of the carriage motor 9 is turned off. Finally, the WDT 1a is restarted.

The WDT 1a is adapted to time up when a state where no restart is performed is continued for a certain period of time. When the WDT 1a times out, a non-maskable interrupt is generated and drive system protection processing is performed.

In the embodiment having such a configuration, when the firmware runs away and the restart interrupt routine of the WDT 1a cannot be executed, the WDT 1a is not restarted. Up. As a result, a non-maskable interrupt occurs, control is transferred to error processing, etc., and drive system off processing is performed. This protects the drive system.

Even if the firmware runs out of control, WDT1
When the restart interrupt routine of a is executed normally, WDT1a is not timed up.
Therefore, the non-maskable interrupt is not generated due to the time-up of the WDT 1a, and the error processing is not performed.
However, in this case, CNTX3a is decremented each time the restart interrupt routine of WDT1a is executed, and eventually the count value of CNTX3a becomes "0".
When it becomes "0", the drive system is turned off in this restart interruption routine, and the drive system is forcibly turned off and protected.

Further, even if the drive system is turned on due to a sudden factor such as noise while the drive system is stopped, CNT
Since the count value of X3a is "0" and the drive system is forcibly turned off, the drive system does not operate erroneously and the drive system is protected.

In this way, the firmware runs away and the WDT
When the restart interrupt routine of 1a cannot be executed, of course, the firmware is out of control, but the restart interrupt routine of WDT1a is normally executed. Even if the drive system is turned on due to a sudden factor, the drive system can be surely protected, and sufficient protection measures can be taken. Next, another embodiment of the present invention will be described with reference to the drawings. The same parts as those in the above embodiment are designated by the same reference numerals, and detailed description thereof will be omitted.

In this embodiment, two drive system operating counters (hereinafter referred to as CNT1,
It is called CNT2. ) Is provided, and CNT1 and CNT2 are
The same numerical value corresponding to the time taken for the drive system to operate is set.

Then, as shown in FIG. 3, in the restart interrupt routine of the WDT 1a, it is checked whether the count value of CNT1 and the count value of CNT2 match, and if they do not match, a runaway of the firmware is detected. I am making an error. This is because the counter may be destroyed or the RAM 3 may be abnormal due to the runaway of the firmware. Therefore, the occurrence of the runaway of the firmware is detected due to the mismatch of CNT1 and CNT2.

With such a configuration, even if the firmware runs out of control, the runaway of the firmware can be detected in this interrupt routine while the restart interrupt routine of the WDT 1a is being executed, so that the drive system can be immediately protected by an error. Done. Therefore, the drive system can be protected more reliably. Although the above embodiments have described the present invention applied to a dot printer, it is needless to say that the present invention is not limited to this.

[0025]

As described above in detail, according to the present invention, it is possible to provide a drive system control device which can more reliably protect the drive system. Further, the present invention can provide a drive system control device that can more surely detect runaway of firmware and more surely protect the drive system.

[Brief description of drawings]

FIG. 1 is a block diagram showing an embodiment of the present invention.

FIG. 2 is a flowchart showing a restart interrupt process of a drive system operating counter in the embodiment.

FIG. 3 is a flowchart showing a restart interrupt process of a drive system operating counter according to another embodiment of the present invention.

[Explanation of symbols]

1 ... CPU (central processing unit), 1a ... Watchdog timer (WDT), 3a ... Drive system operating counter (CNT)
X), 6 ... Drive system circuit.

Claims (2)

[Claims] 1. When a program routine for controlling a drive system is functioning normally, it is restarted regularly by an interrupt without time-up, and when the program routine fails to function normally due to program runaway, restart is stopped. In the drive system control device that provides a watchdog timer that will be timed out and generates a non-maskable interrupt by the time-out of this timer to protect the drive system, a value corresponding to the time required for the drive system operation is set. It is incorporated in the drive system operating counter and the restart interrupt routine of the watchdog timer. When the count value of the drive system operating counter is other than zero, the counter is decremented, and when the count value is zero. The process of forcibly turning off the drive system A drive system control device comprising means for performing the operation. 2. When the program routine for controlling the drive system is functioning normally, it is periodically restarted by an interrupt without time-up, and when the program routine fails to function normally due to program runaway, restart is stopped. In the drive system control device that provides a watchdog timer that will be timed out and generates a non-maskable interrupt to protect the drive system when this timer runs out, set the same value corresponding to the time required for the drive system to operate. A program runaway detection means incorporated in a plurality of drive system operating counters and a restart interrupt routine of the watchdog timer, compares the count values of the counters, and detects program runaway to generate an error when they do not match. And the watchdog timer restart Incorporated into the automatic interrupt routine, when the count value of each drive system operating counter is other than zero, the same decrement processing is performed on each counter, and when the count value is zero, the drive system is forcibly turned off. A drive system control device comprising a means for performing processing.