JPH0490033A - Microcomputer circuit - Google Patents

Abstract

PURPOSE:To reset a microcomputer correspondingly to runaway by outputting a reset signal by expiration of a watchdog timer in the case of runaway of the microcomputer. CONSTITUTION:When a restart indication signal is not given to a slave microcomputer 2 (a master microcomputer 1) by runaway of the microcomputer 1 (2), the microcomputer 2 (1) does not give a restart signal to a watchdog timer 4, and the watchdog timer 4 generates the reset signal by expiration. If both of microcomputers 1 and 2 are run away, the microcomputer 1 does not generate the restart indication signal, and the microcomputer 2 does not generate the restart signal, and therefore, the watchdog timer 4 generates the reset signal by expiration. Thus, microcomputers 1 and 2 are reset together by runaway.

Description

[Detailed Description of the Invention] [Industrial Application Field] The present invention relates to a computer circuit consisting of a mask microcomputer and a slave microcomputer, and in particular,
This invention relates to detection of microcomputer runaway in the circuit.

[Conventional technology]

A conventional example of this type of circuit is shown in FIG. In this circuit, a dual port RAM 3 is connected to a mask microcomputer 1 and a slave microcomputer 2. Hereinafter, the microcomputer will be referred to as a CPU. c.
The pui writes data or signals given to the CPU 2 into the RAM 3, and the CPU 2 reads the data or signals from the RAM 3, thereby transferring data or signals from the CPU 2 to the CPU 2. Also, conversely, CPU2
Write the data or signal given to PUI to RAM3, and
When the PUI reads this data or signal from the RAM 3, the data or signal is transferred from the CPU 2 to the CPU 1.

That is, communication between CPUI and CPUZ is performed via RAM3.

A watchdog timer 4 is provided to detect runaway of the CPUs 1 and 2. A reset signal of the CPU I2 for resetting (restarting = retriggering) the watchdog timer 4 is given to the determination circuit 5. The determination circuit 5
While the reset signals from PTJI and PTJ2 arrive within a predetermined time interval, the watchdog timer 4
The watchdog timer 4 is given a reset signal at an interval shorter than the time limit T, so the watchdog timer 4 times out (time limit T).
timing completion). When the CPU 1 or 2 no longer generates a reset signal, or when the reset signal period becomes longer than a predetermined time interval, the determination circuit 5 does not give a reset signal to the watchdog timer 4, or it is delayed, and the watchdog timer 4 Dog timer 4 times out and generates a computer reset signal, which is sent to CPUI and 2.
is applied to the reset input terminal R3T. When the CPUs 1 and 2 receive this reset signal, they return to a state similar to the initial state immediately after the power is turned on, and start re-executing the program from there.

Another conventional circuit is shown in FIG. In this,
The CPU has a watchdog timer 41, and the CPU also has a watchdog timer 41.
A watchdog timer 42 is connected to C2.
PUI and CPU2 each run timer 4. and 4
A reset signal is given to □ at a time interval shorter than their time limits T1 and T2. When the CPUI no longer generates a reset signal, or when the interval between reset signals becomes longer than timer period T1, timer 4. When the time is over, a computer reset signal is generated through the NOR gate 6 and sent to the CPUI and the υ set input terminal R3T of 2.
give to When the CPU 2 no longer generates a reset signal, or when the interval between reset signals becomes longer than the timer time limit T2, the timer 42 times out, and the NOR gate 6
Generates a computer reset signal via the CP
It is applied to the reset input terminal R3T of UI and 2.

In both of the above two conventional examples, CPU 1 or 2
When the timer reset signal is no longer generated due to runaway,
Or, if the generation of the reset signal is delayed, the CPUI and 2
Both are reset together.

In the example shown in FIG. 7, a determination circuit 5 and a watchdog timer 4 are required in addition to the computer to detect a computer runaway, and in the example shown in FIG. 6 is required. Furthermore, each microcomputer requires an input/output port for outputting a timer reset signal.

In order to omit these additional circuits for detecting runaway, the copying machine control device disclosed in Japanese Patent Laid-Open No. 62-91966 transmits a certain command signal from the master CPU to the slave CPU, and the slave CPU receives this signal. The mask CPU determines that the slave CPU is operating normally if there is this response signal, and determines that the slave CPU is abnormal if there is no response signal to the command signal.

In the copy control device disclosed in Japanese Patent Application Laid-Open No. 63-253964, one of the master CPU and slave CPU counts the number of communications between the other CPU, the count value is reset at a predetermined timing, and when the count value exceeds the set value, the corresponding The other is determined to be abnormal.

[Problem to be solved by the invention]

In the above-mentioned conventional examples shown in FIGS. 7 and 8, the judgment circuit 5 is added, one watchdog timer 41, 4□ is connected to each of the CPUIs 2, or a timer reset signal is output. Connecting input/output ports for this purpose increases the number of circuit elements. In particular, if the input/output boat is connected to other devices other than the timer reset signal, such as state detection sensors inside the machine or various loads, the input/output boat may also be connected to the timer reset signal. If a microcomputer is included that does not require an input/output port other than the timer reset signal, it would be wasteful to provide an input/output port exclusively for the timer reset signal.

Although these circuit elements are omitted in the computer circuit disclosed in Japanese Unexamined Patent Publication No. 62-91966, runaway of the master CPU cannot be detected. If you try to do this,
The slave CPU also sends a command signal to the master CPU, and the master CPU returns a response signal to this signal.
The slave CPU may determine that the master CPU is operating normally when there is this response signal, and determine that the master CPU is abnormal when there is no response signal to the command signal. C
For both PUs, the operation for monitoring runaway behavior of the other party becomes complicated. Furthermore, if both of them run out of control, runaway protection becomes impossible.

The computer circuit disclosed in Japanese Patent Application Laid-open No. 63-253964 may also have the same problems as the computer circuit disclosed in Japanese Patent Application Laid-Open No. 62-91966.

An object of the present invention is to detect runaway of one or both of the master CPU and slave CPU and to protect the CPU from runaway by adding relatively simple circuit elements and monitoring the CPU.

[Means to solve the problem]

If the microcomputer circuit of the present invention receives a restart signal (timer reset signal) within a predetermined time period T from the start of the time limit, it will start a new timed operation, and if it does not receive a restart signal (timer reset signal), the predetermined time limit T A watchdog timer (4) that gives a reset signal (computer reset signal) to reset the tube 1 and the second microcomputer (1, 2) described later when the time expires: During normal operation, the second microcomputer described later (2) a first microcomputer (1) that gives a restart signal at time intervals within the predetermined time limit T and resets itself in response to the reset signal (computer reset signal); a controlled mechanism (30); Sensor (1
0) and outputs a control signal to the actuator (11) of the mechanism (30), as well as a signal input for giving a restart signal (timer reset signal) to the watchdog timer (4). output means (9); and, during steady operation, reads the detection signal of the sensor (10) through the signal input/output means (9) and outputs the detection signal to the actuator (1).
1), and upon receiving the restart instruction signal, outputs a restart signal (timer reset signal) to the watchdog timer (4) via the signal input/output means (9), and then resets the watchdog timer (4). A second microcomputer (2) that resets itself in response to a signal (computer reset signal) is provided.

Note that symbols in parentheses indicate corresponding elements in the embodiments shown in the drawings and described later.

[Effect]

During normal operation of both the first microcomputer (1) and the second microcomputer (2), the first microcomputer (1)
) is given a restart instruction signal at time intervals within a predetermined time limit T, and the second microcomputer (2) responds to the restart instruction signal by starting the watchdog timer (4).
Since a restart signal (timer reset signal) is given to the watchdog timer (4), the watchdog timer (4) does not time out and does not give a reset signal (computer reset signal) to the first and second microcomputers (1, 2).

Suppose that the first microcomputer (1) goes out of control and the restart instruction signal is sent to the second microcomputer (2).
), the second microcomputer (
2) does not give a restart signal (timer reset signal) to the watchdog timer (4), which causes the watchdog timer (4) to time out and generate a reset signal (computer reset signal). This reset signal (computer reset signal) is given to the first and second microcomputers (1, 2) to reset them.

If the second microcomputer (2) goes out of control, even if the first microcomputer (1) gives a restart instruction signal, the second microcomputer (2) will send the restart signal (timer reset signal) to the watchdog timer (
4), this allows the watchdog timer (4)
times out and generates a reset signal (computer reset signal). This reset signal (computer reset signal) is applied to the first and second microcomputers (L2) to reset them.

When both the first and second microcomputers (1, 2) run out of control, the first microcomputer (1) does not issue a restart instruction signal, and the second microcomputer (2) does not issue a restart signal (timer). Since the watchdog timer (4) times out and generates a reset signal (computer reset signal). This reset signal (computer reset signal) is transmitted to the first and second microcomputers (L
2) and those computers perform a reset.

Further, the restart signal (timer reset signal) issued by the second microcomputer (2) is the detection signal of the sensor (10) of the mechanism (30) controlled by the first and second microcomputers (L2). input and output a control signal to the actuator (11) of the mechanism (30), that is, it is output via the existing signal input/output means (9), so especially the restart signal (timer reset signal) There is no need to newly provide signal input/output means exclusively for output.

As described above, according to the present invention, one watchdog timer (4) and the first and second microcomputers (1
, 2), both the runaway of the first and second microcomputers (1, 2) and the simultaneous runaway of both are detected, and in response to this runaway, the first and second microcomputers (1, 2) are 2 microcomputers (1, 2)
are reset together.

Other objects and features of the present invention will become apparent from the following description of embodiments with reference to the drawings.

〔Example〕

FIG. 3 shows the configuration of a copying machine incorporating an embodiment of the present invention. This copying machine is equipped with an automatic document feeder (hereinafter referred to as ADF).
20. Copy machine main body 30° Auxiliary paper feed unit 40
and finisher 50 Yosunaru.

The ADF 20 is provided in the copying machine main body 30 so as to be openable and closable, and is connected to the feeding roller 151. The original placed on the original table +60 is fed and ejected using the belt +52, the ejection roller 153, and the like. That is, before the optical scanning of the copying machine main body 30 starts, the uppermost one of the originals placed on the original table 160 is extracted and placed on the contact glass Ill of the copying machine main body 30, and after the optical scanning is finished, Eject the original onto the upper paper ejection table.

The copying machine main body 30 includes an optical system 1101, an image forming system 120. It consists of a paper feed system 130, a paper refeed system 140, and the like.

The optical system 110 includes a contact glass 111 and an exposure lamp 112 arranged below the contact glass 111. first mirror H3a,
Second mirror ++3b, third mirror 113c, fourth mirror 1]3d, fifth mirror 113e, sixth mirror 113f
, a condensing lens 114, a dust-proof glass 115, etc., and the image forming system +20 includes a photosensitive drum 121 and a charger 122 disposed around the photosensitive drum 121. Eraser 123, developer 124. Pre-transfer charger 1269 Separation charger 1279 Separation claw 128. Pre-cleaning static neutralization charger (hereinafter referred to as PCC) 129 and cleaner 128,
It also includes a conveyor belt 12B, a fixing device +2C, etc. arranged downstream of the photoreceptor drum 12+.

The paper feed system 130 includes a manual paper feed table +31a, paper feed power centers 131b, 131c, and the like.

Further, when the auxiliary sheet feeding unit 40 is combined as in the copying machine of the embodiment, it is knitted together. In other words, the paper feed system 130 is a manual paper feed table! 3]a, one sheet of recording paper held by the one selected by the opaque among the recording paper trays H1d and 13]e provided in the paper feed cassettes 131b and 31e and the auxiliary paper feed unit 40 is extracted. In addition, the recording paper trays +31d, +31e and paper feeding power centers 131b, 13]c (however, the manual paper feeding table 131a is shared with the paper feeding cassette 131b) have calling rollers 132a, ! 32b, 132c,
H2d, paper feed rollers 133a, 133b, 133c,
133d, and reversed: Io 134a, 13
4b, 134c, 134d, and registration rollers 135. Guide mylar 136. Equipped with various guides and intermediate rollers.

The paper refeed system 140 has a switching claw +41. Approaching/separating roller 142° Reversing guy 11439 Reversing roller 144. Gate claw 145
゜Intermediate tray 146. Tip roller 147. Paper stopper 148. Call Koro 149. Paper feed roller 14A,
It consists of a reversing roller 14B, a paper discharge roller 14c, and the like.

The finisher 50 includes rollers, paper guides, and a large number of bins, and performs sorting or scooking of recording paper discharged from the copying machine main body 30.

The copying operation will be briefly explained below.

When a document is set on the contact glass 111 by the ADF 20 and a start instruction is given, the paper feed clutch is turned on and the call roller of the paper feed tray selected at that time feeds the recording paper to the paper feed roller. Since the paper feed rollers rotate in the opposite direction, double feeding is prevented and only the topmost sheet of recording paper is sent toward the registration rollers 135.

During this time, the optical system 110 scans the document on the contact glass 111, and reflects light from the document illuminated by the exposure lamp 112 to the first mirror 113a and the second mirror ++3b.

Third mirror] 13c, condenser lens 114. 4th Mira 11
3d, fifth mirror 113e, sixth mirror +13f
The light is guided to the photosensitive surface of the photosensitive drum 121 via the anti-luminosity glass 115.

The photosensitive drum 121 is rotating clockwise in the drawing.
The photosensitive surface is uniformly charged by a charger 122 before receiving the reflected light of the original from the optical system 110, and a latent image area is formed by neutralization by an eraser 123. Therefore, when this latent image area is irradiated with light reflected from the original, photoelectric grooves are generated depending on the intensity of the light, and an electrostatic latent image is formed.

This electrostatic latent image is developed by a developing device +24, and becomes a toner image with toner attached thereto according to the density of the document. This toner image is transferred to the recording paper fed out from the registration roller 135, but in order to facilitate the transfer, PTL
125, electricity is removed before transfer.

The recording paper fed out by the registration roller 135 is brought into close contact with the photosensitive surface of the photosensitive drum 12 by a guide Mylar 136, and the toner image is transferred directly above the transfer charger 126. Immediately after this, the recording paper is separated from the photosensitive surface by the separation charger 127, but if the separation is insufficient at this time, it is forcibly separated by the separation claw 12g.

After the recording paper is separated, residual toner is removed from the photosensitive surface of the photosensitive drum 121 by a cleaner 12A, and the recording paper is sent to a fixing device 12C by a conveyor belt 12B.

The fixing device 12C includes a fixing roller 12Ca and a pressure roller 12Cb, and heats the recording paper onto which the toner image has been transferred while applying pressure (approximately 185° C.) to fix the toner image.

The recording paper on which the toner image has been fixed is delivered to a paper refeed system 140. The paper refeeding system 140 guides the recording paper to the paper ejection roller 14C by the action of the switching claw 141 when copying the first side in duplex mode, but guides the recording paper to the reversing guide 143 when copying the first side in duplex mode. lead.

After that, when the trailing edge of the recording paper passes through the switching pawl 141, the switching pawl 141 is switched, the contact/separation roller 142 is brought into contact, and the recording paper is sent to the reversing roller 144, which in turn sends it to the gate pawl 145. .

There are four gate claws 145, and when the gate claws corresponding to the size of the recording paper are opened, the recording paper is discharged into the intermediate tray 146. The recording sheets that have fallen onto the intermediate tray 146 are brought together by a leading edge shifting roller 147 until they come into contact with a vapor stopper 148, and their leading edges are aligned and stocked.

When copying the second side of the recording paper stocked in the intermediate tray 146 is started in the duplex mode, the uppermost one of the recording papers is sent to the registration rollers 135 by the paper feed roller 14A and the reversing roller 14B by the calling roller 149.

Note that in the cover creation mode in which front and back covers are attached to each copy and in the front-only cover creation mode in which only the front cover is attached, blank recording paper is passed from the copying machine main body 30 to the finisher 50 at the time of cover creation.

In the finisher 50, the recording sheets sent from the paper discharge roller 14e are sorted line by line when the sort mode is selected, and are sorted page by page when the stack mode is selected.

Note that when detecting the toner concentration of the developing device 124,
Prior to forming a toner image of the original, the contact glass I
A toner image of a standard pattern is formed ahead of I+, and its density is read by a P sensor PSH provided downstream of the developing device 124.

FIG. 4 shows the appearance of an operation and display board 60 provided in this copying machine. Numeric (10) key 61 for setting the number of copies. Also clear key 62. Start key 63 for copy start. Mode clear key 64 to initialize various modes. Enter key 659 to be pressed for recognition when inputting numerical values in special mode, interrupt key 66 to set and cancel interrupt mode, and mode selection keys to select various other modes (paper selection, scaling, image density, etc.) 67.

The display section 68 is composed of a liquid crystal display (LCD), and includes a fixed button (display) section 69 that displays the mode status such as the number of copies, and a character (dot) display section 7 that can display text.
0 and 0.

FIG. 1 shows an outline of the electric circuit configuration of the copying machine shown in FIG. 3. In this electrical circuit, the control circuit consists of two microcomputers, namely master CPUI and slave CPU
It is composed mainly of PU2. The master CPU performs system control of the copier, such as man/machine interface, copy mode management, and copy sequence settings through the operation panel.
U2 executes so-called mechanism control, such as executing sequences instructed by the mask CPUI and controlling the copying process.

The master CPUI and slave CPU2 are connected via a dual port RAM3 as a communication means. When the mask CPUI gives data or a signal to the slave CPU2, it writes it to the RAM3 and sends it to the slave CPU2.
reads it from RAM3. When the slave CPU 2 gives data or signals to the master CPUI, it writes it to the RAM 3, and the mask CPUI reads it.

The master CPUI and slave CPU 2 are equipped with a read-only memory ROM, a read/write memory RAM, and a timer.

The mask CPU 1 is connected to an operation and display board 60 and an ADF 20 . Auxiliary paper feed unit 40. External devices such as a finisher 50 are connected. The operation & display board 60 is a key human power control unit 6
8b, the signal is transferred to the master CPUI via the serial 110 port, and the control signal from the master CPUI is transferred to the control unit 68b via the serial 11 port, and further transferred to the display unit 6 via the LCD driver 68a.
0 is displayed.

The slave CPU 2 is connected to A/D input sensors 8, such as a sensor PSN, a fixing thermistor, a drum thermistor, a light amount sensor, and a potential sensor, which are related to execution of the copying process, through an A/D converter. Further, sensors 10 related to the execution of the copying process and actuators, that is, various AC/DC loads 11 related to the execution of the copying process are connected via the parallel 11 and the bottom 9. Typical sensors 10 include a timing pulse generator that generates pulses synchronized with the rotation of the main motor that drives the photoreceptor drum +21, and a registration roller 1.
These include a registration sensor that detects recording paper near 35, a paper size sensor, a paper presence/absence sensor, a paper discharge sensor, etc. provided in the paper feed system 30.

In addition, a typical load of 0 is the photoreceptor drum 12+
various AC loads such as the main motor that drives the developing device 124, the conveyance fan motor, and the cooling fan motor, and a clutch for controlling the registration rollers.

Clutch for paper feed roller control, solenoid for separation claw control, eraser +23. These are DC loads such as talk counters, toner replenishment control solenoids, and cleaning blade control solenoids.

Furthermore, a watchdog timer 4 is connected to the slave CPtJ2 via a parallel 110 port 9, and the slave CPU2 outputs a timer reset signal to the watchdog timer 4 via an output port.

Watchdog timer 4 computer reset 1- (
The CPU reset) signal is the master CPUI.

Both slave CPUs 2 are connected to the reset input terminal R3T, and when the watchdog timer 4 times out, a computer reset signal is applied to the master CPU 2 and the slave CPU 2, causing a reset.

As shown in FIG. 2, when the interval of the timer reset signal Tm exceeds a predetermined time limit T, that is, when the time has elapsed without being restarted (reset), the watchdog timer 4 outputs a computer reset signal (low level) with a predetermined pulse width. Level L) is output.

When the slave CPU 2 and the master CPU are both in normal operation, the slave CPU 2 executes the timer reset signal output process at intervals shorter than the predetermined time limit T, so the watchdog timer 4 is reset (reset) before the time expires. start) and does not generate a computer reset signal.

If the program that outputs the timer reset signal is no longer executed due to runaway of the master CPU and/or slave CPU 2, the timer reset signal will no longer be generated.
Watchdog timer 4 times out and outputs a computer reset signal to reset master CPIJI and slave CPU 2.

In this embodiment, the master CPU writes a predetermined signal for runaway monitoring to the dual port RAM 3 at a fixed period Ts shorter than the time limit T of the watchdog timer 4.
The slave CPU 2 monitors the presence or absence of this predetermined signal according to the monitoring program. In other words, the slave CPU2 is
At a predetermined timing, read the address of the dual port RAM 3 where the predetermined signal is written, check the presence or absence of the predetermined signal, and if it is interrupted for a predetermined time or more, the master CP
It is determined that the UI has gone out of control.

After determining that the master CPU is out of control, the slave CPU2
In order to stop the runaway, the computer re-cents.

For this purpose, it is sufficient to cause the watchdog timer 4 to time out. Therefore, the slave CPU 2 stops outputting the timer reset signal. In this example, the master CPU
At this time, I executes a HALT process to stop the braking operation of the master CPU, stores control information for restarting control in the memory, and prepares for restarting control after the computer is reset.

FIG. 5a shows an outline of the control operation of the slave CPU 2. The slave CPU 2 is started by a power-on reset (step 1: the word "step" is omitted in parentheses below), sets the signals to be output during standby on the output port, and sets internal registers, timers, flags, etc. to those during standby. (3).

Note that the watchdog timer 4 is also started by power-on reset. The slave CPU 2 reads the data at the address TMM for runaway monitoring in the RAM 3 (4), and checks whether it is an instruction to reset the timer (timer reset instruction signal).5) The TMM instructs the timer reset. Wait for the signal (4, 5). TMM
When becomes the timer reset instruction signal, the timer starts timing.6)
, outputs a timer reset signal to the watchdog timer 4 (7), and erases the timer reset instruction signal of the TMM (8). Then, it waits for TMM to become a timer reset instruction signal (9, 10). When the timer reset instruction signal is received, the slave CPU 2 writes the time count value Tm to the monitoring cycle register Tm (11), starts an internal timer Tm that sets a time limit for the time count value Tm (
12) Give a reset signal to the watchdog timer 4 and erase the TMM timer reset instruction signal 13)
, enable internal timer interrupts (14).

The above-mentioned time count value (contents of monitoring period register Tm) Tm for executing the copy process control program is T
If it is the detected value of s and the master CPU 1 is operating normally, it is the cycle T for writing the reset instruction signal to the RAM 3.
This value is substantially equal to s. If T has elapsed (that is, the master CPU has not generated a reset instruction signal at the regular cycle Ts since the power-on reset) until the detection of the cycle Ts is finished (4 to 11), the watchdog timer 4 times out, the mask CPUI and slave CPU2 are reset, and the slave CPU
2 returns to initialization (3), the master CPU 2 also returns to initialization (33 in Figure 6a, which will be described later), and the slave CPU 2
The period Ts is detected again. The same applies when the reset signal is not given to the watchdog timer 4 due to runaway of the slave CPU 2.

Note that in this embodiment, the slave CPU 2 detects the period Ts as described above, but this period detection is omitted and
Even if the master CPU 2 writes the timer recent instruction signal to the RAM 3, the slave CPU 2 starts the internal timer Ts, enables timer interrupts, and also gives the watchdog timer 4 the t sort signal. good. That is, steps 6 to 11 in FIG. 5a may be omitted, and the internal timer time limit (T m in step 12) may be set to Ts.

Returning to the explanation of the embodiment with reference to FIG. 5a again, the slave CPU 2 starts the internal timer Tm13).
Enable internal timer interrupts 14), copy control (15)
However, when the internal timer Tm times out, it executes the "timer interrupt processing J (20)" shown in FIG. 21), clear the read count N22), and dual port RAM3
The TMM data is read (23) and it is checked whether it is a timer recent instruction signal (24). If it is a timer recent instruction signal, a timer reset signal is given to the watchdog timer 4 (25), and the TMM of RAM3 is
The timer reset instruction signal is erased (26), and the process returns to the main routine (15 in FIG. 5a). dual port R
When reading the TMM data of AM3 (23) and checking whether it is a timer reset instruction signal (24)
), if there is no timer reset instruction signal, in this embodiment, it is checked whether the number of readings N has become 2, and if it has not become 2, the TMM data in RAM 3 is read again, and it is determined as the timer reset instruction signal. (23.24).

If there is no timer recent instruction signal in Uni, set N to 1.
Increment 27), where N becomes 2, so
This is detected in step 28, and all interrupts are prohibited (29
), and sets flag F to 1 (30).

That is, in this embodiment, if the first time the TMM data is read and the signal is not a timer reset signal, then another TMM data read is performed, and if there is still no timer reset signal, the slave CPU 2 issues a watchdog signal. No reset signal is given to timer 4, and master C
Flag F is set to 1 so that the PUI executes a halt (HALT) process, which will be described later.

Therefore, when the time T-Tm passes in this state, the watchdog timer 4 times out and generates a computer reset signal, thereby resetting both the master CPU I and the slave CPU 2.

FIG. 6a shows an overview of the control operation of the master CPUI.

The master CPU is activated by a power-on reset (31), sets the signal to be output to the output port during standby, and outputs the signal to the internal register and timer.

The flag etc. are set for standby (33), and an internal timer T with a time limit Ts shorter than the time limit T of the watchdog timer 4 is set.
s is started (34a). And allow interrupts 3
4b) Execute the copy control main program (35)
. Thereafter, in step 36, it is checked whether flag F (30 in Figure 5b) is set to 1, and unless it is set to 1, the copy control main program is executed (35).
.

If the internal timer Ts times out during this period, the 6b
Execute timer interrupt processing J (40) shown in the figure.

That is, first, in order to time the next time limit Ts, the internal timer Ts is restarted 1-L, (41,), and a timer reset signal is written to the TMM of the dual port RAM 3 (
42), returning to the main routine (35 in Figure 6a). Referring again to FIG. 6a, flag F is set to 1 in step 36.
, the master CPUI writes information for restarting the copy control program to RAM3 (37).
, performs copy stop processing and sets stop information (HALT) (38). After that, when the watchdog timer 4 times out and generates a computer reset signal, which resets the master CPUI, the master CPUI
Since the master CPU is powered on and has stop information (HALT) (32), in this reset, the master CPUI reads the program restart information and resumes copy control based on this (39).

In the above embodiment, the master CPU writes the timer reset instruction signal to the TMM of the RAM 3 at regular intervals Ts in order to transmit the timer reset instruction signal to the slave CPU 2.
PUI outputs a timer reset instruction signal at irregular intervals (maximum value is TI) shorter than time limit T of watchdog timer 4.
After writing to the TMM of AM3, the slave CPU 2 sends a timer reset signal to the watchdog timer 4, and after a fixed time period T2 that is longer than T1 and shorter than T, that is, at a fixed period T2, reads the data in the TMM and resets the timer. If it is a signal, a timer reset signal may be sent to the watchdog timer 4.

〔Effect of the invention〕

As described above, according to the present invention, one watchdog timer (4) and the first and second microcomputers (1
, 2), if one of the first and second microcomputers (1, 2) goes out of control, or if both go out of control at the same time, they are automatically detected. A reset is applied to the computer. The number of circuit elements is relatively reduced, and the reliability of runaway protection is increased.

[Brief explanation of drawings]

FIG. 1 is a block diagram showing the configuration of an embodiment of the present invention. FIG. 2 is a time chart showing the relationship between the reset signal applied to the watchdog timer 4 shown in FIG. 1 and the computer reset signal generated by the watchdog timer 4. FIG. 3 is a side view showing a schematic configuration of a copying machine incorporating the configuration circuit shown in FIG. 1. FIG. FIG. 4 is a plan view schematically showing the operation and display board 60 provided in the copying machine shown in FIG. FIGS. 5a and 5b are flowcharts showing the control operation of the slave microcomputer 2 shown in FIG. 1. 6a and 6b are flowcharts showing the control operation of the mask microcomputer 1 shown in FIG. 1. FIG. FIGS. 7 and 8 are block diagrams showing an outline of the configuration of a conventional microcomputer circuit. 1: Mask microcomputer (1st microcomputer) 2 Nislep microcomputer (2nd microcomputer) 3: Dual baud) RAM 4: Watchdog timer (watchtong timer) 5
: Judgment circuit 6: Noah gate 8: A/D
Input sensors 9: Parallel I10 boat (signal input/output means) lO: Sensors (sensor) 11: Load (actuator') 20: ADF3
0: Copying machine main body (controlled mechanism) 40 Auxiliary paper feed unit 5
0: Finisher 60 operation & display board 11
0' Optical system 120: Imaging system 130: Paper feeding system 140° Paper refeeding system Fig. 2 Fig. 5b ^-r Fig. fip r Funeral b Fig.

Claims (1)

[Claims] If a restart signal is received within a predetermined time period T from the start of the time limit, the timed operation will start anew, and if the restart signal is not received, the time will expire within the predetermined time period T. and a watchdog timer that gives a reset signal to the second microcomputer; gives a restart instruction signal to the second microcomputer described later at time intervals within the predetermined time limit T during normal operation, and resets itself in response to the reset signal. a first microcomputer; a signal input/output means for inputting a detection signal of a sensor of a controlled mechanism and outputting a control signal to an actuator of the mechanism; and a signal input/output means for providing a restart signal to the watchdog timer; During normal operation, the detection signal of the sensor is read through the signal input/output means and a control signal is output to the actuator, and when the restart instruction signal is received, the restart signal is sent to the watchdog timer through the signal input/output means. a second microcomputer that resets itself in response to the reset signal;