Control system job recovery after a malfunction

Description Submit all comments and votes

This invention relates to an electronic control system, and in particular, to full job recovery after a machine power down or after a machine malfunction.

For further information relating to this application, reference is made to the following companion U.S. patent applications filed concurrently herewith to the common assignee U.S. Ser. No. 420,965, Remote Process Crash Recovery; U.S. Ser. No. 420,988, Process Scheduler in an Electronic Control; U.S. Ser. No. 420,991, Distributed Processing Environment Fault Isolation; U.S. Ser. No. 420,992, Common Control in Multiple Processors By Chaining Tasks; U.S. Ser. No. 420,993, Virtual Machine Control; U.S. Ser. No. 420,994, Task Control Manager; U.S. Ser. No. 420,999, Separate Resetting of Processors in a Multiprocessor Control; U.S. Ser. No. 421,006, Filtered Inputs; U.S. Ser. No. 421,007, Multiprocessor Control Synchronization and Instruction Downloading; U.S. Ser. No. 421,008, Microprocessor Memory Map; U.S. Ser. No. 421,009, Changing Portions of Control in a ROM Based System; U.S. Ser. No. 421,010, Race Control Suspension; U.S. Ser. No. 421,011, Control Fault Detection for Machine Recovery and Diagnostics Prior to Malfunction; U.S. Ser. No. 421,016, Single Point Microprocessor Reset; and U.S. Ser. No. 421,615, Control Crash Diagnostics.

Often times in the use of high volume reproduction or printing machines, high volume job requirements cannot be initiated toward the end of the day. This is due to the fact that stopping in the middle of a job run and power shutdown at the end of the day will cause the machine to lose the job status. That is, the machine control will lose the vital information on the portion of the job completed and the portion of the job to be completed. Thus, to start the job up the next morning it is often necessary to start the job from the beginning or to note the portion of a job completed. This is also true during a temporary power outage.

It would be desirable, therefore, to provide a machine control that permits job continuation the following day or whenever desired after a power shutdown in the middle of the job.

As the complexity of electronic control system increases, in particular, multiprocessor control systems, the likelihood of abnormalities and software malfunctions and crashes also increases. Control systems often employ various reset schemes of the various processors to recover from malfunctions. However, in resetting the processors, the processors reinitialize. That is, the contents of various random access memories (RAMs) are destroyed and all outputs turned off. Therefore, if the contents of the RAMs are destroyed, in effect the control is not able to continue from the point of reset because critical machine status information has been destroyed.

It would be desirable, therefore, to provide a complex control system in which recovery from abnormalities and the resetting of the control allows full continuation of the operation of the machine from the point of occurrence of the abnormality.

It is an object of the present invention, therefore, to provide a new and improved control. It is a further object of the present invention to provide a control that permits job continuation after a power down or power interruption in the middle of a job run. It is another object of the present invention to provide a new and improved automatic machine control recovery and, in particular, to provide for the resetting of the various processors in a multiprocessor control without destroying the state of the control at the time of the malfunction or abnormality.

Further advantages of the present invention will become apparent as the following description proceeds, and the features characterizing the invention will be pointed out with particularity in the claims annexed to and forming a part of this specification.

Briefly, the present invention is a multiprocessor control system that allows full job recovery after a machine power down or after a malfunction of software crash. In particular, essential variables such as the state and status of the machine and the programmed job at the time of the malfunction are maintained in nonvolatile memory. This information is continually updated in nonvolatile memory as the job progresses. Once the control system has reset and reinitialized all the control elements after a malfunction, the control restores or downloads all the relevant variables in the nonvolatile memory to the various control elements to restore status. In another embodiment, the essential variables as maintained in RAM locations analogous to nonvolatile memory in a master processor and saved for down-loading to the control elements.

For a better understanding of the present invention, reference may be had to the accompanying drawings wherein the same reference numerals have been applied to like parts and wherein:

FIG. 1 is an elevational view of a reproduction machine typical of the type of machine or process that can be controlled in accordance with the present invention;

FIG. 2 is a block diagram of the control boards for controlling the machine of FIG. 1;

FIG. 3 illustrates some of the basic timing signals used in control of the machine illustrated in FIG. 1;

FIG. 4 is an illustration of the levels of machine recovery and diagnostics upon detection of a software crash;

FIG. 5 is an isometric view of the machine configuration of FIG. 1 showing the control panel and the display control remote panel;

FIG. 6 shows the power up and run time crash counters on each of the control boards in FIG. 2;

FIG. 7 is an illustration of the relationship of addresses and Task Control Buffer data in displaying RAM contents;

FIG. 8 is a schematic for resetting the control boards in a multiprocessor system;

FIG. 9 is a schematic for selective resetting of a particular control board in a multiprocessor system; and

FIGS. 10a-10e show in more detail the resetting as illustrated in FIG. 9.

With reference to FIG. 1, there is shown an electrophotographic printing or reproduction machine employing a belt 10 having a photoconductive surface. Belt 10 moves in the direction of arrow 12 to advance successive portions of the photoconductive surface through various processing stations, starting with a charging station including a corona generating device 14. The corona generating device charges the photoconductive surface to a relatively high substantially uniform potential.

The charged portion of the photoconductive surface is then advanced through an imaging station. At the imaging station, a document handling unit 15 positions an original document 16 facedown over exposure system 17. The exposure system 17 includes lamp 20 illuminating the document 16 positioned on transparent platen 18. The light rays reflected from document 16 are transmitted through lens 22. Lens 22 focuses the light image of original document 16 onto the charged portion of the photoconductive surface of belt 10 to selectively dissipate the charge. This records an electrostatic latent image on the photoconductive surface corresponding to the informational areas contained within the original document.

Platen 18 is mounted movably and arranged to move in the direction of arrows 24 to adjust the magnification of the original document being reproduced. Lens 22 moves in synchronism therewith so as to focus the light image of original document 16 onto the charged portion of the photoconductive surface of belt 10.

Document handling unit 15 sequentially feeds documents from a holding tray, in seriatim, to platen 18. The document handling unit recirculates documents back to the stack supported on the tray. Thereafter, belt 10 advances the electrostatic latent image recorded on the photoconductive surface to a development station.

At the development station a pair of magnetic brush developer rollers 26 and 28 advance a developer material into contact with the electrostatic latent image. The latent image attracts toner particles from the carrier granules of the developer material to form a toner powder image on the photoconductive surface of belt 10.

After the electrostatic latent image recorded on the photoconductive surface of belt 10 is developed, belt 10 advances the toner powder image to the transfer station. At the transfer station a copy sheet is moved into contact with the toner powder image. The transfer station includes a corona generating device 30 which sprays ions onto the backside of the copy sheet. This attracts the toner powder image from the photoconductive surface of belt 10 to the sheet.

The copy sheets are fed from a selected one of trays 34 or 36 to the transfer station. After transfer, conveyor 32 advances the sheet to a fusing station. The fusing station includes a fuser assembly for permanently affixing the transferred powder image to the copy sheet. Preferably, fuser assembly 40 includes a heated fuser roller 42 and backup roller 44 with the sheet passing between fuser roller 42 and backup roller 44 with the powder image contacting fuser roller 42.

After fusing, conveyor 46 transports the sheets to gate 48 which functions as an inverter selector. Depending upon the position of gate 48, the copy sheets will either be deflected into a sheet inverter 50 or