CA1213309A - Software crash diagnostic strategy and ram display - Google Patents

Abstract

ABSTRACT OF THE DISCLOSURE
The present invention is a pair of counters associated with the control elements in a complex control system, in particular, counters asso-ciated with the intelligent processors in a multiprocessor control. Preferably, the counters are maintained in nonvolatile memory and one of the counters for each remote records software crashes experienced in both standby and run mode. The other counter records total software crashes during normal machine operation. These counters provide information on the location and type of software crashes.
In another aspect of the invention, a procedure is provided for the Tech Rep to force the machine into a software crash. The Tech Rep can then interrogate the content of RAM locations before the RAM locations are initialized by the machine reset. The contents of various RAM locations can be selectively displayed for diagnosis.

Description

~ ~ 1 30~ ~

CONTROL CRASH DIAGNOSTIC STRATEGY AND RAM DISPLAY

The invention relates to a multiprocessor electronic control, and i particular, to software crash diagnostic strategy in a multiprocessor control and also the display of the contents of RAM locations for di~gnostic purposes.
In a complex electronic control system, there is a large number of software problems that can csuse the control system to temporarily malfunc-tion. The name typically given to this class of problems is a software "crash".
Usually it is not obvious why the system initially crashed because the problem does not seem to reoccur after initialization. Also, it is very difficult to tell 10 what portion of the control system malfunctioned since the whole system is generally initialized or reset. ~ince tne problem oftens occurs at long and random intervals, the service representative is usually not at the m~chine at the time of the problem.
It would be desirable, therefore, to provide an electronic control 15 system that remembers software crash information and to be able to save this information for diagnostic purposes.
A control system software crash means that the system is not functioning correctly arld that the system must be reset and RAMs reinitia-lized before operation can be resumed. However7 various RAM locations often ~Z~3~9 contain information valuable for diagnostics. During reset, this information is lost.
It would be desirable, therefore, if the system had the means to prevent the destruction of the contents of RAM locations.
It would also be desirable to be able to read out or display the contents of these RAM locations before reset and reinitialization after a software crashO
It is an object of an aspect of the present invention, therefore, to provide a new and improved control system, in particular, a control system that can save transient information, in particular, lnformation on software crashes. It is an object of an aspect of the present invention to provide a control that can provide a history of crash lnformation that relates to portions of the control in which the crash occurred. It is an object of an aspect of the present invention, therefore, to provide a new and improved control system to prevent the destruction of the contents of RAM locations and to be able to display the contents of RAM
locations having valuable diagnostic information before the reset of the system after a software crash.
Further advantages of the present invention will become apparent as the following description proceeds, and the features characterizing the invention will be pointed out with particularity in the claims annexed to and forming a part of this specification.
Briefly, the present invention in one aspect is a pair of counters associated with the control elements in a complex control system, in particular, counters associated with the intelligent processors in a multiprocessor control. Preferably, the counters are maintained in nonvolatile memory and one of the counters for each remote records software crashes experienced in both standby and run mode. me other counter records total software crashes during normal machine operation. These counters provide information on the location and type of software crashes.
In another aspect of the invention, a procedure is provided for the Tech Rep to force the machine into a software crash display routine if there is a crash. m e Tech Rep can then interrogate the content of RAM locations before the RAM locations are initialized by the machine reset. The contents of various RAM
locations can be selectively displayed for diagnosis.
; . ~

~Z133~9 -2a-Other aspRcts of ~is Lnvention are as follo-~s:
In a reproduction machine having a plurality of operating stations and a plurality of control devices for controlling the operation of theoperating stations, each of the control devices having an associated counter 5 for storing indications of the operation of each of the control devices, the method of monitoring the operation of the control devices including the steps of storing an indication of the status of each of the control devices in the associated counter; and determining the status of a selected one of the control devices in response to the information status stored in the associated counter.
In a multiprocessor machine control having a plurality OI
RAM locations corresponding to the processors, said RAM locations being reset during operation of the machine, a diagnostic Tnethod including the steps of a) maintaining status information in the RAM location corre-sponding to one of the processors, b) entering a diagnostic mode, and c) accessing the contents of said ~AM locations prior to reset of said one of the processors.
A control for a system having a plurality of system operating components, said operating components cooperating with one another to produce a result, said control comprising:
a plurality of control devices for controlling the operation of the operating components, each of the control devices controlling a portion of the operating components and having an associated counter for storing indications of the operation of the associated control device, each of the counters including a r~m segment for maintaining indications of operation of the associated control device during system run, and a standby segment for maintaining indications of operation of the control device during system standby, circuitry for storing said indications of operation of each of the control devices in the associated counter; and a display for presenting the operation status of a selected one of the control devices in response to the indications of operaticn stored in the run and standby segments of the associated counter whereby the operation of the control can be diagnosed.

~2~3~9 -2b In a system having a plurality of operating elements, a control comprising a plurality of processors for controlling the operation of the operating elements, each of the processors controlling a portion of the 5 operating elements and having an associated non volatile memory for storing indications of the operation of the associated processor, circuitry for storing an indication of the status of each of the processors in the associated non-volatile memory, and a display for presenting the status of a selected one of the 10 processors in response to the information status stored in the associated memory whereby the operation of the control system can be diagnosed.
In a machine having a plurality of operating stations, and a control having a plurality of processors, each of the processors for controllingthe operation of a portion of the operating stations~ each of the processors 15 having an associated storage for storing indications of the operation of the associated processor and a display for presenting the contents of the storage, each associated storage having a first portion and a second portion, the method of monitorin~ the operation of the machine including the steps of storing an indication of the status of each of the processors in the 20 first portion of the associated storage during machine standby;
storing an indication of the status of each of the processors in the second portion of the associated during maehine run, and determining the status of a selected one of the control devices in response to the information status stored in the associated storage whereby the machine operating ststus 25 can be determined.
For a better understanding of the present invention, reference may be had to the accompanying drawings wherein the same reference numerals have been applied to like parts and wherein:

, - .

Figure l is an elevational view of a reproduction machine typical of the type of machine or proeess that can be controlled in accordance with the present invention;
Figure 2 is a block d;agram of the eontrol boards for controlling 5 the machine of Figure l;
Figure 3 illustrates some of the basic timing signals used in control of the machine illustrated in Figure l;
Figure 4 is an illustration of the levels of machine recovery and diagnostics upon detection of a softiNare crash;
10Figure 5 i3 an isometric view of the machine configuration of Figure 1 showing the control panel and the display control remote panel;
Figure 6 shows the power up and run time crash counters on each of the control boards in ~igure 2;
Figure 7 is an illustration of the relationship of addresses and Task 15Control Buffer data in displaying RAM contents;
Figure 8 is a schematic for resetting the control boards in a multiprocessor system;
Figure 9 is a schematic for selective resetting of a particular control board in a multiprocessor system; and 20Figures lOa - lOe show in more detail the resetting as illustrated in Figure 9.
With reference to Figure 1, there is shown an electrophotographic 2rinting or reproduction machine employing a belt 10 'naving a photoconductive surface. Belt 10 moves in the direction of arrow 12 to advance successive 25portions of the photoconductive surface through various processing stations, starting with a charging station including a corona ~enerating device 14. The corona generating device charges the photoeonductive surface to a relatively high substantially uniform potential.
The charged portion of the photoconductive surface is then 30advanced through an imaging station. At the irnaging station, a document handling unit 15 positions an original document 16 facedown over exposure system 17. The exposure system 17 includes lamp 20 illuminating the document 16 positioned on transparent platen 18. The light rays reflected from document 16 are transmitted through lens 22. Lens 22 focuses the light image of original 35document 16 onto the charged portion of the photoconductive surface of belt 10to selectively d;ssipate the charge. This records an electrostatic latent image L3d ~

on the photoconductive surface corresponding to the informational areas contained within the original document.
Platen 18 is mounted movably and arranged to move in the direction of arrows 24 to adjust the magnification of the original document 5 being reproduced. Lens 22 moves in synchronis~n therewith so as to focus the light image of original document 16 onto l:he charged portion of the photocon-ductive surface of belt 10.
Document handling unit 15 se~uentially feeds documents from a holding tray, in seriatim9 to platen 18. The document handling unit recir-culates documents back to the stack supported on the tray. Thereafter, belt 10 advances the electrostatic latent ilnage reeorded on tne photoconductive surface to a development station.
At the development station a pair of magnetic brush developer rollers 26 and 28 advance a developer material into contact with the electrostatic latent image. The latent image attracts toner particles from the carrier granules of the developer material to form a toner powder image on the photoconductive surface of belt 10.
After the electrostatie latent image recorded on the photocon-ductive surface of belt 10 is developed, belt 10 advances the toner powder image to the transfer station. At the transfer station a copy sheet is Inoved into contact with the toner powder image. The transfer station includes a corona generating device 30 which sprays ions onto the backside of the copy sheet. This attracts the toner powder image from the photoconductive surface of belt 10 to the sheet.
The copy sheets are fed from a selected one of trays 34 or 36 to the transfer station. After transfer, conveyor 32 advances the sheet to a fusing station. The fusing station includes a fuser assembly for permanently affixing the transferred powder image to the copy sheet. Preferably, fuser assembly 40 includes a heated fuser roller 42 and backup roller 44 with the sheet passing between fuser roller 4~ and backup roller 44 with the powder image contacting fuser roller 42.
After fusing, conveyor 4~ transports the sheets to gate 48 which functions as an inverter selector. Depending upon the position of gate 48, the copy sheets will either be deflected into a sheet inverter 50 or bypass sheet inverter 50 and be fed directly onto a second gate 52. Decision gate 52 deflects the sheet directly into an output tray 54 or deflects the sheet into a ~3~

transport path which carries the,n on without inversion to a third gate 56.
Gate 56 either passes the sheets directly on without inversion into the output path of the copier, or deflects lhe sheets into a duple~ inverter roll transport58. Inverting transport 58 inverts and stacks the sheets to be duplexed in a duplex tray 60. Duplex tray 6û provides intermediate or buffer storage for those sheets which have been printed on one side for printing on the opposite side.
In order to complete duplex copying, the previously simplexed sheets in tray 60 are fed seriatim by bottom feeder 62 back to the transfer station for transfer of the toner powder image to the opposed side of the sheet. Conveyers 64 and 66 advance the sheet along a path which produces a sheet inversion. The duplex sheets are then fed through the same path as the previously simplexed sheets to be stacked in tray 54 for subsequent removal by the printing machine operator.
Invariably after the copy sheet is separated from the photocon-ductive surface of belt 10, some residual particles remain adhering to belt 10.
These residual particles are removed from the photoconductive surface thereof at a cleaning station. The cleaning station includes a rotatably mounted brush 68 in contact with the photoconductive surface of belt 10.
A controller 38 and control panel 86 are also illustrated in Figure 1.
The controller 38 as represented by dotted lines is electricaUy connected to various components of the printing machine.
With reference to Figure 2, there is shown in further detail the controller 38 illustrated in Figure 1. In particular, there is shown a Central Processing Master (CPM) control board 70 for communicating information to and from all the other control boards, in particular tlle Paper ~Iandling ~emote(PHR) control board 72 controlling the operation of the paper handling subsystems such as paper reed, registration and output transports.
Other control boards are the Xerographic Remote (XER) control board 74 for monitoring and controlling the xerographic process, in particular the analog signals, the Marking and Imaging Remote (MIR) control board 76 for controlling the operation of the optics and xerographic subsystems, in parti-eular the digital signals. A Display Control Remote (DCR) control board 78 is also conneeted to the CPM control board 70 providing operation and d;agnostic information on both an alphanumeric and liquid crystal display. Inter-connecting the control boards is a shared communicfltion line 80, preferably a 3;~9 ~, shielded coaxial cable or twisted pair with suitable communication protocol similar to that used in a Xerox Ethernet~ type communication system.
Other control boards can be interconnected to the shared com-munication line 80 as required. For e2cample, a Recirculating Document 5 Handling Remote (RDHR) control board 82 (Shown in phantom) can be provided to control the operation of a recirculating document handler. There can also be provided a not shown Semi-Automatic Document ~andler Remote (SADHR) control board to control the operation of a semi-automatic document handler, one or more not shown Sorter Output Remote (SOR) control boards to control 10 the operation of one or more sorters, and a not shown Finisher Output Remote (FOR) control board to control the operation of a stacker and stitcher.
Each of the controller boards prefer~bly includes an Intel 8085 microprocessor with suitable Random Access Memory (RAM) and Read Only Memory (ROM~. Also interconnected to the CP~q control board is a Master - 15 Memory Board (MMB) 84 with suitable ROMs to control normal machine operation and a control panel board 86 for entering job selections and diagnostic programs. Also contained in the CPM board 70 is suitable nonvolatile memory. All of the control boards other than the CPM control board are generally referred to as remote control boards.
In a preferred embodiment, the control panel board 86 is directly connected to the CPM control board 70 over a 70 line wire and the memory board 84 is connected to the CPM control board 70 over a 36 line wire.
Preferably, the Master Memory Board 84 contains 56K byte memory and the CPM control board 70 includes 2K ROM, 6K RAM, and a ~12 byte nonvolatile 25 memory. The PHR control board 72 includes lK RAM and 4K ROM and handles 29 inputs and 28 outputs. The XER control board 74 handles up to 24 analog inputs and provides 12 analog output signals and 8 digital output signals and includes 4K ROM and iK RAM. The MIR board 76 handles 13 inputs and 17 outputs ~nd has 4K ROM and lK RAM.
As illustrated, the PHR, XER and MIR boards receive various switch and sensor information ~rom the printing machine and provide various drive and activation signals, such as to clutches, ~notors and lamps in the 3~

operatior. of the printing machine. It should be undcrstood that the control of various types of machines and processes are contemplated within the scope of this invention.
A master timing signal9 called the timing reset or Pitch Reset ~PR) 5 signal, as shown in Figure 2, is generatecl by P~IR board 72 and used by the CPM, PHR, MIR and ~ER control boards 70, 72, 74 and 76. With reference to Figure 3, the Pitch Reset (PR) signal i5 generated in response to a sensed registration finger. Two registration fingers 90a, 90b on conveyor or registra-tion transport 66 activate a not shown suitable sensor to produce the 10 registration finger or pitch reset signal. The registration finger or pitch reset signal is conveyed to suitable control logic on the Paper lHandler Remote control board 72. In addition, a Machine Clock signal (~CLK) is conveyed to the Paper Handling Remote 72 via the CPM remote board 70 to the same control logic.
In response to the MCLK signal, the timing reset pitch reset signal is conveyed to the CP~I board 70 and the ~ER and the MIR remotes 74, 76.
The machine clock signal is generated tty a timing disk 92 or machine clock sensor connected to the rnain drive of the machine. The clock sensor signal allows the remote control boards to receive actual machine speed timing 20 information.
The timing disk 92 rotation generates 1,000 machine clock pulses every second. A registration finger sensed signal occurs once for every registration finger sensed signal as shown in Figure 3. A belt hole pulse is also provided to synchronize the seam on the photoreceptor belt lO with the 2S transfer station to assure that images are not projected onto the seam of the photoreceptor belt.
In any complex control system, there is always a large number of machine problems, either software or hardware, that can cause the control system to temporarily malfunction. The name typically given to this class of 30 problems, which requires the system to be reset, is the term "crash". IJsually, it is not obvious why the control system malfunctioned or crashed because the problem does not seem to reoccur after the system has been reset or initialized.
However, in accordance with one feature of the present invention, 35 by careful investigation of the types of failures that occur in a tested system causing malfunctions, in particular crashes, it is possible to develop a list of key operations to be monitored. The monitoring of these key operations can indicate either an immediate problem or a condition that would lead to a severe control problem. It is possible to check a sufficient nu~ber of these key operations and yet maintain systern performance and adequate machine or 5 process control. Appendix A is a sample list of key performance parameters which can be monitored.
As an extreme case of the type of software malfunction to be avoided, assume that the command to "turn off fuser" is garbled, lost or never executed. There is then a real danger of stressing the operation of the fuser 10 with possible severe machine malfunction. Various benchmarks to monitor to be able to avoid this type of control failure are available.
For example, these benchmarks include monitoring that the number of tasks or procedures to be completed by the control system is not beyond the capacity of the control system to respond. Another benchmark would be to 15 determine that the communication system has more than the expected number of requests to be made and would be forced to drop or ignore further reguests.
In general, any complex control system has numerous li mits. When these limits are exceeded either because of a malfunction, software error, or because of the nondeterministic nature of real time control, the control 20 system is in danger of erroneous operation. In prior systems, one of the following actions happen:
1) Tables were prematurely overwritten causing information to be lost, thus causing erroneous operation of the control system.

2) Requests were delayed until the table information had caught 25 up. An example of this is a magnetic tape drive controller. Since this is typicaUy a noncritical application, all write requests can be suspended almost indefinitely. In a real time control system, most events must be performed within a specific time window or misoperation will result. Indefinite sus-pension of operations obviously jeopardizes the timely completion of some 30 operations.
In accordance with another feature of the present invention, once a fault has been detected, the recognition of the fault can provide valuable control information. With reference to the diagram illustrated in Figure 4, here is illustrated the response to a fault detection. Fault information is 35 recorded and available for Tech Rep diagnostics or to maintain machine operation. After the crash or fault detection (block lO0), there is merely the ~9--isolation of the fault to a particular control board (block 102). This information is recorded in nonvolatile memory for later use by the Tech Rep.
There is also the auto!natic recording of the history of faults in suitable counters related to the various control boards as illustrated in block l04. This history of faults in each particular control board is much more valuable then merely identifying the bo~rd caus;ng a crash after a particular crash since it is vital for the Tech Rep to know the pattern of where crashes are occurring.
The next step is to monitor a crash display enable flag in l0 nonvolatile memory (block 105). If the flag is not set, the control will proceed with a control board reset procedure (block 108). If the flag is set, the rnachine enters a crash display routine (block 107). The crash display enable flag or location in nonvola~ile memory is set by the Teeh Rep to place the machine in the display mode. Once in the display mode, the Tech Rep can 15 examine RAM, nonvolatile memory, and other registers to provide valuable diagnostic information.
It is undesirable for the operator to be required to power up the machine after a software crash. Therefore, after the fault detection, an automatic hardware reset procedure will reset all the control boards of the 20 machine and the machine will be allowed to resume operation. This is shown in block 106. All control boards will be reset regardless of which particular board or boards caused the crash.
In a second level of machine operation response, block 108, only the particular control board causing the crasn or fault ~vill be reset. This 25 eliminates the need to re-initialize those control boards not causing the crash.
It enables the saving of status and operating information in the board RAMs that would have been lost during reset. These first two levels are basically hardware reset procedures to recover from a crash unnoticed by the operator In a third level of machine response, bloek 110, the fault is in one of 30 the control boards and that particlllar control board fails reset. That is, there is a hardware failure related to the particular control board causing the crash.However, if it is a noncritical hardware component, that is1 if the failed component is not crucial to machine operation or control, maehine operation can continue either unaffected or only slightly degraded.
For example, if the failed control board controls fl display that is not essential to the operation of the machinc, the control board and display --lO -can be ignored by the rest of the control system until the control board has recovered. Machine operation can continue without the use of the device controlled by the failed board. Generally, this situation would ~e noticed by the operator since the display would be blank for a few seconds until it had recovered.
The final level of machine operation response, block 112, ;s the indication of a crash or failure of a control board that cannot be reset and it is critical to the maehine operation. This can be termed a critical hardware failure. At this point the machine must be stopped and corrective action 10 taken such as n jam clearance. At this particular level, in response to the software crash or malfunction, the machine can be cleared and totally recovered. That is, the parameters of the interrupted job remain intact.
These parameters are saved and restored for the machine to continue on with the job in progress at the point of the malfunction. It should be noted that 15 each of the levels of response is a further feature of the present invention and will be described in more detail.
According to one feature of the present invention, various errors and faults are recorded by the CPM board 70 (Figure 4, block 100). These faults are conveyed by the CPM board to the control panel 86 for display.
20 With reference to Figure 5, a preferred embodiment of control panel 86 is illustrated. There is also shown a display panel 120. The control panel 86 is electrically coupled to the CPM board. The display panel 120 is electrically coupled to the DCR remote control board 78.
The control panel 86 allows an operator to select copy size (button 25 122), copy contrast (button 124), number of copies to be made (keys 126), andthe simplex or duplex mode (button 128). Also included on panel 86 are a start button 130, a stop button 132, an eight character 7 segment display 134, a threecharacter 7 segment display 136, and a job interrupt button 138. The displays 134, 136 provide the operator and Tech Rep with various operating and 30 diagnostic information.
The display panel 120 informs the operator of the status of the machine and can be used to prompt the operator to take corrective action in the event of a fault in machine operation. The display panel 120 includes a flipchart 140, a Liquid Crystal Display (LCD) 142, an alphanumeric display 144 and 35 a "Power On" button 146.

In the event of a software crash, a coarse code is provided, giving the reason for the crash. This coarse code will be automaticall~7 displayed on the control panel 86 on display 134 if the rnachine has been so programmed by the Tech Rep in NUM; i.e. the crash display flag is enabled. The coarse codes 5 generally identify the particular control board that failed.
A fine code is used to indicate in more detail the cause of the failure of a particular control board. The fine code is obtained by pressing thestop key 132 and looking at the right most two digits on the display 134 on the control panel 8~. Preferably, the fine code (error code) will be displayed in 10 hexadecimal on the control panel 86. As an alternative, a decimal value of the fault code is found in nonvolatile memory using a diagnostics procedures.
T~pical of coarse codes would be X'lF' or decimal 31 indicating a CPM board 70 fault. That is, an error occurred on the CPM board 70. The fine code is then used for the specific error. Another example of a coarse 15 code would be X'5F' or decimal 95 indicating no acknowledgement from the XER board 74. That is, the CPM board 70 sent a message to the XER board 74 and after three retransmissions of the message, the XER board failed to acknowledge receiving any of them.
Other coarse codes would be to indicate that the CPM board 70 20 sent a message to the MIR board 76 or to the DCR board 78, and after three retransmissions of the message, the DCR or the MIR board failed to acknowledge receiving any message. Still other coarse codes are to indicate that the CPM board tried to communicate with an unidentified processor, or that the MMB board 84, for example, failed a background checksum. I$ should 2S be noted that many other codes are available. Those listed are merely exemplary.
The coarse code and a fine code together describe the failure.
Thus, if the coarse code is X'5F' and the fine code is X'OA', the XER board 74 failed and the specific failure was a timer failure. Various other Fine Crash 30 Codes are listed in Appendix A.
The first level of the Tech Rep response to a fault indication, block 102 as shown in Figure 4s is to isolate the particular control board having the fault. This information is recorded in nonvolatile memory.
In accordance with another feature of the present invention, one of 35 the control boards, in particular, the CPM control board 70, is designated asthe master. All the other processors or control boards report their faults to the master. In other words3 failures to communicate over the shared line by a particular remote control board or failure, such as a timer failure on a particular remote board, generates an error signal conveyed to the CPM board.
When the CPM control board 70 recei~es a îault message, it will 5 record the type of fault and the source of the message in suitable memory locations, preferably in nonvolatile memory. This data is preserved for Tech ~ep diagnostics. It will also time starnp the fault so that the first fault message is identified. That is, the CPM board will checl~ Machine Clock pulses and record the count along with the error message.
Next, the master or CPM board 70 will transmit a message to itself. That is, the CPM board 70 will transmit a message to itself that simulates a mes~age being received by the CPM board over the shared communication line. This will verify whether the master's communication channel is valid, in particular to verify the CPM board's receiver circuitry.
15 This is done to identify the case that the remote control board sent a valid response, but the CPM board did not receive it. In this case, the master or CPM board 70 will be identified as being faulty.
This provides the rneans to collect fault information as a remote control board begins to fail. It is particularly valuable in identifying the first 2û of a possibly linked series of subsystem failures that can be traced to the first board to send a fault message.
In accordance with another feature of the present invention, each controller board has designated counters or storage locations in nonvolatile memory. These counters enable the control system to record the fault history 25 of each control board. This is the second level of diagnostics shown as block104 in Figure 4. Each of the control boards has one counter designated in nonvolatile memory to record instances of malfunctions or crashes. Another counter records instances of machine crashes during machine run or operation.
Distinguishing between power up and run provides fault history to 30 draw various conclusions about the operation and type of malfunction. With reference to Figure 6, there is illustrated associated with each of the control boards, specifically the CP~I, RDH, MIR, XER, DCR, and PHR, boards, a pair of counters. The counters are illustrated as being on the various control boards. However, in a preferred embodiment, all counters are located in 35 nonvolatile memory on the CPM board 70. Since crashes can be reset and the machine can then run again, there will probably be several crashes before the Tech Rep actually services the machine. ~ounter l is associated with each of the control boards to record crashes for that particular control board during both standby and machine run. Counter 2, although illustrated for each control board, in the preferred embodiment is actually only one counter to record all instances of crashes during machine run only. It is a cumulative count of crashes for all boards.
The Tech Rep preferably only clears those nonvolatile memory locations associated with control boards having problems corrected by the Tech Rep. In this manner, the systern can be used to record problems only 10 occurring on an infrequent basis then the control can record and have available problems that it had even if only on a very infrequent basis. It is possible to distinguish interm;ttent control board problems from intermittent problems that are not associated with the control boards, such as noise. Nonboard problems such as noise and software design errors are usually caused during 15 machine running.
For example, a failure during both power up and machine run is a good indication of board failure. The board failure could be either the board itself or, under rare circumstances, the software associated with the board.
However, suppose there is no failure noted during power up and the control 20 board self test, but a problem, even though intermittent, is observed during run. This is a strong indication of noise or some intermittent running problem.
That is, nonboard problems are usuaUy caused by noise from some rnachine component when it is running.
If there is no indication of failure for a particular board during 25 standby, there is a very low probability that that particular board itself is bad.
A failure only during run would likely indicate noise. It should be noted that fault recording (block 104, Figure 4) need not necessarily occur before the reset of the control boards. It could occur, for example, after reset and restoration of parameters, i.e. after block 112.
A control system software crash means that the system is not functioning correctly. The usual response is to reset or re-initialize the system. In other words, various registers are cleared, in particular various Rundom Access Memory locations are re-initiali~ed. In most cases the problem causing the software crash will disappear during the re-initialization 35 and will not effect the system. If the system only has an automatic reset mechanism, memory will be initialized and valuable diagnostic information residing in ~AT~ is lost after reset. In short, ~AM locations often contain information on the nature and type of a particular software crash.
In accordance with another aspect of the present invention, there is an automatic reset disable feature. This feature allows a Tech Rep to place the machine into the crash display mode if a crash occurred. Preferably, the automatic reset is disabled through a suitable switch. E~or the Tech Rep, forcing the system software to crash can be a valuable diagnostic tool. For example, if the Tech ~Rep suspects a software problem, he can force the machine to software crash and then interrogate various RAM locations for 10 crash related information.
Typical of the sequence of events that rnight occur, the CPM board 70 may have an incorrect value in memory. It may be that the system can reset and ignore the problem temporarily. However, the problem may occur relatively frequently. Suspecting a problem, the Tech Rep will begin to isolate 15 the cause. The Tech Rep will first verify the operation of the microprocessors and the RAM controls. The Tech Rep can then force the machine into a software crash and display the contents of RAM. The display of the RAM
contents will occur after the reset of all the boards except the CPM board ~0.
In a preferred embodiment, the Tech Rep, using a special routine, 20 sets a predeter~ined nonvolatile memory location to a certain value. This causes a display of software crash if a crash occurs. If a crash oecurs, the display 134 on control panel 86 will show the word "error" on the lefthand side of the display 1340 Various two digit code numbers on the right of the display represent the processor board where the failure occurred.
With the word "error" displayed, the Tech Rep has the capability to read the content of RAM locations. Certain control panel buttons then provide the Tech Rep with certain capabilities. For example, with the stop print 132 button initially pushed, the control panel display 134 will show the location of the address of the crash code on the left with the contents of that 30 location on the right. The location is correctly defined as "ElR0". Further actuation of this button 'Nill increment the lower byte addresses, displaying the new location and its contents.
Further actuation of the job interrupt button 138 will increment the higller byte addresses, displaying the new location and its contents. For 35 example, if the address or the display is currently "E000", actuating this button will cause the address to increment to "E100". Whenever the "clear"

~L2~33~9 key C is pushed, the crash display Uvill be terminated, coarse and fine code memory locations in nonvolatile memory are cleared and a self test initiated.
As an example of RAM diagnostics, the error lF/81 indicates an invalid activation address on the CPM board. This error results from a taslc 5 trying to execute in an area of memory not intended for execution (eor example, input/output ports, vector address area, ~AM and nonvolatile Inemory). The error occurs as a task is about to jump to its next instruction.
This means thflt the task must have already put the bad address in its Task Control Buffer before the execution was attempted.
Much of the time, noise is the culprit for an lF/81 error caused by loosely connected input connectors. TrIowever, this error can also be caused by software. The following procedure is used to identify the source.
First, the Tech Rep fills out the Task Control Buffer (TCB) information for the currently running task. The Task Control Buffer (TCB) is a 15 RAM table that merely contains information relative to a particular task thatis being executed. Such information includes data and priority information for relationships to other tasks. The currently running task is found in $CURRENT ID which is at address F361.
From this information, the Tech Rep can make certain judgements.
20 In particular, he can predict if the problem is noise and check the connectors, or if the values that he reads are within a certain range, it might indicate a software problem. As an example of how the Tech Rep relates various address locations with various information reference is made to Figure 7.
Each task receives its parameters in a stack called the correspon-25 dence or byte stack. A pointer to the first element in the stack is found in theTask Control Buffer (TCB) table or pointer starting at EEA0. To get the pointer of task X, look at memory location EEA0 + X. This pointer is the least significant Yalue of the address of the first element in the stack. The most significant byte of the address is hexadecimal address 'EE'. Thus, to get the 30 element that X points to, look at location EEOI) + the contents of EE00 + X.
This will contain the pointer to the next element of the list, or zero if this is the last element. The contents of memory location EF00 + X contains the data for that element of the stack. For example, the cGrrespondence stack (2, 11, lD, 96,1, A, A) (top to bottom) might look as shown in Figure 7 if it were 35 the stack for task 12.

Each task also has a word stack, which is used for saving informa~ion while the task is running. It uses the .same format as the correspondence stack, except that there are two data fields (one for the least significant byte of the word, and one for the most significant byte) Typically, there will be only one or two entries on the stack. The address for the TCB
word stack pointer starts at EFA0, and the stack is located at F9XX, FA~X
and FBXX. The crash counter and crash display routines are illustrated in Appendix D.
~gain, with reference to Figure 49 there are shown the various 10 levels of machine recovery upon detecting a software crash. A concern with a multiprocessor control system is to synchroni~e all the processors of the system. This is particularly important whenever a system abnormality or software crash occurs.
In accordance with another feature of the present invention, one of 15 the processors or control boards is given the role of a master control from the standpoint of simultaneously resetting the other controller boards, Figure 4, block 106. When a system abnormality or software crash occurs, the master control issues a global reset signal. This signal goes automatically to each of the other processors or control boards in the system.
The global reset signal will resynchronize the other processors or control boards in the system back to a normal state of operat;on. Since many of the abnormalities and system software crashes are transient, the multi-processor system is reset and the system continues to function without requiring any manual power up or other resetting. In a preferred embodiment, 25 the CPM control board 70 is given the role of master control for resetting the other control boards.
With reference to ~igure 8, there is shown reset circuitry on the CPM control board 70. The reset circuitry provides suitable reset signals to the PHR, XER, MIR, DCR and RDHR, control boards 72, 74, 7~, 78 and 82.
30 The reset circuitry holds the other control boards reset during the normal power up and power down operations. This allows the CPM contol board 70 to insure its proper operation before it allows the other control boards in the system to start their normal operation. Thus, if the CPM board detects its own operational problem, it can hold the remaining control boards in a safe 35 condition.

~Z~33~

The reset control includes an Bû85 reset signal from the Intel 8085 microprocessor on the CPM control board 70. The 8085 signal, set to 0, is fed to a buffer B to gate the transistor driver T. The transistor T provides a suitable reset signal simultaneously to each of the control boards through 5 suitable resistor networks.
In particular, the transistor T is shown providing the RST$PHR, RST$RDHR, lRSr$DCR, RST~MIR, and RST$XER si~nals. Preferably, a reset signal spare (SPR) is provided for any additional control boards that may be added to the system.
In a second level of hardware reset circuitry, Figure 4, block 10~, the master controller (CPM board 71)) in the multiprocessor system provides for the selective resetting of the other individual control boards in the system.
Thus, any type of abnormal operation in any one of the processors or control boards, will not force all the other control boards to be reset. Resetting all 15 the control boards may cause the control boards to unnecessarily lose status and operating information.
It is ~ossible, therefore, if a system problem occurs, to reset one remote control board without losing valuable status information in other control boards. The master controller need only look to the crashed remote 20 control board to determine proper function of the system.
With reference to Figure 9, there is shown the CPM control board 70 with reset lines to the PIIR board 72, the XER board 74, the MI~ board 76, the DCR board 78 and the RDHR board 82. There is also illustrated individual reset circuitry for each of the reset lines. In particular, reset circuitry 140 on 25 CPM control board 70 controls the reset of the PHR control board 72, reset circuitry 142 controls the reset of the DCR control board 78, and reset circuitry 144 controls the reset of the RDHR control board 82. In addition, reset circuitry 146 controls the resetting of the MIR control board 76 and resetcircuitry 148 controls the resetting of the ~ER control board 74.
These separate reset lines are independent of the shared line 80 interconnecting the various control boards. There is also iUustrated a spare control board that could be suitably interconnected to additional reset circuitry. The reset circuitry 140,142,144, 146 and 148 is shown in more detail in Figures lOa through lOe.
In particular, Figure lOa illustrates the reset circuitry 140 on CPM
board 70. The reset circuitry includes the Intel 8085 reset signal to buffer B, in turn driving transistor drive T to provide a separate reset signal l~ST$PH~
to the PHR control board 72. Reset circuitry 142 as shown in Figure 10b includes the 8085 reset signal to a separate buffer ~, in turn driving its own transistor driver T to provide a separate reset signal RST$CDR to the DCR
control board 78. Similarly, separate reset circuitry shown in Figures 10c, 10d and 10e provides suitable separate reset signals to the RDHR, MIR and XER
boards 82, 76 and 74.
A problem can occur where a remote control board processor prevents the board from responding back to the CPM control board that it is 10 functioning normally. The CPM control board then resets this one remote control board individually. If the remote control board is not functioning properly, the CPM board can hold the one remote board in reset. In addition, it should be noted that there are various resetting and self test procedures initiated at machine start up. There is an automatic self test to check the 15 control logic circuitry on the control boards. During the automatic self test, any fault that is detected is displayed by suitably mounted LEDs.
There are three major checks, namely the check of the CPM and MMB boards 70, 84, the remote board tests, and shared communication line 80 test. During the .est of the CPM and the MMB boards 70, 84, the status of a 20 not shown low voltage power supply is checked as well as the continuity of the connection between the control panel 86 and the CPM board 70.
Also, during this test9 the CPM board 70 writes information into a small portion of the nonvolatile memory. Thus, when the copier power is on, the low voltage power supply is conveying power to the nonvolatile memory 88 25 and charging the battery. When the copier is switched off, the nonvolatile memory is relying on the battery to hold its contents.
During the tests, the information in ROM in the CPM board 70 that is writteJI into the nonvolatile memory is compared. If the two mernories do not match, a battery fault status code is declared. Also, the CPM board 70 30 writes a small portion of information into nonvolatile memory and then reads the same information. If the information is not matched, a nonvolatile memory fault code is declared.
After the CPM and MMB board tests have begun, the CPM board 70 conveys a reset signal to all the remote control boards 72, 74, 76, 78, and 82 to 35 start the self test of each of the remotes. When the reset is received from the CP~q board 70, each remote simultaneously starts its own sel~ test checking ~2~33~'~

for a remote control board processor fault, an input circuit fault or an output circuit fault.
A processor or control board fault is declared when a remote control board cannot communicate with the CPM board 70. That is, the S control logic on the remote control board cannot perform its basic test of itshardware devices. There is also a DC input self test to verif'y operation of theDC input circuitry on all the remotes and a DC output self test to verify the DC output circuits on all the remote control boards.
~inaJly, there is a shared communication line 80 test to test the 10 shared communication line logic on the CPM board 70, the shared communica-tion logic on the remote control boards and the shared communication logic cable. The CPM board 70 attempts to send and receive a signal to and from each of the remotes in sequence. When the CPM board 70 successfully sends and receives signals from the remote control boards, the CPM board 70, the 15 remote control boards and the shared communication line 80 are verieied.
In accordance with another feature of the present invention, the failure of a remote control board to reset does not necessarily inhibit machine operation (block 110 of Figure 4). In particular, if the particular control board failing reset is not critical to the overall machine operation, the machine 20 continues operation. The machine continues operation even though the particular board is not operational. The DCR control board 78 is an example of a control board that is not crucial to machine operation.
When a Display Control Remote (DCR) board 78 crash occurs two alternatives are available. In one embodiment, a flag or crash enable byte is 25 set in nonvolatile memory. The application software will monitor the flag to determine if it is necessary to go to crash display routine for the Tech Rep or not. This is done by the CPM board 70 looking at the crash enable byte in nonvolatile mermory.
If the crash enable byte is set, that is, no go to crash display 30 routine for the Tech Rep, the CPM board 70 will reset all remotes, including nCR and goes to crash display routine with a message "Error 8F".
If in the recovery mode, there is still a DCR power up reset procedure. After completion of a DCR self test, the CPM board will attempt to communicate with the DCR board 78 by polling the DCR board. If the 35 communication is successful, the CPM board 70 will send for DCR board status and allow normal eommunication to the DCR. If the comrnunication is not completed~ no further communication will be allowed to the DCR board and the machine will continue to run as though the DCR does not exist.
In a preferred embodimentT however, there is nG crash enable byte to be monitored. There always is an automatic attempt to recover the DCR
board after a software crash during machine run. In general, in the preferred embodiment, the DCR operating system will send status messages to the CPM
board for the following two conditions:
1) At power up (or whenever DCR gets reset) after the DCR has passed self test.
2) At a software crash, whenever a fatal fault is detected on the DCR board.
The DCR recovery strategy follows the following sequence:
l) There is an indication that the DCR board is dead. There is then a request from the CPM board 70 to the DCR board 78.
2) The CPM board 7l) reads or acknowledges that the DCR board is dead.

3) The CPM board attempts to reset the DCR board.

4) After a delay of five seconds, there is a test to see if the DCR board has recovered.

5) If the DCR board has not recovered, the system will try again. Messages will not be lost from the system as they will be retained in the CPM RAM and be annexed to an initialized package when the DCR is eventually recovered.
For example, if there is a critical faulty component on the DCR
25 board 78, that has not intermittently failed, the DCR board may never be reset and the messages will never be displayed. However, tnere may be noise related crashes that will cause the display to indicate a faultO These causes may be transient and ultimately the DCR board will recover.
Therefore, even though for each message request to the DCR
30 board, it was determined that the DCR was dead, ultimately the DCR board may be recovered. At this time, the system will initialize and updatc all messages that were initially lost. In particular, the messages that had been saved in the CPM RAM will finaMy be dumped into the DCR board RAM table.
The DCR will then display the most valid or current message to the display.
Of course, if the DCR board 78 cannot be recovered, the machine will continue to run aIld the DCR board will remain blank. The DCR recovery procedure is shown in Appendix B.

~33~

The final level in machine recovery is to completely restore the interrupted job after a critical software crash or failure. This type of crash recovery can be considered full job recovery after a system erash. The machine resets itself, and with some operator intervention, job integrity is 5 preserved (Figure ~, block 112).
In one embodiment, in response to software crash or malfunction, one of the processors of a multiprocessor control a~ain assumes the roll of the master controller. In particular, the CPM board 70 is the master controller.
At the time of the crash, a software flag, typically a bit in the memory could 10 be monitored. This flag would indicate to the CPr\l board 70 that there should be no destruction of the contents of the random access memories. This monitoring would be done prior to any initiation or reset sequence of the control boards.
In particular, the CPM board 70 would indicate to itself not to 15 destroy the contents of RAM location that contained the necessary para-meters. These would be the parameters needed to place the CPM board and the other control boards into the same state as before the occurrence of the crash. In other words, the CPM board 70 would reset the other control boards using the standard diagnostic and checking procedures, but would retain the 20 information in RAM locations necessary to recover the other control boards with the appropriate information in tact.
The primary purpose of crash recovery, however, is to maintain job integrity by saving the essential variables to be able to continue the job afterthe crash. The essential variables are such things as the selected information 25 from the control panel such as quantity selected, magnification ratio, tw~
sided eopying and copy quality. Other essential information is state and status information of the machine at the time of the crash. The most reliable means to preserve this information is to store these variables in nonvolatile memory rather than RAM and to continually update the information in nonvolatile 30 memory as it changes.
In a preferred embodiment, therefore, all the control boards auto-matically perform job recovery and all key information is continually updated in nonvolatile memory. By way of example, if the machine is in the print state or paper has reached the fuser area, after a crash, an El0 fault will be 35 declared. This instructs the operator to clear the entire paper path.

Once this fault is cleared, the job progresses accordin~ to the following re-initialization procedure. If a recirculating handler is in the system, then the RDHR control board ~2 receives a fault signal from the CPM
control board 70 that there is a crash. The RD~R control board 82 ihen immediately declares a fault, A10, that instructs the operator to remove and reorder the documents in the document handler.
By this time, the CPM board 70 Operating System has reset and re initialized all the remote control boards, in particular clearing all of the information stored in RAM. Next, the Operating System restores the relevant 10 variables in the nonvolatile memory ~8 on the CPM board 70 to the appropriate ~AM los~ations on the remote boards. In particular, the CPM
board 70 updates the control panel 86 with the job selected parameters at the time of the crash and restores the remote control board status.
For example, the ~DHR board 82 is told the number of originals in 15 a set and the CPM board 70 instructs the RDHE~ board 82 to cycle the sheets until the correct sheet is on the platen. Other restored information would be, for example, the number of sheets already delivered to a sorterl along with the bin number to start additional sorting if necessary. Note that in a preferred embodiment, there are approximately 116 variables deemed necessary to be 20 used for crash recovery and automatically updated in nonvolatile memory as re~uired.
If a software crash occurs in a standby mode, the machine is reset and the control panel is refreshed unchanged. If stop print has been pushed and the machine has cycled down, recovery is identical. If a software crash 25 occurs in the middle of the second job during a job interrupt, crash recovery is identical to a noninterrupt job. In particular, the second job continues where it left off as if no software crash occured. After completion of the second job, the interrupted job with its variables stored in nonvolatile memory continues from where it was interrupted.
With reference to the code Appendi2~ C, there is shown the software recovery procedure. If, however, crash recovery is selected, statements 142 -147, a crash recovery flag, in particular a byte of memory in ~AM and the CPM is set. Then, if there is a recirculating document handler, the RDHR control is informed of a software crash. After an E10 fault has 35 been declared and if a crash is in the interrupt mode, the interrupt light isturned on. In addition, the selected job before the crash is restored. In --~3--particular, there is an update of a seven segment LED display 134 including quantity flashed and the number of copies selected, statements 804- 816.
There is also a re-initialization of the remote control boards. That is, the appropriate variables stored in nonvolatile memory on the CPM board 5 are downloaded to the appropriate RAM locations in the remotes, statements 817 - 827.
While there has been illustrated and described what is at present considered to be a preferred embodiment of the present invention, it will be appreciated that numerous changes and modifications are likely to occur to 10 those skilled in the art, and it ;s intended in the appended claims to cover all those changes and modifications which fall within the true spirit and scope of the present invention.

APPENDIX A

FINE CODES FOR CPM

OEC HEX MESSAGE AND DESCRIPTION

131 X'83' No More TCBS
A task made a request to STA RT/FORK/CALL fl local task or to FORK/CALL a remote task and there were no TCBs left for the new task.

133 X'85' Attempt To E~elease A Free TCB
A request was made to release a TCB to the list of unused TCBs and that TCB was already released.

134 X'86' Invalid Task ID In Conditioner An attempt was made to access a condi-tion variable in a task whose RTID was not within the proper range.

140 X'8C' 13mpty Corres Buffer An O.S. Instruction routine tried to retrieve a correspondence byte from an empty correspondence buffer.

141 X'8D' Empty Control Buffer An O.S. Instruction routine tried to retrieve a control word from an empty control stack.

150 X'96' Join Corres Buf Not Empty On End When a for3ced task hits its ENI) state--ment, it vuill swap correspondence with its Parent. If the Parent's correspondence stack is not empty at that time, the Child will try to end with a non-empty stack.
This is usually caused by passing the wrong number OI arguments to the Parent.

152 X'98' No Task To Join The current task requested to JOIN to a nonexistant task.

153 X'99' Unexpected OS Will Executed An O.S. task that should not have had a Will somehow tried to execute its Will.
This can be caused by CANCELLING an O.S. task by mistake.

158 X'9E' SCH Enter Task Already Scheduled An attempt was made to enter a taslc that was already entered.

156 X' SCH Enter Invalid Priority The value in $PRIORIT~ VALUE was not valid when the enter was performed.

16Q X'A0' SCH Start Invalid Priority The Parent's priority was invalid and that would make the Child's priority invalid too.

163 X'A3' SCH Release Task Not Scheduled Tried to release a task that is not spooled or queued.

^) ~
`f ~3~31~9 165 X'A5' SCH Free Invalid Priority Tried to free a task whose priority entry is inva'Lid.

170 X'AA' SCH VIP Activate ERR
Tried to activate a task that was not set up to be activated.

180 X'B4' Timer Duration Too Large 182 X'B6' Timer Still Active Tried to start a timer that's already active.

186 X'BA' ~SG Too Long An attempt was made to send a message longer than 16 total bytes across the bus.
This includes 3 bytes of header, 2-3 bytes of task information, one byte len~th, and correspondence. Thus, you can only pass 10-11 bytes of correspondence to a remote task.

187 X'BB' Bad Dest ID
The transmit routines have generated a bad destination ID.

188 X'BC' Xmitter Fails Reset The hardware in the transmitter isn't functioning properly.

189 X'BD' RCVR Fails Reset The hardware in the receiver isn't func-tioning properly.

19~ X'C6 [nvalid OS Instraction Exe(?uted An attempt to execute an undefined O.S.
instruction was attempted.

FINE CODES FOR I/C) CONTRC)L BOARDS
2 X'02' Invalid TCB Status The TCB just retrieved has an invalid status tag.

3 X'03' Invalid Timer Status The timer that just expired is neither a ;nachine or real-time timer.

4 X'04' No Ack This I/O Control Board sent a message and did not receive an acknowledgement of that message.

X'05' Backlog Full I/O control Board 's transmitter backlog is full (i.e. it cannot queue any mo. e messages for transmission.

X'OA' SCC Real Time Timer Failure A "Real-Time" timer did not respond within the specified amount of time.

131 X'83' No More TCB's The maximum number of active tasks allowed in this IOP were exceeded. This might be caused by performing too many downloads to the IOP.

FIN~ CODES FOR DCR CONTROL BOARD
132 X'84' Invalicl Yector Address A task executed an O.S. Instruction and its next 8085 Instruction to execute was not in the proper ran~e.

134 X'86' Invalid Task ID In Conditioner An attempt was made to access a condi-tion variable in a task whose RTID was not within the proper range.

208 X'D0' Bad Chaining RTID
A chaining RTID with an invalid value was encountered.

209 X'Dl' Bad Chaining STCB
A chaining STCB with an invalid value was encountered.

210 X'D2' Bad CTID In STCB Table A CTID with an invalid value was encountered in the STCB table.

130 X'82' No More Free Space An attempt was made to allocate a eorre-spondence byte or control word from its free space and the Eree space was exhausted.

145 X'91' Exceeded Maximum Number Of Events A task reguested to start an 13vent and there was no room left in the Event tables for it.

150 X'96' Join Corres Buf Not Empty on End When a forked taslc hits its EN D state-ment, it will swap correspondence with its Parent. If the Parent's correspondence stack ;s nol: empty at that time, the Child will try to end with a non-empty stack.
This is usually caused by passing the wrong nul-nber of arguments to the Parent.

151 X'97' End Corres Buf Not Empty On End A taslc reached its END statement and its correspondence buffer was not all used.
This is usually caused by passing more parameters to the routine than it expected.

152 X'98' No Task To Join Too The current task requested to Join to a non-existant task.

154 X'9A' Tried To Retrieve From An Empty Buffer A task was expecting more parameters than it was passed.

APPENDIX B

546 /*$PA.*/

548 7007 ENTER;
549 700E IF DCRSWITCH THEN BEGIN;
550 700E TEST USER~NU~VI;
551 700E CASE=POL1REQUEST;
552 7016 CALL DISPLAY_INTERFACE
(USER~NUM ,USER~ DAlA);
553 7022 CASE=DCRRESET;
554 7027 TRANSMIT LOOP VARIABLE~POINTER
<-u 10 31;
555 7033 M ESSAGE~ COMM AND <-R ESElPREFIX/VARIABLE
~ POINTER;
556 703B TEST VARIABLE~POINTER;
557 703B CASE=SEN DFINISHED;
DCR~DAIA ~-SENDFINISHED;
558 704B CASE=SENDINOUTCONFIG;
DCR~DAIA <~-IN~ OUT~ CONFIG;
559 705C CASE=SENDIVCONFIG;
DCR~DAIA C-IO~ CONFIG;
560 706A CASE~=LASTSUBSYSTEM;
DCR~DAIA <-STATE~ ARRAY(VARIABLE~
POINTER);

562 7083 ENU;
563 7083 IF DCR~ DAIAt-O 'rHEN CALL
l)ISP L ~ Y I NT E ~ :F AC E ~M ESS AG E~
COMM AND,DCRr~DATA);
564 7094 RELOOP;
5fi5 7098 DCR~FLAG ~- DC,RPRESENT;
566 70A3 OTHERWISE BEGIN;
567 70AB IF DCR~ FLAG--DCRPRESENT THEN
CALL :DISPLAY_IN'rERFAC,E
(USRR~ NUM ,USER~ DATA);
568 70B4 END;
569 70B4 END;
570 70B4 ENO;
571 70B4 END;

APPENDIX_C

142 7D5C ELSE :13EGIN;
143 CRASH~RECOYER~FLAG ~-CRASHRECOVER;
144 7D61 IF ( (IO~CONFIG & RDHCONFIGMASK) ! = 0) &
145 (JOB~SELECTION( INPUTSTATION) = RDH) T:E~EN
146 7D71 START INPIJT_STATE_M ANAGER
(RDHCRASHRESTORECOMMAND, 0~;
147 7D77 END;

804 87FF IF (CRASH@RECO~ER~FLAG = CRASEIRECOVER) THEN BEGIN;
805 START STATE_HANDLER
(OPElRATORINTE~FACESTATE / &OREADY);
806 880A IF (STATE~ARRAY(VIPSTATE) = LEVEL 2) 807 8812 THEN INTERRUPT$ ~- ON;
808 8819 DEFAULT JOB( CURRENTFEATURES);

811 882E IF (JOB~STATE = COMPLETE) THEN
812 8835 START PROCESS_KEYBOARD
(RESTOREQUANTITYSELECTED / 3);
813 8838 ELSE BECIN;
814 START PROCESS_KEYBOARD
(RESTOREQUANTITYSELECTED);
815 883E START QUTY_FLSHD
(UPDATEDISPL AY);
816 8841 END;
817 8841 IF ( (IO~CONFIG & RDHCONEIGMASK) ~ = O) &
818 (JOB~SELECTlON( INPUTSELECTION) = RDH) THEN

819 8851 START INPUT_STATE_M ANAGER
(UPDATENlJ~q BE:E~OlRIGINALS, NUMBER~ORIGINLS);
820 885A IF ( (IO~CONFIG & SADHCONFIGl~llASK) ! = 0) &
821 (CFF~RUN = 1~ THEN
822 886A START INPIJT_EXECUTIVE
(SELECTCFE~M ODE);

(UPDATESHEETSDELIVEREDMSB, I\q SB(SHEETS~ DELIVERE ~ OUTPUT~ );

(UPDATESHEETSDELIVEREDLSB, LSB( SHEETS~DELIVERE ~OUTPIJT) );
825 887E OUTPUT_INï`ERFACE (UPDATEPRESENTBIN, PRESENT~ BIN);
826 8886 CRASH~RECOVER~FLAC; ~- 0;
827 888A END;

APPENDIX D
1176 GlobalProcedureJump-ZERO:
1177 /****************************************************~*****
1178 *
1179 * *
11~0 * *
1181 * Description: Jump to location zero of CPM or crash display routine. *
1182 * When operating system or diagnostic detec~ed *
1183 * any system alfunction, they wil! write the error code *
1184 * to NVM location 100 and jwmp to this routine. *
1185 * This rou~ine will check to see if exit ~rom diagnostic *
1186 * and NVM location 100 is zero. If it is not, and the *
1187 * crash location (location 102) is enable then this wi ll *
118B * enable then this will jump to crash display *
1189 * routine in i~PM. Otherwise this will jump to location *
1190 * zero in CPM and set the flag (for incre crash counter *
1191 * in slo test) if location 100 is not zerox. *
1192 * *
1193 *
1194 * *
1195 *
1196 * *
1197 * *
1198 *
1199 * *
1200 * * * * * * * * *

1202 Declare 1203 Procedure DCR-interface (Byte, Byte), 1204 Procedure increment-counter (BytQ) 1205 DCR&Reset External WO Ram Bit variable 1206 Type = output Zero = Reset DCR one ~ Release DCR, 1207 DCR (~ Retry Global RW RAM Byte Variable, 1208 DCR @ Indicate Global RW RAM Byte Variable, 1209 DCR @ Flag External RW RM Byte Variable, 1210 Last ~ Crash @ Fine External RW RAM 8yte Variabie, 1211 Last @ Crash @ Coarse External RW RAM Byte Variable, 1212 Jump @ Z @ Stat External RW RAM Byte Variable, 1213 Jump @ Z @ Fin External RW RAM Byte Variable, 1214 Jump @Z @ Flt External RW RAM Byte Variable, 1215 Crash @ Enable External RW RAM Byte Variable, 1216 Diag @ Exit External RW RAM Byte Variable, 1217 Rest@Time External RWRAMByteVariable, 1218 Run @ Bi~ External RW RAM Byte Variable, 1219 Total @ Crash ~ Cnt External RO Nomem Byte Constant;

J
., --1 220 I*Spage~l 122 1 Enter:
1222 DCR @ Flag <-0;
1223 If Diag @ Exit = 0 then 1224 Begin: I*lf this is a crasha nd machine in run 1225 Jump@Z@Stat<-1: incrementtotalcrashcounterinrun 1226 Rest@Time <-128: modæ ~l 1227 If Run @ Bit = 1 then increment-counter (To~al: Crash.Cnt);
1228 End;
1229 Diag @ Exit, Run @ Bit <- a;
1 330 Loophole;
*

Ram @ Page EQU X 'FC00' Down load address Enable @ EQU X '48' Indicate crash is enable DCR Ena @ EQU X '4C' Enable DCR crash Byte @ ~QU 8 Number of bytes downloaded Page @ Bit EQU X '00' Leds EQU X '00' Leave Leds and DCR reset on DCRCrash EQU )('8F" DCRcrash log PGROM & En EQU X 'E30B' Output port for turn page Crash @ Routine EQU X'7A' Crash routine entry *
*

LDA Jump@Z @Flt Checkcrashlocation AMA A
J7 Not @ Crash If crash then CP1 DCR Crash Is it a DCR crash JNZ Not DCR @
LDA Crash @ Enable And is DS:R crash enable CP1 DCR FNA @
JZ Crash Rout @ Then goes to crash routine JMP End @ Loop Else goes to end of loophole Not DCR @ : Label LDA Crash @ Enable Check for crash is enable SHI Enable @ I*Crash display routine is enable by Tech Rep setting NVM location 102 to ~Pl 2 to 75 or 76 *l JNC Not @ Crash If crash and enable then Crashrout ~ :Label LXI H, Down @ Load @ NVM To ~rash display routine JMP Crash @
Not @ Crash : Label LXI H, Down @ Load Point to ROM to be download Crash @ :Label LXI B, RAM @Page Point to RAM
MVI D, Byte @ Number of bytes Loop @ 2 :Label Mov A,M
STAX B
INX H Point to next byte DCR D
JMZ Loop@2 - 3 6 ~ 33~

DT
JMP RAM @ Page Down @oAD :Label MVI A, Page @ Bit STA Pgrom & En Turn the Page JMP 0 Jump to CPM entry Down @ Load @ NVM: Label MVI A, Leds STA Pgrom ~ En JMP Crash @ Ruutine Jump to crash routine entry End @ Loop : Label 1 284 End 1285 Cancel DCR- Interface;
1286 DCR & Indicate ~- 0;
1287 DCR & Reset <- Reset DCR;
1288 Wait 10 Ms;
1289 DCR & Reset <- Release DCR;
1290 DCR Indicate ~- 1;
1291 Last@ Crash @ Fine <- Jump @ Z (~ Fin 1292 Last @Crash @ Coarse <- Jurnp @ 7 Flt;
1293 Jurnp(~Z@Flt,Jurnp@Z@Stat<-0;
1 294 End 3 7 ~;2~33~

**********************************~********************~**********
This program is for debug, aid for crash investigate when machine goes to the field.
This routine is enable by setting crash & enable In RVP to 75, when a crash occurs, jump to zero routine will down load turn page code to spare NVM and jump to thisroutine. This routine will allow the tech rep to examine all KVM and RAM when crashing. The following keyboard will do these function:
Clear push: Will clear crash log and jump 5top push: Will increment lower byte address and display Interr push: Will increment higher byte address and display P and stop push: Will decrement lower byte and display U and anything above: will speed up display routi ne.
********************************************************************
Base @ output EQU X "E300" Bec~inning of Output Port Bit @ E EQU X "79" Big Capital Letter E
Clear @ Push EQU X "FBn Indicate Clear is push Crash @ Log EQU X "E000" Crash location Current ~ Stack EQU X "EIFO" Current Stack storage Init @ Log EQU X nEOFF" Initialize to E000 when stop pu Interrupt @ Push EQU X "DF" Indicate interrupt button is p KV (~ Right 0 Pull X " E309 Output port for led right 0 KV @ Right 3 Pull X "30A" Output port for 7 Seyment right Led @ Port EQU X "0Bn Port contain led NVM @ Begin EQU X "E000 Beginning of NVM
NVM (3~ Limit EQU X "L2" Upper limit of NVM
NVM @ Stack EQU X " E200" In itialize Sp to E 1 FF
P& StoD @ Push EQU X "AF" Indicate P and stop are push RAM (~ Upper X "EE00" Lower limit of RAM
RAM @ Limit EQU X "00" Upper limit o~ RAM
SCC @ Storage EQU X "E3N High over address of SCC
SCC (~ Stora~e EQU X "EIEF NVM location for storing SCC
Small @ 0 EQU X "SC" Srnall letter 0 Small @ R EQU X "SO" Small letter R
Stop (3~ Push EQU X "BF" Indicate stop is push Zero @ Push EQU X "08" Indicate zero is push Crash @ Routine EQU & Beginning of crash routine A RVI A, SOD & Clr Clear Sod line to reset all A SIP Remote and IOP
1 ,XI 11, UASE @ output 1 ,FPF @ T
1,A1 R,1 Clearall CPM output

Claims (18)

WHAT IS CLAIMED IS:

1. In a reproduction machine having a plurality of operating stations and a plurality of control devices for controlling the operation of theoperating stations, each of the control devices having an associated counter for storing indications of the operation of each of the control devices, the method of monitoring the operation of the control devices including the steps of storing an indication of the status of each of the control devices in the associated counter; and determining the status of a selected one of the control devices in response to the information status stored in the associated counter.

2. The method of claim 1 including the steps of storing an indication of the status of a control device during machine standby.

3. The method of claim 1 including the step of storing an indication of the status of control devices during machine run.

4. The method of claim 1 wherein each of the control devices is a processor and including the steps of storing an indication of each of the processors during machine run.

5. The method of claim 1 wherein each of the control devices includes one associated counter and a common counter.

6. The method of claim 5 wherein the counters are locations in nonvolatile memory.

7. The method of claim 6 wherein one of the control devices is a master control and said counters reside in said master control.

8. In a multiprocessor machine control having a plurality of RAM locations corresponding to the processors, said RAM locations being reset during operation of the machine, a diagnostic method including the steps of a) maintaining status information in the RAM location corre-sponding to one of the processors, b) entering a diagnostic mode, and c) accessing the contents of said RAM locations prior to reset of said one of the processors.

9. The method of claim 8 including the step of displaying the contents of said RAM location.

10. The method of claim 8 including the step of manually entering the diagnostic mode.

11. The method of claim 8 including the steps of maintaining status information in RAM locations corresponding to each of the processors and selectively displaying the content of the RAM locations corresponding to one of said processors.

12. The method of claim 8 including the step of reseting the processors after displaying the contents of the RAM locations.

13. The method of claim 8 wherein said status information includes information relative to machine malfunctions.

14. A control for a system having a plurality of system operating components, said operating components cooperating with one another to produce a result, said control comprising:
a plurality of control devices for controlling the operation of the operating components, each of the control devices controlling a portion of the operating components and having an associated counter for storing indications of the operation of the associated control device, each of the counters including a run segment for maintaining indications of operation of the associated control device during system run, and a standby segment for maintaining indications of operation of the control device during system standby, circuitry for storing said indications of operation of each of the control devices in the associated counter; and a display for presenting the operation status of a selected one of the control devices in response to the indications of operation stored in the run and standby segments of the associated counter whereby the operation of the control can be diagnosed.

15. The control of claim 14 wherein the control devices are processors and the counters are locations in non-volatile memory.

16. In a system having a plurality of operating elements, a control comprising a plurality of processors for controlling the operation of the operating elements, each of the processors controlling a portion of the operating elements and having an associated non-volatile memory for storing indications of the operation of the associated processor, circuitry for storing an indication of the status of each of the processors in the associated non-volatile memory, and a display for presenting the status of a selected one of the processors in response to the information status stored in the associated memory whereby the operation of the control system can be diagnosed.

17. The control system of claim 16 wherein each of said asso-ciated memories includes a first counter portion for storing indications of operation of the associated processor during system standby and a second counter portion for storing indications of operations of the associated pro-cessor during system run.

18. In a machine having a plurality of operating stations, and a control having a plurality of processors, each of the processors for controllingthe operation of a portion of the operating stations, each of the processors having an associated storage for storing indications of the operation of the associated processor and a display for presenting the contents of the storage, each associated storage having a first portion and a second portion, the method of monitoring the operation of the machine including the steps of storing an indication of the status of each of the processors in the first portion of the associated storage during machine standby;
storing an indication of the status of each of the processors in the second portion of the associated during machine run, and determining the status of a selected one of the control devices in response to the information status stored in the associated storage whereby the machine operating status can be determined.