DE2458070A1 - DATA PROCESSING SYSTEM WITH SELF-VERIFICATION - Google Patents

Description

51-01126 / 57/1343 Ge ⁶ December 1974

HONEYWELL INFORMATION SYSTEMS INC.

200 Smith Street
Waltham, Mass., USA

Data processing system with self-checking

The invention relates to a self-checking data processing system.

With the increase in the complexity of modern data processing systems It has become more and more difficult to perform an operation check and an investigation into a fault condition that has arisen. The increased complexity of the plants is not just about the likelihood enlarged for a malfunction, but also makes it more difficult to discover the source of the error.

Two solutions to this problem have been attempted in the past. In one solution, the data processing system is set up redundantly so that even in the event of a malfunction of the Plant a correct result is available. Such a solution is out of the question in many cases because of the additional costs required components of the system become unaffordable.

HZ / Kö.

509824/0709

24böü7ü

A second attempt at a solution makes use of devices for error detection. In this solution, for example, at least a parity check signal of the information comprising the data signals added. The parity signal is taken into account at different times during data processing on the system, and the calculated parity check signal is compared with the originally attached parity check signal. voices If the two signals do not match, the data processing system is in a faulty state. At the enlarged However, the complexity of modern data processing systems is particularly complicated by the technical equipment required for a fault condition test then into the immeasurable, if an additional attempt is made to localize the error. A mistake can also remain unnoticed and are processed by the data processing system and are later located at one point, which is far away from the point causing the error.

With the increasing complexity of the data processing systems, more and more control functions were used, which were previously from the central unit were carried out, relocated to the input / output control unit. As a result, a second control device had to be connected to the input / Output control unit can be added to its control functions to evoke.

Starting from such a system in which both the central unit as well as the input / output control unit is provided with control devices, it is the object of the present invention to specify an effective fault control system. This object is achieved according to the one characterized in claim 1 Invention, further advantageous embodiments of the invention can be found in the subclaims.

Based on one shown in the figures of the accompanying drawing Exemplary embodiment, the invention is described in more detail below. Show it:

509824/0709

Figure 1 is a simple block diagram of the system; Figure 2 is a more detailed block diagram of the system; FIG. 3 shows a block diagram of the examination and verification device the system;

Figure 4 is a detailed block diagram of the investigation ' and checking device within the central unit; Figure 5 is a detailed block diagram of the investigation and Verification device within the input / output control unit; FIGS. 6a to 6c are block diagrams with regard to the interaction of the monitoring devices of the two subsystems; FIG. 7 is a flow chart relating to the testing and investigation process;

FIG. 7a an identification key for FIGS. 9 to 17> FIG. 8 is an illustration of the test procedure with respect to growing parts of the system;

FIGS. 9 to 17 show detailed flow charts of the method steps according to FIGS

FIG. 18 shows a schematic representation of the mode of operation of the test and investigation method in the presence of a Error condition.

Figure 1 shows a block diagram of the main subsystems of the data processing unit. The peripheral subsystem 50 consists from peripheral units, e.g. printers, magnetic tape units, etc., which the rest of the data processing unit with data .supply or receive data from it. The input / output controller subsystem 200 (IOC) controls the transfer of data from the units of the peripheral subsystem 50 according to the Data processing system. The main memory subsystem 400 (MMS) is a device for storing data, which continuously required for the operation of the data processing system. The central unit subsystem 100 (CPU) provides the core of the data processing system.

509824/07 09

system 300 (MIU) controls the transfer of data between main storage subsystem 400 and the central processing unit subsystem 100 or the input / output controller subsystem 200.

The subsystems are shown in greater detail in FIG. The connections between the various components of the subsystem are not complete and are purely by way of example to watch.

The peripheral subsystem 50 consists of systems 1 to 16, of which only the first and last peripheral systems 51 and 52 are shown. The input / output controller subsystem 200 comprises a memory management unit 201, an operation code unit 202 and a number of channel control units, two of which are shown, 203 and 204. Every Channel control units 203 to 204 provide an interface between the peripheral units 51 to 52 of the peripheral subsystem 50 and the memory management unit 201 and the service code unit 202, respectively. The channel control units buffer the data, which come from the peripheral units of the peripheral subsystem 50 or are sent to this, and they store a Information concerning the condition of the peripheral channel.

The main memory subsystem 400 consists of a group of four main memory modules 401, 402, 403 and 404, which are in different Modes of operation, for example, can be operated in an overlapping mode of operation.

The operations of the central processing unit 100 are carried out by the control storage unit 105 controlled, which in the preferred embodiment by a control store loader outside the central unit 100 is loaded. The control store interface adapter 104 contains the necessary logic circuitry

6 09824/0709

to act on the control storage unit 105, for example perform an address modification or a test of the address generation. The arithmetic processing unit 106 contains the circuits for performing the basic arithmetic operations and the data manipulation required by the central processing unit. The internal storage unit 107 consists of a small memory and associated logic circuitry and is used to to control the control information of the central unit or to act as a temporary memory for operands and partial results during to serve data processing. The address control unit 102 has means for address development within the central unit on. The command fetch unit 103 supplies the central unit with commands and keeps the next command available before the current command is finished. the Data management unit 101 forms an interface between the central unit and / or the buffer memory 302. The data management unit 101 specifies which part of the central unit's memory contains the information to be looked up, and it transmits the information to the central unit at the appropriate time.

The memory interface unit 300 contains the buffer memory 302, by means of which a small storage area is provided for data is what data is high over a given period of time

the

Show degree of use. Memory interface unit 300 includes Furthermore, a buffer memory address list 303, which enables access to the buffer memory 302 with a predetermined address, if a certain piece of data is contained in the buffer memory 302, and it also contains a main memory sorter 301, which is an interface between the modules of the main memory subsystem and the input / output controller subsystem. or the central processing unit subsystem 100.

50982470709

Figure 3 is a block diagram of the facility used in the inspection and testing process. The test device has both parts in the central unit 100. .. as well as in 'the input / output control unit 200. A tax and Monitoring rail 20 and a data rail 10 connect the Devices within the input / output control unit with the devices within the central unit. The monitoring rail 20 includes two supervisory data rails. A monitoring data rail transfers data from. the central unit to the input / output control unit, while the second monitoring data rail Transmits data from the input / output control unit to the central processing unit. The data rail 10 provides a connection between the test device within the central unit and a corresponding test device within the input / output control unit The data rail 10 is used to transfer data between these two subsystems of the data processing system to exchange. A system investigation display panel 199 is associated with both the central processing unit 10 and the input / output control unit 200 connected. In the preferred exemplary embodiment shown, the display panel is located within the central unit.

The test device within the central unit 100 has a control store logic unit 150, a count and compare register 160, a maintenance field interface 170, a control store loader 195, an inspection routing register 180 and an intactness.: collective tester 190 on. The examination master register 180 is a register RC of the central processing unit, this register being selected because it resides in the main message processing stream of the central unit and an operand register of the main adder of the central unit forms. This register is connected to the data rail 10 allows the input / output controller to have one direct access to a register in the central processing unit, creating a main transmission path for a systematic exchange of information is formed. The general integrity tester

509824/0709

190 comprises devices for determining faulty states and for processing this fault information. The general integrity tester 190 is also connected to the data rail 10 and supplies the input / output control unit Signals that are caused by the faulty states within the central unit.

The control store loader 195 contains an investigation AND Test program / which in a control memory part of the control memory logic unit 150 or in the control store logic 250 of the Input / output control unit 200 can be stored. The control store loader 195 is connected to the data rail 10. The control store logic unit 150 has facilities Generation of investigation commands as a function of those stored in the control memory part of the control memory logic unit 150 Orders on. In addition, commands from the input / output control unit a sub-command generator via the monitoring rail 20 cause the control store logic unit 150 to issue commands which affect the circuits within the Take effect on the central unit. The control store logic unit 150 is on both the data rail 10 and the monitoring rail 20 connected. The count and compare register 160 has circuitry for executing certain tests during instruction advancement by the control store logic unit 150. The count and compare register 160 is both on the data rail 10 as well as to the control store logic unit 150. The maintenance field interface 170 has devices for manual input of commands for the central unit. It is on the one hand to the data rail 10 and on the other hand to the counting and Compare register 160 connected.

Within the input / output controller, the investigation lead register 280 is selected to be in the main message processing stream of the control unit and one of the OpercPdeiregister

509824/0709

of the main adder of the control unit. A buffer stage can be used if necessary if there is a difference exists in the data format between the input / output control unit and the central unit. The investigation master register 280 forms the main transmission path for systematic data exchange and is connected to the data rail 10. The general integrity tester 290 is used to identify errors and to calculate the error status within the input / Output control unit 200. The group integrity tester 290 is connected to the data rail 10 and to the system investigation display panel 190 connected. The control store logic unit 250 is used to store a program which is generated by the control store loader 195 is loaded via the data rail 10, and it is further used to output a command sequence based on this program. In addition, you can use the toe unit Commands via the monitor rail 20 to a subcommand generator of the control store logic unit 250 for delivery of commands that affect the devices within the input / output control unit. The control store logic unit 250 is connected to the data rail 10 and the monitoring rail 20. The count and compare register 260 includes circuitry for controlling the command sequence from control store logic unit 250. The count and compare register 260 is connected to the control store logic unit 250 and to the Data rail 10 connected. The maintenance field interface 270 is used for manual input of data and commands into the data processing system. The maintenance field interface 270 is connected to the counting and comparison register 260 and the data rail 10. The group integrity testers 190 and 290 of the central processing unit 100 and. of the input / output control unit 200 connected to the system examination display panel 199 which has facilities for displaying the results of the examination and processing which has error conditions, and is also equipped with switches through which the operating method of the data

5 09824/0709

Processing plant can be controlled manually.

According to Figure 4, the examination device is within the Central processing unit (CPU) shown. The control store loader 195 includes a CPU control store load programmer 196 and a CPU control store load buffer register 197. The CPU control store load programmer is the unit that runs the program for examining and testing the central unit having. In the preferred embodiment, a cartridge unit is used. The buffer register 197 ensures that the Program is entered into the central unit in the appropriate data format.

The body integrity tester 190 has a CPU scan delivery register 191, a CPU secondary selector 192, a CPU interruption priority unit 193, and a CPU primary signal generation unit 194 on. The central unit is divided into N areas. Each area from the CPU secondary area 1 up to the CPU secondary area N has associated circuits, which detect the error in each case, and groups of data signals which can be used to identify the location of the fault condition within the relevant area. Regarding of the secondary areas, areas 1 and N are shown with the reference numerals 189 and 188.

The examination routing register 180 consists of the aforementioned Central unit AC register.

The count and compare register 160 is a register which can perform three distinct control functions.

Its first use is as a counting register, which can be loaded with a certain value and then

509824/07 0 9

is incrementally counted down by 1 with each clock pulse. A synchronization pulse is generated when the count is 0 and can be used to control the test sequence. Second, this register has a comparator assigned to it on, the other input of the comparator being formed by the content of the control store address register. To this A synchronization pulse can be generated when the program reaches a previously loaded address. In the end this register forms an entry point for the maintenance field parameter (input M.P.) when an extended procedure is available. The count and compare register 160 consists of a CPU control store compare register 161, a single step down counter 164, a zeroing stop circuit 163, and an address comparison stop circuit 162. The CPU control store comparison register 161 can be loaded from the data rail 10.

The control store logic unit 150 is constructed as follows: A CPU control store 151 has a buffer stage in the form of a CPU control store sense amplifier 152. The contents of the CPU control speiche rs 151 is accessed from the data rail via a CPU control store write data register 156 loaded with an address specified by a CPU control store group address register 157 is determined. The contents of a CPU control store address register 158 are determined by a sequence address means 166, i.e. means which determine the next address within the CPU control store. The next address facility 166 is in turn by a CPU control store interrupt return register 167 or a CPU control store return branch register 159 controlled. The interrupt register 167 stores the address at the time of interruption and the branch register 159 stores the control store address at branch time. A CPU control store master data address register 168 records the previous address of the CPU

509824/0709

subsequently changed

Control store address register 158. The contents of the CPU control memory 151 can be transferred to the internal CPU control store examination register (EN) 153. About this internal registers can - the content of the CPU control memory 151 to data rail 10, monitor rail 20, or to a CPU control store subcommand generator 154. The address found in the subsequent address device 166 is obtained from an address from the test and investigation method or from the contents of an associated register, e.g., the CPU Control Store Interrupt Return Register 167 derived. The control store address register 158 can be one by the interrupt sequence specific address, an address loaded via the maintenance field or the address of the next address device 166. An address loaded via the maintenance field is also loaded into the CPU control store compare register 161. An internal CPU storage register 155 feeds the output of amplifier 152 back to write data register 156.

The system investigation display panel 199 is to the CPU investigation submission register 191 and to the IOC Investigation Submission Register 291 connected.

According to Figure 5, the input / output control unit 200 (IOC) associated examination circuit shown. The investigation-Leitregiste.r 280 contains the previously described IOC register 281.

The body integrity tester 290 has an IOC investigation submission register 291, an IOC secondary selector 292, an IOC interrupt override device 293, an IOC primary signal generator 294 and a number of IOC secondary area circuits for areas 1 through N, i.e., the circuits 289 to 288. These circuits detect the presence of fault conditions and generate a series of signals characterized by the nature and location of the fault condition will. The IOC Investigation Submission Register 291 is attached to the

509824/0709

- 2,58070

Connected system investigation display panel 199, which is shown in the illustrated preferred embodiment is contained in the central unit. The IOC Investigation Submission Register 291 is connected to the data rail IO.

The count and compare register 260 has, as described above, an IOC control store compare register 261, an address compare stop circuit 262, a zeroing stop circuit 263 and a single step down counter 264.

The control store logic unit associated with the input / output control unit 250 is constructed as follows. An internal IOC control store storage register (SKN) 252 can be accessed via the data rail can be loaded and unloaded and its contents can be sent to the IOC investigation subcommand generator 253, which is also connected to the monitoring rail 20. The content an IOC control store 251 can be accessed through the internal IOC control store register 252 can be loaded with an address determined by the IOC control store address register 254, the Address register 254 by a test and examination address, the contents of an IOC control store return register 256, or the Contents of an IOC control store interrupt return register 257 can be loaded. The address previously used by IOC control store address register 254 is stored in an IOC control store master data register 255 filed.

Figure 5 also shows the information exchange channel which is an optional feature of the system. Part of the information exchange channel 171 is connected to the maintenance field interface 170, which is arranged in the central unit is. A second part of the information exchange channel 271 is connected to the maintenance field interface 270 arranged in the input / output control unit.

509824/0709

The information exchange channel is thus both with the maintenance field interface connected within the input / output control unit as well as the central unit. Any maintenance field interface has manually operable switches to control the inspection and testing equipment, and they further comprises electronic switching devices so that signals arriving over the information exchange channel can control the operation control of the examination and testing facility. The information exchange channel is connected to a remote connection point and can despite its spatial Separation of these sub-systems can be viewed as part of the CPU sub-system and the IOC sub-system, respectively.

The information exchange channel is preferably used to enhance the inspection and testing procedures within the control store loader, the entire procedure being removed from one arranged connection point can be controlled, if this is desired. The remotely located connection point can for example another data processing system.

The response from the data processing system being tested is typically sent to the remote connection point transmitted back via the data rail, the maintenance field interface and the information exchange channel. This answer is typically used to determine the next command sequence. The information exchange channel can, however, directly be coupled to the data rail, whereby it takes over the function of the control store loader, and still its influence on maintains the results of the subsystem treatment. In this case, however, suitable control signals must be provided.

In Figures 6a to 6c it is shown how part of the data processing system can be used to. the processes within the. second part of the data processing system to

509824/0709

watch. With regard to FIG. 6a, this is a typical procedure shown, at tier a part of the data processing system monitors its own internal operation. Part of the content of the Control store 151 is stored in the CPU internal control store examine register RN 153 filed. The contents of the register RN 153 are passed on to the CPU examination subcommand generator 154. The output of the generator. 154 has subcommands which cause activities in the central processing unit 100. In In the same way, part of the content of the IOC control store 251 is stored in the internal IOC control store register (SKN) 252. The contents of register SKN 252 are then sent to the IOC investigation subcommand generator 253 issued, which in turn issues sub-commands that are in the input / output control unit 200 trigger corresponding activities.

Figure 6b shows how a part of the data processing system works in a second part of the data processing system can monitor. When the central unit 100 takes over the monitoring, i.e., when the central processing unit assumes the precedence state, a sub-command activates the examination sub-command generator 154 the AND gate 149. This brings the contents of the internal CPU control store examine register 153 over the monitor rail 20 given to the Examine Subcommand Generator. In this way, commands of the CPU control memory 151 resolve the generation of sub-commands in the input / output controller 200. The sub-commands cause a predetermined operation within the input / output control unit 200, whereby the • The examination and inspection program has been carried out. If the Central processing unit 100 assumes the priority state can process commands from the IOC control memory via the register SKN-252 are required by the IOC input / output control unit. Access to IOC Investigation Subcommand Generator 253 from the register SKN is possible via the AND gate 147. The AND gate 147 is switched through if an IOC priority status signal from generator 253 and signals from register RN 153

509824/0709

Not available via the monitoring rail 20.

In the same way for the case that the input / output control unit 200, which controls the activity of the central processing unit 100, i. H. if the input / output control unit 200 is in the priority state, a subcommand from the investigation subcommand generator 253 AND gate 148 activated. This will show the content of the SKN register 252 via the monitor rail 20 to the CPU examination subcommand generator 15.4 switched to, which then generates sub-commands for the central unit 100. These CPU subcommands are generated depending on commands from the IOC control memory .251, which activate the circuit devices within the central unit in a predetermined manner. Even if the input / output control unit 200 is in the priority state, the devices within the central unit 100 can be requested by commands from the CPU control store via register RN 153. Access to the Examine Subcommand Generator 194 from register RN 153 takes place via AND gate 146. AND gate 146 is switched through when the CPU priority status signal of the generator 154 and the signals of the register SKN 252 supplied via the monitoring rail 20 are not present.

According to FIG. 6c, it is shown in what way a subsystem in the priority state and the priority subsystem as well as the sub-subsystem checked. In this case, the examine subcommand generator 154 provides a subcommand which activates AND gate 149. Thus, the instructions of the CPU control store 151 which are in the internal CPU control store examination register 153 are loaded directly onto the Examine Subcommand Generator 154 and via AND gate 149 and monitor rail 20 to the IOC investigation subcommand generator 253 switched. In the same way, a subcommand of the examination subcommand generator 253 activates the AND gate 148, if the input / output control unit IOC 200 is in the priority state.

50982 4/070 9

■ * ι

t t J ■ ι I I

245807Q

is located. The from the IOC control store 251 into the internal IOC control store register Commands written in 252 are sent to the IOC exam subcommand generator 253 and via the AND gate 148 and the monitor rail 20, the CPU probe subcommand generator 154 activated, whereby examination sub-commands are generated in both sub-systems.

It will thus be used to check the integrity of the operation or to determine the origin of a fault condition in a data processing system, two monitoring centers are used to monitor the Monitor the operation of the two subsystems. Monitoring devices within the central unit and the Input / output control unit made use of. In the illustrated preferred embodiment, the monitoring device of the input / output control unit is connected to the operating code unit and is used in addition to the examination and test procedure, to handle service code requested by the channel control units and to execute certain command codes. At two monitoring centers, the establishment of the first monitoring center can be used to establish the with the second to handle the surveillance center connected subsystem. Further the monitoring device of the first center is able to provide an appropriate response to the monitoring by the second center in succession to give results obtained from the manipulation mentioned. Thus, when a fault condition is located, provided that this error does not occur in an affiliated with a surveillance center Subsystem occurs, the other monitoring center can can be used to identify the fault condition. There the fault condition on an isolated from the investigating device Position occurs, the uncertainty is eliminated that would arise if the error were detected with a defective device would have to.

The monitoring centers are each equipped with a control memory for storing a set of commands, and they assign

509824/0709

2458Q70

furthermore a subcommand generator for converting the commands supplied by the control store into commands on the devices acting signals, as well as a counting and comparison register for generating a partial control of the command progression of the control memory , as well as assigned devices for bringing data into the Control store, for fetching data from the control store and for addressing the appropriate control memory location. A control store loader generates a stored program, which is brought into the assigned control memory during the investigation and test procedure.

In both sub-systems there are additional devices for identification an error condition provided. This identification will carried out by a group integrity tester. This device identifies an error condition, e.g. B. when the generated and transmitted parity check signals do not match and transmits the available information relating to the location and nature of the Error condition concerns, to an investigation transmission register. At the same time, when an error condition is detected, a primary signal is generated by the monitoring device is used to ensure that the state of the data processing system is appropriate Generate response signal. This primary signal can be masked out under certain circumstances.

In the present exemplary embodiment, the examination routing register allows which is assigned to essential parts of the data processing system, an access to the signal-changing Part of the data processing system. This access can be used to check the results of the signal processing, whereby the manner of this verification is different from that by the Integrity group tester can be generated error detection and the access can also be used to data

to discard, e.g. B. Data containing errors during an intermediate step of signal processing. Such a data format formation

509824/0709

can be used to locate the operation which results from the generation of an error condition.

It is still a manual entry of data for the examination and examination procedures provided. This manual entry is done via the maintenance field interface. The maintenance field interface allows a more flexible handling of the subsystem compared to the pure preselection of a series of commands.

The independence of both monitoring centers makes it necessary that the results of the data processing in one subsystem are available to the other subsystem. Furthermore, it is often desirable enter a data group from the first subsystem into the second subsystem. To ensure this two-way data transmission a data rail is provided, the main function of which is to create a transmission path for examination and testing of data between the first and second subsystems. In the table at the end of the description are the Data rail coupled devices of the subsystems of the central processing unit and the input / output control unit are shown, and it is the direction of data transmission indicated. For example, the examination master registers of the central unit and the input / Output control unit, as already mentioned, can be loaded with data, and this data can be taken from them again, the monitoring device of the other subsystem acts according to the desired investigation and test step.

The preferred embodiment of the invention includes three modes of operation the monitoring centers of both sub-systems.

The first mode of operation represents the normal mode of operation of the monitoring The center of a subsystem in which under control of the addressing circuits, commands are taken from the control store and fed to the sub-command generator of the subsystem.

509824/0709

This procedure is used in the investigation and testing process used for self-testing of a limited area of the surveillance center. The self-test of both subsystems is generally used to localize an error condition. The localization a detected error condition can, however, just through the occurrence of the error state can be prevented.

The second mode of operation of the system according to the invention consists in that a first monitoring center having priority has the activity of a second in a subordinate state Monitored subsystem. In the preferred embodiment then commands from the control memory of the monitoring center having priority are sent to the subcommand generator of the subordinate Subsystem fed. The command is transmitted via the monitoring rail, which consists of two data transmission rails exists between the internal control store register of one subsystem and the subcommand generator of the other subsystem. Provided the instruction formats of the two subsystems are different from each other, a conventional buffering between the two subsystems becomes intended. In the preferred embodiment, the subcommand generator of the ancillary subsystem can also Receive commands from the assigned control store, provided that the the parent subsystem the sibling subcommand generator not supplied with commands.

The third approach of the two surveillance centers includes the Take commands from the control store of the subsystem with priority for the purpose of supplying the subcommand generators of both subsystems. This mode of operation is used with respect to the test parts of the data processing system which respond to commands between the input / output control unit and the central processing unit. In the preferred embodiment, at In this mode of operation, the central unit is regarded as a priority, as it is the more distinctive and flexible monitoring device. contains. ·.

50982 A / 0709

Il I I ·

The sub-command generators of the central processing unit and the input / output control unit are used to carry out the investigation steps to control, e.g. B. the data transmission via the information exchange rails, the clocking of the units, the cyclical flow of the control memory, the general integrity test and the control of various examination procedures. The generated Steps are divided into internal and external steps. Internal steps are those investigation steps which are a subsystem can perform within itself without direct action on the other subsystem. External steps are those investigation steps which are carried out by one subsystem in the other Subsystem can be executed. There are some investigation steps that are carried out internally and externally together. the Generation of external steps is restricted to the subsystem which carries out the investigation process at the given point in time. This supervisory subsystem takes precedence. That Investigation process is designed so that no more than one subsystem will take precedence at any given time can.

The use of the independent group integrity tester for the two subsystems represents a further feature of the investigation problem. The identification of a faulty state within of a subsystem causes control of the test procedure by that subsystem which has the faulty condition is not affected. Furthermore, the response of the data processing system to an error condition is within the priority Subsystem different from that of the response that occurs when noting an error occurs in the ancillary subsystem. It is therefore useful to have the associated with the two subsystems Separate error checking devices from one another.

For this purpose a system exam display panel is used which is the one obtained from the exam memory registers

09824/0709

Information displays. This display field also contains a manual switch for entering the operating mode of the data processing system, z. B. normal operation, examination operation, etc.

The basis for a proper course of the exam between the sub-system with priority and the subsidiary The sub-system forms a corresponding clock control between the systems. This clock control allows synchronization of the Test sequence and the analysis of the test steps within the subsystem operated with priority with the relatively short test sequence with regard to of the ancillary subsystem. In particular, this timing control allows the test results to be maintained of the ancillary sub-system until they can be analyzed by the sub-system operated in priority.

In the preferred embodiment, a single timer controls the clock systems in the central processing unit, the input / output control unit and the buffer memory portion of the memory interface unit. The main memory sorter (MSS) as part of the memory interface unit (MIU) and each of the A main memory modules have independent asynchronous timing devices.

Within the connected to the common timer device Units, d. H. the central unit, the input / output control unit and the buffer memory, different clock systems are arranged. The central unit and the input / output control unit each have three clock systems. The first clock system is assigned to the control store, serves its cyclic run and is referred to below as the control store clock generator. That The second clock system is used for the functional execution of subcommands and is referred to below as the system clock. The third Clock system is the error signal propagation and the investigation subcommand generation assigned and is hereinafter referred to as a free-running clock designated. Both the control store clock and

509824/0709

the system clocks can be stopped or started or operated step-by-step under control of the hardware and firmware will. The idle clock is always in effect when the common timer source is in effect. The clocking of the buffer memory is done here by the free-running clock.

A number of states are defined in relation to the central subsystem to reflect the state of the system and control store clock circuits. The sub-system states, e.g. B. "Halt", "Idle" and "Waiting" describe the activity of the subsystem as a whole, ie whether the clock is within the priority subsystem, within the priority subsystem and ancillary subsystem, or in neither of the two systems at the time of termination of the Investigation procedure is switched on. The subsystem states, e.g. B. "Running", "Loading" and "Scanning" indicate which clock signals are in effect within the two subsystems at any given point in time in the investigation process. The three clock-related process completion states are defined as follows: in the "Halt ^I!" State, the clock is stopped both in the central unit and in the input / output control unit; in the "idle" state, the clock runs in the priority sub system, and with respect to the ancillary sub-system, the system and control store clocks are stopped; finally, in the "wait" state, all clocks of the central sub-system are in operation the control store clock can run while the system clock is stopped. If both clocks are in effect, the subsystem in question is considered to be in operation, which corresponds to the normal state of the central processing unit and the input / output control unit. During two states, ie when "loading" and "scanning" the control store clock is on and the system clock is off turns on. The "load" state serves two purposes: in functional use it is used to load the control memory and in

S 09824/0709

for additional test use, it allows the control memory of the ancillary subsystem to be addressed as a result of control by the overriding subsystem. For example, the priority subsystem can cause a change in the selection of the storage location sequence of the control memory provided by the subordinate subsystem, which corresponds to a control memory branch each memory location of the control memory is read out in sequence and subjected to a parity check, with no external intervention in the examination process being possible during this scanning process until the end of the same. A "Stop ^n" condition occurs when both the control store and system clocks are ineffective. The override subsystem can replace the slave subsystem in this condition.

The system clock control with regard to the central unit and the input / output control unit can be implemented in different ways will. For example, with regard to the input / output control unit only a single clock system can be provided, by triggering by means of a subcommand generator output signal the system clock is always turned off when the control store clock is turned on and the clock pulses can be taken from the same clock system in both cases.

Circumstances may arise during the execution of an examination program occur that require a check of the clock signals of the subsystem do. Such a case is, for example, when a hardware failure is detected during the execution of a part of the examination program, whereby it is necessary that this part of the program must be carried out to its end. In such cases, the clock is controlled by the firmware and always includes the control of the clock generator of the sibling

5 09824/0709

Subsystem. Another case is when the error is a requires immediate shutdown of the clock in either the primary or secondary subsystem so that the error symptoms cannot be destroyed by further hardware activity.

The design of the hardware allows the automatic stopping of the clock of a subsystem within which an error appears, depending on two mutually exclusive investigation procedures, It is important which investigation method is being carried out in the subsystem at the time of the occurrence of the error will. The two procedures are the normal examination procedure and the investigation suspension procedure. During the Normal investigation procedure results in the occurrence of an undiscovered fault within one of the two subsystems transition to the investigation suspension procedure and a Activation of those circuits of the control store logic which serve to generate the interruption features. At the point in time when the undiscovered fault occurs, the subsystem becomes a Subject to investigation interruption procedures, the hang resulting action depends on whether the subsystem is in the priority state or is in the sibling state. In the case of a subordinate subsystem, the triggered action results in stopping both the control store and system clocks. If the subsystem is in priority mode, the occurrence occurs in addition to the shutdown of its clock generator a special control function that acts as a CPU or IOC priority-error-cancellation function referred to as. If this function occurs, the subsystem previously operated with priority loses its priority position. The other sub-system takes precedence and sets the investigation method depending on the circumstances away.

In addition to finding an undiscovered fault condition, the ability to stop a subsystem's clock, Another feature is this feature is provided by a stop sync pulse at the output of the counting and comparison register

5 09824/0709

realized. This state can be seen through those in priority mode Subsystem used to control the ancillary subsystem during the execution of the test steps from an uncontrolled To prevent loops.

There are various · examination Uriter commands for control the clock signals of the subordinate subsystem via the firmware. A charge level set command stops the clock of the subordinate subsystem and lets the clock of the control store continue to run. A state of charge reset command starts the clock of the subordinate subsystem when the clock of the control memory already working. A clock start command sets all clock systems of the subordinate that are permitted by the state of the subsystem Subsystem in motion.

A clock stop command keeps both clock systems in the sibling Sub-system on. A clock increment command switches the slave subsystem clock continues every time this is not in operation and is enabled by the state of the subsystem. The effect of a timer start is every time to equate the effect of a clock increment if a valid stop status exists.

Referring to Figure 7, there is shown a flow chart illustrating the general Test procedure to determine the integrity of a data processing system or to determine an error condition. Section 1 of the test procedure includes a internal CPU test step 10 and an internal IOC test step 15. These tests are only limited to a limited part within the Central processing unit and input / output control unit subsystem. The limited parts tested include the circuitry required to be expanded by a subsystem Part of the other subsystem to be checked.

509824/0709

At the end of section 1, it is checked in step 20 whether the error has occurred in the input / output control unit. Became during the internal check of the input / output control unit (Step 15) no error found within this subsystem, so in section 2 the checked part of the input / output control unit (IOC) is used to control the function of the central processing unit (CPU) check in step 25. However, in step 20 an error occurred within the input / output control unit during the internal check detected, the central unit is used in step 30 to identify the error state within the input / output control unit After the error has been corrected, the input / output control unit is used to determine if an error condition goes unnoticed during the internal verification process stayed.

Following section 2, the central unit is used, to check the operation of the main memory in step 35 in section 3. Finally, in step 40, both the central processing unit and the input / output controller are used to ensure the integrity of the operation of the memory interface unit check. At the end of step 40 there is a check the integrity of the operation with regard to the entire data processing system before.

The details of this method are described below with reference to FIGS. 9 to 17 and FIG. 7a, FIG. 7a a representation of how the individual process sections according to FIGS. 9 to 17 within the 3 segments of the overall system cooperate according to Figure 7.

The procedure for checking the integrity of the operation of the data processing system is also described very generally with reference to FIG. According to FIG. 8, there are three different at the top Blocks assigned to parts of the system are shown and the remainder of the figure points to one another when reading from top to bottom.

509824/0709

--27-

of the following stages of the test procedure with the interacting Share the system.

Looking first at the top row of three blocks in Figure 8, the central processing unit CPU 700 is in a basic priority area 701, an extended area 702 and a non-priority area 703, while the input / output control unit IOC 710 is divided into a Basic priority area 711, an extended area 712 and a Area 713 is divided without priority. The primary priority area The comprehensive part of the one sub-system has sufficient technical equipment to check the basic priority area and the extended range of the other subsystem. In the input / output control unit, the basic priority area includes' the control field, the addressing logic circuitry for the control store / internal control store data register, a subset the entire sub-instruction decoding and generating device, a basic test and branch logic, the basic functions of the main adder as well as all integrity test circuitry of the device. The CPU basic priority area assigns the IOC basic priority area appropriate circuits. The extended precedence of a subsystem assigns all to the review of the operation of the whole other subsystem required devices. The extended IOC priority area includes the devices of the IOC basic priority area as well as additional memory access options, extended Sets of subcommands, buffers, all main adding functions and integrity test circuitry for the devices of that unit. The expanded CPU priority area includes the expanded IOC priority area devices. The IOC area without priority 713 includes all IOC logic circuits as well as those in the integrity check circuitry not included in the IOC base priority or the extended IOC priority as well as the channel controllers. The non-priority CPU area 703 includes all logic circuits and the integrity checking circuits of the

S09824 / G709

Central processing units which are not included in the basic CPU priority area or the extended CPU priority area, and he further includes the address control unit and the instruction fetch unit. The remaining devices of the data processing system include the main memory, i.e. the part of the main memory that can be checked independently of the input / output control unit, the buffer memory, i.e. all the parts of the buffer memory that are operated by the central processing unit independently of the input / output control unit can be checked and the connection circuits between the central unit and the input / output control unit, i.e., the subsystem logic circuits which carry out concurrent examination firmware commands from the central processing unit and the input / output control unit.

If one now reads FIG. 8 from top to bottom, the Section 1 of the test procedure is the self-test of the basic CPU priority area 701 and the IOC basic priority area 711. Section 2 initially comprises the checking of the CPU basic priority area 701 and the extended CPU priority area

702 by the IOC base priority 711. Next, the IOC base priority and the extended IOC priority area checked by the CPU priority area. This second step is illustrated by the reference numbers in brackets, while the reference numbers not in brackets den show first step of section 2. However, if an error is found in the IOC base priority area during the self-assessment, so the second procedural step is carried out as the first step. Then review the IOC basic priority area and the extended IOC priority area the CPU area without priority

703 and finally the IOC area is passed with no priority 713

the basic CPU priority area and the extended CPU priority area, re i ch over rcheck t.

S 09824/070 9

In section 3, the entire central processing unit CPU checks the Operation of the main memory 706 and the buffer memory 707. Ultimately, the entire central processing unit CPU and the Entire input / output control unit IOC checks the connection circuitry 108, which is the input / output control unit is under the supervision of the entire central unit.

The test procedure for the entire data processing system is shown in detail in Figures 9 to 17, each figure showing a complete process step or a phase of the Examination of a predetermined part of the data processing system represents, these figures represent the rectangles hardware-controlled Commands and the hexagons represent firmware-controlled commands. The distinction between hardware- and firmware-controlled commands is a conventional matter of interpretation.

Phase 1A according to FIG. 9 represents the method for self-checking of the IOC basic priority area. "The examination procedure begins at point 500 for the data processing system. In step the data processing system is in an examination mode of operation toggled, e.g. by means of a switch on the system investigation display panel, and the system is put into operation. In step 502 a command is generated by which the control store loader is read out into the IOC control memory. The step sees the next IOC control store load segment being loaded into the IOC control store. A charging error detected at this point in time leads to step 504 and a new one Attempt to load the IOC control memory. If after 10 charging attempts the IOC control memory has not been charged then in step 505 the system is forced to stop. If there is no loading error, the IOC control store is scanned in step 506. Becomes a when scanning the control memory If errors are found, a termination occurs in step 507 due to an IOC priority area error. When leaving

509824/0709

keys of the control memory no error is found, it takes place in step 508 an internal review of the IOC basic priority area » An IOC error occurring during the internal check of the IOC basic priority area causes in step 507 an IOC priority area error termination. At the end of the command test sequence of the control store, it is determined in step 509 whether the IOC base priority check phase has ended. is this review phase has not been completed; so in step 510 becomes the next IOC control store load program sequence into the IOC control store read in. However, this is the test phase of the IOC basic priority area terminated, then in step 511 a normal termination of the test sequence with regard to the IOC basic priority area takes place. Of the The output of both steps 507 and 511 in this phase points to point A of the flowchart. At this point A is self-practice r Examination of the IOC basic priority area ended, regardless of whether it was successful or unsuccessful.

According to FIG. 10, phase IB relating to the self-checking of the central unit CPU is shown. In step 520 that is next CPU control store load segment is loaded into the CPU control store. Used when loading the CPU control store load segment If an error is detected, the loading of the control memory is repeated in step 521. If after 10 repeated attempts the control memory has not been loaded without errors, the method is stopped in step 522. Will not If errors were found while loading the CPU control store load segment, then in step 523 a scan of the CPU control store is carried out carried out. If an error is detected when scanning the CPU control memory, the data processing system does a branch after step 525, in which a CPU precedence error termination occurs. Will be used during the If the scan of the CPU control memory does not detect an error, the content of the CPU control memory is used in step 524 to the internal check of the CPU basic priority area

5098 2 4/0709

to undertake. At the end of the control memory test sequence at step 526, determines whether the check of the basic CPU precedence is complete. If the test sequence is not complete, then in step 527 the next CPU control store load segment loaded. If the check of the basic CPU priority area has been completed, the system branches to the step 528 in which the normal termination of the CPU base priority test sequence given is. From steps 525 and 528, the system proceeds to step 529 in which it is determined whether the IOC abort signal is present or not. If the IOC abort signal is not present, a branch is made after point B. If the IOC abort signal is present, however, the system proceeds to step 530 in which it is determined whether the CPU abort signal is also present. If the CPU abort signal is not present, the system branches after point D. If the CPU abort signal is also present, the entire system is stopped in step 531.

Figure 11 shows phase 2A, in which the CPU basic priority area and the expanded CPU priority is checked under the control of the IOC base priority. Starting from In process point B, step 503 consists of loading the next IOC control store load segment into the IOC control store. If an error is found in loading the IOC control store, a renewed attempt to load the control store is made in step 504 carried out. After 10 unsuccessful loading attempts, the system is stopped in step 505. If there is no loading error, then in step 506 the contents of the control memory are scanned. When an IOC control store error is detected during the scanning process an IOC precedence error termination results in step 542. Used when scanning the iOC control memory If no error is found, then in step 540 the IOC acts as the basic priority area and examines the in step 541 Basic priority area and the extended priority area of the central processing unit CPU operated in secondary priority. Will regarding the

509824/0709

If the central processing unit CPU detects an error, then in step 543 an IOC secondary-priority error termination takes place, and then the system halted in step 544. If there is no error and the contents of the control memory of both the input / output control unit are available IOC and the central processing unit CPU completely before, it is determined in step 545 whether the phase IB is complete is or not. If a test sequence with regard to the input / output control unit IOC is not completed, then im Step 546 generates an IOC control store read request and the process returns to point B. If the If the test sequence has not reached the end with regard to the central processing unit CPU, a CPU control store read request is made in step 547 generated. Subsequently, in step 520, the next CPU control store load segment is entered into the CPU control store loaded. If there is a loading error, loading of the control memory is attempted again in step 521. After 10 unsuccessful Attempts to load the system are stopped in step 522. If there is no load error, the content of the CPU control memory is saved sampled in step 523. Thereafter, at step 540, the system returns to examine the subordinate CPU base priority and the expanded CPU priority through the IOC base priority. When testing the central unit CPU is completed by the input / output control unit IOC in this phase, a normal end is made in step 548 displayed. The result of the IOC priority area error termination in step 542 or the result of the IOC normal termination at step 448 it is used to test for a CPU abort signal. If the CPU abort signal is not present, this is achieved Data processing system process point H. If the CPU abort signal is present, it is determined in step 550 whether also the IOC abort signal is present. If the IOC abort signal is not present, the system reaches method point F. However, if it is the IOC abort signal, this leads to a system halt in Step 551. The test for the presence of the CPU abort signal

509824/0709

in step 549 can also be reached through the reentry point.

Figure 12 shows phase 2B, in which the IOC base priority area and the extended IOC priority area can be monitored by the basic CPU priority area. In procedure point D is the next CPU control store load segment is loaded into the CPU control store. If an error is found while loading, so another attempt to load the control memory is carried out. If the charging process is fault-free after repeated charging attempts of the control memory is not reached, the data processing system is stopped in step 522. When the If no error is found in the control store, the CPU control store sampled in step 523. If an error occurs when scanning the control memory, then step 562 results a CPU priority area error termination. We'd be no mistake Scanning the contents of the control store detected, the CPU base priority tests the IOC base priority and the extended IOC priority area with the contents of the control memory. The detection of an error within the central processing unit CPU in step 562 causes a CPU precedence error termination. The detection of an error in the input / output control unit IOC causes a normal CPU shutdown in step 563 and then a system halt in step 564. At the end the test sequence with respect to one of the two control stores, a determination is made in step 565 as to whether the test sequence is terminated or not. If the test sequence is not completed and are those resulting from the current contents of the control memory When method steps are completed, a CPU control store read request is generated in step 566 and it is returned to process step D. If the test sequence is not completed, and are those by the contents of the IOC control memory If the triggered method steps are completed, an IOC control store read request takes place in step 567 and that

509 824/0709

The next IOC control store load segment is loaded into the IOC control store. In step 503 the writing of the next IOC control store load segment into the IOC control store is initiated. If an error is found during charging, then in step 504 another charging attempt is made. If the control memory has not been loaded without errors after IO loading attempts, the system is halted in step 505. If there is no error when loading the control memory, then in step 560 the IOC basic priority area and the extended IOC priority area are examined under the control of the CPU basic priority area. If it is determined in step 565 that the test sequence has reached the end _f, then in step 568 a normal CPU termination is generated. The CPU normal exit in step 568, the CPU precedence failure exit in step 5 ^ 2, and the re-entry point 572 cause the system to proceed to step 569 where the IOC abort signal is tested. If the IOC abort signal is not present, the system proceeds to method point F. If the IOC abort signal is present, a check for the CPU abort signal is carried out in the subsequent step 570. If the CPU abort signal is not present, the system reaches method point H. If the CPU abort signal is present, the system is stopped in step 571.

In Figure 13, the phase 2C is shown, in which the CPU area without priority by the IOC basic priority area and the extended IOC priority area is examined. Starting with process point F, the control memory of the input / output control unit IOC is loaded with the next IOC control store load segment and steps 504, 505 and 506 follow as previously described. In the absence of a loading error or a scanning error, the check of the CPU area is carried out without priority by the IOC

509824/0709

Basic Precedence and the IOC Extended Precedence performed in step 580, the verification process being through the content of the control memory is determined. The detection of an error within the input / output control unit IOC or a Scan errors result in an IOC precedence error termination in step 582. The determination of an error within the central unit -CPU leads in step 583 to an IOC secondary-priority error termination. In step 584 an IOC re-examination sequence is performed performed and at step 585 an idle condition of the data processing system can be achieved. If the test of the CPU logic circuits does not take precedence through the IOC base priority and the extended IOC priority area is interrupted due to depletion of the contents of the control store, so a determination is made in step 586 as to whether or not the test sequence has ended. If the test sequence is not finished and you are yourself operations resulting from the contents of the IOC control memory have been completed, an IOC control memory read request is made in step 587 and the process point F is returned. The test suite is not completed and are the operations resulting from the 'contents of the CPU control memory are fully executed, in step 588 a' CPU control store read request generated and the next CPU control store load segment is loaded into the CPU control memory. The function of the now following steps 520, 521 and 522 has been completed already described above. If the test sequence is at the end in step 586, this leads to an IOC normal termination in step 589. Based on the IOC normal termination in step 589, the IOC priority area error termination in step 582 or the re-entry point 594, the presence of the CPU abort signal is checked. The CPU abort signal is not is present, the system proceeds to process point H. If the CPU abort signal is present, the IOC abort signal becomes tested in step 591. If the IOC abort signal is not available,

509824/0709

the data processing system then advances to method step J. If the IOC abort signal is present, then will a system halt is reached in step 592.

the
FIG. 14 shows phase 2D in which the IOC area is checked without priority by the CPU basic priority area and the extended CPU priority area. Starting from system point H, the next CPU control store load segment is loaded into the CPU control store in step 520. Steps 520, 521, 522 and 523 have already been described in more detail above and do not need to be explained in more detail here. In step 600, the IOC logic circuits are checked without priority by the CPU basic priority area and the extended CPU priority area. The detection of an error within the central processing unit CPU or a counter in the scanning of the CPU control memory leads to a CPU priority area error termination in step 602. The detection of an error within the input / output control unit IOC leads to a CPU subordinate counter termination. Subsequently, in step 604, a CPU follow-up check is carried out, which in step 605 causes the system to run idle. The CPU follow-up check 604 also has a re-entry point 613. At the end of the check with regard to the completeness of the operations resulting from the content of the two control stores, it is determined in step 601 whether the test sequence has been completely processed. If the test sequence is not complete and the contents of the CPU control store are exhausted, then in step 607 a CPU control store read request is triggered. The system then returns to method step H. If the test sequence is not completed and there are no further commands in the IOC control store, an IOC control store read request is made in step 608, which causes the IOC control store to be loaded with the next IOC control store load segment. Steps 503, 504, and 506 following step 608 have already been described above. If it is found in step 606 that the test sequence is complete, then in step

6 09824/0 709

609 generated a normal CPU termination. The CPU normal termination in step 609, the CPU priority error termination in Step 602 and the re-entry point 612 are used to test for the presence of the CPU abort signal. Is the CPU abort signal does not proceed, the system proceeds to step J. If the CPU abort signal is present, the Step 611 creates a system halt.

FIG. 15 shows phase 3A in which the main memory is checked by the entire central processing unit CPU, which has priority. Starting with process step J, the In step 520 the next control store load segment is stored in the CPU control store. The sequence of steps 52o, 521, 522 and 523 have already been described in more detail above, so that they no longer need to be explained here. In step 620 the begins entire central processing unit CPU operated with priority the examination of the main memory. The presence of a CPU bug in the Step 620, or a scan error in the control store, causes a CPU priority miss termination in step 625. The detection of an error in the main memory causes the CPU subordinate error termination in step 621. Next is done a follow-up CPU check in step 623, which in step 624 results in an idle state. The CPU follow-up check has a re-entry point 631. After the CPU control memory test sequence has been executed, step 626 a test is performed to determine whether the test suite is complete. If the test sequence is not complete, the Step 627 a CPU control store read request and the system returns to process point J. If in step 626, that the entire test sequence has been carried out in full, a CPU control store read request results in step 673. the CPU control store read request in step 6 73, the CPU priority error termination in step 625 and the re-entry point 630 all lead to a check "on the presence

509824/0709

gen of the CPU abort signal in step 628. If the CPU abort signal is present does not proceed, the system proceeds to method step K. If the CPU abort signal is present, then leads this in step 629 to a system halt.

In Figure 16, the phase 3B is shown in which the buffer memory is checked by the entire central processing unit having priority. Starting with system K, step 520 loads the next CPU control store load segment into the CPU control store. Steps 520, 521, 522 and 523 were made previously described and need not be explained in more detail here. The central processing unit CPU is used in step 640 to check the buffer tank. In the case of a detected error within the central processing unit CPU or in the presence of a A scan error of the control memory results in a CPU priority area error termination in step 641. If an error is detected with regard to the buffer memory, a CPU subordinate error termination is triggered in step 642. In step 643 finds a follow-up CPU check takes place which ends in step 644 in an idle state. The CPU follow-up check in step 643 is provided with a re-entry point 654. Regarding the command execution of the CPU control memory, step 645 a determination is made as to whether the test suite has completed. If the test sequence does not complete, then in step 648 a CPU control store read request is made triggered and the system returns to point K of the procedure. If the test sequence is finished, there are the CPU control store issues a read request in step 649. The control store read request at step 649, the CPU override error termination in step 641 or a re-entry point 653 lead to a check of the presence of the CPU abort signal in step 650. If the CPU abort signal is present, a system stop is achieved in step 652. Is this CPU abort signal not present, then in step 651 it becomes present of the IOC abort signal checked. Is the IOC demolition

509824/0709

signal is also present, a system stop is achieved in step 652. If the IOC abort signal is not present, then steps advances the system to point L of the procedure.

FIG. 17 shows phase 3C, which is the test method with regard to the intermediate circuits between the central unit CPU and the input / output control unit IOC concerns. Starting from process point L, the next CPU control store load segment becomes loaded into the CPU control store at stage 520. Steps 520, 521, 522 and 523 were previously described in more detail and are not explained in more detail here. In step 640, the entire central processing unit operated with priority run the CPU and the entire in priority operated input / output control unit IOC under control by the central processing unit CPU the investigation of the connection system. If the test sequence due to the lack of further unexecuted commands in one of the two Control store is interrupted, the test sequence is checked for completeness in step 667. Is the test suite not completely carried out and the instructions of the CPU control store have all carried out, then in step 668 a CPU control store load request triggered and the system returns to process point L. The test suite is not complete carried out and all instructions of the IOC control memory have been carried out, then the system in step 670 is due an IOC control memory load request in the process point M is fed back, as a result of which the next IOC control store load segment is loaded in step 503-. Steps 503, 504, 505 and 506 have already been described in more detail above. The presence an error within the central processing unit CPU or a scanning error of the CPU control memory leads to in step 661 a CPU priority area error termination, which in turn results in a system halt in step 669. The finding an error regarding the input / output control unit

509 8 24/0709

IOC results in an IOC override error termination in step 663 and subsequently in step 664 in a system halt. If the test sequence has ended, then in step 671 the examination is carried out of the intermediate logic circuits is ended and the entire test procedure is concluded in point 672.

FIG. 18 shows the sequence of steps in the localization of an error condition / which occurs in the IOC basic priority area. The localization of the fault condition is shown for the case / where the fault condition occurs during the self-checking phase is not detected as well as the case where the fault condition is detected during the self-checking phase. Starting with Phase IA, the IOC core priority area is dealt with through a program that includes self-assessment of the Devices within the IOC basic priority area. If an error is found during this self-check, thus a precedence failure termination (MET) occurs, which is represented by the solid line in FIG. If the faulty status within the IOC priority area during the self-assessment according to phase IA no detectable If an error is produced, a normal termination (NT) results which indicates the absence of an error and what is shown by the dashed line. In both cases, the procedure goes into phase IB, in which the CPU priority area is checked by a program that causes the devices to self-check. Since in the CPU priority area If there is no error condition, the process stage IB ends in a normal termination (NT), which indicates that that there is no error in this part of the data processing system. Starting from this normal termination (NT) of phase IB, the process advances to phase 2A, provided that no error was found in the IOC priority area. In phase 2A, the detection of an error leads to a priority error termination (MET) as the input / output control unit

509824/0709

IOC forms the priority unit. From the termination of the priority error (MET) the procedure advances to phase 2B. However, during phase 2A it is possible that the fault was in the IOC base precedence is not determined. The phase 2A is then in a normal termination (NT) according to the dashed line completed. Starting from the normal termination (NT) of phase 2A, the method proceeds to phase 2B. However, if the Phase IA ends in a priority error termination (MET), so leads phase IB to normal termination (NT) and bypasses the procedure the phase 2A and goes directly to phase 2B. Phase 2B ends in a secondary-priority error termination (SET), which is indicated becomes that an error in the data processing system under test was established. The expiry of the test procedure in a secondary priority error termination (SET) results in the Possibility of locating the error through the program, although extensive investigation procedures in certain cases may be required.

In the same way, the occurrence of a faulty state leads to it in any part of the data processing system immediately ^ for generation a secondary priority error termination (SET). The investigation process works its way through the phases of the test procedure and bypasses those phases in which a precedence failure termination (MET) occurs.

The strategy used in the investigation and verification process consists of self-testing a basic part of the monitoring circuits associated with each subsystem, use the tested primitive of each subsystem to to test an extended part of the other sub-system, to use the tested extended part of each sub-system, to test the whole other sub-system, and finally this strategy uses every whole sub-system checked

509824/0709

to test the circuits between the two subsystems. The subsystem of the central processing unit CPU, which is the furthest has developed monitoring circuits is also used to control the main memory and the buffer memory testing.

The particular subsystem abort signal is generated when that subsystem has an internal error condition while it is working in priority mode itself. The phase of the test procedure is then terminated by a priority error termination completed. The reaction of the investigation and verification process to the appearance of a "priority-error-termination." is the generation of an abort signal for this subsystem and a test to determine whether an abort signal for the other Subsystem is also present. If there is no termination signal for the other subsystem, the control of the examination and testing process relocated to the other subsystem, thereby avoiding faulty devices from failing locate. If the termination signal is also present in the other subsystem, this leads to a system halt in the data processing system.

Precautions can be taken to ensure that when a system halt is reached, due to the two abort signals present, over a maintenance field interface these abort signals are deleted and a re-entry point into the test procedure is re-entered. The presence of a faulty state can thus be ignored and the fault localized defective technical equipment can be attempted.

A normal exit indicates that the particular phase of the test procedure has been performed and that no errors have been found.

509824/0709

A halt state due to a control store load error is achieved, requires manual intervention Determine the origin of the error.

A secondary-priority error termination usually results from the detection and localization of a fault condition in the circuits of the subsystem, which is in the secondary status is located. In the event that the test sequence determines an error condition with regard to the subordinate subsystem was, however, the test sequence was not sufficient to determine the error condition more precisely, a follow-up test is triggered. The follow-up check, which repeats the test sequence for a detected error, is used to check the to confirm the detected error state and thus avoids the complete repetition of the investigation procedure Repair the malfunctioning unit. After a follow-up check, the data processing system is in an idle state. The follow-up check can also be carried out by means of a re-entry point under manual control from the maintenance field interface can be made from.

The read request for index steps, which occurs in certain phases of the test procedure, causes the program of the Control store charger to the beginning of a sequence of instructions for the next phase of the test procedure to proceed.

509824 / Ό709

I 1 1

Table 1: Subsystem name of the register

loadable

unloadable

CPU

Control store address register

Control store master data register

Control store return branch register

Control store return interrupt register

Control store compare register

Control store successor address generator

Internal control store function register

Internal control store examination register

Control store group address register

Control store data write register

5 09824/0709

üntersystem Name of the register loadable unloadable

CPU

Examination master register χ

Investigation transmission register χ

Internal control store buffer register

IOC

Control store address register

Control store master data address register

Control store return interrupt register

Control store compare register

Internal control storage register

Examination master register

Investigation Transmission Register

509824/0709

Claims (5)

Claims Self-checking data processing system, characterized by two sub-systems, each of which has control circuitry for controlling the operation and for monitoring the subsystem and circuit for the Detecting errors, as well as through a monitoring rail between the two sub-systems to the control circuitry of each of the two sub-systems to enable the other sub-system to be tested. 2. System according to claim 1, characterized in that that the control circuits of each subsystem have a control memory for storing a command set, a control circuit for taking commands from the control memory and a sub-command generator for Control of the subsystem in dependence on such commands, and that the monitoring rail has the control memory of each subsystem with the subcommand generator of the each other sub-system connects. 3. System according to claim 2, characterized by a maintenance field interface which is connected to both Subsystems is connected and allows manual control of one or both of the subsystems. 4. System according to claim 1 or one of the following, characterized by an examination controlled by the error detection circuit of both subsystems 509824/0709 Scoreboard to show the existence and nature of what has been detected Error. 5. System according to claim 1, characterized by one that connects the two subsystems Data rail for monitoring the status of various Register in one subsystem by the other subsystem. 6. System according to claim 5, characterized z e i cn η e t that each subsystem is one on the data rail connected master register has that the master " register is formed from the operand register of a main adder in the subsystem and that the master register is a Main transfer of data effected via the data rail. A system according to claim 1, characterized in that each subsystem is connected to a message exchange channel is connected, each subsystem by signals injected over the message exchange channel can be checked and the test results are displayed via the messaging channel. 8. System according to claim 1, characterized in that the two sub-systems ^{1 are given} by a central unit and an input / output control unit. 9. System according to claim 1, characterized through test facilities within each subsystem for self-checking of one part of the sub-system at a time and by an action of each sub-system on the each other subsystem for the purpose of checking the entire other subsystem. 509 824/0709 10. System according to claim 9, characterized in that the test device interrupts the test method when an error is detected. 11. System according to claims 9 and 10, characterized that the test facility is the test of each subsystem, by the respective other sub-system is effected by first the self-checking part of each sub-system in turn already checked part as well as other parts of the other subsystem checked and that afterwards the checked parts of each subsystem in turn the remaining parts of the other subsystem check. 12. System according to claims 9 to 11, characterized in that further outside of the subsystems arranged devices to be checked are available and that the test device has devices that cause both subsystems together to test the further devices after the two subsystems have completed themselves are checked. 5 09824/0709