DE3328405C2 - - Google Patents

Description

The invention relates to a multi-computer system according to the preamble of claim 1.

Especially when such multi-computer systems for the central tax computers of a telephone switching system are used particularly high requirements for safe operation, the maintenance data integrity and fault tolerance.

In a known multi-computer system (US Patent 42 45 344) these requirements taken into account in that a double multi-core system bus is provided and that the information Parity-secured transmission on this bus.

A multicomputer system with double bus made up of standard components is also made of "Electro nics ", January 27, 1983, pages 94 to 97.

In another known multiprocessor system (NTG reports volume 80, March 1982, VDE-Verlag, pages 94 to 104) are for the purpose of Processing security computer pairs formed, their more orderly Operation is monitored by comparing the output signals.

The object of the invention is to start a multi-computer system give that meets the requirements mentioned, although it is from Individual computers is built, which is not safe for this are enough, and that it is also in its security technology behavior can be adapted to different requirements can.

This object is achieved in the characterizing part of patent claim 1 specified features solved.

Further refinements of the invention are specified in the subclaims.

The invention and its developments are based on of the examples shown in the figures, where it shows

Fig. 1 is an overview of the multicomputer system together with the central system,

Fig. 2 other aspects of the example shown in Fig. 1,

Fig. 3 is a data processor,

Fig. 4 is an interface processor,

Fig. 5 shows a memory array redoubled,

Fig. 6 shows a memory array ungedoppeltem,

Fig. 7 is a possible signal at the central management system,

Fig. 8 signals to the central system bus Entkoppelbaugruppe,

FIG. 9 is a table showing variations of the BIC status,

Fig. 10 is a schematic diagram of the BIC,

Fig. 11 is a block diagram of one half of the BAS (right half),

Fig. 12 shows a possible arbitration logic,

Fig. 13 is a timing diagram concerning the arbitration,

Fig. 14 is a timing chart with respect to a write cycle,

Fig. 15 is a timing chart with respect to a read cycle in non-redundant subscribers,

Fig. 16 is a timing diagram for modified read-write cycle, as well

Fig. 17 is a timing diagram for a write cycle of a TWIN pair to another TWIN pair.

FIG. 1 thus shows an example of the concept of multi-computer system according to the invention. Several PROC computers work together via a multi-core system bus CSB, possibly also with a central memory unit MU connected to the system bus CSB. The system bus CSB is doubled in itself, that is, it forms a system bus pair, with the control lines being doubled for each other in order to secure the transmission on each system bus CSB, cf. also FIGS . 7 and 8. In addition to the information lines, this also includes still use parity lines to increase security.

The computers PROC - and in general also preferably the central memories MU - are each doubled, see FIG. 1, and thus each form a pair of computers working in parallel, or a pair of memories, each of which has its own local bus LB. are connected to a BIC / BIC bus interface circuit.

Each consisting of two identical parts BIC BIC / BIC bus interface circuit checked for safety in turn that of the computer pair or memory (pair) PROC, MU received information as well as their own the system bus CSB signals to be sent by a ver  equal. In the event of inequality, the bus interface Circuit BIC / BIC itself and therefore also connected This pair of computers or memory (pair) PROC, MU from the system bus CSB and reports this shutdown of the bus Zen trale BAS as an alarm.

The tax received from each individual system bus CSB The generation and information signals are also from the Bus interface circuit BIC / BIC checked, the In only then to the received pair of computers or Memory (pair) PROC, MU passed on if at least on one of the two system buses CSB the transfer was error-free.

At the request of the BIC / BIC bus interface circuit The BAS bus center then shares in each system bus COD double lines of this bus interface circuit BIC / BIC to the relevant system bus CSB, the Bus release within a maximum occupancy time follows.

When operating both system buses CSB there is an additional part only if there is a connection on both CSB system buses was made. If one of the two fails System buses CSB meet the requirement on the ver the CSB system bus remains intact.

The BAS bus center takes its own lines to the Bus interface circuits BIC central security radio tion true in many ways, namely z. B. by the collection of alarms from the bus interface circuits gen BIC / BIC, by switching bus-in on and off interface circuits BIC / BIC and thus of computer pairs and memory (pair) PROC, MU, by the on and off switch through one of the two system buses CSB Test orders to the bus interface circuits BIC / BIC, with which system bus errors can be localized and  by switching off a pair of computers or memory (paa res) PROC, MU the system bus redundancy can be maintained can, further z. B. by system start and by Communication with security processes that run on any of the PROC computer pairs.

The BAS bus center consists of two equal parts, each one for the two system buses CSB are arranged, whereby all signals to be transmitted are compared be and being the registration of an inequality what leads to a shutdown of the bus center BAS a replacement bus center BAS is reported. The he Set bus center BAS is determined by the state of the bus signals and messages from the active bus center BAS always kept up to date. If this message is a certain time is missing, or in the event of a failure report the active bus center BAS, or with routine The functions of the two BAS bus centers can be exchanged the previous replacement bus center BAS the task of Take over the active BAS bus center without gaps.

The IO organs are preferably connected to an IO interface switching CIC / CIC via two standard IO buses. The IO interface circuit CIC / CIC can communicate via the two local buses LB with the parallel computer pair PROC and the bus interface circuit BIC / BIC, see FIGS. 1 and 2.

The IO interface circuit CIC / CIC consists of two equal parts that the two local buses delivered are arranged. They are also all on the IO Bus signals to be compared compared. In case of inequality the bus interface circuit BIC / BIC switches off System bus CSB and reports the alarm to the bus Zen wear BAS.  

The IO interface circuit CIC / CIC sends at one IO transfer usually only to a single IO bus, but they usually have a single IO Bus received information each at both local LB buses of the parallel pair of computers PROC or the bus interface circuit BIC / BIC.

The bus center BAS, the bus interface circuit BIC / BIC and the IO interface circuits CIC / CIC monitor theirs own functionality as a rule. You register errors yourself, e.g. B. voltage errors, clock failure and watch dog expiration, whereby they switch off yourself as in the case of a comparator error and report the alarm.

A further development of the invention contains, for one fault-tolerant operation whereby if one PROC or central memory MU of the program running in the system is not disturbed, two pairs of computers and two memory pairs PROC, MU, each in parallel work. If a PROC computer fails, one of the Computer pairs are managed by the other intact PROC computer pair the current task continues on its own. In the event of failure a memory MU one of the memory pairs does that intact memory pair MU the current task initially away alone. This means that the intact memory pair MU continues to have correct data available.

Two can simultaneously on the same system bus CSB Bus interface circuits send BIC / BIC, whereby on the System bus CSB has an active potential, that prevails when different potentials be created.

The BAS bus center shares the CSB with the system bus bus interface scarf belonging to both computer pairs PROC BIC / BIC only if both bus interface switches  BIC / BIC of the computer pair PROC willing to send have made a request to be erroneous computers working the same, i.e. the failure of one of the Computer pairs can be recognized at this point in time. The BAS bus center registers the fault-tolerant Operating mode related bus interface circuits BIC / BIC, which in principle can be selected arbitrarily and lifts the PROC if a pair of computers fails Doubling up so that the remaining pair of computers PROC can be assigned the system bus SCB.

The IO organs are each connected to an IO interface scarf CIC / CIC connected via the local Buses with two parallel pairs of PROC computers and two bus interface circuits BIC / BIC communicate can. As a rule, only one IO-Inter sends at a time face circuit CIC / CIC of the IO interface circuit pair CIC / CIC on an IO bus - Receive from an IO bus Information is preferred over outcrossing from one IO interface circuit CIC / CIC to another Ren IO interface circuit CIC / CIC of an IO interface Circuit pair CIC / CIC transmitted. The bus center BAS puts together the fault-tolerant operating mode associated IO interface circuits CIC / CIC as IO Interface circuit pair CIC / CIC on and on Failure of an IO interface circuit CIC / CIC or one associated PROC computer or the associated bus Interface circuit BIC / BIC in the IO interface scarf CIC / CIC from the fault-tolerant operating mode.

The invention can be developed so that it asynchronous operation is not permitted with the Problems of a fully synchronous system is burdened and which allows any commercially available calculator and To use memory. For this, the data transfer fer controlling bus lines "Adress Valid" AV, "Data Valid "DV and" Transfer Aknowledge "TK from the am  Transfer involved bus interface circuits BIC / BIC switched to active as soon as possible. The bus interface circuits BIC / BIC - also the ge RAD sending BIC / BIC - evaluate the level transitions active after passive the bus controlling the data transfer lines, so that fault-tolerant pairs through this over Control signals on the CSB system bus are synchronous will hold. The signals that control the data transfer the bus lines are from the bus interface circuit BIC / BIC synchronized to its own clock. If but after a waiting period of e.g. B. 1 or 2 bars on the other system bus CSB does not also receive this signal the bus interface circuit ignores BIC / BIC for the ongoing transfer to the other system bus CSB to avoid a complete interruption.

To maintain the command sequence in parallel PROC computers can also use the interrupts - e.g. B. from the timer - be masked, except for an interrupt that is derived from a counter whose counter reading is fixed is coupled with the command sequence as when counting the Address latch enable pulses. With an interrupt this Counters are all connected to the interrupt controller Interrupts from PROC computers of the bus interface circuit BIC / BIC communicated. The computer then reads PROC again both the interrupts on by both of them a bus interface circuit belonging to BIC / BIC PROC, as well as those interrupts, which according to the system bus CSB for the computer PROC be det; it also reads if there is an IO interface CIC / CIC circuit to which local buses are connected, the interrupts collected here for the PROC computer a. The from the computer PROC from its bus interface scarf device BIC / BIC and - if available - IO interface switch CIC / CIC read interrupts are in these Circuits BIC / BIC, CIC / CIC cleared one time  Monitoring in the BIC / BIC bus interface circuit makes sure that not only one of the two is parallel working computer PROC reports an interrupt what namely from the bus interface circuit BIC / BIC is regarded as an error, which to switch off the Computer pair PROC from the system bus CSB leads. The two BIC / BIC bus interface circuits leading to two errors owned, exchanged, operated PROC computers after the PROC computers have given them the interrupts have shared this interrupt over the system bus CSB Messages, whereby only those interrupts from the PROC computers can be read in again by all computers involved here PROC and from the associated CIC / CIC have been notified.

If the bus interface circuit or IO interface Circuit BIC / BIC, CIC / CIC a message on a lo kalen bus receives and if this circuit BIC / BIC, CIC / CIC after a specified maximum waiting period from other local bus LB but still no message received, causes the bus interface circuit BIC / BIC the switching off of the computer or memory pair PROC, MU from the system bus CSB, because then there is an error lies.

Functions of the lines of each system bus CSB are now explained by way of example with reference to FIGS. 7 and 8. B. 32 information lines are addresses and ope rationscode, the latter on z. B. 4 lines, and then sent data on the same lines, where the information such. B. with additional, e.g. B. four to seven, parity lines are secured. As long as a bus interface circuit BIC / BIC keeps the line LOCK doubled for each system bus CSB in the active state, several data transfers can be carried out in succession on the system bus CSB without, or before, the bus center of the system bus CSB again to share.

Various Lei are available for serial communication available: Via the common serial Line, the BAS bus center sends one to a bus Interface circuit BIC / BIC addressed message from Mel from the individual bus interface circuits BIC / BIC to the active bus center BAS; and over two zen Central serial lines SAC communicate the active Bus center and the replacement bus center with each other. The active BAS bus center can be used for any bus interface Circuit BIC / BIC on by sending the active level whose reset line is switched off by the CSB system bus Maintain state while the active bus center BAS is running the change in potential from the active to the passive level a reset of the bus interface circuit BIC / BIC and the associated computer or memory pair PROC, MU, as well as switching on the bus interface circuit BIC / BIC to the system bus CSB.

Each CSB system bus consists of e.g. B. from a Mehrla Gigen board to which several, z. B. six ten, bus decoupling assemblies of the bus interface circuits BIC / BIC and the two BAS bus centers can be connected. The information and control lines are on the two Line ends with line terminations that also have the function, in the passive state the associated one Apply potential with high resistance. The bus interface scarf The BIC / BIC can be connected to the bus decoupling module via cables pen containing the line drivers be and supply them electrically.

The serial communication on the system bus CSB should now are explained in more detail. There is a serial message from packets that, in addition to the start and stop bit, e.g. B. eight, information bit and an additional bit, the additional bit only for the first packet of a message  the BAS bus center on the common serial line device GSI is set, while the additional bit is otherwise used for Parity assurance is used. The bus interface Circuit BIC / BIC that is always ready to report messages receive the common serial line, right initially only registers a packet if the additional bit is set, this package in the first, e.g. B. four, Bits the address of the addressed bus interface scarf device contains BIC / BIC and only the addressee he Register the first package and the other packages of a message strictly. The BAS replacement bus center is always ready Messages on one of the two central serial Receive lines SAC. The bus interface circuit BIC / BIC or the replacement bus center BAS are allowed to do so from just one continuous signal on an individual series len ISC or on one of the two central se sial lines send to the active bus Zen trale BAS to indicate a communication request. Like this long the active bus center with an intact bus Interface circuit BIC / BIC communicates on the individual serial line no continuous signal, son response packets for the active bus Central BAS sent while a bus Interface circuit BIC statically on the continuous signal lies. The active bus center BAS teaches according to the Execution of an order of a bus interface scarf BIC / BIC first the replacement bus center BAS and then the bus interface circuit BIC / BIC thereupon the continuous signal is reduced, if not yet there are further orders. If the active fails BAS bus center while processing a job A bus interface circuit BIC / BIC finds the previous BAS replacement bus center, which is now becoming active, the continuous signal again and thus processes the open carry over again, while still securing the transmission Acknowledgments, additional parity bits and a timeout monitoring of the transfer can be provided.  

A secure memory MU, but without duplication of the Memory MU or the memory content is obtained, if the information in the memory MU is sufficient appropriate number of parity bits is secured so that One-bit errors are corrected and two-bit errors can be recognized. The memory control exists preferably from two identical, synchronously operated tax MCU, each connected to their local bus LB. are closed. The memory MU is only one single control actively described, but when reading both controls carry out error correction and testing through, the detection of an uncorrectable Error in at least one of the two controls as Memory failure can be interpreted.

The concept of the invention thus allows "normal" Computers and save a fault-tolerant multi-computer build system. The next one is of particular importance usability of the existing ones System software for using the computer as a tax computer, especially of highly complex systems, e.g. B. of telephone switching systems. By standardized Interfaces, it is then even possible to progress in the development of the system participants without feedback to use the overall concept.

Essential parts of the concept are explained again with reference to FIG. 1 - now from a different perspective. Accordingly, the concept consists of the CSB system bus and various participants. Safety-related functions are fulfilled by the components marked with a dashed line. These include the CSB, the bus center BAS, the two identical parts BIC of the bus interface circuit BIC / BIC and IO interface circuit CIC / CIC, which in turn consists of the identical parts CIC.

Each participant is internally linked. The doubling does not serve to increase availability - in return part, this even decreases - but the detection of errors nung; reliable error detection is considered un essential part of every usable additional computer system considered. Undetected, possibly over Several computers can postpone errors, if they be noticed at all, not localized afterwards and therefore not be repaired.

However, assuming that every mistake is certain immediately is noticed and in its effect on each participant remains limited in which he appeared, un different requirements regarding computing security, Availability and fault tolerance are met.

If only high computing security is required, It is sufficient in itself, according to a (internal participant) Ver same alarm stop and the canceled program to start again after the repair. But become high System availability requirements, can be a redundant participant or one with others Stepping in tasks entrusted to participants. When a If the program is terminated, the disrupted program may to be set up again.

But become actual fault-tolerant properties required, namely when a program has been started cannot be canceled again, then the Invention the possibility to synchro two participants nize that if one participant fails the other participants continue the common task alone leads, and in such a way that the surroundings of it nothing notices (twin operation). The invention offers one high level of safety-related modularity, that different security requirements technical behavior is not only met statically  can, but that the configuration is even dynamic and set individually for different programs can be made cash.

Apart from the internal doubling of the participants, there is a computer architecture or an arrangement of their switching elements, for which an example is given by FIG. 1.

This structure allows the tasks on all processors to distribute the same, or else processor-bound. Data and programs can be found both in the local stores of the Processors, as well as kept in shared memories will. The required performance determines the number of processors, at least as long as no saturators appearances at the CSB or in the shared memory CM to step.

Participants on the system bus CSB are data processors DP, Interface processors IP, in addition to the data processors DP best of two equal parts CIC existing IO interface circuit CIC / CIC connections to the I / O buses to which I / O processors are connected sen, also common memory CM. The Participants are on the system bus over two of the same BIC share existing BIC / BIC bus interface circuits connected. Two BAS bus centers are for central Tasks provided.

An example of a multi-computer system is given in Fig. 2. Here are two interface processors IP, the access to the various IO processors IOP, z. B. operate a switching technology periphery VT, and have IO bus extensions BEU. Both the data processors DP and the memories CM can be operated - dynamically selectable - as fault-tolerant pairs (TWINs).

The CSB can e.g. B. ver a maximum of 16 participants tie; this can then e.g. B. 16 processors if no shared memory is needed, or any any mix of processors and memories.

Which processor is chosen for IP or DP is initially irrelevant to the concept of the invention. It is important to set up the interface to the BIC. See the data processor DP in FIG. 3 and the interface processor IP in FIG. 4. These figures show, for example, the structure using a clock generator C, local memory units LMU, processor units PU together with the double system bus CSB 0 , COD 1 . All processors that have the same local bus LB can be operated by the BIC or CIC. If you want to use commercially available computers and memory, no further demands may be made of the participants apart from the definition of the local bus LB. Therefore, at least in the case of further developments of the invention, clock synchronism of the subscriber internal processors must be dispensed with.

FIG. 5 shows a storage example with a double and FIG. 6 with an unduplicated memory array AY. The memory control is always duplicated. As can be seen from FIGS. 5 and 6, the Com mon memory CM also has an internal bus in this example, which is expediently identical to the LB of the processors. The CM can be constructed differently depending on the size of the storage medium. If there is only one array, the MCU should, if possible, also provide safety-related functions.

The structure of the multiple calculation system should be as little as possible safety-related requirements for the respective Provide participants with hardware and software.  

The bus signals are structurally divided into different line areas of the CSB, namely in the lines in the multilayer and in the lines of the ribbon cable between the bus decoupling assembly AK and BIC of the subscriber. From the function z. B. are different in common bus lines, to which each participant has access, and in individual lines, which lead from each participant to the left BAS BASl and right BAS BASr, or which connect the two BAS with each other, see FIG. 7 and 8. FIG. 7 shows the signal routing at the CSB, the doubling of the CSB not being shown for reasons of clarity. Multilayer signals MLS and signals on the subscriber cable STK to the subscribers TLN are also shown. Fig. 8 shows signals on a CSB decoupling module with individual lines IndL and "real" bus signals EBS on the subscriber cable STK and multilayer ML, with lines in the multilayer, including the common bus lines, e.g. B. 32 address / data lines / bidirectional (bd), 4 parity lines / bd, 3 reserve lines for possible expansion of the parity bits for ECC / bd, 2 reserve lines for possible interrupts / bd, further 8 control lines, namely 2 Address Valid (AV ) / bd, 2 Data Valid (DV) / bd, 2 Transfer Acknowledge (TK) / bd; 2 Lock (LOCK) / bd, additionally 1 serial communication line with 1 Global Serial Interface (GSI) / unidirectional: BAS - TLN; as well as the individual lines, e.g. B. 1 Request (RQ) / uni directional (ud): TLN - BAS, 2 Grant (GT) / ud: BAS-TLN, 1 Individual Serial Channel (ISC) / ud: TLN - BAS, 1 Res (RS) / ud: BAS - TLN and 2 Serial Arbiter Communication (SAS) / ud: BASl - BASr.

The cables in the cable between bus decoupling and BIC are z. E.g .: 32 address / data lines, 4 parity lines, 5 reserve lines, 12 control lines with 2 AVH / ud, 2 AVZ / ud, 2 DVH / ud, 2 DVZ / ud, 2 TKH / ud, 2 TKZ / ud and  2 Lock / bd, also 1 Global Serial Interface GSI / ud: BAS-TLN, 1 request / ud: TLN - BAS, 2 grant / ud: BAS - TLN, 1 Individual Serial Channel ISC / ud: TLN - BAS, 1 reset RS / ud: BAS - TLN, 1 transmitter lock / ud: TLN - bus decoupling, 2 power supply lines SV (to guarantee the Tri-state output when the decoupling module is inserted), 3 transmitter control signals SST / ud: TLN - bus decoupling with 1 transmitter lock ADR / DAT lines, 1 transmitter lock Control lines and 1 change of direction: send / Receive.

As can be seen from FIG. 1, the BIC forms the interface between the subscriber and the system bus. Fig. 10 shows the principle circuit diagram of a BIC example. The data flow and control sequence depend on the bus operation and the BIC status according to the table shown in FIG. 9. To explain the basic functions when receiving from the CSB, the PW action should be explained in more detail:

A participant sends data on the CSB. Not everyone active participants take over this data with AV or DV into the CADR or CDAT register. Simultaneously with that Latching into the CADR is done by COD CONTROL CCT checks whether it is one for the recipient relevant address. This is not the case, no further activities are initiated. Recognizes the CCT but the address as in its own area properly, then it triggers the BIC-CONTROLL BCT. These switches the address as soon as the I-Bus is free Parity check by. The process in the BCTs of the BICs (of a participant) is by crossing out all rele synchronized event signals. Only if both BCTs have not detected a parity error, the checked addresses are transferred to the MADR register. On the data is then processed in an analogous manner ren; they are transferred from CDAT to the MDAT register.  

Finally, the BCT initiates the multibus control MCT, the data provided in MADR and MDAT according to the multibus protocol to the participant forward.

BCT encountered an error while checking parity both BCTs remain on the alarm request stand. This leads to a time out in both BICs Alarm that is sent as an interrupt to the control processor CP is leading. This initially blocks the command line BCT and evaluates the alarm and status signals. In the BIC, in which the parity alarm was recognized, takes place the connection of the X-Bus to the I-Bus and the Transfer to the corresponding Multibus register the CP, provided the partner BIC has the correct parity has received and no new pari on its own I-bus physical alarm has occurred. Then the CP gives the Command lines of the BCT are free again and delete the Parity alarm. In the BIC, which received without errors, the CP returns control to the BCT without its own To carry out measures. As soon as the parity alarm is deleted, both BCTs set the control of the Ab keep going. Both halves of the participant receive the information received without errors. Both have BICs received with wrong parity, or occurs when crossing tick the one-sided correctly received information parity alarm again, the received data not forwarded to the participant. In all disturbance The CP transmits cases via the individual serial Channel ISC a corresponding alarm message to the BAS.

The sending process as part of the AW campaign then runs z. B. as follows:

The MCT-Control hears those sent on the multibus Addresses with. Shows an address on the common  Memory or in the BIC-individual IO room, acti fourth the MCT the BIC-CONTROL. This causes about the CCT sending a REQUEST on the CSB. Meets the GRANT from the BAS, this first causes the asynchronous switching of the MB address by MADR and CADR on the CSB, switching the parity network on "Generate parity" and arm the AV signal. At the same time, the MCT is caused to complete the MB cycle close. The GRANT signal is synchronized; both BCTs start and switch with the same cycle the address on the own I-bus on the X-bus, where the information of both BICs overlaps (wired or). The address superimposed in this way is the one on your own I-bus lying compared; in good cases, the BCT sends to the CCT to remove the AV signal and thereby declare the address valid. The CCT checks whether the AV signal also disappears on the CSB Detects and sends the receipt as soon as this is the case to the BCT that the address has been declared valid. This is followed in an analogous manner with the data method. Finally, the cycle at the CSB with the Removal of the TC signal completed.

If an alarm occurs during the comparison, the BCT remains on the alarm request. This leads to a time Out alarm that causes an interrupt on the CP. The CP takes control and initiates the lock first ren the address or data sender to the CSB. With a delay The control signals are then switched off, so that in the case of a twin configuration there are no errors acceptance at the received participant.

The serial interface to the BAS is e.g. B. be as follows driven: sends the BAS over the serial line GSI, an interrupt occurs in the CP if it has its own Recognized address. Since it cannot be guaranteed that both BICs (from both CSBs) receive the message  must have this out before further processing to be crossed. This is preferably done by the CP, controlled via the X-Bus.

When sending the BIC over the serial channel ISC (for BAS) two states have to be distinguished:

• - Alarm status (call waiting at BAS):
  Statically active potential is applied to the ISC line. This leads to an interrupt in the BAS and to the interrupt handling for the reception selection of the alarming BIC.
• - Information status (data transfer to BAS):
  If the BIC is requested to send messages via the GSI channel, an upcoming call waiting signal (alarm) is removed from the ISC line and the data is transferred from the CP:

The Synchroni is of particular importance in this case interruption conditions. Interrupts are required both in the computers not running synchronously Participant, as well as between participants in the TWIN-Be driven, synchronized. Interrupts should therefore can only be admitted if all affected invoices have the same command count; also should ensure that all computers have the same In get terrupts. Within a participant, the Interrupt synchronization e.g. B. re in the following way be alized:

• - Local interrupts:
  These occur within a computer, e.g. B. when the internal timer expires. In the interrupt controller of the participant's two computers, all interrupts are masked except for one level. The unmasked interrupt is generated by a counter that a certain number, z. B. 10⁴, of Address Latch Enable (ALE) cycles of the PROC, z. B. 8086 counts. This count should be on the assembly, e.g. B. ISBC 86 / 12A from Siemens. It is reset on the start of a subscriber in both computers and thus generates signals that are generated in a command-synchronous manner (not time-synchronized!) In the two computers of a subscriber. In the associated interrupt routine, the (masked) interrupts pending at the interrupt controller are transferred to the BIC using the OUT command. This OUT command generates an interrupt in the CP of the BIC. The BIC does not immediately acknowledge the multibus cycle of the OUT command so that the subscriber computer cannot continue with the program (= interrupt routine). The CP in the BIC now crosses out the interrupt bits present in the BICs via the X bus and forms the intersection of the interrupts present in the half of the subscriber. Then the BIC (controlled by the CP) acknowledges the multibus cycle so that both subscriber computers now continue with the interrupt routine in command synchronization. The IN command following the OUT command transfers the symmetrical interrupts pending in the BICs to the subscriber computer, where they can be processed according to their priority. If the CP has identified the same interrupts from both subscriber computers, it checks whether the previously different interrupt bits have become the same with the next ALE counter interrupt; if this is not the case, there is a participant hardware error that is reported to the BAS via an alarm.
• - External interrupts (interrupts from the BIC):
  Such interrupts arise due to "Inter Processor Commands" (IPC). IPCs that are known in a BIC first generate an interrupt in the CP that analyzes the command received and, if it is a message to the subscriber computer, sets an interrupt bit that is then sent to the next ALE counter interrupt. Treatment with local interrupts is read in and processed.

If two computers are running in TWIN mode, all of them must also be used Interrupts synchronized in the two participants will. Here, for. For example, the following procedure is used: First each participant synchronizes its interrupts in the BIC as described earlier. The CPs (in all four be participating BICs) recognize by querying a port that Twin operation exists and apply by creating the RQ signal one CSB cycle. This cycle runs (as only) not symmetrical in the twins. The through a configuration bit called "leading" twin first sends its interrupts after the BUS allocation to the "not leading" twin. After that, the "not" leading "twin interrupts to" leading Twin sent. Only after the exchange on BICs acknowledge receipt of the OUT command to the CSB on the multibus, so that now all four participants Computer synchronously with the interrupt handling can set, which only takes into account the interrupts, in both twins.

As is apparent from Fig. 1, the bus center BAS forms the conclusion of the CSB; ie CSB always contains a "Left BAS" BAS1 and a "Right BAS" BASr. BASl and BASr are doubled again and monitored by comparison. One BAS is active in the running system, the other is in hot standby mode and is able to take over the CSB control without interruption at any time.

The BAS has z. B. the following tasks: the COD supply line, Configuration handling of the CSB and the participants, Routine check of the CSB, control of the check in the Participants, localization of defects at the COD or in the participants, carrying out the core run, as well as maintenance the operating system interface for security tech nik.  

The function of the BAS can best be described using an example of the structure of a BAS in FIG. 11, which for simplicity only shows the right half of the BAS example. B. can be divided into three main parts, namely the arbitration unit, serial communication and the BAS processor. The arbitration unit receives from e.g. B. A maximum of 16 participants, one request RQ per CSB. For synchronization to the BAS clock, each request first runs through a register, which simultaneously carries out the conversion from ECL (CSB) to TTL level. The second synchronization stage is in the Arbitration Logic ABL or AC, an example of which is shown in FIG. 12; there mean: STE or STD single / twin encoder or decoder, PRE or PRC priority encoder or counter, and ABC arbitration control.

To keep the BAS halves in sync, the RQ Crossed lines between halves. The AC leads the COD allocation for unduplicated (single) and double (twin) operation.

The CSB allocation can be set using the BP software, under the condition: Fixed priority with choice of the highest priority participant, or rotating priori fair allocation. If an RQ arrives, this leads in sync in both BAS halves at the start of the Arbitra tion control ANY RQ. A new request is accepted if the controller is in the IDLE state. The arbitration is proactive, d. i.e. while the grant The new GT-Si will signal the predecessor gnal determined-

When fully expanded, the RQs stored in RQSYN are deleted from SINGLE-TWIN ENCODER RAM STE only passed on if at Both RQ signals are applied to the individual TWINS. The after following rotating priority PRIORITY  ENCODER PRE selects the participant with the highest priority act out. Finally, the SINGLE / TWIN DECODER RAM provides STD that both are selected for a selected TWIN related participants get a GT signal. At small number of participants, a single RAM build is sufficient stone to perform the functions described above in one Step. The GTs are on the system bus switched through if a be time passed and - with ongoing arbitrie tion - the end of the last bus cycle with TK (and LOCK) was signaled. You must also at this point the GTs determined internally in the BAS halves match agree (MP GT - otherwise an alarm is sent to the processor BP reported, and there must be no other alarm otherwise further arbitration will be stopped).

The bus transfer is e.g. B. with a BUS TIMEOUT COUNTER supervised. If this counter expires, the ar bitration stopped and a corresponding alarm to the BP reported.

The assignment of twins can be freely changed, since SINGLE / TWIN-ENCODER and -DECODER STE, STD to the Address and data bus of the BP are switched on and everyone time can be reprogrammed. Becomes a GT signal placed on the COD, the storage takes place at the same time in the LAST-GT register. The LAST-GT is readable by the BP and is used in the event of an error to determine the participant who has requested the CSB cycle. The GT signals are doubled to each participant for security reasons leads, see GT and GT *. A transmitter error for a GT bit could otherwise lead to total failure in single-CSB operation to lead.

The SCHCONT serial channel control controls the transmission or direction of reception for serial communication: - In the Individual Serial Channel ISC z. B: Every participant  sends on this line to every BAS. First reports the subscriber creates a message to be output by creating it a continuous signal, d. H. Alarm, on. At the request of BAS the participant sends the message. - In the global Serial Interface GSI: The BAS sends on this line to a participant after selected by the address judge. - In Serial Arbiter Communication SAC: The SAC consists of two lines for communication between the two BAS. - In the intra-BAS communication IBC: The IBC consists of two lines for communication between the halves within the BAS.

The comparator CMP SCH belongs to the SCHCONT outgoing serial lines GSI and SAC. Encounters active potential in one of the serial channels, ent there is an alarm signal that causes an interrupt. The alarm signal is static. Since it is not safe is that an alarm message is received on both CODs the BAS crosses the two halves which information ALC from the IBC interface, at least in duplex mode. As a rule, the BAS then the alarming subscriber via GSI or SAC interface on, detailed information to send. The reception selection is based on the corresponding Station set. After a timer for the the maximum waiting time for the participant's response will be BP internal buffer register of the serial interface read out and its content mutually from the IBC exchanged. The interrupt can then be reset and, if necessary, the associated alarm can be masked.

The BAS processor BP provides all but the arbitration other BAS line features are available.

It has an external program memory PROM and one RAM memory. Via an address decoder fol Controlled IO ports:

Status logic (STAT);
the STAT contains flip-flops that affect the BAS-internal configuration. So z. B. which RQ receiver is to be synchronized, or which BAS half it is, etc. The status logic can be read and partially loaded via the BP bus.
Alarm collection (ALC);
In the ALC, external alarms are synchronized to the BAS clock and saved with the BAS internal alarms. An OR signal from all alarms leads to the interrupt input of the BP after a second clock synchronization flip-flop. The interrupt is synchronized between the BAS halves. The external alarms can be individually blocked. To differentiate the cause of the interruption, the BP reads the content of the ALC onto its bus.
Arbitration logic (AC);
Serial Channel Control (SCHCONT);
Rest Logic (RSL);
the reset logic contains a port for e.g. B. 16 individual lines for resetting each subscriber and a comparator for each RS line. The transmitters are only enabled for the RS signals if the comparison result is positive.

Each data cycle on the CSB is registered by the active participant with the REQUEST signal. The arbitration takes place centrally with BAS. The assignment of the CSB is given by the GRANT signal GT. The GRANT line GT is doubled for safety reasons. The requesting participant only accesses the CSB if both GRANT lines have active potential. The participant who completes a CSB cycle reports the completion of the transfer to the BAS with a confirmation signal (TC). Fig. 13 shows an example of the initiation and completion of the COD-cycle, wherein n, m bus cycles, t _w waiting times for arbitration (it depends on the priority of the subscriber and the number of gleichzei tig appended requeste RQ), t _{RQ, off} switch-off time for the request after the bus allocation, t _TK, delay until the acknowledgment signal TACK (TK) is prepared, tk _{TK, min} minimum duration for TK, t _A arbitration time, t _T transfer time on the bus and t _C Mean bus cycle time.

Depending on the mode of operation of the participants, this can also be done CSB data protocol differ into a protocol for unduplicated participants and in a protocol for doubled te participants (twins). Both protocols are - what the or concerns the doubled participants - identical; d. that is, a participant does not need to in this regard know whether he has a partner twin or not. Only the BAS knows about the configuration. If a twin sends a request, it waits until the partner twin RQ then sends and shares this to both GRANT signal too. No further measures are necessary.

There are two different CSB cycles for unduplicated participants. Fig. 14 shows an example of the timing of the write cycle, wherein (S) transmitter (R) receiver, t _{S, AD} set up time address t _AD address provisioning time, t _{h, AD} hold time address t _{S , D} set up time data, t _{h, D} hold time data, t _AR address recognition time in the receiver and t _DP data processing time in the receiver.

As soon as GT (from BAS) is received, (asynchronous from the participant) created the addresses and the tax AV and DV signals prepared. Are the addresses on swinging and right (comparison), they are by way acceptance of AV as valid. After the hold time who which the data is created and after the settling time Removing DV declared valid if the comparison  was positive. If the recipient receives the addresses has recognized it, it applies the TC signal until he has saved the data and for a new COD- Cycle is ready. This completes the write cycle. The BAS takes away the GT signal and assigns it if a new cycle.

If the comparison of addresses or data was negative, the A / D and parity transmitters are blocked. The lines go into the passive state, cf. LOW in Fig. 14. After the settling time, AV and / or DV are switched passively. The recipient takes over addresses or data of wrong parity and separates them in the BIC. The receiver ends the cycle as usual by removing the TC signal.

Fig. 15 shows an example of the timing of the read cycle. The designation and times apply analogously as in FIG. 14, where t _{DA means} data provision time of the recipient. As with writing, the addresses are assigned to the lines according to the bus assignment. The signals AV and TK are prepared at the same time. As soon as the addressed recipient has recognized the address (and the operation code), it applies the DV signal. After the data access time and the data setup time, DV is removed. The BIC of the reading subscriber (S) takes over the data and acknowledges receipt by removing the TC signal as soon as it has given the data to the subscriber and is thus free for the next CSB cycle. In the case of a comparison alarm, the statements regarding the write cycle according to FIG. 14 apply accordingly.

The CSB can be reserved to implement read-modify-write cycles. For this purpose, the LOCK signal generated in the PROC iSBC86 is placed on the CSB when the bus is allocated. As long as the LOCK signal is present, the BAS ignores the TK signal. The end criterion is: TK and LOCK are passive. Fig. 16 shows an example of the timing of a read-write access in a reserved bus. The number of reserved bus cycles is only limited by the time monitoring in the bus. The CSB remains reserved until the reserving participant removes the LOCK signal.

If participants are operated in twin mode, they must synchronize each other. Besides, it's supposed to be possible at any time of a bus cycle, after off in case of a twins the log with the remaining one Continue computer without this from the partner part taker (who can also be a twin) is noticed.

The CSB data protocol is synchronized via the control lines, which are also required for the operation without doubling. In twin mode, two participants send simultaneously on the CSB, ie addresses or data and parities of both twins overlap on the bus. As already explained in connection with FIG. 13, in the present example the BAS assigns the grant signal to each twin of a pair as soon as it has received the request from both. The Twins TK signal or is on the CSB; Only when TK becomes passive does the BAS take away both GRANTs and award the next cycle.

The data exchange is synchronized via AV or DV. The control signals also change (active high) on the CSB. A twin only continues the CSB cycle when it has recognized by listening to the control signals that its associated twin has reached the same position in the log. To make this possible, each BIC must have access to the AV and DV signals directly at the CSB. For this reason, the transmission and reception paths for AV and DV between bus decoupling and BIC are designed separately, see also FIG. 8.

Fig. 17 shows an example of the timing for a length cycle with Twins as a transmitter (processor) and Twins as a receiver (memory). The signals marked with * are present at the respective input of the CSB driver. Since the AV and DV can also be listened to in unduplicated mode, there is no difference for the BIC control between unduplicated mode and twin mode in the present example.

Claims (10)

1. Multi-computer system with several, via a double, multi-core system bus (CSB) with parity-secured transmission to cooperating computers (PROC), characterized in that the control lines of the system bus (CSB) are doubled again,

• - The computers (PROC), which are each doubled, each connected to a bus interface circuit (BIC / BIC) via a local bus (LB),
• - The bus interface circuit (BIC / BIC) consisting of two equal parts (BIC), the information received from the computer pair and own signals to be sent on the system bus (CSB) are compared by comparison, the bus being Interface circuit (BIC / BIC) switches itself off and thus also the connected computer pair (PROC) and reports this to an alarm center (BAS) as an alarm,
• - The control and information signals received by each individual system bus (CSB) are checked by the bus interface circuit (BIC / BIC), whereby the information may only be passed on to the computer pair (PROC) if at least on a system bus ( COD) the transfer was error-free,
• - at the request of the bus interface circuit (BIC / BIC), the bus center (BAS) shares the system bus (CSB) via lines of this bus interface circuit (BIC / BIC) which are duplicated in each system bus (CSB), the bus release takes place within a maximum occupancy time,
• - When operating both system buses (CSB), an assignment is only made if a request has been made on both system buses (CSB), while if one of the two system buses (CSB) fails, the request on the remaining intact system bus (CSB) is sufficient.

2. Multi-computer system according to claim 1, characterized, that to the system bus (CSB) a central double storage unit  (MU) is connected. 3. Multi-computer system according to claim 1 or 2, characterized in that

• - The bus center (BAS) via its own lines to the bus interface circuits (BIC / BIC) performs central security functions by collecting the alarms from the bus interface circuits (BIC / BIC) by switching on and off Bus interface circuits (BIC / BIC) and thus of computer pairs and memory pairs (PROC, MU), by switching one of the two system buses (CSB) on and off, by means of test orders to the bus interface circuits (BIC / BIC ), with which system bus errors can be localized and the system bus redundancy can be maintained by switching off a computer pair or memory pair (PROC, MU), by system start and by communication with safety-related processes that run on any of the computer pairs (PROC),
• - The bus center (BAS) consists of two equal parts (BASl, BASr), which are assigned to the two system buses (CSB) and compare all signals to be sent, with the registration of an unequal to switching off the bus center (z. B. BASl) does what is reported to the replacement bus center (BaSr),
• - The replacement bus center (BASr) is always kept up to date by the state of the bus signals as well as by messages from the active bus center (BaSl), whereby if this message is missing for a certain time or if the active bus center fails (BASl) or, if the functions of the two bus centers (BAS) are routinely exchanged, the previous replacement bus center (BASr) can take over the task of the active bus center (BASl) without gaps.

4. Multi-computer system according to one of claims 1 to 3, characterized in that

• - The IO organs are connected to an IO interface circuit (BIC / BIC) via two standard IO buses, which are connected to the parallel pair of computers and the bus interface circuit via the two local buses (LB) ( BIC / BIC) can communicate,
• - The IO interface circuit (BIC / BIC) consists of two equal parts (CIC), which are assigned to the two local buses (LB) and compare all signals to be sent on the IO bus, with the bus interface being different Circuit (BIC / BIC) switches off from the system bus (CSB) and reports the alarm of the central bus (BAS).
• - The IO interface circuit (CIC / CIC) actively sends an IO transfer to only a single IO bus and the information received from a single IO bus in both local buses to the parallel computer pair (PROC) or Bus interface circuit (BIC / BIC) forwards,
• - The bus center (BAS), the bus interface circuits (BIC / BIC) and the IO interface circuits (CIC / CIC) each monitor their own operability by themselves, with voltage errors, clock failure and watchdog - Register the process and, as in the case of a comparator error, switch itself off and report the alarm.

5. Multi-computer system according to one of claims 2 to 4, characterized in that

• - for fault-tolerant operation of the multi-computer system, the program sequence in the system not being disturbed in the event of a computer (PROC) or central memory (MU) failure,
• - Two pairs of computers and two pairs of memories (PROC, MU) each work in parallel and if one of the pairs of computers fails, the other intact pair of computers (PROC) continues the current task on its own, or if one of the pairs of memories fails, the intact pair of memories (MU) continues the current task alone, which means that correct data is still available in the intact memory pair (MU),
• - Two bus interface circuits (BIC / BIC) can send simultaneously on the same system bus (CSB), since an active potential is marked on the system bus (CSB), which becomes established when different potentials are applied,
• - The bus center (BAS) only assigns the system bus (CSB) to the interface circuits (BIC / BIC) belonging to the two computer pairs (PROC) if both bus interface circuits (BIC / BIC) have made a request ,
• - The bus central unit (BAS) registers the bus interface circuits (BIC / BIC) that belong together in the fault-tolerant operating mode, which can be selected in principle, and, in the event of a pair of computers (PROC), cancels the doubling so that the remaining pair of computers (PROC) can be assigned to the system bus,
• - The IO organs are each connected to a pair of IO interfaces (BIC / BIC) that can communicate via the local buses with two parallel pairs of computers (PROC) and two bus interfaces (BIC / BIC),
• - sends only one IO interface circuit (BIC / BIC) of the IO interface circuit pair (BIC / BIC) to an IO bus,
• the information received from an IO bus is transmitted via cross-out lines from one IO interface circuit (BIC / BIC) to the other IO interface circuit (BIC / BIC) of a pair of IO circuits (BIC / BIC),
• - The bus central unit (BAS) sets the IO interface circuits (BIC / BIC) that belong together in the fault-tolerant operating mode as an IO interface circuit pair (BIC / BIC) and, in the event of failure of an IO interface circuit (BIC / BIC ) or an associated computer (PROC) or the associated bus interface circuit (BIC / BIC) switches off the fault-tolerant operating mode.

6. Multi-computer system according to one of the preceding claims, characterized in that

• for an asynchronous operation of the multicomputer system which is not burdened with the problems of a fully synchronous system and which allows any computer and memory to be used,
• - The bus lines controlling the data transfer "Address Valid" (AV), "Data Valid" (DV) and "Transfer acknowledge" (TK) from the bus interface circuits (BIC / BIC) involved in the transfer as soon as possible in put the active state,
• the bus interface circuits (BIC / BIC) actively evaluate the level transitions according to the passive of the bus lines controlling the data transfer, so that fault-tolerant pairs are kept synchronized by these transitions of the control signals on the system bus (CSB),
• - The signals of the bus lines controlling the data transfer from the bus interface circuit (BIC / BIC) are synchronized to their own clock, whereby if after a waiting time on the other system stembus (CSB) this signal was not also received, the Bus interface circuit (BIC / BIC) for the current transfer ignores the other system bus (CSB),
• - to maintain the command sequence in parallel working computers (PROC), which are masked interrupts except for an interrupt which is derived from a counter, the counter value of which is firmly coupled to the command sequence as when counting the address latch enable pulses,
• - In the event of an interrupt of this counter, all of the interrupt pending on the interrupt controller from the computer (PROC) of the bus interface circuit (BIC / BIC) are communicated, the computer (PROC) then reading the interrupts again, both of them into one Bus interface circuit (BIC / BIC) belonging computers (PROC) are communicated, this computer (PROC) additionally reads the interrupts that are reported via the system bus (CSB) for the computers (PROC), and if an IO interface circuit (CIC / CIC) is connected to the local buses, the computer (PROC) also reads the interrupt collected here for the computer (PROC),
• the interrupts read by the computer (PROC) from its bus interface circuit (CIC / CIC) in these circuits (BIC / BIC, CIC / CIC) are deleted,
• - A time monitor in the bus interface circuit (BIC / BIC) ensures that not only one of the two computers working in parallel (PROC) reports an interrupt, which the bus interface circuit (BIC / BIC) regards as an error which leads to the computer pair (PROC) being switched off from the system bus (CSB),
• - The two bus interface circuits (BIC / BIC), which belong to two fault-tolerant computers (PROC) after the computers (PROC) have notified them (BIC / BIC) of the interrupts, via the system bus (CSB) Interrupt messages are exchanged, and only those interrupts are read in by the computers (PROC) that each of the four computers (PROC) has communicated,
• - If the bus interface circuit or IO interface circuit (BIC / BIC, CIC / CIC) receives a message on a local bus (LB) and who this circuit (BIC / BIC, CIC / CIC) according to a predetermined maximum waiting time from the other local bus (LB) has not yet received a message, the bus interface circuit (BIC / BIC) initiates the switching off of the computer or memory pair (PROC, MU) from the system bus.

7. Multi-computer system according to one of the preceding claims, characterized in that

• - to operate the lines of each system bus (COD) of the multi-computer system,
• - Addresses and operation codes and then data are sent on information lines, the information being secured with additional parity lines,
• - As long as a bus interface circuit (BIC / BIC) keeps the line (LOCK) doubled for each system bus (CSB) in the active state, several data transfers on the system bus (CSB) can be carried out in succession before the bus center (BAS) reassigns the system bus (CSB),
• - Various lines are available for serial communication, whereby
  • via the common serial line (GSI), the bus center (BAS) issues a message addressed to a bus interface circuit (BIC / BIC),
  • - via individual serial lines (ISC) messages from the individual bus interface circuits (BIC / BIC) to the active bus center (BAS), and
  • - Communicate with each other via two central serial lines (SAC) the active bus center (e.g. BASl) and the replacement bus center (BASr),
• - The active bus center (BAS) can keep each bus interface circuit (BIC) by sending the active level on its reset line in the state switched off by the system bus (CSB), while the active bus center (BAS) by the potential change from active to passive level, resetting the bus interface circuit (BIC / BIC) and the associated computer or memory pair (PROC, MU) and switching on the bus interface circuit (BIC / BIC) to the System bus (CSB) initiated.

8. Multi-computer system according to one of the preceding claims, characterized in that

• - Each system bus (CSB) consists of a preferably multi-layer board, to which several bus decoupling modules of the bus interface circuits (BIC / BIC) and the two bus centers (BAS) can be connected via plugs,
• the information and control lines are provided with line terminations at the two line ends, which also have the function of applying the associated potential in the passive state,
• - The bus interface circuit (BIC / BIC) is connected via cable to the bus decoupling modules, which contain the line drivers, and supplies them electrically.

9. Multi-computer system according to one of the preceding claims, characterized in that

• - For serial communication on a system bus (CSB) of the multi-computer system
• - A serial message consists of packets that contain additional information bits and an additional bit in addition to the start and stop bit, the additional bit being set only in the first packet of a message from the bus center (BAS) on the common serial line (GSI) is while the additional bit on the other serial lines is used to ensure parity,
• - The bus interface circuit (BIC / BIC), which is always ready to receive messages on the common serial line, initially only registers a packet if the additional bit is set, this packet being the address of the first bits contains the addressed bus interface circuit (BIC / BIC) and only the address sat registers the first packet and the other packets of a message,
• - the replacement bus center (BAS) is always ready to receive messages on one of the two central serial lines (SAC),
• - A bus interface circuit (BIC / BIC) or the replacement bus center (BAS) by itself only a continuous signal on an individual serial line (ISC) or on one of the two central serial lines (SAC) may send in order to indicate a communication request to the active bus center (BAS),
  As long as the active bus center (BAS) communicates with an inactive bus interface circuit (BIC / BIC), no permanent signal but rather reply packets to the active bus center (BAS) are reported on the individual serial line (ISC) , while if a bus interface circuit (BIC) fails, the permanent signal is applied statically,
• - after the completion of an order for a bus interface circuit (BIC / BIC), the active bus center (BAS) first informs the replacement bus center (BAS) and then the bus interface circuit (BIC / BIC), which then cancels the continuous signal if there are no more orders,
• - If the active bus center (BAS) fails while processing an order from a bus interface circuit (BIC / BIC), the previous replacement bus center (BAS), which now becomes active, finds the permanent signal and so that the order is processed anew,
• - Receipts, additional parity bits and time monitoring of the transfer are provided to secure the transmission.

10. Multi-computer system according to one of the preceding claims, characterized in that

• the information in the memory is secured by a sufficient number of parity bits so that one-bit errors can be corrected and the two-bit errors can be recognized,
• - the memory controller consists of two identical, synchronously operated controllers (BCU), each of which is connected to its local bus (LB),
• - The memory (MU) is only actively written by a single controller (MCU), while when reading both controllers (MCU) carry out the error correction and checking, the detection of an uncorrectable error in at least one of the two controllers (MCU) is interpreted as a memory failure.