DK143819B - APPARATUS TO ENABLE COOPERATION BETWEEN AN EXECUTIVE COMPUTER AND A RESERVE COMPUTER - Google Patents

Description

(19) DENMARK VJji

| F | (12) PRESENTATION WRITING ου 143819 B

DIRECTORATE OF THE PATENT AND TRADEMARKET SYSTEM

(21) Application No. 501/74 (51) fntCI.3 9 06 F 15/16 (22) Submission date 29 · Oct. 1974 0 06 F 11/16 (24) Race day 29 · Oct. 1974 (41) Aim. available 1 · tnaj 1975 (44) Submitted 1 Oct 2 1981 (86) International Application No. - (86) International Filing Day - (85) Continuation Day - (62) Master Application No. "

(30) Priority Oct. 50 1975, 7514715, SE

(71) Applicant TELEPHONE SHARE COMPANY L M ERICSSON, S-126 25 Stockholm, SE.

(72) Inventor Bengt Erik Ossfeldt, SE.

(74) Associate Engineering Company Budde, Schou & Co.

(54) Apparatus for enabling co-operation between an executive computer = shine and a spare computer.

BACKGROUND OF THE INVENTION 1. Field of the Invention This invention relates to an apparatus for one of an executive computer and a system, which is identical to a substantially spare computer 2, to enable collaboration between the computers, e.g. the backup computer update with the executive computer working before the collaboration in single operation produced 3 data · so that the spare computer then works in parallel with the executive computer, which is of the kind specified in the preamble of claim 1.

S

143819 2

From e.g. Swedish Patent Specification No. 227,356 discloses such a parallel synchronous operation of two computers, while e.g. from US Patent No. 3,631,401 it is known how the computers used are constructed.

One form of cooperation between the computers is the start-up or start-up process, which means the preparation of the machine for the final start-up. During the start-up process, the executive machine is prepared for parallel operation. In both computers, the startup process begins with processing of startup instructions. Hereby, e.g. the backup machine is ordered to cancel any test programs, and the executive machine can also be ordered and at the nearest opportunity - e.g. at the end of a routine program - to give an initial readiness impulse as feedback.

Another form of cooperation is the updating of the backup machine so that it can take over the process control at all times. A further and very important form of cooperation is a continuous data comparison to which a data transfer channel can be used. A fourth form of cooperation is the execution of a diagnosis on a faulty computer by means of an identical computer without errors.

Furthermore, there are numerous opportunities for collaboration between two identical computers. By parallel-synchronous cooperation, it should be understood here that the inputs of both computers and the output of the executive computer are connected to the process to be controlled. The data generated by the machines at each moment is continuously compared to each other. When a fault occurs, the process control only stops until it is found which of the machines is faulty. Then the control is continued with the faultless machine in single operation and the fault is rectified as soon as possible, since in this operating mode you have to work without the continuous data comparison. Such a structure is also called twin configuration or twin configuration.

As used in the claims, the term "clock phase" shall mean the shortest period of time available for the logical state change in the data processing used, e.g. data reception.

Such a computer equipped with order bus and data bus is known as mentioned in US Patent No. 3,631,401 and is called 3 143319 a "direct function data processing machine". Compared to a more common computer designed for a single particular task and therefore relatively rigid in terms of its applicability to other newly discovered tasks, or in terms of its ability to be expanded or renewed in separate parts, the so-called common bus computer described in said US patent flexible. Thanks to the common bus system, which comprises a number of parallel wires for transferring data, addresses and orders in parallel and digital form, to which the wires all the computer parts are connected, a module principle is obtained with the computer's functional units as modules. The functional units are connected to the common bus system in a uniform manner by means of uniform so-called "interfaces" or "interfaces", e.g. in the form of code-affected registers. Choosing suitable modules yields extremely diverse computer designs, such as calculators, calculators or real-time computers for managing simple or complicated processes.

The said common bus module principle is also used for the construction of real-time computer controlled telecommunication systems. However, the demands made by the real-time management of telecommunication processes often make it necessary to separate fast and slow working units from each other, ie. introducing different bus systems for different speeds in the data processing, whereby buffer units provided with said interfaces constitute connecting means between the bus systems. If the central functional units that make up the computer processing unit and the buffer units between the central and peripheral units are manufactured with very fast responsive logic components such as TTL (transistor-transistor logic) circuits and connected to a central bus system, the bus system characteristics constitute a limit to be observed when calculating the resulting data processing speed.

Namely, the data transfer rate obtainable on a bus is affected by the number of interfaces, ie. of the number of connected functional units and of the geometric thread lengths of the bus system. Thus, an appropriate reduction in the number of central parts results in optimally short processing periods for data processing instructions processed over said central bus system and thus a very effective real-time control of the telecommunication process.

143819 4 In a real-time controlled computer, the processing periods are controlled by clock pulses from a clock generator connected to a function bus via a clock bus included in the bus system. The processing of an instruction extends over a number, e.g. four, clock pulses and for example. in the following way:

If data is to be transported from a transmitter to a receiving function unit, the instruction, in addition to a code expressing the transport, contains the addresses of the transmitting and receiving function unit in digital form. An instruction follow counter activates the respective instruction records during all of the processing phases so that the code and addresses are applied to the rail system's order rail during the entire processing period. During the second to fourth beat phase, the data of the respective transmitting functional units is applied to the bus system's data bus. Finally, during the fourth clock phase, the said data is entered into the receiving function unit.

Since there are fluctuating phenomena in connection with changing the logical state of the bus system, such or similar phase splitting of the processing periods is necessary, and in order to achieve the fastest possible data processing the frequency of the clock generator is chosen so high that time delays due to the mentioned fluctuating phenomena and the reaction time of the components is precisely controlled. A clock frequency of 20 MHz and processing periods of 200 ns are practical examples.

When collaborating between shared bus computers, e.g. at a system consisting of an executive computer and a spare computer, problems arise with the aforementioned time delays. As is known per se, e.g. from the Swedish patent specification No. 227,356, the backup computer is used to increase the reliability of the real-time management by means of a continuous comparison between the instantaneous data generated in the computers and to increase the operational reliability of the control, in spite of failures in one computer, to continue the control with it. error-free computer, but without the mentioned continuous comparison. After an examination of the faulty computer by means of the single-time real-time computer and after a repair of the faulty computer, the parallel synchronous operation is restarted, where the initial state is that the executive data machine operates in single operation and the spare computer is not updated, ie. that the data stored in the computers does not match. Therefore, the cooperation includes the parallel computer synchronization with the executive computer being initiated in a precisely defined way, updating the spare computer, comparing the instantaneous data of the computers continuously and examining a computer that has become faulty.

Synchronism between the computers is most easily achieved by means of a common clock generator whose clock frequency determines the clock phases and processing periods in both computers respectively. In other known parallel synchronous computers, the computers are driven by their own clock generator, the clock generators being synchronized with each other. Despite an exact synchronization achieved in the said manner, phase shifts occur between the processing periods of the computers as a result of the aforementioned time delays due to fluctuating phenomena and the reaction times of the components. If a stable logic state of a data bus in a single-operating computer according to the above example is not achieved during the fourth beat phase of the processing periods, the continuous comparison of the instantaneous data of the cooperating computers is jeopardized already by a phase shift between the computers of the order of one clock phase.

This, due to the phase shifts between the computers, is addressed with regard to the continuous comparison e.g. in Swedish Patent Specification No. 361,368, which relates to a frequency divider apparatus, by means of which the phase offsets are made vanishing. In such cases, only data from e.g. each other's treatment period. As far as the update is concerned, such a frequency divider is completely unacceptable, because if the update is to be performed using instantaneous data generated in the executive computer, all data must be transferred to the spare computer without, for example, each other's treatment period is skipped. Known update methods therefore allow e.g. an interruption of the executive work until the update is complete. Another and trivial solution to the updating problem is to allow a decrease in the clock rate so that the said phase offsets are vanishing, but such solutions result in a general decrease in the real-time control data processing capacity.

In prior art systems with an executive computer and a backup computer, at the commencement of cooperation between the two machines, it is necessary to interrupt the execution of the executive machine's data recording as long as it takes to complete the data transfer program from the executive machine to the backup machine. This means that the entire system is not available for processing data for a corresponding period of time, e.g. by process controls and the like.

In contrast, the object of the invention is to provide such an arrangement of the apparatus that the spare computer can be updated while the executive computer is normally operating in continuous operation.

The stated object is achieved by an apparatus which according to the invention is peculiar to the design and arrangement according to the characterizing part of claim 1.

This results in the fact that the computers can work together without adversely affecting the data processing speed attainable in a redundant computer and without interfering with the work in progress of the computer, even though e.g. the update basically causes unacceptable time delays in the instructions processing in the backup computer.

The invention will now be explained in more detail with reference to FIG. 1-3, showing the system comprising the executive computer and the spare computer together with the proposed apparatus in various embodiments.

In all the figures, a common clock generator CG and the executive computer E and the spare computer R, respectively, are shown interconnected functional units respectively FUe and FUr, by means of bus systems consisting of a data bus respectively dbe and dbr and an order bus respectively. obe and obr and a beat bus tbe and tbr respectively. It is further shown that the computers each contain their respective instruction register rows, respectively IRSe and IRSr, consisting of a number of registers with instructions stored therein, which are read out on the order bus in turn or in a different order e.g. prescribed because of a hop instruction. Of the said instruction registers, BIRe and BlRr respectively denote an initial instruction register which stores an instruction that starts the work of the respective computers in a specific manner. Said initial instruction register is assigned by means of a start-up instruction applied to the respective order buses, the processing period of which determines the respective pulse phases of the respective computers during the subsequent cooperation of the computers, as will be described later. The hop instructions used are part of a generally known computer technique, and the method of the hop instructions does not in itself relate to the idea of the invention any more than what is explained in the introduction in connection with the instructions' treatment by means of a common bus system connected to the functional units.

The apparatus according to the invention for enabling the cooperation of the common rail computers comprises, according to all three figures, as main parts a data transfer channel DCH and a start pulse source SP with at least one delay element.

The data transfer channel DCH is directed in one direction from the executive computer to the spare computer and is used for the cooperation between the computers, e.g. to the backup computer update, which is done by means of the data which, during the executive work, is imposed on the executive computer's data bus dbe, and which is transmitted over the channel to the spare computer's data bus dbr, ie. without at all interfering with the executive computer's real-time management. As can be seen from the introductory explanations, the functional units are placed in a computer built according to the common bus principle so that the geometric extent of the bus system remains as small as possible. However, with the parallel work of two computers, there is such a distance between the computers that one uses e.g. a symmetrical transmission at the data transmission between the bus systems, which means that the data transmission channel, in comparison with a data rail, comprises the double number of wires as well as pulse amplifiers and pulse generators. The structure of the data transfer channel is only indicated in principle in the drawing, while many designs are applicable. However, it should be noted that all the solutions impose a time delay exceeding a period length of the clock generator CG common to both computers.

During the update, the backup computer produces erroneous data that must not be sent to an addressed FUr functional unit. Therefore, the data transfer channel includes a control memory CM for manually or automatically recording a transmission state, which control memory transmits a logic logic TL to open the transmission channel 143819 8 in an imposed transfer state and to prevent the transport of said erroneous data. In the FIG.

1 and 3, the data bus of the spare computer is divided into a receiving part, over which data is transported to one of the functional units, and in a transmission part over which data is transported from one of the functional units. By means of a first gate circuit GI associated with said transfer logic, said data bus parts are respectively connected to each other and separated from each other depending on the normal operation of the spare computer and a transfer state imposed on the control memory respectively. Furthermore, during the update, the transfer logic by another gate circuit G2 connects said receiving portion to the executive computer's data bus, whose logic state during the processing periods is thus transferred to addressed functional units in both computers.

In the embodiment of FIG. 2, a transfer state is not generally recorded for the entire system, but separately for each of the computer's functional units. In this case, said second logic means G2 of the transfer logic is activated to open the data transfer from the executive computer to the backup computer by means of a gate circuit G of the respective function units, whose activation conditions are that and that a transfer state TS is recorded in the control unit CM of the functional unit which is placed in place of or in addition to the joint control memory mentioned above. In this case, instead of the said division of the spare computer's data bus into a receiving and sending part, and instead of said first logic port of the transfer logic, a transmitting port means SG included in the interfaces of the respective function units is used in the computer, which has its inputs connected to said function unit's control memory. CM for manual or automatic recording of the mode of transmission of the functional unit TS. Due to a recorded transfer state, sending of the backup computer data is prevented, while a recorded transfer state in one of the executive computer's functional units does not affect the data transmission of the executive computer.

For the sake of clarity, FIG. 2 only shows an interface belonging to the backup computer's bus system and includes an interface register REG, a receiver decoder RDEC and a receiving port means RG in addition to said gate circuit G, control memory 9, the transmitter decoder SDEC and the transmitting port SG. Over the bus system clock bus tb, respectively, the transmitting and receiving port means are controlled so that an activation is effected only during the clock pulse phases calculated for transmission and reception respectively. Data transmission, respectively, from the interface register of the sending port means to the bus system's data bus db and data reception from the bus system's data bus over the receiving port means to the interface register, if the transmitted or receiving decodes of the bus system's order bus respectively perceive the addressing of the function unit at or the receiving port means.

The start pulse source SP comprises a switching signal unit IU and starting means SDe and SDr for starting each of their respective computers E and R. In the figures, the switching signal unit is shown as an added function unit, which usually comprises an interface connected to the bus system of the executive computer. However, this does not increase the impedance load of the bus system further, since the switching signal unit is in fact included in a break-in unit which is part of every real-time computer to control a telecommunications system, but which is not shown in the figures for the sake of clarity. Such an intrusion device known per se is tasked with receiving incoming interrupt signals, prioritizing them and delivering for each priority change a hop instruction that designates one of the initial instruction belonging to the respective priority levels.

At a system consisting of an executive computer and a backup computer, a primary start pulse ps to start the parallel synchronous operation produces such an interrupt signal in each of the computers. In order to explain the principle initiation of the start-up process for the computers parallel operation, the figures show a bistable multivibrator F, a call unit CD and a decoder DEC. The bi-stable multivibrator is set by the primary start pulse in the first stable state a, by which the call unit is activated. The instruction register row includes a regularly assigned register that stores a transport instruction for any interrupt device's interrupt signals. An interrupt signal from said call unit CD is prioritized in the executive computer e.g. such that an ongoing real-time controlling instruction is terminated and an instruction register is provided containing an instruction to carry a coded ready signal to start the cooperation to the switch signal unit if decoder DEC converts the ready signal to a secondary pulse ss which sets the multivibrator F in the second stable state b. Without defining certain design elements, the task of the switching signal unit consists in interrupting, by activating through a primary start pulse ps, interrupting the ongoing executive work and producing a secondary start pulse ss for the computers parallel operation. The example mentioned in the preamble assumes that a processing period for an instruction comprises four clock pulse phases and that a data receiving address unit records transmitted data in the last clock pulse phase of the processing period, said secondary s tart pulse at the output of the switch signal unit during the fourth clock pulse phase of the processing period. clear signal transport instruction

For the starting pulse source SDe and SDr included in the starting pulse source, just as for the switching signal unit, these are bodies which are also included in single-operating computers.

To explain the principle initiation of the single operation, the figures show a starting instruction register SIR and one of the clock generator advanced first and second phase generator PG1 and PG2.

The start instruction register stores start instructions that are of the hop instruction type. An initial instruction transmitted to the order bus addresses the functional unit provided with the instruction and indicates the above-mentioned initial instruction register BIR, possibly over a number of so-called blind instruction registers BLR, as will be explained in connection with fig. 2nd

The first phase generator PG1 comprises a shift register for stepwise feeding of a trigger pulse, e.g. said secondary starting pulse ss, the step-by-step advance in the various embodiments of the proposed apparatus being used to determine isolated processing periods or portions thereof or to constitute portions of a time delay as will be described later.

Said second phase generator PG2 comprises a cyclic counting chain whose step number corresponds to the number of clock pulse phases in a processing period. Thus, according to the example used heretofore, the second phase generator has four steps which cyclically activate the outputs of the generator connected to the respective clock buses. The cyclic counting chain is provided with an input o which, in the activated state, resets the chain which remains in the reset state until an activated input s starts the step feeding. In this way, the logic state of the shared bus system's clock bus defines the processing periods and their breakdown into clock phases.

In the embodiment shown in FIG. 1, the first phase generator PGle of the executive computer is connected to the output of the switch signal unit transmitting said secondary start pulse ss. A first OR port ORle is connected to the outputs of the data generator PGle which are activated during the processing period following immediately after the above processing period in order to transport the ready signal to the start of cooperation to the switch signal unit / transport in its last clock pulse phase results in the secondary start pulse. A pulse emitted from said OR gate ORle lasts a full processing period and activates a first readout gate means ANDle, over which the start irradiation stored in the start instruction register SIRe is routed to the executive computer's order bus obe. In this way, the processing periods of the executive computer continue completely without interruption during the transition from single operation to parallel operation.

There is no reset and restart of the second phase generator PG2e, and the start instruction's processing is normally controlled over the executive computer clock bus tbe. If it is desirable in connection with a start of collaboration to determine the processing periods of the executive computer and their clock pulse phases again, the design according to FIG. 1 is modified, e.g. as will be explained in connection with FIG. 2nd

In contrast, the second phase generator PG2r of the spare computer is always reset at the start of parallel operation. According to FIG. 1, the first stable mode a of the multivibrator F activates the phase generator reset, which results in any work in progress in the spare computer being completely stopped. Furthermore, in principle, the start of the spare computer proceeds according to the start of the executive computer, the difference being merely that the first phase generator of the spare computer PGlr together with an OR-gate ORlr produces an impulse that is time-delayed relative to the pulse obtained from the OR-gate ORle. The time delay is caused according to FIG. 1 partly by means of a delay means DE connected between the output of the switching signal unit and the input of the first phase generator PGlr into the spare computer, and partly by means of a number of shift register steps in the phase generator PGlr prior to the shift register steps activating the OR gate ORlr. first, the second phase generator PG2r starts the spare computer. In another possible embodiment, not shown, both the first phase generators PGle and PGlr can be designed in the same way, whereby the delay means causes the entire time delay.

The delay means may e.g. may take the form of a delay line, of a separate shift register which is incrementally advanced by means of special clock pulses or by the clock generator pulses, of a transmission channel whose construction substantially corresponds to the construction of the data transfer channel DCH arranged between the computers. both computers share common first phase generator PG1, optionally in connection with a so-called blind instruction register BLR, as will be explained in connection with FIG. 2, or of the data transfer channel DCH itself, as will be explained in connection with FIG. 3. If no blind instruction register is included, the delay means is dimensioned independently of the selected structure so that the total delay between the OR gates ORle and ORlr's pulses is essentially in accordance with the length of time that arbitrary data needs for the DCH to transmit from the data transfer channel. -tive computer's data bus dbe to the spare computer's data bus dbr.

In the one in .fig. 2, the OR gates OR1 and OR1r are connected to a common first phase generator PG1 through which said secondary starting pulse ss, which in this embodiment also resets two other phase generators PG2e and PG2r, is advanced stepwise. After a number of shifts in the phase generator PG1, the executing computer's second phase generator PG2e is started and the activation of the OR gate OR1 is started. After a further number of shifts, substantially corresponding to the transmission time of the data transmission channel, possibly reduced by a number of processing periods, the second phase generator PG2r of the backup computer is started and activation 143819 13 of the OR gate ORlr is started. The said possible reduction by a number of processing periods is introduced if the required time delay exceeds a processing period and if the spare computer instructional sequence of the sequence comprises a number of so-called blind instruction registers. A blind instruction register is defined as an instruction register whose instruction is only to assign a specific other instruction register so that the instruction of a blind instruction register corresponds to a stay of a processing period in the computer's work. In FIG. 2, there is a blind instruction register BLR, which belongs to the spare computer instruction register sequence, which contains an instruction to assign the above-mentioned initial instruction register BIRr. In this case, the start instruction register SIRr in the backup computer's start means SDr contains an instruction to instruct the blind instruction register BLR.

In the embodiment shown in FIG. 3, the data transfer channel DCH itself is used to cause the start pulse source to initiate the startup of the spare computer time delayed relative to the start of the executive computer. The secondary phase pulse secondly pulsed by the executive computer, PGle, is applied to determine the two treatment periods following the secondary start pulse, during which the OR gate ORle is activated in the last period for a readout of the starting instruction to the executive computer's order bus obe as explained in FIG. 1. By means of a pulse obtained from the phase generator PGle during the first clock pulse phase of the immediately following secondary start pulse, the second logic means TL of the above-mentioned gate means G2 is activated over the control memory of the data transfer channel so that the data transfer channel is connected to the data transfer computer. During the remainder of the immediately following secondary start pulse following processing period, the data generator PGle over another OR port 0R2 and over another readout port means AND2 activates the start instruction readout to the executive computer's data bus dbe so that the start instruction is processed in the same way as data processed during an instruction processing any functional unit. The backup computer's starting means SDr, whose second phase generator EG2i 14 143819 is reset in one of the above-mentioned ways, comprises a starting comparison means with inputs connected to the start instruction register SIRr and to the inputs of the spare computer's bus.

The starting comparator is indicated in FIG. 3 using an EXCLUSIVE OR CIRCLE EXOR with inverting output. When the start instruction received over the data transmission channel is perceived to be equal to the start instruction stored in the start instruction register SIRr, the start comparison means sends a similarity signal which is passed stepwise through the first phase generator PG1r of the spare computer. By waiting for an appropriate number of shifts in the shift register before the phase generator PGlr, the phase generator PG2r starts before it starts activating the OR gate ORlr. and before disabling the second gate means G2, it is possible to fine-tune the total time delay so that optimum cooperation is achieved. This means that data transferred from the executive computer, e.g. update data, during the rate pulse phase calculated for receiving, is received error-free by the function unit of the spare computer addressed due to an instruction from the spare computer's order register to the order of the spare computer's order bus. In FIG. 3, as has so far been assumed, each processing period comprises four clock pulse phases and data is transmitted on the respective data buses in the last three phases. Furthermore, it is assumed that the best updating conditions are obtained if the similarity signal occurs two clock pulse phases before processing the spare computer's start instruction.

The embodiment of FIG. 3, the starting process lasts a treatment period longer than in the embodiment according to FIG. 1, but in turn makes less demands on the time and temperature dependence of the transmission channel's structural elements. By means of all embodiments of the proposed apparatus for enabling the cooperation between two shared bus computers, it is achieved that the instructions of the spare computer during the whole cooperation are processed in parallel synchronously, but delayed in relation to the instructions of the executive computer, where the time delay is such that the spare computer during the update processing periods is picture-wise. not to mention that received data is not sent from a separate functional unit, but from the corresponding functional unit of the executive computer.

15 143819

The result obtained by means of the starting pulse source is that the logic state of the output of the data transmission channel at least during the rate pulse phases calculated for data reception in the spare computer, according to the previously mentioned example phase 4 of each processing period, corresponds to the logical state of the spare computer data bus. by means of an operating comparison apparatus, to carry out the continuous comparison mentioned in the introduction with the instantaneous data produced by the computers. The operation comparison apparatus is shown in FIG. 2, where it is essentially symbolized by an EXCLUSIVE OR circuit EXORd, which during the said data reception in the spare computer calculates the clock pulse phases with the two logical states mentioned and which generates an alarm signal in case of inequality between the states.

The operating comparison apparatus EXORd in connection with the control memories CM, one of which is shown in FIG. 2 is advantageously utilized to make a diagnosis in a faulty common bus computer by means of a faultless common bus computer identical to the substantially common bus bus. The purpose of the diagnosis is to determine which building unit is defective so that the computer repair consists only of replacing the defective building element with a faultless one. The diagnosis is started with a parallel operation start according to the above description, the faulty computer acts as a backup computer, while the error-free computer functions as an executive computer which normally manages, for example, in single operation. a telecommunications plant. The faulty computer is then updated as a transfer state is entered in all control memories CM. A subsequent complete transition to a normal parallel synchronous co-operation of the computers will cause the EXORd operating comparison device to produce an alarm signal when the function unit which produces faulty data is addressed for data transmission. However, a gradual transition to normal cooperation, which means, for example, means that the number of functional units with enrolled transmission mode is manually or automatically reduced more and more at appropriate time intervals, no alarm signal, as long as the transmission mode is entered in the faulty function unit. The said successive reduction of the recorded transmission states thus constitutes a very simple diagnostic method, since an alarm signal determines the functional unit as the faulty one whose transmission state is abolished last before the alarm.

There are many modifications to this diagnostic method that use the option to enroll the transfer state separately in the functional units. An example of such a modification is to maintain all transmission states except one at a time, or to divide the functional units into groups and first determine the group containing the flawed functional element.

A breakdown into groups shortens the average diagnosis time, although a new update must be completed before the diagnosis within the group with the malfunctioning functional unit begins.

In summary, by means of the proposed and described apparatus, such collaboration between two shared bus computers enables one computer to update the other computer with its instantaneous data generated, that the computers monitor each other by comparing their current data continuously and completely with each other, and that a flawless single-operation real-time controlling computer performs a diagnosis on a malfunctioning computer for determining the malfunctioning functional unit, using only the immediate real-time data.

Claims (16)

143819 17 PATENT REQUIREMENTS. 1 · Apparatus for enabling collaboration between the computers, eg by an executive computer (E) and a system which is identical to the main computer (R), which is essentially identical. the backup computer update with the executive computer working before the single operation working in collaboration, so that the spare computer then works in parallel synchronous with the executive computer, where synchronism is obtained by clock pulses, e.g. from one common to both computers and to a clock bus (tbe, tbr) in a bus system in each computer connected clock generator (CG), and wherein the computers each contain a number of addressable function units (FUe, FUr), e.g. memory units, arithmetic units, process registers, between which function units data and addresses and orders are respectively transported over a data bus (dbe, dbr) and order bus (obe, obr) included in the said bus system and of which at least one function unit contains a result of selectable instruction registers (IRSs, IRSs) in which instructions are stored that are read and processed one after a processing period activated in each of the clock generator comprising a plurality of clock phases, characterized by a) a start pulse source (SP) fed from the clock generator (CG ) and is connected to said bus system in each computer (E, R), and which initiates, by means of a primary startup pulse (ps), the parallel operation of the computers (E, R), and by means of a secondary startup pulse (ss), the computers start, (b) a one-way data transfer channel (DCH) directed from the executive computer (E) data bus (dbe) to the spare computer (R) data bus (DCH) dbr) which channel (DCH), due to its structure, imposes a certain time delay on the transmitted data, and c) at least one delay means which causes the start pulse source (SP) to start the spare computer (R) relative to the executive computer (E). with a time delay substantially equal to the time delay imposed by said data transmission channel (DCH) due to its construction. Apparatus according to claim 1, characterized in that a delay line is included in said delay means. 143819 18 Apparatus according to claim 1, characterized in that said delay means includes a transmission channel, the structure of which substantially corresponds to the construction of said data transfer channel from the executive computer's data bus to the spare computer's data bus. Apparatus according to claim 1, characterized in that said delay means includes a shift register which is progressively advanced by means of clock pulses, the period length of the clock pulses and the number of register changes causing at least a part of said definite time delay. Apparatus according to claim 4, characterized in that the clock pulses for the shift register of the delay means are generated by the clock generator (Figures 1 and 2). Apparatus according to claim 1, characterized in that said delay means comprises a number of blind instruction registers (BLR) belonging to the spare computer's instruction register, the information content of which specifies that a particular instruction register must be selected and whose information content is processed in turn, during which the processing periods causes at least part of said particular time delay (Fig. 2). Apparatus according to claim 1 or 6, characterized in that: (a) the starting pulse source (SP) comprises a switching signal unit (IU) connected to the executive computer's bus system which, upon activation by a primary start pulse (ps), interrupts the ongoing executive work and upon receipt of a feedback signal generates said secondary startup pulse (ss), as well as a startup means (SDe, SDr) for each of the computers which, upon activation by a trigger pulse, commences the work of selecting an initial instruction register (BIRe, BIRr) that stores an instruction, (b) the said delay means is disposed between the switch signal unit (IU) and the reserve computer's initial instruction register (BIRr), and (c) the data transmission over said data transmission channel (DCH) is controlled by a control memory (CM) for recording. of a transmission state (ts) and by means of a transmission l ogik (TL) to open the data transfer channel in an applied transfer mode and prevent a data transfer between the spare computer's functional units. 19 143819 Apparatus according to claim 7, characterized in that the transmission logic (TL) comprises an operational comparison means (EXORd) for producing data transmitted to the data transmission channel's outputs and on the data computer of the spare computer bus an alarm signal (Fig. 2). Apparatus according to claim 7 or 8, characterized in that the functional units of the computers each comprise a control memory (CM) for recording the transfer state (ts) of the respective functional units (Fig. 2). Apparatus according to any one of claims 7-9, characterized in that: (a) the starting means (SDe, SDr) comprise at least a first phase generator (PG1, PGle, PGlr) controlled by the clock generator (CG) and which upon activation at said trigger pulse out of a plurality of clock pulse phases generated, those which form the processing period of a starting instruction register (SIRe, SIRr) associated with said starting organ determines the processing leading to said selection of said initial instruction register (BIRe, BlRr) and b) the starting means each comprise a different phase generator (PG2e, PG2r) controlled by the clock generator, generating the clock pulse phases for the processing periods of the particular computer and connected to the clock bus concerned, c) the one of the spare computer startup device (SDr) belonging to the the second set of phase generators is connected to the switch signal unit (IU) for resetting at the same time with said secondary start pulse (ss) the second phase generator, thus interrupting the supply of clock phases to that clock bus, and furthermore is connected to the first phase generator (PG1,. PGle, PGlr) to restart said second phase generator (PG2e, PG2r) using the clock pulse that coincides with the first of said clock phases within the processing period of said starting instruction and thus re-supply the clock phases to that clock bus. Apparatus according to claims 5 and 10, characterized in that the switching register is included in a first phase generator (PG1) common to both starting organs, whose triggering pulse is constituted by said second starting pulse (ss) and which determines the processing period for the spare computer startup instruction delayed by 20 The U3819 processing period for the executing instruction of the executive computer (Fig. 2). Apparatus according to claim 10, characterized in that the starting means (SDe, SDr) each comprise its first phase generator (PGle, PGlr) and that the secondary start pulse (ss) constitutes the trigger pulse for the first phase generator (PGle) of the executive computer, thus defining the processing period of the start instruction. that it coincides with one of the periods produced by the phase generator (PG2e) that is not disconnected from the switch signal unit. Apparatus according to claims 5 and 12, characterized in that said switch register is included in the first phase generator (PGlr) of the spare computer, which receives the secondary start pulse as a trigger pulse. Apparatus according to claims 2 and 12, or 3 and 12, characterized in that the first phase generator (PGlr) of the backup computer's starting means (SDr) receives its trigger pulse from the delay means which is activated by the secondary start pulse. Apparatus according to claims 2, 5 and 12, or 3, 5 and 12, characterized in that said switching register is included in the first phase generator (PGlr) of the spare computer, which receives the secondary start pulse delayed by said delay means (triggering pulse). Figure 1). Apparatus according to claim 12, characterized in that: (a) the first phase generator (PGle) of the executive computer, prior to the commencement of the processing instruction for the start instruction, determines at least one additional processing period during which a transfer state (ts) is recorded in said at least one control memory (CM), and the start instruction stored in the executable computer's register (SIRe) is sent to the executable computer's data bus (dbe) for transmission over the data transfer channel (DCH) to the spare computer's data bus (dbr), and by b) that the spare computer's starting means comprises a start comparator (EXOR) to the backup computer's data bus transmitted data and the start instruction register (SIRr) start instruction register stored in the spare computer