GB1597198A - Data processing - Google Patents

Abstract

For this purpose, an error registered in an error register (E-REG) is examined in an analysis network (ANW) and the latter generates a start signal (STE) for a pause generator (PG), the output signals of which stop the system clock generator (TG) of the data processing system at a defined point before a particular system clock pulse (T1) and asynchronously start it again. With the start at a particular system clock pulse, an error routine can be started in a defined manner without there being a possibility of sequence errors. The circuit arrangement is used as pause generator (PG) for stopping the system clock generator (TG) in a defined manner before an error routine and can be used in error routines controlled by hardware or by microprogram. <IMAGE>

Description

(54) DATA PROCESSING (71) We, SIEMENS AKTIENGESELLSCHAFT, a German Company, of Berlin and Munich, Federal Republic of Germany, do hereby declare the invention, for which we pray that a patent may be granted to us, and the method by which it is to be performed, to be particularly described in and by the following statement: The invention relates to data processing installations, and is particularly concerned with the handling of errors therein.

Data processing installations are intended to produce error-free results. However, they constitute complex technical structures which operate under programme control and in respect of which there are a number of potential sources of error. Without wishing to investigate all possible sources of error, at least two fundamental groups will be referred to: the source of error can lie either in the programme or in the construction of the data processing installation, i.e., its hardware. With faults of the latter kind the final breakdown of a component is simpler to handle because the origin of the error can often be more easily established. However, sporadic errors which apparently occur without any detectable cause and which also disappear again are particularly unpleasant. They are frequently triggered by the rare occurrence of a coincidence of several causes which in themselves are considered non-critical.

Thus as the operation of data processing installations cannot be handled entirely free of disturbance, it is at least necessary to make provisions for establishing, checking, and where possible correcting errors. Thus error-free results are to be safeguarded or at least the emission of incorrect results is to be avoided which means that the further processing of a programme must be interrupted if an error, once established cannot be automatically corrected. Therefore a number of attempts to achieve this goal have already become known.

United States Patent No. 3,548,177 discloses a device which serves to monitor the operation of a data processing installation in respect of critical states in which there is a specific probability that errors may be expected in the future. An interference level in a micro-programmed control device is used as criterion for a specific fault probability. This level is analysed and the processing cycle is stopped when this signal exceeds a stipulated value. A waiting state of this kind lasts until the critical function state is at an end. Then the data processing installation continues normal operation from the point at which it stopped.

The delay of the processing cycles is achieved by inhibiting a number of central timing pulses. and thus pulsed devices of the control or processing unit in the data processing installation retain their function state, and in particular no change is permitted to occur in register contents. Furthermore devices for resynchronising storage devices with the central processor of the data processing installation on restarting are provided.

The principle of this error monitoring consists in providing that a flowing machine cycle is not interrupted but extended by a waiting time, under the assumption that the critical function state of the data processing installation will clear automatically within this waiting time. This is to avoid from the start the occurrence of a genuine error which would have to lead to an error handling process and thus to an interruption in the normal processing state of the data processing installation.

A device disclosed by United States Patent No. 3,548,178 is based on similar considerations. Here again the system clock of the control device is disabled if, in the flow of a cycle, a specific probability of the occurrence of an error in the control signals of the micro-programme control device can be inferred from an interference level. In this case, however, a second pulse generator is additionally activated during such interruptions in the system clock, with the aid of which it is possible to continue those pulsed control steps ofthe micro-programmed control device and of other devices within the data processing installation which one nevertheless desires to continue uninterrupted.

These known devices are limited to the monitoring of a small group of possible errors which can occur during the read-out of micro-command words from the microprogramme store of the control unit. A further difficulty consists in establishing the critical threshold value for the interference level to be such that on the one hand a possible error origin in clearly eliminated but on the other hand elementary operations are not arbitrarily extended with unnecessary frequency by the blocking of the system clock generator until an apparently non-critical function state in the control device has been reached. Overall this could lead to a considerable reduction in the operating efficiency of the data processing installation if one errs too far on the side of caution. On the other hand, however, this concept has the disadvantage that a specific accumulation of such error sources cannot be directly established because the occurrence of an error is to be eliminated from the start and thus there is no question of a documentable or displayable error routine.

Furthermore German Auslegeschrift 23 24 906 discloses a data processing installation having a control device, which, on the occurrence of an error recognised by an error detector, can be reset into a state which has already been run through and can restart from this state as a result of a restart signal. In the control unit, this restart signal produces an intermediate signal which causes the central clock generator to emit timing pulses having a low pulse frequency during a specific length of time. This is to ensure that a flow of control steps which previously led to an error is repeated more slowly and in error-free fashion.

This type of principle can be successfully used to handle many sporadic faults if the appropriate source of error is only short-acting. However, in the practical operation of a data processing installation the situation also occurs that sporadic errors of this kind are longer lasting, i.e., the source of error is maintained for a length of time which extends over more than one elementary operation of the micro-programmed control unit. Then the problem of preventing in particular the propagation of the origins and effects of an error which has occurred remains unsolved.

The problems resulting from error handling in the known prior art will be summarised once again in the following: fundamentally there is no possibility of entirely eliminating all sources of error with a viable outlay with a high average processing efficiency. Therefore errors must be accepted and corrected as far as possible. In hardware circuit devices this is possible by means of the micro-programmed control unit during the processing of a machine command and by extended machine fault routines.

Under normal circumstances an error handling routine which is extended in stepped fashion necessitates the following reactions in the case of an uncorrected hardware fault: the fact that a specific error has occurred is traced, i.e. is stored for example by setting a bit position in an error register. This also includes subsequently blocking this register from adopting new faults. In respect of each circuit arrangement or micro-programme, thus by means of the control unit of the data processing installation, it is then possible to analyse the origin of the error and to establish the requisite reaction to the error. This involves safeguarding the error information and then releasing the error register to register further error occurrences. The error is analysed and, where possible, the command counter is decremented so that the relevant machine command can be repeated at hardware- and micro-programme level. In dependence upon the result of a command repetition of this kind and of the error reaction mode, it is either possible to continue the command execution or it is necessary, on each programme break, to assume a function state of the data processing installation in which the error which cannot be eliminated in the normal function state of the installation is subjected to further treatment.

If another hardware fault occurs in the time between the release of the error register and the beginning of a machine command repetition, it is necessary to stop the data processing installation as satisfactory further processing and error handling are not guaranteed. This also applies when, during the error handling in software, i.e., in the error function state, a hardware fault occurs which cannot be directly corrected by hardware measures. Stopping the data processing installation on account of a fault of this kind then means a collapse of the system and should therefore be avoided as far as possible.

However, not all double errors which occur need inevitably lead to a system stop if their origins are considered. Double errors can be due to faults which are produced by the final breakdown of a component and which therefore will be constantly repeated under similar conditions. However, double errors can also be due to long lasting sporadic errors whose origins extend over several elementary operations of the micro-programme and therefore, following a first error report, lead to a further error report in a later elementary operation.

Finally, double errors can also occur as sequence errors in the case of which one short interference influences the state of the data processing installation or is propagated within the hardware in such manner that further error reports occur in a sequence. This is the case for example when, following the execution of a faulty elementary operation, a register contains items of information having incorrect parity.

The above-mentioned "fixed" faults can be eliminated only by replacing the defective components, whereas the other faults remain manageable, i.e. need not necessarily lead to a system stop if the propagation and effects of a source of error which is given rise to a first error can be prevented.

The aim of the invention is thus to provide means whereby, in the event of an error handling process triggered by a simple error, for example a repetition of preceding operating steps, the danger of the source of error from which the simple error arises producing multiple errors can be reduced.

The realisation of this aim is based on the fact that German Auslegeschrift 26 19 445 discloses a pulse generator for the production of the system clock pulses of a data processing installation whose produced pulses can be multiply interrupted and asynchronously restarted. For this purpose the pulse generator possesses a AND -gate which is fed back via a delay element and can be blocked with stop conditions supplied via a polariser and which pulses a D-flip-flop. Its output lines alternately pulse further D-flip-flops of a pulse train shift register which is closed in the form of a ring and whose D-inputs can be partially supplied with optionally timing shift pulses or start signals under the control of preceding stop signals. If a pulse generator of this kind is used to produce the system pulse train in a micro-programmed control unit of a data processing installation, it is simple to interrupt and asynchronously restart the system pulse train at precisely defined times.

According to the present invention there is provided a data processing installation wherein the occurrence of single errors can be distinguished separately in accordance with their nature by means of different error signals, including an error register assigned bit positions of which are set by said error signals, an analysis network which serves to check the relevant contents of the error register and in dependence upon the outcome to produce a start signal for fault handling operations, a clock generator which operates in accordance with the start-stop principle and which serves to produce system clock pulses for the central control of the data processing installation. and a pause generator connected between the analysis network and the clock generator and which, upon receipt, in the case of an error, of the start signal from the analysis network, stops the clock prior to a predetermined clock phase corresponding to initiation of a new elementary operation of a micro-programme and. after a predetermined pause period restarts the clock.

Preferablv. the pause generator comprises a stop marker bistable flip-flop which is set upon receipt of said start signal and which when set actuates a start stop device of the clock to stop the clock, a monostable circuit which is set upon receipt of said start signal and which resets after said predetermined pause period to, via pulse shaping means, reset the stop marker flip-flop and provide a fault routine start signal.

Consequently the following fault treatment is possible: following the recognition of a non-correctable hardware fault, the central pulse generator is stopped and thus the processing device of the data processing installation is brought into a waiting state. In parallel, the pause generator is started which, on the expiration of a pause time which can be set by the reversible RC-network but which is defined and amounts for example to 100 ms. produces a start signal which restarts the pulse generator. During this pause, the registers and control flip-flops of the processing unit and control unit of the data processing installation no longer receive timing pulses. Therefore disturbances are unable to propagate and the signal states in the relevant logic complexes and on signal lines have sufficient time to stabilise i.e. to build up to determinate logic levels.

The stopping of the central pulse generator is always carried out prior to a specific clock pulse phase within the pulse train chain so that a determinate starting state is set up. As a result, for example a register which has been loaded with the incorrect parity as a result of the established single error, can be prevented from giving rise to a further fault report during a following machine fault routine. This is because in this way it is simple to ensure that all the working registers required for this machine fault handling can be set to zero in a determinate fashion at the beginning of this routine. Consequently the fault routines are considerably simplified.

In association with a pulse generator of this kind, the pause generator can be constructed in a simple fashion in respect of circuitry irrespective of which circuitry technique is used to construct the control unit of the data processing installation.

An exemplary embodiment of the invention is illustrated in the accompanying drawing which shows a general circuit diagram of a data processing installation with devices for fault handling to the extent that these are important in respect of the functions to be described.

The installation has a central processor CPU and also a main store M which can also be designed as storage system. Fault sources can occur in both the units of the data processing system, where they are determined for example by locally provided circuitry devices for fault establishment and localisation and produce specific fault signals. These fault signals set assigned bit positions in a fault register E-REG connected to the central processor and to the main store. The outputs of said fault register are connected in parallel to an analysis network ANW which, in dependence upon the occurred fault which is signalled by a specific bit position in the fault register and upon a resultant fault reaction mode, initiates the requisite fault treatment by circuitry measures and/or the micro-programme of the control umt of the data processing installation. In the cases being considered here, this includes for example the temporary prevention of further writing into the fault register E-REG in order to conserve the fault information. Here this is achieved by means of an AND-gate U3 which is connected to its output to the fault register and whose inputs are supplied with a fault register timing signal TE which is derived from signal TE which is derived from one of the system pulse trains which are to be explained in the following and with a blocking signal STE which is emitted from the analysis network ANW and serves to block the fault register.

As a result of the AND-logic-linking of these two signals, the fault register E-REG remains blocked in respect of the input of new fault reports until this blocking signal is withdrawn.

The analysis network ANW has not been illustrated in detail as the actual fault handling which results from the different sources of error is not of significance in the present context.

The essential feature is simply that the analysis network activates a pause generator PG by a start signal ST in the fault source situations being dealt with here. Furthermore a flip-flop which in the following will be referred to as stop marker SM is arranged at the output of this pause generator. One output of this stop marker is connected to a central clock generator TG which, as schematically indicated, is constructed from D-flip-flops TF1 to TF5 of a pulse shift generator closed in the form of a ring. As a pulse generator of this kind can be considered to be known, in the schematic illustration the actual oscillator and the requisite start-stop logic have not been illustrated or have only been indicated in outline. The fact that the pulse generator TG can be stopped before one of the system clock pulses T1 to T5 emitted by the pulse train flip-flops TF1 to TF5 here has been indicated by a stop flip-flop SFF which precedes the first pulse train flip-flop TF1. This stop flip-flop is supplied with the output signal from the stop marker SM of the pause generator PG and thus prevents the shift pulse emitted from the last pulse train flip-flop TF5 from being switched through the first pulse train flip-flop TF1 of the pulse generator. Therefore the output signal from the stop marker SM causes the pulse generator TG to be stopped at the next possible opportunity via a start-stop logic for a specific length of time - here before the emission of the first system pulse train T1 which introduces a new elementary operation of the micro-programme.

In order to achieve this, the start signal ST in the pause generator PG is fed to the setting input of the stop marker SM via a further AND-gate U1. The second input of this AND-gate is supplied with an inhibit signal INH the significance of which will be explained below. For the time being it will merely be pointed out that the start signal ST in the case of a fault and the inhibit signal INH under normal circumstances possess equal logic levels and thus the stop marker SM is set by the start signal ST in the event of a fault, i.e. then also stops the pulse generator TG.

The pause generator is required to maintain the effects of the start signal ST only for a specific length of time. Therefore it contains a device for a delayed resetting of the stop marker SM. In the present exemplary embodiment it has been assumed that the major components of the micro-programmed control unit of the data processing installation has been constructed for example in the ECL circuit technology. However, in the case of the pause generator PG not all the requisite components are available in ECL type and it is therefore constructed with TrL components. For this reason the start signal ST is fed via a first level converter stage PW1 to the dynamic input stage of a monostable trigger stage MK. After a specific delay time this trigger stage produces an output signal, i.e., thus represents the oscillator of the pause generator PG.

For this purpose the control inputs S of the trigger stage MK are assigned a switchable RC-network. The latter possesses a resistor R1 which is connected to the OV-level of an operating voltage source UB and which is connected to the control inputs S of the monostable trigger stage MK directly via a reverse biased diode D1 and via one of three capacitors C1, C2, C3 which are selectively connected in series with the resistor by a first switching device S1.

This RC-network can be switched by the switching device S1 to various delay times which then establish the delay of the output signal from the monostable trigger stage MK. This output signal is converted via a pulse shaper stage IF and a TTL-ECL level converter stage PW2, to provide a start signal SFR for a fault routine which signal has a specific pulse width and is fed to an input of a further AND-gate U2 which is assigned to the resetting input R of the stop marker SM. A second input of this AND-gate U2 is fed with the aforementioned inhibit signal INH.

This inhibit signal is the output signal of a further switching device S2 whose selectively operable input contacts are connected to a voltage divider formed from three further resistors R2, R3, R4. It is thus clear that with this switching device S1 and the inhibit signal INH supplied to the two AND-gates U1 and U2, the stop marker is blocked irrespectively of the delay time set in the RC-network, i.e., in such a situation the start signal ST emitted from the analysis network ANW has no influence upon the function of the pulse generator TG.

Apart from this special situation which occurs for example during servicing, the described arrangement has the following mode of operation: a fault occurrence traced in the fault register E-REG is analysed in the analysis network ANW where a specific fault routine is established which for example flows under micro-programme control. This is indicated in the drawing in that the analysis network ANW loads an address register MAR of a micro-programmed store MP in the control unit of the data processing installation. The transfer of this start address for a micro-programme which controls the machine fault routine is likewise triggered by a start signal ST as illustrated by a broken line. As the start signal stops the central pulse generator TG prior to the first system clock pulse T1 via the stop marker SM, it is ensured that the processing recommences with the first elementary operation of this micro-programme when the pulse generator is restarted.

The start signal ST also influences the dynamic input stage of the monostable trigger stage MK so that the latter is triggered as soon as the delayed control signal produced by the RC-network occurs at its control input. The converted and transformed output signal from the monostable trigger stage - the start signal SFR for fault routines - resets the stop marker SM so that after a determinate delay time the pulse generator TG is restarted with a determinate system pulse train T1. Within a fault routine of this kind this pulse train could also be coupled with the determinate resetting of all the registers and control flip-flops which could also exhibit faulty signal stages as a result of the fault source. Frequently, however, this resetting is introduced by a short micro-programme started at a determinate time. Thus any fault source which results in a specific micro-programme for the handling of the occurred fault can in a simple manner be assigned a determinate starting state with which the effects of long-duration. sporadic faults or sequence faults can also be safely eliminated.

List of References CPU central processor M main store E-REG fault register ANW analysis network U3 AND -gate TE fault register timing signal STE start signal PG pause generator SM stop marker TG pulse generator ..... .TO5 D-flip-flops of the pulse train shift register SFF stop flip-flop Ti.. .T5 system pulse trains Ut, U2 AND-gate INH inhibit signal PW1 first level converter stage MK monostable triggerstage S control input Rl, C1. C2, C3 RC-network UB operating voltage source R2. R3 second and third resistors D1 diode S1 S2 first and second switching devices IF pulse shaper stage SFR start signal for fault routine PWZ second level converter stage MAR address register MP micro-programme store

Claims (7)

WHAT WE CLAIM IS:

1. A data processing installation wherein the occurrence of single errors can be distinguished separately in accordance with their nature by means of differerent error signals, including an error register assigned bit positions of which are set by said error signals, an analysis network which serves to check the relevant contents of the error register and in dependence upon the outcome to produce a start signal for fault handling operations, a clock generator which operates in accordance with the start-stop principle and which serves to produce system clock pulses for the central control of the data processing installation, and a pause generator connected between the analysis network and the clock generator and which, upon receipt, in the case of an error, of the start signal from the analysis network, stops the clock prior to a predetermined clock phase corresponding to initiation of a new elementary operation of a micro-programme and, after a predetermined pause period, restarts the clock.

2. A data processing installation as claimed in claim 1, in which the pause generator comprises a stop marker bistable flip-flop which is set upon receipt of said start signal and which when set actuates a start stop device of the clock to stop the clock, a monostable circuit which is set upon receipt of said start signal and which resets after said predetermined pause period to, via pulse shaping means, reset the stop marker flip-flop and provide a fault routine start signal.

3. A data processing installation as claimed in claim 2, in which the pause period of the monostable flip-flop is determined by an RC-network which is switchable whereby one of several predetermined pause periods may be selected.

4. A data processing installation as claimed in claim 3, in which the RC-network of the monostable circuit comprises a resistor which is connected with the zero potential of an operating voltage source and which is connected via a reverse biased diode to one of the control inputs of the monostable and via switching means to a selected one of several capacitors, a different capacitances, which are connected to a second control input of the monostable trigger stage.

5. A data processing installation as claimed in claim 2, 3 or 4 in which the pause generator is equipped with a blocking device consisting of two AND-gates which are assigned to the setting input and resetting input of the stop-marker flip-flop, a first input of each AND-gate being connected to a respective control line which carries, respectively, the start signal for the pause generator and a signal from the pulse shaping means, and a second input of each AND gate for commonly supplying an inhibit signal is connected to the output of further switching means whose selectively connectable input contacts are connected via a further resistor to zero potential and via a further resistor to negative operating potential of the operating voltage source.

6. A data processing installation as claimed in any one of the preceding claims, wherein central control devices of the data processing installation are constructed in ECL-circuitry technology and the pause generation is constructed in TTL circuit technology and, in order to match levels of the ECL-circuitry to levels of TTL-circuitry the pause generator is equipped with two level converter stages which are connected to the input end and, via the pulse shaper stage to the output end of the monostable trigger stage.

7. A data processing installation substantially as herein described with reference to the accompanying drawing.