SU559238A1 - Control device with control - Google Patents

Description

If the main volume is hundreds of thousands of hours and even millions of hertz, the discharge counter length of the pulse, subject to the assumption of at least two attempts to pass the test program, must be 14-15 bits However, with a stable failure, the waiting time of the overflow signal {failure signal} of a counter of such magnitude is large, which practically makes it unacceptable to use this device in digital computers that work as part of control systems operating in real life. om masigabe aremeni. Typically, such systems are built using redundancy, so a quick failure detection is a prerequisite for the quickest switch to the reserve, which ensures that the control mode continues to the end.

In the known device, it is impossible to generate a failure signal of a digital computer in case of failures of its equipment, leading to generation in the operation control device of signals that set the error duration counter to position O, which prevents its overflow. In addition, when executing the actual error analysis program and the digital computer, all the control circuits in it are blocked, i.e. any occurrence (repetition) of a malfunction at this time places the digital computer into an indeterminate state. Similarly, in this device, there is no corresponding response to failures, which steadily suppress the call blocking signal of the error analysis program, which simultaneously blocks the flow of main pulses into the fault duration counter and, therefore, prevents the overflow signal from being generated. It is clear that difficult situations in the work of such; The digital computer also leads to the absence of the possibility of generating a failure signal in the event of a hardware failure in the main pulse generation circuits.

This device does not have time monitoring of program execution, which reveals faults leading to jamming and stopping, although the equipment of the error duration counter used occasionally stays idle for almost the entire operation time of the digital computer. There is no possibility of repeated use of the failure duration counter (i.e., the possibility of its activation in case of independent faults occurring during one mode, but at different times) due to the fact that the start unit does not have an unlock signal that could programs (after the completion of the error analysis program) remove the prohibition on the arrival of the main pulses, which is set by the blocking signal at the beginning of the error analysis program execution. No sleep is also a reaction to possible malfunctions in which during

run the test program logical

The test pass test detects an error, and the error detection device does not work.

The aim of the invention is to increase

speed and reliability.

This is achieved by introducing a stable signal generator, a frequency control unit, a gating unit, a second element I, the output of the stable signal generator connected to the third input of the start unit and to the first input of the frequency control unit, the second input and output of which are connected respectively to the input of the device and the first input of the output unit

Failure signals, the second and third inputs of which are connected respectively to the first output of the fault counter and to the second output of the start block, the third output of which is connected to the first inputs of the second element I and the gating unit, the outputs of which are connected to the first input of the failure counter and the first control input of the counter failure duration, the output of which is connected to the fourth input of the start-up block, the fourth output of which is connected to the third input of the error analysis block, the second output of which is connected to the second inputs of the string block The second output of the local control unit is connected to the second control input of the failure duration counter, the fourth, sixth and seventh outputs of the local control unit are connected respectively to the third inputs. gating unit, utility counter and the fifth input of the starting unit.

The drawing shows a block diagram of the proposed device.

The device contains a command counter .1, a tag generation and storage unit 2, a local control unit 3, an error detection unit 4, an error analysis unit 5, a start unit 6, a failure duration counter 7, elements 8 and 9, an off-stage signal generation unit 1O, fault counter 11, gating unit 12, stable signal generator 13, frequency control unit 14. The device operates as follows In the process of executing the programs, block 2, using the counter 1 and block 3, forms and stores labels (owls), to which the program is returned in case of an error detected during its execution. In addition to monitoring the operation of a digital computer performed by block 4, the device has a temporary control of the passage of program sections between two adjacent marks. The control is built using counter 7 and generator 13. In normal operation of the digital computer, the main pulses 1 and 1 are constantly supplied to the blocks 6 and 14 and the highly stable low-frequency signals, while the block 6 is in the off state and highly stable low-frequency signals are passed to the counter 7 seeking to overflow. However, if there are no disturbances in the program flow, then simultaneously with the formation of each new label, block 3 through AND 9 enters into counter 7 a constant code that determines the execution time of the program until the next label is generated, which updates the counter state 7, preventing its overflow. If, during the operation of the digital computer, unit 4 detects an error, then the signal from it goes to blocks 5 and 6. The signal that arrives at bpoc 5 is transmitted to counter 11, which is stored, and to block 12, which is turned off when the block 6 is turned off this signal to counter 7, resetting it to the zero state. The error signal received at block 6 turns it on, as a result of which a signal is received at the block and element 9, which prohibits the passage of signals, while the reception of highly stable low-frequency signals stops at the counter 7 and the main pulses begin to flow. From this point in time, counter 7 starts counting the error signal processing time. On the error signal, block 5 interrupts the execution of the program and switches to the counter 1 the address of the first command of the analysis program, errors. At the beginning of the error analysis program, unit 3, through the start-up circuit of the test-program, switches to the 1-address address, the first command of the test program. the purpose of which is to check the use of equality of digital computer equipment. Performing a test program on a digital computer in which a failure of any of its elements takes place, in the overwhelming majority of cases, leads to the appearance of new errors, which ° cause a new triggering of unit 4. At the same time, every nsha error signal interrupts the test being performed. the program with its new launch along the same chains. At the same time, each of the generated error signals goes to counter 11, and fills it. This process continues until the counter 11 overflows, as a result of which a failure signal is sent to block 1O. Blocking the installation in the position O of the counter 7 according to the error signals generated during the execution of the test program is stored in the device. The result is: t counting the duration of a possible failure. If the execution of the test program is successful, i.e. it reaches the end without causing overflow of the counter 11, then the error analysis program itself is activated, the first command of which block 3 blocks the interrupt and turns off block 6. The interrupt block signal goes to block 5, thus eliminating the possibility of starting the test programs, as well as the passage of error signals to the counter 11. The arrival on the counter 7 of the main pulses is stopped and the receipt of highly stable low-frequency signals there is resumed. Immediately before returning the label of the error analysis program, block 3 overlaps the signal that arrives at block 5, unlocks the interrupt, i.e. unlock call blocking analysis program -. mistakes. In the last command of the error analysis program, unit 3 sends a signal to the return control circuit. the signal arrives at block 2, as a result of which the label (address) stored in this block is stored in the return circuit in counter 1. After this, the repetition of the program section where the error was originally detected begins. The entire stage of the execution of the error analysis program itself, despite the fact that it occurs when the interrupt state is blocked, is monitored over time due to the operation of counter 7. If for any reason. The progress of the error analysis program is disturbed, the output to the return branch of the label is not it happens, and the investigator does not update the code in meter 7. In this ray, it is re-populated, which indicates that an error has been detected. The overflow signal of the counter 7 goes to block 6, turns it on and at the same time, skipped by the still off state of block 6, goes to bpock 5, where it triggers as an error signal from the time control. The response of block 5 to the error signals output by counter 7 is similar to that described in processing signals generated by block 4. The only difference is that the error signal from the time control is non-blocking, i.e. it causes the program to be interrupted and enters counter 11, even if there is a block in block 5. Since in such situations a blocked interrupt state prevents the error signals generated by block 4 from passing to counter il, then in order to increase the efficiency and speed of processing the malfunction The first command of the test program, regardless of the reason for its inclusion, always proactively removes the blocking call to the error analysis program (i.e., unlocking the possibility of interruption in block 5).

The operation of the device during the processing of error signals detected by time monitoring during the execution of working programs is similar to that described above. As a rule, group time or control errors are triggered by the triggering of a time control, which disrupt the work flow: programs, but can not be detected by block 4. The test program included in this service reveals such faults due to the operation of the logic control embedded in it. If during the operation of the digital computer the equipment fails in the main impulse circuit, then there is a complete stop in the operation of the circuits, which in turn completely blocks the operation of unit 4. and. Such failures are detected by unit 14, which promptly reveals the fact of loss of main impulses. The signal from block 14 enters H block 10, a certificate of failure.

- The control device has a number of technical advantages, of which the most important is to increase the efficiency of establishing the fact of failure in the equipment of a digital cyclone

The shortening of the generation time of the failure signal | DVM is provided by the operation of the counter 11, which receives the primary one, as well as all subsequent error signals that cause the program to be interrupted. The excess of the number of error signals over the permissible value for a limited time (during the execution of the test program) is regarded as a failure of the digital computer. Due to the fact that the failure of almost any element of the digital computer generates a steady stream of error signals while the test program is running, counter 11 overflows, which is 3-4 bits wide, causing failure to occur, long before the possible moment, that counter overflow 7

The use of counter 11 also makes it possible to reduce the time it takes to generate a failure signal even in those cases where a malfunction triggers the logic control embedded in the test program itself, and block 4 does not work. In this case, the software-generated error signals (i.e., the results of the program control) also go to counter 11, causing it to overflow.

A significant advantage of this device is the possibility of generating a failure signal of a digital computer in cases where a fault occurs in the main impulse circuit, which previously, in principle, did not allow the generation of a failure signal.

The block 14 and the generator 13 entered into the device allow for the failure of the digital computer to fail in cases where there is a complete stop in the operation of both the working and monitoring equipment, and the speed of the failure signal generation is of the same order as when the counter was triggered eleven.

The increased operability of detecting a failure expands the possibilities of using digital computers in various systems. In particular, such digital computers can operate as part of control systems built with the use of redundancy, in which control processes take place in real time .;

Offered g || 1 ysgv6 increases functional reliability - CV.M and reduces the likelihood of registering errors that occur during program execution. Improvement of these parameters is provided by the introduction of a time control of these stages of the digital computer operation, including when blocks of the developed interrupt capability state, which completely disables the error detection device. In particular, this control is valid during the execution of the error analysis program itself, when malfunctions resulting from primary malfunctions are possible. Thus, the introduction of new blocks, the activation of the counter of failures, the organization of a new mode of operation of the counter of failure duration, the introduction of a blockage in the installation chain to the O position of the diagnostic circuits, and the removal of the blocking signal from the start-up unit dramatically increase the efficiency of the device, which allows and promptly respond practical (: q

and group failures in the digital computer equipment.

Claims (1)

Invention Formula A control device with a control containing an error detection unit, the output of which is connected to the first inputs of the start-up unit and an error analysis unit, the first output of which is connected to the first input of the command counter, the second and third inputs of which are respectively connected to the first output of the local control unit and through the shaping unit and storing labels — with the second output of the Mect control unit; the output of the command counter is connected to the input of the shaping and storing unit of the G marks; the third and fourth outputs of the local control unit dinene respectively with the second input of the error analysis block and with the input of the first element I, the first output of the start block through the serially connected counter fault duration and the first element soy. The device is connected to the device input, a fault counter and a failure signal generation unit, characterized in that, in order to improve speed and reliability, a stable signal generator, a frequency control unit, a gating unit, a second element are entered into it And, moreover, the output of the generator of stable signals is connected to the third input of the start block and The first input and output of the frequency monitor control unit are connected respectively to the device input and the first input of the failure signal generation unit, the second and third inputs of which are connected respectively to the first output of the fault counter and to the second output of the start unit, the third output of which is connected to the first inputs of the second element AND and gating unit, the outputs of which are connected to the nepBbn i input of the fault counter and the first control input of the failure duration counter, the output of which is connected to the fourth input of the start block, the fourth output of which is connected to the third input of the error analysis block, the second output of which is connected to the second inputs of the gating unit and the fault counter, the second output of which is connected to the input the first element And, the fifth output of the local control unit through the second element And is connected to the second control input of the failure duration counter, the fourth, sixth and seventh outputs of the local unit the controls are connected respectively to the third inputs of the gating unit, the fault counter and the fifth input of the starting unit. Sources of information taken into account in the examination, 1, USSR author's certificate .№ 435526, M, CL °. eO (G1L / OO, 17,10,7.1 2, USSR author's certificate No. 37885О, M.Kl ООГГГ / О8, 30.04,71 (prototype).