499NEH00410模块备件

CI873和TP867-以太网/IP接口
m） 。两个处理器单元
也连接到相同的CEX总线，并且两个总线中的任何一个都可以控制
膨胀装置（参见93页图29）。
S800 I/O单元通过光学模块总线和两个
每个S800 I/O集群上的TB840集群调制解调器（参见161页的图55）。这个
TP830基板上的内置电气模块总线不能用于连接
冗余系统中的S800 I/O。
底板TP830上的串行端口COM3不能用于冗余CPU
配置
PM891/PM86x/TP830处理器单元-冗余1节介绍
48 3BSE036351-510 A
PM891冗余
PM891中的冗余链路由两个物理链路组成。这些是
RCU数据链路和RCU控制链路。
RCU数据链路是用于传输数据的快速通信信道
需要保持备份CPU与主CPU同步。
TK855 RCU数据链路电缆用于数据链路。
RCU控制链路用于角色选择和CPU标识分配
（上/下）。
TK856 RCU控制链路电缆用于控制链路。
容错原理
冗余处理器单元的容错原理基于：
将备份单元持续更新到与主单元相同的状态。这
使备份单元能够在不影响周围系统的情况下进行控制
不颠簸的方式。
这一原则涉及程序执行的动态划分
单元和创建回滚点，处理器单元的状态为：
完全定义。
在此上下文中，处理器单元的总状态定义为处理器单元的
内部状态，即处理器寄存器的内容，加上
数据存储器。
每次主单元通过回滚时，备份单元的状态都会更新
点，使备份单元能够从上次回滚恢复程序执行
如果主单元因错误而失败，则通过点。
为了尽量减少更新中涉及的信息量，备份
仅当自新回滚点以来发生更改时，单元才会更新。
在回滚点之间，这些写入数据内存的更改存储在
备份单元中的日志缓冲区。在回滚点，处理器的总寄存器
内容也被写入数据存储器，因此该信息也
记录。一旦建立了回滚点，记录的写操作将
传输到备份单元的数据存储器。
1节介绍PM891/PM86x/TP830处理器单元——冗余
3BSE036351-510 A 49
如果主单元因错误而失败，备份单元将从
后一个回滚点，这意味着后一个执行单元部分重新执行
由备份单元执行。为了重新执行执行单元的一部分
影响外围设备（CEX总线上的通信设备），外围设备
在回滚点之间也会记录单元的引用。在重新执行期间
已执行的外围设备参考结果如下：
而不是重新执行它们。检索读取操作的结果
从日志中，和写入操作在不执行的情况下通过，因为它们已经
已被处决。因此，外围设备的状态不受重新执行的任何影响，但发生的时间延迟除外。
处理器单元中包含的RAM提供自动双反转
用于检测存储器中任意位错误的存储器功能。
•所有内存更新都写入主内存和反向内存
并行存储。
•在每个存储器读取周期，比较两个存储器的数据。
•如果数据不匹配，则强制转换。
双倒相内存处理在硬件中完成，不会有任何延迟：
存储器循环时间。
冗余配置中的MAC和IP地址处理
为了提供相对于控制网络的无冲击切换，
MAC和IP地址在初始主和备份之间交换
CPU。初始主CPU的地址被存储并保持为地址
由代理主CPU使用。类似地，初始备份CPU的地址
被存储以供代理备份CPU使用。这意味着一个冗余
控制器将始终由以下人员识别和识别：m). Both processor units
are also connected to the same CEX-Bus and either of the two can control the
expansion units (see Figure 29 on page 93).
S800 I/O units are connected to the two CPUs via the optical ModuleBus and two
TB840 cluster modems on each S800 I/O cluster (see Figure 55 on page 161). The
built-in electrical ModuleBus on the TP830 baseplate cannot be used for connecting
S800 I/O in a redundant system.
The serial port, COM3 on the baseplate TP830, cannot be used in redundant CPU
configuration.
PM891/PM86x/TP830 Processor Unit – Redundancy Section 1 Introduction
48 3BSE036351-510 A
PM891 Redundancy
The Redundancy Link in PM891 consists of two physical links. These are the
RCU Data Link and the RCU Control Link.
The RCU Data Link is a fast communication channel used to transfer the data
required to keep the backup CPU synchronized with the primary CPU.
TK855 RCU Data Link Cable is used for the data link.
The RCU Control Link is used for role selection and CPU identity assignment
(UPPER/LOWER).
TK856 RCU Control Link Cable is used for the control link.
Fault Tolerance Principle
The principle of fault tolerance in the redundant processor units is based on
continuous updating of the backup unit to the same status as the primary unit. This
enables the backup unit to assume control without affecting surrounding systems in
a bumpless manner.
This principle involves dynamic division of the program execution into execution
units and the creation of rollback points at which the processor unit's status is
completely defined.
In this context, the processor unit's total status is defined as the processor unit's
internal status, that is, the contents of the processor registers, plus the contents of the
data memory.
The backup unit's status is updated each time the primary unit passes a rollback
point, enabling the backup unit to resume program execution from the last rollback
point passed, should the primary unit fail due to error.
In order to minimize the amount of information involved in the update, the backup
unit is updated only with the changes taking place since the latest rollback point.
Between rollback points, these changes that writes in the data memory, are stored in
a log buffer in the backup unit. At a rollback point, the processor's total register
contents are also written into the data memory, so that this information is also
logged. Once the rollback point is established, the logged write operations are
transferred to the backup unit's data memory.
Section 1 Introduction PM891/PM86x/TP830 Processor Unit – Redundancy
3BSE036351-510 A 49
If the primary unit fails because of an error, the backup unit resumes execution from
the last rollback point, which means the last execution unit is partially re-executed
by the backup unit. In order to re-execute a portion of the execution unit without
affecting the peripheral units (communication units on the CEX-Bus), the peripheral
units' references are also logged between rollback points. During re-execution, the
results of the peripheral units' references, which have already been executed, are
used, rather than re-executing them. The results of read operations are retrieved
from the log, and write operations pass without execution, since they have already
been executed. The peripheral units' statuses, then, are not affected by the reexecution in any way, except for the time delay which occurs.
The RAM included in the processor unit provides an automatic double inverted
memory function for detection of arbitrary bit errors in the memory.
• All memory updates are written to both the primary memory and to the inverted
memory in parallel.
• At every memory read cycle, the data from tho two memories is compared.
• If there is a mismatch in the data a changeover is forced.
The double inverted memory handling is done in hardware and without any delay to
the memory cycle time.
MAC and IP Address Handling in Redundant Configuration
In order to provide for a bumpless changeover with respect to the control network,
both the MAC and IP addresses are swapped between the initial primary and backup
CPUs. The addresses of the initial primary CPU are stored and kept as the addresses
used by the acting primary CPU. Similarly the addresses of the initial backup CPU
are stored to be used by the acting backup CPU. This means that a redundant
controller will be always identified and recognized by