 |
Description  |
|
|
FIELD OF THE INVENTION
The clock of this invention provides a stable reliable clock for local
distribution synchronized with a remotely transmitted signal and, for
times, independently producing said signal when said remotely transmitted
signal is unavailable.
BACKGROUND OF THE INVENTION
Systems for the transmission of the digital information, over line wire
links, microwave or other radio links, are well known to the art. Some of
these systems, either now operating or planned for operation, are
thousands of miles in length or more. For those systems which employ
synchronous data handling a clock must be available at each data handling
locality which is synchronized with the clock at the originating station.
To enable any station in the system to communicate with any other station,
then, each station must have a local clock available which is synchronized
with every other local clock at every other station. In order to effect
this a single station is selected as the master and its clock employed for
data transmission. The adjacent station generates a synchronous clock for
distribution and retransmission. Of course, due to signal degradation, as
a result of transmission, the remotely transmitted signal (or clock) must
be reconditioned or regenerated at each of the stations. In order to
provide a stable synchronized signal for local distribution a phase lock
loop, which is a well known circuit configuration, is an obvious choice.
However, the very high data transmission rates, up to 20 M bits per
second, coupled with the serious consequences at any station of losing the
clock, require that in addition to stability, the local clock generation
equipment must be highly reliable.
One well known method of increasing reliability of any apparatus is to
provide that apparatus in redundant form, that is to provide more than one
copy of the apparatus and, when a failure of an operating apparatus is
indicated a switch over can be effected to the redundant apparatus. It
should be apparent to those skilled in the art that due to the high data
rates employed in typical data transmission systems, one cannot rely upon
manual switch over between redundant apparatus. Therefor, automatic
operating apparatus must be provided to effect a switching operation. In
addition, as a further corollary of the reliability requirements, the
automatic switching apparatus must be capable of sensing of any one of a
number of possible failures (including failure of the failure detecting
apparatus) and properly responding thereto in a short a time as posssible.
Merely providing redundant apparatus in automatic equipment to switch out a
"failed" unit and switch in a "good" unit will not, however, porvide a
complete solution. In addition to the possibility that one of the
redundant apparatus may fail, this system must also handle the possibility
that the local station will not receive the remotely transmitted signal,
or if a remotely transmitted signal is received it is so degraded that
synchronizing the local oscillator thereto will actually be detrimental to
system operation. Thus, not only must the apparatus respond to effective
loss of the remotely transmitted signal but some means must be provided
for independently generating the signal and furthermore, such independent
local generated signal must meet system specifications.
SUMMARY OF THE INVENTION
The present invention meets the forgoing and other requirements for data
transmission systems by providing a station clock which is responsive to a
remotely transmitted signal for locally generating a synchronized signal.
In order to meet the reliability requirements three independent phase lock
loops are provided, each of which is responsive to the remotely
transmitted signal for generating a synchronized signal. Means are
associated with each phase lock loop for detecting a failure thereof. More
particularly, signals of various components of one phase lock loop are
compared with corresponding signals of another of the phase lock loops as
well as absolute standards. Majority voting logic means responsive to
these comparisons determines whether or not a particular one of the phase
lock loops has failed, and if that is the case, which of the phase lock
loops has failed. Switching means selectively connects one or more of the
phase lock loop outputs to an output port for local distribution. The
switching means is, of course, controlled by the majority voting logic so
that the output of a failed phase lock loop will not be connected to the
output port.
In addition to the foregoing apparatus, each phase lock loop independently
detects the quality of the remotely transmitted signal it receives and
independently determines whether or not it is acceptable. The clock then
determines whether or not the remotely transmitted signal is acceptable
based upon a majority voting logic comparison of the signal received from
each of the phase lock loop detectors responsive to the remotely
transmitted signal. If the majority voting logic analysis indicates that
the remotely transmitted signal is deemed unavailable, i.e., it is
unacceptable, the apparatus switches from the slave mode to the master
mode.
Each of the phase lock loops includes an A/D convertor connected to the
output of the low pass filter to receive the loop error voltage. The
output of the A/D converter is, of course, a digital representation of the
phase lock loop error voltage. This output is connected as one input to a
multiplexer whose output is connected to a D/A converter. The analog
output of the D/A convertor controls the voltage controlled oscillator in
the phase lock loop. A serial combination of a digital filter and a
digital modifiable memory is connected between the output of the A/D
converter and the second input of the multiplexer. In the slave mode the
multiplexer passes, to the D/A convertor, the output of the A/D convertor.
However, in this mode the digital filter maintains a running "average" of
a number of previous samples of error voltage. Of course, the sampled
error voltage is indicative of the proper frequency for the voltage
controlled oscillator. When the clock switches to the master mode the
digital filter output is loaded into the memory and the multiplexer is
controlled to block its first input and to pass its second input to the
A/D convertor. This action effectively opens the phase lock loop and
causes the voltage controlled oscillator to be driven by the sample error
voltage. Since the "average" of the sampled error voltage which is
generated by the digital filter is now resident in the memory, the voltage
controlled oscillator generates a frequency corresponding to the "average"
error voltage. Since the digital filter generates a time average error
voltage the error voltage will correspond to a frequency which is
acceptable. So long as the phase lock loops remote transmitted signal is
unacceptable the clock remains in the master mode. In this mode only one
of the locally generated signals is allowed to reach the output port. When
the remotely transmitted signal is detected as again acceptable a recovery
mode is entered.
During the time when the remotely transmitted signal was unacceptable it is
possible for the voltage controlled oscillator to "drift" in frequency
and/or phase. As a result, at the time the remotely transmitted signal
again becomes acceptable, there may be an accumulated error between the
remotely transmitted signal and the voltage controlled oscillator output.
To ensure proper data handling this accumulated error must be compensated
for. This is accomplished in the recovery mode, where the modifiable
memory is incremented or decremented to adjust the oscillator frequency.
After a predetermined period of time during which the frequency of the
voltage controlled oscillator may be adjusted to compensate for the
accumulated errors the recovery mode terminates and the clock again enters
the slave mode.
BRIEF DESCRIPTION OF THE DRAWINGS
A specific embodiment of our inventive remote master/slave clock is
disclosed in this specification when taken in conjunction with the
attached drawings in which like reference characters identify identical
apparatus and, in which;
FIG. 1 is a block diagram of our remote master/slave clock illustrating the
major functional units;
FIG. 2 is a detailed block diagram of the clock receiver and selector and
select control switch;
FIG. 3 is a block diagram of a timing generator;
FIGS. 4A and 4B illustrate two types of typical majority logic analysis
circuits employed in various portions of the inventive apparatus.
FIGS. 4C and 4D are detailed block diagrams of automatic mode control
circuit;
FIG. 5 is a detailed block diagram of the majority logic circuit;
FIG. 6 is a detailed block diagram of a clock switch 15;
FIG. 7 is a detailed block diagram of the phase lock loop frequency
division chain and timing generation;
FIG. 8 is a detailed block diagram of the connections between A/D convertor
37, multiplexer 40, filter 38 and memory 39;
FIGS. 9A and 9B are respectively typical wave forms and a detailed block
diagram of a portion of a phase failure detector; and
FIG. 10 is a detailed block diagram of the filter 38.
DETAILED DESCRIPTION OF THE DRAWINGS
FIG. 1 is a block diagram of the apparatus of the clock built in accordance
with the teachings of the present invention. Before discussing this Figure
in detail it will be helpful to briefly set out the context in which this
station clock operates. A data transmission system includes a plurality of
stations which may be connected one to another via a transmission link
such as line wires, microwaves or other radio links. Each of the stations
includes a station clock as illustrated in FIG. 1. One of the stations,
preferably a station located near the geographic center of the system, may
be designated as a master station. This station generates a signal which
is used in transmitting, to stations adjacent thereto, any data which the
station may be transmitting. Each of the stations receiving the
transmission operates in a slave mode and generates a signal which is
synchronized with the remotely transmitted signal. This signal, in
addition to being employed locally at the station, is also transmitted to
stations downstream of the receiving station. In this fashion, each of the
stations receives a remotely transmitted signal which is synchronized with
a signal generated at the master station.
The station clock illustrated in FIG. 1 includes a clock receiver and
selector 10 which has connected to it a plurality of inputs one, two and
three. Only one input is selected and this is the input to which the
remotely transmitted signal is applied. The effective input is selected by
the select control switch 11 connected to the clock receiver in selector
10. Switching apparatus within the clock receiver and selector 10 is
operated by the select control switch 11 to route the remotely transmitted
signal to each of at least three timing generators 12, 13 and 14. Each of
the timing generators 12, 13 and 14 are identical with one another and
each provides an output to switching circuit 15. In the slave mode of
operation the output of each of timing generators 12, 13 and 14 provided
to switch 15 is a locally generated signal which is synchronized with the
remotely transmitted signal. In a manner to be described hereinafter
switch 15 combines its inputs and provides the combination to driver 16.
Driver 16 is connected to the output port to thus make available the
locally generated signal which is synchronized with the remotely generated
signal. For some applications signals synchronized with the signal but at
sum-multiples thereof are also desired at the stations. To effect this
switch 15 also includes one or more divider chains to provide such
synchronized signals at sub-multiple frequencies of the remotely generated
signal. Illustratively, driver 17 and 18 are illustrated as receiving
divided outputs from switch 15 and making available such lower frequency
signals to still other output ports for local distribution and use.
As has been mentioned above the station clock operates in one of three
modes, in the slave mode the clock provides, to an output port, a locally
generated signal synchronized with the remotely transmitted signal. If,
based on criteria to be explained hereinafter, the station clock
determines that the remotely transmitted signal is unavailable the station
clock enters the master mode in which a signal is locally generated which
is independent from the remotely transmitted signal. Finally, when the
remotely transmitted signal is again detected as being available the
station clock enters the recovery mode to compensate for the effects of
drift in the master mode. At the conclusion of a predetermined interval of
time, the recovery mode terminates and station clock again enters the
slave mode.
As used in the foregoing description the term "unavailable" as applied to
the remotely transmitted signal is intended to mean that either the
remotely transmitted signal is completely unavailable or, the remotely
transmitted signal which is available is so degraded in amplitude and/or
frequency, that it would be detrimental to synchronize the locally
generated signal thereto.
Based upon signals received from each of the timing generators 12, 13 and
14 with respect to the quality of the remotely transmitted signal, each of
a plurality of automatic mode control circuits 19, 20 and 21 may determine
that it is necessary to switch from a slave to a master mode. Furthermore,
each of the timing generators 12, 13 and 14 include failure detecting
circuits of two types. One type of failure detecting circuit is
independent from any other timing generator and may determine a failure
based on an absolute standard. For instance, the phase failure detector
circuit is included in each timing generator 12, 13 and 14. A voltage
comparator triggers an alarm whenever the output of the phase detector
reaches a predetermined level indicating an improper phase relation
between the local generator signal and the remotely transmitted signal.
The other type of failure detecting circuit is a relative failure
detecting circuit which compares corresponding signals from two timing
generators and detects a failure if a difference between these signals
exceeds a pre-established minimum.
Based upon the foregoing plurality of failure detecting signals each of the
automatic mode controls 19, 20 and 21 determines whether the remotely
transmitted signal is acceptable, whether any timing generators has an
absolute failure or a relative failure. A plurality of majority voting
logic means 22, 23, 24 and 25 responds to signals received from each of
the automatic mode control circuits 19, 20 and 21 on a majority voting
principal selects both the mode of the station clock, which of the timing
generator outputs to pass switch 15 to the output port and what status and
alarm signals to be transmitted by the status and alarm circuit 27. In
addition, if the majority voting analysis determines that the clock should
enter the recovery mode then a recovery gate is generated by the majority
voting logic means 24 and transmitted to the recovery mode interface 26.
The recovery mode interface 26 interfaces the station clock with
associated equipment at the station. In response to the recovery gate,
transmitted to it, the associated equipment may request either a frequency
increase or frequency decrease. Whichever signal is received (if any) is
then passed on to all three of the timing generators 12, 13 and 14 for
appropriate modification of the locally generated signal in a manner to be
explained hereinafter.
Before discussing the detailed block diagrams which illustrated the
configuration of the various components of the station clock illustrated
in FIG. 1, a brief recitation of the system operation in its various modes
will enable the reader to more easily understand the functions which are
required by the various components.
The remotely transmitted signal which is received by the clock receiver and
selector 10 is reshaped and sent in parallel to the triple redundant
timing generators 12, 13 and 14. If more than one remotely transmitted
signal input is connected, the select control switch 11 determines which
input is effective. Each timing generator consists of a stable voltage
controlled oscillator in a phase lock loop and a loop control. Together
they operate as a narrow band, high stability phase lock loop with
controlable memory internal to the loop. The timing generators also
contain a number of failure detectors for determining the status of the
remotely transmitted signal as well as the internal status of each
generator. The results of all failure detectors are fed in triple
redundant fashion, to three automatic mode control circuits 19, 20 and 21
where control decisions are made. The outputs of the automatic mode
control circuits 19, 20 and 21 are fed to the plurality of majority logic
circuits 22, 23, 24 and 25. When two or three of the automatic mode
circuits 19, 20 and 21 indicate a certain control should exist or that a
failure has occurred then the output of the respective majority logic
means will implement the control function or send an alarm via the status
and alarm circuit 27.
When the remotely transmitted signal is at proper amplitude and within a
predetermined frequency limits the remotely transmitted signal will be
considered "good" by the failure detectors and the automatic mode controls
19, 20 and 21 will vote a slave mode. In an embodiment of our invention
which has been constructed in which the signal was nominally 21.504 MHz we
employed frequency limits of .+-. 3 Hz in the slave mode and .+-. 2 Hz in
the master mode. In the slave mode all three timing generators will
independently phase lock to the remotely transmitted signal. The output of
all three timing generators will be identical to the input frequency and
within 40.degree., for example in phase but there will be about a 30 or
40:1 reduction in RMS jitter. The remotely transmitted clock originates on
a clock recovery loop in the above mentioned embodiment employing a PSK
demodulator with a double sided band width of about 2 KHz. The timing
generator's phase lock loops have band widths of about 6 Hz, accomplishing
a large reduction in jitter. In the slave mode the output of all three
timing generators are fed to the switch 15. If all three generators are
operating properly the output of the switch is a combination of these
outputs. If one timing generator fails in amplitude or frequency the
majority logic will disable the "bad" input and properly bias the input to
the majority logic gate. If non-like failures occur in two of the three
timing generators then the automatic mode controls and the majority logic
will turn off both bad inputs and the output would be from the one good
timing generator. The status and alarm circuit 27 generates an alarm
indicating that a failure or failures have occurred.
The combined outputs from the timing generators 12, 13 and 14 then goes in
parallel to buffers and internal dividers in switch 15. The various
outputs from the switch 15 then drive the drivers 16, 17 and 18.
If the remotely transmitted clock becomes unavailable i.e., the amplitude
or frequency depart from the nominal by greater than the pre-established
standards then the failure detectors in each timing generator 12, 13 and
14 will provide a "bad" input signal to the automatic mode controls 19, 20
and 21. Based on a majority vote of the automatic mode controls 19, 20 and
21 the associated timing generators 12, 13 and 14 will be commanded to the
master mode.
Shortly prior to entering the master mode each phase lock loop of the
timing generators were tracking normally. Each loop has an A/D convertor,
a low cut-off frequency digital filter a modifiable digital memory and a
D/A converter plus associated control circuitry. The A/D - memory - D/A
apparatus provides a means of storing frequency (actually, a loop error
voltage) long term. During normal slave operation a new sample of error
voltage is taken and converted to a digital word. Periodically (for
example every 0.1 seconds) during normal slave mode operation one of these
words is loaded into the digital filter which effectively updates an
n-sample long "running average" of the error voltage with every new
sample. In the embodiment referred to above we employed a filter
containing 256 samples.
When the remotely transmitted signal fails and switch over to the master
mode occurs, the stored error voltage is passed to the modifiable memory
and the phase lock loop is opened. No further samples of the error voltage
are taken and the modifiable memory is employed as an holding register to
drive the D/A convertor. Therefore, a constant DC voltage is sent from the
D/A convertor to the voltage controlled oscillator. This value of error
voltage is relatively old since the filter acts as a delay by reason of
its time constant (in the referred to embodiment the time constant of
approximately 26 seconds was employed). A "good" frequency is therefor
establihsed as the secondary master clock. As long as the remotely
transmitted signal is deemed unavailable the phase lock loop simply holds
the last known good frequency.
In the master mode the three timing generators are not phase locked but
tend to drift slowly in phase, relative to each other. Majority logic
combining cannot, therefore, be used to derive the output clock. Instead,
the automatic mode controls 19, 20 and 21 select, again by a majority
logic, one and only one of the timing generators 12, 13 and 14 as the
effective output from switch 15. Normally, timing generator 12, for
example, would be selected as the effective clock unless it is determined
to have failed.
The digital filters and memories in the timing generators are monitored in
the master mode. If one of these memories departs, in numerical content,
from the other two by greater than a pre-established standard (12.5% in
our referred to embodiment) then that timing generator is considered
failed and rendered ineffective.
When the remotely transmitted signal returns to normal the clock reverts
back to its slave mode through the recovery mode. Normally the recovery
mode is only entered when the remotely transmitted signal returns to
within pre-established frequency limits (such as plus and minus 2 Hz).
However, if the stored error voltage exceeds a pre-established standard a
different limit (.+-. 6 Hz) is employed.
By reason of drift in the master mode each of the timing generators may
have slipped out of synchronism with the unavailable transmitted signal.
When the fault in the remotely transmitted signal clears the failure
detectors in each of the timing generators indicate an acceptable remotely
transmitted signal. The automatic mode control circuits 19, 20 and 21
then, based on a majority vote, determine to enter the recovery mode and
the associated timing generators are appropriately operated. The recovery
gate is generated by the majority voting logic means and is sent to the
associated equipment. That equipment may respond with a signal to either
increase or decrease the locally generated frequency. The manner in which
this signal is employed to change the voltage controlled oscillator
frequency will be explained hereinafter. Suffice to say here, however,
that the recovery mode last for a pre-established period of time. During
the switch over from the master mode - recovery mode - slave mode, a
"master mode extended" signal is provided to prevent false alarm signals
from being generated.
FIG. 2 is a detailed block diagram of the clock receiver and selector 10
and select control switch 11. Three input terminals connect, respectively
signal 1, signal 2 and signal 3. Each input terminal is connected to a
pair of receiving amplifiers 28 and thus, each input signal generates a
pair of outputs from its respective associated receivers. A plurality of
AND gates 29 are provided, each with a pair of inputs. One input of each
of the AND gates 29 is connected to a single receiver output. Each pair of
AND gates 29 associated with each of the input terminals has its second
input connected to one of three possible terminals in the select control
circuit 11. The select control switch can enable any pair of AND gates
associated with a single one of the inputs, or it can enable none of the
AND gates (in the OFF position). The output of each of the AND gates 29
are fed to each of three exclusive OR combining circuits 30, 31 and 32.
Each of the exclusive OR combining circuits 30, 31 and 32 includes three
OR gates, each with two inputs. Each of the OR gates are connected to the
outputs of a pair of AND gates associated with a single input. Thus,
exclusive OR circuit 30 has three two input OR gates, one connected to the
output of gates 29-1 and 29-2, a second connected to the output of gates
29-3 and 29-4 and a third connected to the output of AND gates 29-5 and
29-6. The output of each of the OR gates is then applied as an input to
one of two exclusive OR gates. The output of one exclusive OR gate forms a
second input to the second exclusive OR gate. The output of the second
exclusive OR gate, in exclusive OR circuit 30 is then connected as the
input to timing generator 12. Identical circuitry is contained in each of
exclusive OR circuits 31 and 32 which are respectively inputs to timing
generators 13 and 14.
The purpose of the clock receiver and selector is to receive, amplify and
buffer anyone of the three input signals, which are the remotely
transmitted signals. As is illustrated in FIG. 2 the selection is done
with manual switch positioning. However, it is within the scope of our
invention to provide electronic switching or remove and/or automatic input
selection. Self failure detectors 33 are connected, via plurality of
exclusive OR gates to several key points for comparing proper frequency
and phase relationships.
FIG. 3 is a block diagram of any one of the timing generators 12, 13 and
14. In particular, the timing generator is a narrow band width highly
stable phase lock loop with memory. It provides the basic local signal
from which all outputs of the station clock are derived. The timing
generator may operate in a slave or a master mode. The loop tracks the
received signal when in the slave mode, and is capable of maintaining the
same frequency in the event the remotely transmitted signal is unavailable
by means of a memory that stores a digitally filtered representation of a
previous good loop error voltage. The loop band width is typically very
narrow (in our embodiment between 1 and 4 Hz) so, in order to remain
locked at the nominal frequency the voltage controlled crystal oscillator
of the loop is very stable with temperature and time. The noise band with
the loop is also quite narrow (typically between 2 and 8 Hz) thus
providing substantial jitter reduction. A damping factor of about 0.61 is
selected representing a compromise between loop stability and jitter
immunity.
The timing generator includes the phase lock loop and associated control
and failure detecting circuitry, illustrated in FIG. 3. The input to any
of the timing generators 12, 13 and 14 is connected to an amplitude
detector 34 for detecting whether or not the amplitude of the remotely
transmitted signal is acceptable. This detector performs an RC integration
of the rectified remotely transmitted signal and is provided with a time
constant of approximately 100 nanoseconds so that the detection of
amplitude failure may be done rapidly. As illustrated in FIG. 3 the loop
actually operates at one-fourth the frequency of the input by reason of
the divide by 4 flipflops connected to each of the inputs of phase
detector 35. Those of ordinary skill in the art will understand that the
actual operating frequency of the loop may be varied and that division by
other factors can be employed, or can be omitted. The output of the phase
detector 35 comprises the loop error voltage along with high frequency
components which are filtered out by the low pass filter 36. The output of
the low pass filter 36, after amplification, is provided as an input to
the analog to digital convertor 37. The output of analog to digital
convertor 37 is provided as one input to multiplexer 40. The output of the
analog to digital convertor 37 is also provided to digital filter 38 whose
output is provided to memory 39. The output of memory 39 is connected as
the second input to multiplexer 40. The output of the multiplexer 40 is
fed to digital to analog convertor 41 whose output, after amplification,
controls the voltage controlled oscillator 42. As is illustrated in FIG. 3
the error voltage input to the voltage controlled oscillator may be
monitored by means of a meter. The output of the voltage controlled
oscillator is, after amplification, and frequency division provided as the
second input to the phase detector 35. In addition, the output of the
voltage controlled oscillator 42 is also provided to an amplitude detector
42 which provides a local amplitude failure signal. This amplitude
detector is an RC integrator following a diode rectifier with a time
constant of approximately 100 nanoseconds. This relatively fast time
constant allows switch over in response to amplitude failure detection in
less than 400 nanoseconds.
The output of the voltage controlled oscillator is also provided as an
input to a frequency division chain and timing generation circuit 45. One
of the outputs of this frequency division chain 45 is a signal CONVERT
which controls the rate at which A/D convertor 37 provides digital
samples. A second timing signal from circuit 45 is LATCH which is applied
to digital filter 38 to determine the rate at which new error voltage
samples are added to the filter. Other control and timing signals include
a timing signal to upcount or downcount the memory 39 in the recovery
mode, a timing signal to terminate the recovery mode and a signal
MASTER/SLAVE to control the multiplexer 40 when switching from slave to
master mode.
Each timing generator includes a total of five failure detectors. The
first, the remotely transmitted amplitude detector 34 has been discussed
above as well as the detector 43 to detect a failure in the local
oscillator amplitude. These two detectors are absolute in the sense that
the input amplitude or local oscillator amplitude is compared with a
predetermined standard for failure determination. If either of these two
detectors indicate a failure the signal is due, either to the signal
amplitude falling below the predetermined level or a failure in the
detector itself. Detector 34 produces a signal which will be hereinafter
referred to as RAMP (Remote Amplitude) and the detector 43 produces a
signal SAMP (Self Amplitude).
Another failure detector is phase comparator 44 which compares the phase of
the local oscillator signal with the phase of the local oscillator signal
on another timing generator. When the output voltage of this phase
detector 44 exceeds a predetermined threshold (and meets other criteria --
see FIG. 9B) the signal PFAB is produced where A identifies the timing
generator associated with the phase comparator 44 and B identifies the
timing generator which provides the other input to phase comparator 44.
This failure detector is, of course, relative in that which of the two
timing generators has failed has not been uniquely identified.
Failure detector 47 senses the output of phase detector 35 and, if the
phase detector output exceeds the predetermined standard (and meets other
criteria -- see FIG. 9B) a failure detection signal PFAR is produced where
A identifies the timing generator associated with the detector 47 and R
refers to the remotely transmitted signal input.
Finally, failure detector 46 comprises a memory comparator which compares
the most significant bits (in the referred to embodiment the four most
significant bits are employed) of memory 39 with corresponding bits in a
memory on an adjacent timing generator. The unit actually accomplishes a
one's complement addition and declares a failure if the two memories
differ by more than a predetermined amount. This comparison is effected
every time the memory is updated or when the clock is in the master mode.
Now the various circuits which make up the automatic mode control (AMC)
will be discussed. As is shown in FIG. 1 there are three identical AMC's,
19, 20 and 21. Each AMC performs essentially two types of failure checks
including;
a. a self amplitude failure, remotely transmitted signal amplitude failure,
and a self phase versus a remotely transmitted signal phase check
b. a self versus other check including a self phase versus next phase
check, and a self memory versus next memory check.
The failure signals come from each of the three timing generators 12, 13
and 14. Based upon an analysis of these signals the status of each timing
generator is determined.
FIG. 4A illustrates the majority voting logic analysis employed in the
first type of check. In this example signals from each of the received
amplitude detectors 34 are fed to a majority logic network 50. These
separate inputs are labled RAMP-12, referring to the amplitude detector 34
from timing generator 12, RAMP-13, referring to the amplitude detector 34
in timing generator 13 and, finally RAMP-14, referring to the amplitude
detector 34 in timing generator 14. Each of these input signals is also
provided as one input to an exclusive OR gate 51, 52 or 53. The output of
the majority logic network 50 is also provided, as the second input to
each of the exclusive OR gates 51, 52 and 53. The majority logic network
50 tally's the voting and the status of the RAMP. If two or more signals
indicate a failure than the signal MASTER MODE (19) is generated to
indicate that AMC 19 has detected a failure of the remotely transmitted
signal amplitude. The function of the exclusive OR gates 51, 52 and 53 is
to determine if there is any variance between the three inputs from that
of the majority logic gate output. If one input is different from the
majority logic gate output, the timing generator associated with that
input is indicated as having failed. Thus, exclusive OR gate provides the
signal 12-34 failed indicating that detector 34 associated with timing
generator 12 has failed. An additional check is accomplished to determine
if the output of the majority logic gate 50 differs from all three inputs.
In this case, then the associated AMC itself labled as a failure.
The remaining two failure detector checks provide failure signals
indicating that one of a pair of timing generators do not agree, either in
memory content or in phase. That is the output of either detector 46 or
44. For instance, the phase of timing generator 12 is compared with that
of 13 in phase comparator 12-44 the output from this detector is sent to
all three AMC units 19, 20 and 21. The phase of timing generator 13 is
compared with that of timing generator 14 in detector 13-44 and a failure
signal is sent to all three AMC units 19, 20 and 21. Finally, the phase of
timing generator 14 is compared with that of timing generator 12 in
detector 14-44 and a failure signal is sent to all three AMC units. If,
for example, we assume that timing generator 12 is not phased locked and
is slowly drifting then signals PF 12-13 and PF 14-12 will indicate a
failure implying that timing generator 12 has failed. If timing generator
13 fails then PF 12-13 and PF 13-14 will indicate failure. If timing
generator 14 fails then PF 13-14 and PF 14-12 will indicate failure. Thus,
for a valid failure at least two failure signals must be enabled and the
common generator is identified as having failed. However, if only one
failure signal is enabled this implies that the detector itself has
failed. The same principal is applied to the memory failure detector and
signals as follows MF 12-13, MF 13-14 and MF 14-12 are generated. These
signals are also sent into all three AMC units 19, 20 and 21. Again, two
failure signals must be enabled for a valid failure and if only one fails,
the detector is labeled as having failed.
The apparatus illustrated in FIG. 4B is typical of the analysis described
above. As shown in FIG. 4B three AND gates 55, 56 and 57 are provided each
having two inputs and having their inputs connected to different
combinations of the signals MF 12-13, MF 13-14 and MF 14-12. The output of
AND gate 55 indicates that a memory on timing generator 13 has failed, the
output of AND gate 56 indicates that the memory on timing generator 14 has
failed and the output of AND gate 57 indicates that the memory on timing
generator 14 has failed and the output of AND gate 57 indicates that the
memory on timing generator 12 has failed. If the outputs of each of AND
gates 55, 56 and 57 are low, that indicates that no memory failures have
been detected. Thus, the output of OR gate 58, each of whose inputs is
connected to a different one of the outputs of AND gates 55, 56 and 57
will also be low. This output, negated, is applied as an input to each of
AND gates 59, 60 and 61. The other input to each of these AND gates is
derived from a different one of the signals MF 12-13, MF 13-14 and MF
14-12. If any of AND gates 59, 60 and 61 produce a high output it will
only be because a single memory failure detector signal has been
generated. This, as referred to above, indicates, not a failure of a
memory, but a failure of a memory detector. Thus, the output of AND gate
59 indicates that the detector 12-46 has failed (detector 46 associated
with timing generator 12) where as the output of AND gate 60 indicates
that detector 13-46 has failed and the output of AND gate 61 indicates
that detector 14-46 has failed.
There are several other signals that come from the timing generators which
are not error signals but status signals. MASTER EXTENDED is one of them.
This is received from all three timing generators and a majority vote is
performed. An error analysis as explained above is also accomplished. The
majority vote is used to inhibit some of the error signals while in master
mode since they would have no meaning. The only failure signals enabled
during master modes are the SAMP and MFAB. The MASTER EXTENDED signal is
enabled for approximately 3 seconds after the timing generator goes to the
slave mode. During the transistion many error signals are generated since
each timing generator switches semi-independently to slave. However, these
signals are disregarded since we are still disabled by MASTER EXTENDED.
Finally, when the MASTER EXTENDED drops, the system is stabilized and all
failure signals are activated again.
Another status signal received from all three timing generators is the
recovery mode signal. This is also majority voted on and an error analysis
takes place as explained above. The generation of the recovery mode signal
will be explained. All the error signals associated with timing generator
12, for instance, are combined in a multi-input OR gate to form a timing
generator 12 failed signal. The same is done with timing generators 13 and
14.
Based upon these failures a selection is made as to which timing generator
will be effective. In the slave mode all three timing generators are
selected. Upon a failure only the failed one is turned off. In the master
mode, however, only one timing generator at a time is selected, or turned
on. The decision is weighted to select timing generator 12, for instance,
unless that is failed. If timing generator 12 has failed, then 13 is
selected. If all three are indicated as failed, then the AMC unit is
considered failed.
This may occur whenever a majority logic gate fails and its outputs are
compared with the three inputs. All three will register as bad and thus
all three timing generators will be labled as failed by this particular
AMC unit only. The AMC failed signal drives the status light and is also
sent to the majority logic means.
FIG. 4c schematically illustrates a number of the inputs and outputs of a
typical AMC unit. And as has been discussed above the RAMP signals, and
PFAR signals are voted on in circuits similar to FIG. 4A. In addition, the
RECOVERY A (where A refers to the timing generator producing the signal)
as well as MASTER EXTENDED A signals are also provided to circuits similar
to FIG. 4A. The circuit of FIG. 4A determines whether or not at least a
majority of the inputs agree, if they do then, for instance, the RAMP
signals result in a MASTER ON/OFF; similarly the PFAR signals also can
produce a MASTER ON/OFF; RECOVERY A can produce RECOVERY X and MASTER
EXTENDED A can produce MASTER EXTENDED X (where X refers to the AMC unit).
If anyone of the inputs dissents, it is labled as failed. Finally, if the
inputs do not agree with the output, then the AMC unit itself is labled as
failed.
The relative failure signals MFAB and PFAB are provided to circuits similar
to the one illustrated in FIG. 4B. The outputs of these circuits indicate
that | | |
