PDP11 PeripheralsHbk 1972 - Trailing-Edge

7.2.3 Fail-Soft Operation
The bus switch is designed so that a greater system reliability may be achieved.
An internal timer allows for processor backup, (see below) and the ability to completely
disconnect a bus allows for peripheral backup.
The bus switch is built so that one processor cannot force the switch to the other
processor or cause an interrupt on the other processor's bus unless the other processor
permits it. This means that a non-working processor cannot cause anything
to happen to a working processor.
To prevent a device that has been started by one processor from causing any interrupts
or DMA transfers on the other processors bus, an Initialize signal is generated
on the switched bus every time the switch goes into the Neutral position.
The length of this signal is the major factor in how long it takes to switch from
one processor to the other, and is, therefore, set for 10 microseconds. It is possible
to inhibit this initialization by a switch on the manual panel, if desired_ However,
in this mode the bus switch cannot really be used for fail-soft operation. It
does allow one processor to start a device and then let the other have the
switched device without stopping the device. Great care must be taken if running
in this mode to make sure a DMA device does not transfer into an area of the
other processor's memory that should be protected.
As noted earlier, the warning signal on the UNIBUS that causes a power failure
trap in the processor is passed through the bus switch in both the connected and
controlled states. There is also a bit in the bus switch control register that is set
whenever this warning signal is on the switched bus, independent of the position
of the switch. Thus, whenever the switched bus is connected and a power fail trap
occurs, the power fail trap routine can examine the bus switch control register to
find out if the failure is on the switched bus.
Just before power actually fails (and at least 2ms after the warning bit is set, and
trap, if any) the switch will automatically go to the Neutral position if in either the
connected or controlled states.
Depending on the source of the power failure, the switch may do several things:
1. A processor or device on its bus has a power failure. In this case, the switch
automatically disconnects from that processor and will not honor any
requests from that processor until the power is restored. The bus switch bus
interface and control register associated with that processor will be initialized.
The other processor, however, can use the switch normally.
2. A device on the switched bus has a power failure. In this case, the switch will
always go to Neutral and remain there until the power is restored. Both control
registers are initialized. Each processor can run the devices on its own
bus.
3. The bus switch may be powered by a system of three power supplies. If any
one supply fails, the switch will continue to operate normally, and there will be
a visual indication of which supply failed. If more than one supply fails, the
switch will act as in case 2, above.
7.2.4 * Operation of the Internal Timer
A timer is included in the bus switch to help in the detection of processor hardware
or software failures. Basically, the timer must be referenced every so often
by the processor that has the switch. '
102