CA1131365A - Programmable controller with data archive - Google Patents

Abstract

PROGRAMMABLE CONTROLLER WITH DATA ARCHIVE
Abstract of the Disclosure A programmable controller interfaces a numerical control system to sensing and operating devices that control the auxiliary functions on a machine tool. In the controller a microprocessor is coupled to a random-access memory (RAM) and an electrically alterable read-only memory (EAROM) through an address bus and a data bus. The RAM stores a user control program and an I/O image table that depicts the status of the sensing and operating devices on the machine tool. Under program control the microprocessor verifies the contents of the RAM and copies the verified contents into the EAROM. If the contents of the RAM are altered or lost, the master copy of data stored in the EAROM is reloaded into the RAM.

Description

~3136S

The ield of the invention is programmable control-lers, including those controllers which are integrated into numerical control systems as programmable interfaces.
In programmable controllers and inter~aces a random-access read/write memory (RAM) is used to store input/outputstatus data and a user control program, so that the I/O status can be fre~uently updated and the control program can be easily revised when necessary. The RAM, how~ver, is volatile, i.e., it must be energized at all times to prevent a loss of stored data. Power is provided to the RAM by a main power supply which is connected to an a-c power source and which converts a-c power to d-c power for operation of the RAM.
Memory back-up batteries have been employed in prior programmable controllers to provide standby d-c power to the RAM when a-c power to the main power supply is interrupted.
These batteries typically are limited to supplying standby power for a month and have a battery life of one to three years. Even with memory back-up batteries, data can be lost if these battery limits are reached. These batteries also re~uire charging circuits to enable recharging during system operation from an a-c power source.
The invention is embodied in a digital controller in which a nonvolatile memory and associated digital circuitry are coupled to a random-access read/write memory (~AM). The RAM stores control data that directs the controller in con-trolling a machlne.
The invention includes an erasable, read-mostly memory for nonvolatile storage of control data and first means coupled to both the read/write memory and the read-mostly 3~5 memory for transferring control data from the read/write memory to the read-mostly memory to form a nonvolatile master copy. Second means are coupled to both the read/write memory and the read-mostly memory for transferring the master copy of control data from the read-mostly memory to the read/write memory.
Data stored in an erasable, read-mostly memory, is nonvolatile. It will not be lost if external power to the memory is interrupted. In an erasable, read-mostly memory, data is read in one operation, and data is written and erased in other operations, which require longer access to the memory than the read operation. In a specific embodiment of the invention described herein, the read-mostly memory is an electrically-alterable read-only memory (EAROM), so called because the write and erase operations are performed electri-cally as opposed to optically, as in some other read-mostly memories.
The EAROM is used as a data archive where data, such as image tables of status data and a user control program, can be stored without threat of loss due to an interruption of power to the RAM. With the EAROM providing this back-up for the RAM, memory back-up batteries are no longer necessary.
The invention is particularly applicable to program-mable controllers and interfaces which execute a user control program of macro-instructions to operate a plurality of devices that control the functions of an industrial machine. The control program operates on data stored in an I/O image table which depicts the status of the operating devices on the machine. Periodically, an I/O scan interrupt routine is executed wherein data is exchanged between the I/O image table and an I/O interace module to actually operate the control devices and obtain updated status information.

~.,,1 1~1365 The transfer of data between the RAM and the EAROM
is conditioned upon the position of a mode switch. The mode switch can be set in a LOAD mode, a TEST mode or a RUN mode.
'The RUN mode is the normal mode for operating the programmable controller to control the functions of an associated machine.
Transfer of data between the RAM and the EAROM occurs only when the mode switch is set in the LOAD mode. The switch position is read by the processor means at a status port address. A decoding circuit and a write enable circuit are connected between the processor means and the EAROM to prevent access to the EAROM for writing or erasing when the mode switch is in a mode other than the LOAD mode. This protects the EAROM from spurious overwriting when the programmable controller is in the RUN or TEST mode.
A watchdog timer circuit is connected between -the decoding circuit and a nonmaskable interrupt terminal on the processor means to generate a nonmaskable interrupt signal.
The watchdog timer circuit can be controlled by the processor means, however, to inhibit such signals from interrupting the transfer of data between the RAM and the EAROM.
The invention enables one to provide a programmable controller in which data stored in a random-access memory is also stored in a data archive memory to protect against its loss.
The invention also enables one to provide a data archive that can be updated when desired.
The invention also enables one to protect the data archive from loss of data during the RUN mode of operation when spurious overwriting could otherwise occur.

1~3~365 The invention also enables one to protect against loss of data from either the RAM or the data archive memory when data is being transferred between them.
The invention also eliminates the need for memory back-up batteries and associated circuitry in a programmable controller.
The invention also allows a reduction in maintenance re~uirements for programmable controllers.
In drawings which illustrate one embodiment of the invention, Fig. 1 is a perspective view of a numerical control system in which the present invention is employed;
Fig. 2 is a block diagram of a programmable interface module which is part of the system of Fig. 1 and which incor- -porates the present invention;
Fig. 3 is a schematic diagram of a decoding circuit represented in Fig. 2;
Fig. 4 is an electrical schematic diagram of an EAROM enable/disable circuit represented in Fig. 2;
Fig. 5 is an electrical schematic diagram of a RAM
enable and parity checking circuit represented in Fig. 2;
Fig. 6 is an electrical schematic diagram of a watchdog timer circuit represented in Fig. 2;
Fig. 7 is a flow chart of an INITIALIZATION routine stored in the ROM in Fig. 2;
Fig. 8 is a flow chart of a RELOAD routine stored in the ROM in Fig. 2;
Fig. 9 is a flow chart of a LOAD NEW PROGRAM routine stored in the ROM in Fig. 2; and Fig. 10 is a flow chart of an ERROR routine stored in the ROM in Fig. 2.

~131~5 The invention is embodied in a programmable inter-face (PI) module 10 in a numerical control system seen in Fig.
1. The numerical control system includes a main control station 11 that is connected to a machine tool 12 through control cables 13 and 14, and a pendent control station 15 that is connected to the main control station 11 through a communication cable 16. A program panel 17 is also connected to the main control station 11 through a communication cable 18.
The main control station 11 is housed in a rack enclosure 19. For a detailed description of this rack enclo-sure 19, reference is made to Struger et al, U.S. Patent No.
4,151,580, issued April 24, 1979, and entitled "Circuit Board Assembly with Disconnect Arm." A group of modules, which are printed circuit boards that mount the circuit components described herein, are supported in closely spaced upright positions in the main control station 11. Besides the PI
module 10, these modules include a main processor module 20, a servomechanism interface module 21, and an I/0 interface module 22.
These modules 10 and 20-22 are connected to one another through a back plane motherboard 23 mounted on the back of the control station rack 19. The main processor module 20 connects to the communication cable 16 and the programmable interface module 10 connects to the communication cable 18. The servomechanism interface module 21 is connected through one control cable 13 to the servomechanisms which control the motion of a cutting tool on the machine tool 12.
And, the I/0 interface module 22 is connected through the other control cable 14 to a plurality of I/0 devices, such as motor starters, limit switches and solenoids which control the auxiliary functions on the machine tool 12. These auxiliary ll;~l;~tiS

functions include such operations as tool selection, spindle speed, coolant flow and pallet selection.
The pendent control station 15 includes a keyboard 24 and switches 25 for manual entry of data. It als~ includes an optional alphanumeric display 26 and an optional CRT display 27. The pendent control station encloses a processor (not shown in the drawings) which connects to the communication cable 16 and which processes data from the keyboard 24 and switches 25 and outputs data to the alphanumeric display 26 and the CRT display 27.
The program panel 17 includes a keyboard 28 and a visual display 29. Through the program panel 17 a control program of the type executed by programmable controllers is entered into the PI module 10 and is displayed and edited from time to time. The program panel 17 is a peripheral unit, which need not be operatively connected to the main control station while the machine tool 12 is being operated. There-fore, after the entry or editing of the control program, the control panel 17 may be disconnected from the numerical control system and used to program other controllers.
As seen :in Fig. 2, the PI module lO is connected through a sixteen-bit (A0-A15) PI address bus 30 and an eight-bit (B0-B7) PI data bus 31 to a DMA interface 32. The DMA interface 32 couples these two buses 30 and 31 to a nineteen-bit (AB0-AB14, EXT0-3) main address bus 33 and a sixteen-bit (DB0 DB15) main data bus 34 on the main processor module 20. For a complete description of the construction and operation of the main processor module 20 and the DMA interface 32, reference is made to Bernhard et al, U.S. Patent No. 4,228,495, issued Oct. 14, 1980, and entitled "Multiprocessor NC System."

~1~13~;5 Besides the main processor module 20, the DMA inter-face 32 also couples the PI module 10 to the I/0 module 22, which is connected to the main address and data buses 33 and 34. The I/0 module 22 includes sets of sixteen input circuits and sets of sixteen output circuits. Each input circuit is connected to a sensing device on the machine tool 12, such as a limit switch, and each output circuit is connected to an operating device on the machine tool 12, such as a motor starter or a solenoid. Input circuits which are suitable for this purpose are disclosed in U.S. Patent Nos. 3,643,115 and 3,992,636, and output circuits which are suitable for this purpose are disclosed in U.S. Patent No. 3,745,546.
The operation of the programmable interface (PI) module 10 is directed by a microprocessor 36 which is coupled to the PI address bus 30 through a set of buffers 37 and which is coupled to the PI data bus 31 through a set of bidirec-tional buffers 38. The microprocessor 36, which in this embodiment is a model Z-80A microprocessor manufactured by Zilog, Inc., is driven through a clock line 39a by a four-megahertz clock circuit 39. Besides the description that follows, reference is also made to the Z80-CPU Technical Manual published in 1976 by Zilog, Inc., for information on the architecture, the operation and the instruction set for this microprocessor 36.
The PI address bus 30 and the PI data bus 31 connect the microprocessor 36 to three memories. The first of these is a random-access memory (RAM) 40 which stores some test location data 35, a programmable interface image table 41, an I/0 image table 42, a table of preset and accumulated values of timers and counters 43 and a user control program 44. The RAM 40 can store 2K bytes of data in corresponding address lines with an added parity bit in each line. The second of !~

~13136S
these memories is a 4K-byte read-only memory (ROM) 45 which stores a table of jump statements 46. It also stores a first group of microprocessor instructions organized in firmware routines 47 and a second group of microprocessor instructions organized in macro-instruction interpreter routines 48. The third memory is a 2K-byte electrically alterable read-only memory (EAROM) 49 which serves as an archive for data stored in the RAM 40, to protect against its loss.
The EAROM 49 is a nonvolatile memory, i.e., data is not lost when power is removed. It is one type of "read-mostly" memory, which is both erasable and programmable, in addition to being readable. Another type of read-mostly memory is the optically erasable read-only memory. Although the apparatus for erasing and programming a specific read-mostly memory is described herein, it should be apparent thatthe invented data archive can be embodied in other arrange-ments. For more information on read-mostly memories, refer-ence is made to an article of David A. Hodges, entitled "Micro-electronic Memories," in the September, 1977, issue of Scientific American.
Data that is transferred to the EAROM 49 from the RAM 40 is user-oriented control data. This data includes status data and control instructions which operate on the status data. The programmable interface image table 41, which is stored on the lowest address lines of the RAM 40, contains data that depicts the status of the NC portion of the s~stem.
The I/O image ta~le 42 depicts the status of the sensing devices and the operating devices which control these selected functions on the machine tool 12. The control program 44 contains macro-instructions which examine the status of both the NC portion of the system and the input devices on the ~3136S

machine tool 12, and which set output status bits according to the logic of such instructions.
The programmable interface image table 41 in the RAM
is updated by data received from the NC or main portion of the system. The I/O image table 42 is updated during an I/O scan operation in which data is received to indicate the status of input circuits in the I/O interface module 22. During the I~O
scan output status data from the I/O image ta~le 42 is coupled to the I/O interface module 22 to set output circuits therein and thereby control output devices on the machine tool 12.
As described in the copending application referred to above, the DMA interface 32 periodically obtains control of the main address and data buses 33 and 34 in response to a DMA
request received from the PI microprocessor 36. During a DMA
cycle, the DMA interface 32 divides sixteen-bit words on the main data bus 34 into pairs of eight-bit bytes that are sequen-tially coupled to the PI data bus 31. The DMA interface 32 also couples pairs of eight-bit bytes sequentially received on the PI data bus 31 to form sixteen-bit data words on the main data bus 34. In this way, data can be coupled between the RAM
40 on the PI module 10 and a memory (not shown) on the main processor module 20. The PI microprocessor 36 also signals the DMA interface 32 when an I/O scan cycle is to be performed.
After the I/O request signal has been acknowledged, data can be coupled between the I/O image table 42 in the ~ 40 and the I/O interface module 22.
Control program macro-instructions and other data are coupled between the program panel 17 in Fig. 1 and the RAM
40 through a program panel interface 50 seen in Fig. 2. The program panel interface 50 connects one end of the communica-tion cable 18 to a branch 31a of the PI data bus 31 that ~131365 bypasses the buffers 38 to connect to the microprocessor 36.
The program panel interface 50 includes a USART (not shown) which converts between serial data transmitted through the communication cable 18 and parallel data coupled on the PI
data bus 31. The microprocessor 36 connects to the interface 50 through a read line 51, a write line 52 and the AO line in the PI address bus 30. The microprocessor 36 also connects to the interface 50 through a decoding circuit 57 and through a USART enable line 54.
The program panel 17 interrupts the microprocessor 36 through an INT line connecting the program panel interface 50 to the microprocessor 36. The microprocessor 36 then executes a panel interrupt service routine, which is part of the firmware 47 stored in the ROM 45. During execution of this routine the microprocessor 36 transmits logic signals through the read line 51, the write line 52, the USART enable line 54, and the AO line in the address bus 30 to load, update and read data through front panel interface 50. For further detalls of the operation of the program panel interface 50, reference is made to U.S. Patent No. 4,228,495 entitled "Multiprocessor NC System," which is fully cited above.
The PI microprocessor 36 controls the coupling of data to the RAM 40, the ROM 45 and the EAROM 49 through the read and write control lines 51 and 52 and lines A10-Al5 of the address bus 30. These lines and memory request (MREQ) line 55 and a refresh (RFSH) line 56 are connected to the decoding circuit 57. The ROM 45 is connected to the decoding circuit 57 through a four-line ROM enable bus 58. Data is read from the ROM 45 by generating an address in the ROM 45 on lines AO-All of the address bus 30. Lines AO-A9 actually specify the address, while lines A11 and AlO are decoded by ~13:~365 the decoding circuit 57 to enable one of four lK-byte memory chips (not shown) that constitute the ROM 45 through a line in the ROM enable bus 58.
The RAM 40 is also connected to lines A0-A9 of the address bus 30. The RAM 40 is a 2K by nine-bit memory which stores data in eight bits of each line and which stores a parity bit as the ninth bit in each line. The stored parity is read out on a parity bit output line 59 to a RAM enable and parity checking circuit 60 as data is read from the RAM 40.
The RP~I enable and parity checking circuit 60 is connected to the data bus 31 to receive data read from the RAM 40, and it calculates the parity of this data and compares it to the stored parity received on the parity bit output line 59. The `, RAM enable and parity checking circuit 60 is connected through a parity error (PE) line 73 and a parity error complement (PE) line 81 to a watchdog timer circuit 74 to signal a parity error.
The RA~I enable function is controlled by the micro-processor 36 through the A10 address line and the read line 51, which connect the microprocessor 36 to the RAM enable and parity checking circuit 60. The RAM 40 is enabled through two chip select (CSl and CS2) lines 65 and 66 connecting tne RAM
enable and parity checking circuit 60 to the RAM 40. Through each chip select line 65 and 66, a lK by nine-bit block of the RAM ~0 is enabled for read and write operations.
Data is written into an addressed line of the RAM 40 through a set of input buffers 67 connected in a one-way input branch 31b of the data bus. The input buffers 67 are enabled through a buffer enable line 68 connecting the buffers 67 to the RAM enable and parity checking circuit 60. The buffer enable line 68 is driven by the read line 51 which connects to an input on the RAM enable and parity checking circuit 60.
When a memory write instruction is executed by the micro-processor 36, a logic high signal is output on the read line 51 and the buffers are enabled through the buffer enable line 68, so that a byte of data can be stored in the addressed line of the RAM 40.
Data is read from an addressed line of the RAM 40 through a mapping PROM 69 in an output branch 31c of the data bus 31. The mapping PROM 69 is a mask-programmable read-only memory. Each macro-instruction in the control program speci-fies an operation, e.g., XIC, XIO, and an eight-bit operand address. The operand address specifies a location in the image tables 41-43 of the RAM 40 that contains the data upsn which the operation is to be performed. Although programmable controller-type instructisns such as XIC, XIO and OTE are standard operations, these operations are translated into different multi-bit binary operation codes by different program loaders and microprocessors. Both the number and identity of digits can vary from one operation code to another. To make the microprocessor 36 compatible with a program panel 17 that uses different binary operation codes, the mapping PROM 69, which has eight address terminals A7-A0 couples to the RAM 40 and eight data terminals coupled to the PI data bus 31, is programmed as follows.
In the RAM 40 operand addresses are stored on even-numbered address lines while operation codes are stored on odd-numbered lines. The stored operation codes are those used by the program panel 17 and read into the RAM 40 through the data input buffers 67. The mapping PROM 69 is a 512-line by eight-bit memory where operation codes recognized by the microprocessor 36 are stored in the lower 256 addresses, and li;~l365 operand addresses are stored in the upper 256 addresses. The upper 256 addresses merely provide a one-to-one mapping of data read from the RAM 40 with each line storing its own identity. Partitioning of the mapping PRO~ 69 is controlled through lines A0 and All of the address bus which are con-nected through a NAND gate 70 to the upper address terminal (A8) on the mapping PROM 69.
When a logic low signal is transmitted on the All address line, a logic high signal is input to the address terminal A8 on the mapping PROM, the upper 256 lines are addressed, and a one-to-one mapping of data occurs. This allows data to be read from the image tables 41-43. When the All address line carries a logic high signal, the mapping PROM
69 is in its translating mode of operation, and addressing is controlled by the signal on the A0 address line. A logic low signal on the A0 address line occurs when an operand address on an even-numbered line of the RAM 40 is addressed, thereby applying a logic high signal to the A8 address terminal on the mapping PROM 69 and providing the one-to-one mapping of operand addresses. On the other hand, a logic high signal on the A0 address line occurs when an odd-numbered line of the RAM
containing an operation code is addressed. A logic low signal is then applied to the A8 address terminal on the mapping PROM
69 and translated operation codes are sent out on the PI data bus 31. These translated codes are read and executed by the microprocessor 36. The inclusion of the mapping PRO~ 69 in this PI module 10 allows a single program panel 17 to be used with another programmable controller as well as the program-mable inter~ace of the present invention.
Besides decoding contxol signals from the micro-processor 36, the decoding circuit 57 can be addressed through lines A10-A15 of the address bus 30 to read the status of various circuits in the PI module 10. Eight status bits can be read through the PI data bus 31 on lines D0-D7. A single-pole, three-position mode switch 70 is connected to the decod-ing circuit 57 through three inputs 71, so that its status canbe read through the PI data bus 31. The RAM enable and parity checking circuit 60 is connected to another decoding input through the parity error (PE) line 73. The watchdog timer circuit 74 is connected to another decoding input through a watchdog status line 75 and to still another decoder input through an ERR status line 77.
The decoding circuit 57 is also connected to the watchdog timer circuit 74 through a kick dog line 78 and a dog reset line 79. The watchdog timer circuit 74 responds to malfunctions in the operation of the PI mod~le 10 by "timing out" and generating a nonmaskable interrupt (NMI) signal on an NMI line 80 connected to an input on the microprocessor 36.
The watchdog timer circuit 74 is also connected through the parity error (PE) line 73 and a parity error complement (PE) line 81 to the RAM enable and parity checking circuit 60.
Through these lines 73 and 81 parity errors are signaled to the watchdog timer circuit 74 and it generates a nonmaskable interrupt signal on the NMI line 80.
The decoding circuit 57, the RAM enable and parity checking circuit 60, and the watchdog timer circuit 74 will now be described in more detail. Referring to Fig. 3, the decoding circuit 57 more particularly includes a three-line-to-eight-line decoder 82 having address lines A12, A13 and Al4 connected to three inputs 83 and having the Al5 address line, the memory request line 55, and the re~resh line 56 connected to three enable inputs 84. A "0" output on the decoder 82 and the read line 51 are connected to t~o respective inputs on an OR gate 85. The output of this OR gate 85 is connected to an enable input 86 on a two-line~to-four-line decoder 87. This decoder 87 has four outputs connected to respective lines in the ROM enable bus 58, and two other inputs connected ts the Al0 and All address lines. Logic signals on these address lines will determine which lK block of the ROM 45 will be enabled. When data is being written to the RAM 40 and the EAROM 49, the decoder 87 will have its outputs disabled by logic signals on the read line 51 and lines Al2-Al4 of the address bus 30.
A RAM enable line 88, an EAROM enable line 89 and the USART enable line 54, are connected to the "2," 11311 and "6" outputs of the three-line-to-eight-line decoder 82. The "7" output on the decoder 82 and the write line 52 are coupled through an OR gate 90 to the dog reset line 79. The "5"
output on the decoder 82 and the write line 52 are coupled through one OR gate 9l to the kick dog line 78, and the "5"
output and the read line 51 are coupled through another OR
gate 92 to a buffer enable line 93. The buffer enable line 93 is connected to a set of buffers 94 which are enabled when a status port is addressed through lines Al2-Al4 of the PI
address bus 30. An address of 7,000 (hexadecimal) on the PI
address bus 30 will enable the buffers 94, so that the status of circuits con~ected to its inputs can be read.
The mode switch 70 is connected through three flip-flops 95-97 to three inputs 98-l00 on the set of buffers 94.
These inputs 98-l00 are coupled by the buffers 94 to lines D2-D4, respectively, of the PI data bus 31. The mode switch 70 includes three stationary contacts associated with the LOAD, TEST and RUN modes, respectively, which are pulled high through pull-up resistors 101-103 by a d-c voltage source 104.
A grounded, movable contact 105 pulls the lin~ connected to 13~iS

one of the stationary contacts to a logic low level. In Fig.
3, the line connected to the TEST contact is pulled low. The LOAD, TEST and RUN switch contacts are connected to the S
(set) terminals on the three flip-flops 95-97. The Q outputs of these flip-flops 95-97 are connected through NOR gates 106-108 to R (reset) terminals on each other pair of flip-flops 95-97.
The setting of the mode switch 70 in the TEST mode generates a logic high signal at the Q output of the flip-flop 96, while logic low signals are maintained at the Q outputs of flip-flops 95 and 97. If the movable contact 105 were to be switched to the LOAD position, the Q output on flip-flop 95 would switch to a logic high level, and this signal would be returned through the NOR gate 107 to reset the TEST flip-flop 96. Furthermore, the logic high signal would be coupled through an inverter 109 to produce a logic low signal on a LOMO line 110.
The PE line 73, the watchdog status line 75 and the ERR line 77 are connected through the buffers 94 to lines D5-D7, respectively, of the PI data bus 31. The D7 line in the data bus is also connected to read the status of a push-button 111. To enable the status to be read, the "4" output on the three-line-to-eight-line decoder 82 and the read line 51 are coupled through an OR gate 112 to a pushbutton read enable line 113. This line 113 connects to a buffer gate 114 coupling the pushbutton 111 to the D7 line, and when the "4,000" hexadecimal addxess is generated, the gate 114 is enabled so that the status of the pushbutton 111 can be read.
The pushbutton 111 indicates a user command to copy data from the R~M 40 into the EAROM 49 for permanent storage.
Referring to Fig. 5, the RAM enable and parity checking circuit 60 more particularly includes a two-line-to-four-line decoder 115 having a "1" input connected to receive signals on the A10 address line, and having a "2" input that is grounded. The decoder 115 has its "0" and "1" outputs connected to the chip select lines 65 and 65 and an enable input 115a connected to receive logic signals on the RAM
enable line 88. When the decoder 115 is enabled through the RAM enable line 88, the enable line of alternate lK by nine-bit blocks of the RAM 40 is controlled by high and low logic signals on the A10 address line.
The RAM enable line 88 also connects to an enable input 116 on another two-line-to-four-line decoder 117. The read line 51 is connected to a "1" input on the decoder 117, and the "2" input is grounded. A logic low signal on the read line 51 enables the mapping PROM 69 (seen in Fig. 2) through a map enable line 119 connected to the "0" output in the decoder 117. A logic high signal on the read line 51 enables the input buffers 68 (also seen in Fig. 2) through the buffer enable line 68 connected to the "1" output on the decoder 117.
The parity checking portion of the circuit 60 includes a parity generator 122 having eight inputs 123 connected to the PI data bus 31 to receive data. The parity data output line 59 and the read line 51 are connected through a NAND gate 125 to another input 126 on the parity generator 122. The parity data output line 59 is connected to a parity data output on the RAM 40, as seen in Fig. 2. When data is read from the RAM 40, a stored parity bit is received at the single input 126 of the parity generator 122 and compared with the data received on the PI data bus 31. When data is written into the RAM 40, the parity generator 122 calculates the parity of the data and the calculated parity is written into the RAM through a parity data input line 128 connecting the parity generator to the RAM, as seen in Fig. 2.

Referring to Fig. 5, each calculated parity sum is also transmitted throu~h a line to a D input on a parity error flip-flop 129. The dog reset line 79 connects to an S (set) terminal on this flip-flop 129, and the map enable line 119 connects to a clock input on this flip-flop. The Q output on the flip-flop 129 is connected to the parity error (PE) line 73, and the Q output is connected to the parity error comple-ment ~E~ line 81. When data read from the RAM 40 has a faulty parity, a logic high signal is received at the D input of the flip-flop 129 while the clock input is enabled, to reset the flip-flop 129 and indicate a parity error. Parity errors are cleared by setting the parity error flip-flop 129 through the dog reset line 79.
The RAM enable and parity checking circuit 60 is connected through the PE and PE lines 73 and 81 to the watchdog timer circuit 74 seen in Fig. 6. The main component of the watchdog timer circuit 74 is a multivibrator which is con-nected to an RC coupling circuit to form a monostable multi-vibrator 130. The monostable multivibrator 130 remains in an unstable state for a time period of approximately 70 milli-seconds before returning to its stable state. The kick dog line 78 is connected to a dual input clock terminal on the multivibrator 130 and the dog reset line 79 is connected to a reset terminal 132. The other clock input is pulled high through a resistor 133 by a d-c voltage source 134. A Q
output on the multivibrator 1JO is connected to the watchdog status line 75 and a Q output is connected through two inver-ters 144 and 145 to the ERR line 77 and through yet an addi-tional inverter 146 to the NMI line 80.
In the watchdog circuit 74, one LED (light-emitting diode) 135 is provided to indicate satisfactory operation of the PI module 10 while another LED 136 is provided as a fault I

3~i5 indicator. The Q output is connected with the PE line 73 to a NAND gate 137 that has its output connected through the LED
135 and a pull-up resistor 138 to a d-c voltage source 139. A
logic high signal on the watchdog status line 75 in the absence of a parity error signal on a PE line 73 causes the illumina-tion of the LED 135. The Q output is connected through an inverter 140, the other LED 136, and a pull-up resistor 141 to a d-c voltage source 142, to indicate when the watchdog timer 74 has "timed out."
This occurs when the multivibrator 130 is reset, or when a parity error is indicated on the PE line 81. The PE
line 81 is connected through an inverter 143 in a "wired or"
connection with the line coming from the Q output terminal through another inverter 144. When a logic high voltage signal is present at the O terminal or on the PE line 81, a nonmaskable interrupt signal will be generated. The second LED 136 will be illuminated and the error can be read on the ERR line 77.
The watchdog timer 74 can also be prevented from generating an interrupt signal on the NMI line 80. If the multivibrator 130 is reset, but not started through the kick dog line 78, and the PE line 81 is held low, an interrupt signal cannot be generated on the NMI line 80.
Referring to Fig. 2, the coupling of data to the EAROM 49 is controlled through an EAROM enable circuit 150, which has inputs connected to the read line 51, the EAROM
enable line 89, the LOMO line 110 and the A10 and A11 address lines. The write line 52 and lines AO-A9 of the address bus 30 are connected directly to the EAROM 49, while the All address line, the read line 51 and two chip enable lines (CE1 and CE2) 153 and 154 connect the EAROM enable circuit 150 to the EAROM 49.

?

1~3~365 Referring to Fig. 4, the EAROM enable circuit 150 more particularly includes two NAND ~ates 155 and 156 with their outputs coupled through a NAND gate 157 to a "2" input terminal on a two-line-to-four-line decoder 158. The LOMO
line 110 is connected to one input on each NAND gate 155 and 156; the read line 51 is connected to the other input on one NAND gate 156; and the All address line is connected to the other input on the other NAND gate 155. The A10 address line is connected to the "1" input on the decoder 158 and the EAROM
enable line 89 is connected to an enable input 151. The two EAROM chip enable (CE1 and CE2) lines 153 and 154 are connected to the "O" and "1" outputs of the decoder 158.
Two lK by eight-bit blocks of the EAROM 49 are alternately enabled through the CE1 and CE2 lines 153 and 154.
The selection of one of these lines is controlled by the logic signal on the A10 address line, provided that the outputs of the decoder 158 are enabled through the EAROM enable line 89.
To protect the EAROM 49 from spurious overwriting, the EAROM
49 is disabled for writing and erasing except when the mode switch 70 is set for operation in the LOAD mode. When a logic high signal is present on the LOMO line 110, the chip enable lines 153 and 154 will disable the EAROM for writing and erasing, although data can still be read.
/ The All address line and the read line 51 provide an erase function for the EARO~ 49 in response to logic high voltage signals. The EAROM 49 is prevented from receiving these signals, however, unless the mode switch is in the LOAD
mode, as signalled through the LOMO line 110. Signals coupled to the EAROM 49 through the write line 52 seen in Fig. 2 are also conditioned upon the status of the LOMO line 110. With the mode switch in the 10AD position, the EAROM 49 is enabled through the EAROM enable line 89, and data can be read, written 11313~5 or erased according to signals provided on the read line 51, the write line 52 and the All address line.
The microprocessor 36 is operated in response to timing signals received from the clock 39 to read and execute 5 instructions in the firmware routines 47 stored in the ROM 45.
The microprocessor 36 repeatedly executes a FETCH routine stored in the ROM 45 to read macro-instructions (including both an operation code and an operand address) from the RAM
40. As explained previously, the two bytes in the macro-instruction are read out through the mapping PROM 69 and thedata bus 31 to the microprocessor 36. The FETCH routine used in obtaining the macro-instructions is listed in Table 1 below.
Table 1 15 Instruction Mnemonic Comment PoP HL Get next instruction; store the operand address in the L register and store the operation code in the H
register.
20 LD E,L Load operand address (the low byte of the macro-instruction) into the E
register.
LD L,H Form the address in HL which speci-LD H,C fies a location in a jump table 46 in the ROM 45.
JP (HL) Jump indirect via the jump table 46 in the ROM 45.
The microprocessor 36 makes use of a number of internal registers in executing the FETCH routine, which will become apparent by reference to the Z80-CPU Technical Manual, referred to above. These registers include:
PC, a sixteen-bit program counter;
SP, a sixteen-bit stack pointer;
B and C, eight-bit registers arranged as a pair;
D and E, eight-bit registers arranged as a pair; and 3~;5 H and I, eight-bit registers arranged as a pair.
The program counter PC stores the memory add~ess of the current machine instruction to be read from the RQM 45.
While this instruction is being read from the ROM 45 the program counter PC is incremented for addressing the next line of the ROM 45. The stack pointer SP stores the memory address of the programmable controller-type instruction to be read from the ~AM 40. It is initialized to point at the first macro-instruction in the control program 44, and as each macro-instruction is fetched, the stack pointer SP is incre-mented two counts to address the next controller instruction.
The translated operation code that is read from the mapping PROM 69 as part of each macro-instruction is, in fact, an address in the jump table 46 in the ROM 45. Each macro-instruction must be linked with one of the interpreter routines4~ in the ROM 45. This is done via the jump table 46 which contains instructions to jump to the address of a first in-struction in a corresponding interpreter routine 48. When the microprocessor 36 executes the operation code of each macro-instruction, it jumps to the first instruction in one of theinterpreter routines 48 in th~ ROM 45. The last portion of each interpreter routine includes the FETCH routine, which is executed to fetch the next macro-instruction.
Where macro-instructions are used to manipulate single bits of data, eight distinct operation codes corres-ponding to the bits of data to be manipulated are required. A
typical macro-instruction interpreter routine for XIC2 is given below in Table 2. This interpreter routine 48 examines bit 2 of an input status byte in the I/O image table 41. This bit represents the status of some relay contacts (not shown).

ii;~l36S

Table 2 Instruction Mnemonic Comment .. . ... . ..
LD A,(DE) Load operand in the A register.
BIT 2,A Test the specified bit.
5 JR NZ, FETCH Return to fetch next macro-instruction if bit 2 = 1 (which represents closed contacts).
RES 0, B Reset rung status if bit 2 = 0 (repre-senting open contacts).
10 FETCH:
While the firmware routines 47 and the macro-instruction interpreter routines 48 are not intended to be altered, the flexibility of programmable controllers and programmable interfaces depends upon the ability to edit and 15 update the control program macro-instructions 44 in the RAM
40. In prior controllers, the RAM 40 would require power from a back-up battery during periods when the controller was not being operated, to preser~e the contents of the RAM 40. In the PI module 10 of the present invention, the EAROM 49 and associated control circuitry provide a back-up to the RAM 40, which makes the use of back-up batteries unnecessary.
The ROM 45 stores the jump table 46 in lines with addresses from 000 to 00FF (hexadecimal). The firmware routines 47 are stored in lines 0100 to 0495 (hexadecimal). The macro-instruction interpreter routines are stored in the ROM 45 at addresses above 0497 (hexadecimal). It is certain firmware routines 47 which instruct the microprocessor 36 to transfer data between the RAM 40 and the EAROM 49. These routines are set forth in Appendices A-D. Addresses of certain locations in the memories 40, 45 and 49, as well as addresses of hard ware on the PI module 10 are given in Appendix E.
An INITIALIZATION routine is set forth in Appendix A
and represented in a flow chart in Fig. 7. The first instruc-tion executed by the microprocessor 36 is a jump to the INITI-ALIZATION routine, this jump instruction being stored at address 0000 (hexadecimal) in the ROM jump table 46. Referring to Fig. 7, the microproce~sor 36 first disables both maskable and nomnaskable interrupts as represented by process block 160. The nonmaskable interrupt is disabled by clearing the parity error flip-flop 129. The parity error flip-flop 129 is addressed and cleared through lines Al0-Al5 of the address bus 30 and the d~coding circuit 57 as explained previously. The instruction that is executed to clear the parity error flip-flop 129 is given in Appendix A.
The microprocessor 36 then enters a system check(SYS CHK) portion of the INITIALIZATION routine in which the mode switch 70 is examined as seen in decision block 161 to determine whether it is in the LOAD mode. If the mode switch 70 is set in the LOAD mode, the microprocessor 36 branches and begins the LOAD NEW PROGRAM routine in Fig. ~. If the mode switch 70 is not set in the LOAD mode, the microproce~sor 36 loads the starting address in the RAM 40 in the HL register pair as represented in process block 162. It then reads the processor status through the status port in the decoding circuit 57 to check for a parity error, as represented in decision block 163. If a parity error is detected, the micro-processor 36 then jumps to a R~LOAD routine in Fig. 8. If there is no parity error, the pointer in the register pair HL
is incremented, as represented in process block 164, and as shown in decision block 165, this address is tested to deter-mine whether it is greater than the last address in the RAM
40. The microprocessor 36 loops back to process block 162 to test the parity of the data in the next address until all of the data in the RAM 40 has been checked~ When all of the data has been checked, the microprocessor 36 checks data at two test locations, as shown in decision block 166. If this test li3~36S

fails, the microprocessor 36 again jumps to the RELOAD routine in Fig. 8. If the test is successful, the interrupts are enabled and the microprocessor 36 waits for an interrupt to begin one of the interrupt firmware routines 47, as repre-sented in process block 167.
From this description it can be seen that duringinitialization the data in the RAM 40 is checked and if it is faulty a RELOAD routine is executed to reload the master copy of the data tables and test data 35 and 41-43 and the user control program 44 rom the EAROM 49 into the RAM 40. Referring to Fig. 8, the RELOAD routine hegins as seen in process block 168 with a disabling of both maskable and nonmaskable interrupts, so that data will not be lost due to an interrupt while the RAM 40 is being reloaded. Next 2K lines of data are loaded from the EAROM 49 into the RAM 40 as shown in process block 159. The mode switch 70 is then checked as shown in decision block 170 to determine whether it is in the LOAD mode. If the mode switch 70 is not set in the LOAD mode, the microprocessor 36 returns to the system check portion of the INITIALIZATION
routine to check the data in the RAM 40. If the mode switch 70 is set in the LOAD mode in decision block 170, the micro-processor proceeds to the LOAD NEW PROGRAM routine in Fig. 9.
During the LOAD NEW PROGRAM routine, interrupts are enabled to allow input from the program panel 17. The RAM 40 is checked as shown in decision block 171 to determine whether a program is present in the RAM 40. If a program is not present in the RAM 40, a check is made as represented in decision block 172 to determine whether a program is present in the EAROM 49. If the result of this check is affirmative, the microprocessor 36 goes back to the RELOAD routine to reload the master copy of data in the EAROM 49 into the RAM
40. As represented in decision block 173, if there is a 1~3~365 program present in the RAM 40, or if there is no program present in either the RAM or the EAROM, a check is made to determine whether the mode switch 70 is in the LOAD mode. If the mode switch 70 is not in the LOAD mode, the microprocessor 36 returns to the system check portion of the INITIALIZATION
routine in Fig. 7 to check the accuracy of the data in the RAM
40.
If the mode switch 70 is in the LOAD mode in deci-sion block 173, the LOAD pushbutton 111 is examined as repre-sented by decision block 174 to determine whether a new programin the RAM 40 should be loaded into the EAROM 49 to form a new master copy. If the LOAD pushbutton 111 is not set, the microprocessor 36 enters a program loop until either the mode switch 70 is switched to another mode or until the LOAD push-button 111 is set. If the LOAD pushbutton 111 is set, the microprocessor 36 erases the EAROM as represented in process block 175 and then writes the data from the RAM into the EAROM
line by line in process blocks 176 and 177, checking to see when all of the data has been transferred in decision block 20 178. When the contents of the RAM have been transferred to the EAROM 4g, the microprocessor 36 returns to the system check portion of the INITIALIZATION routine in Fig. 7. Once a correct copy of the data has been stored in both the RAM 40 and the EAROM 49, the microprocessor 36 will wait for an 25 interrupt as represented in process block 167 at the end of the initialization routine.
Besides establishing the image tables 41-43 to the user control program 44 in the RAM 40 and the EAROM 49 during system start-up, the microprocessor 36 also reloads the data t 30 master copy from the EAROM 49 into the RAM 40 when a fault is encountered during execution of other firmware routines 47.
When a fault occurs, an ERROR interrupt routine is executed, i365 as seen in Fig. 10. Maskable interrupts are disabled in process block 179 and processor status is read and checked as seen in decision block 180 to determine whether the error is in fact a parity error. If it is, the microprocessor 36 then executes the RELOAD routine discussed above. If the error is not a parity error, the microprocessor 36 checks the watchdog timer 74, as represented by decision block 181 to determine whether it has "timed out." If it has, the microprocessor 36 returns to the system check portion of the INITIALIZATION
routine. Otherwise, the microprocessor 36 determines the error interrupt to be a false alarm and reloads the RAM 40 from the EAROM 49 to preclude any possibility of an error passing into the RAM undetected.

~131365 a x X Z
~ a u~ ~ ~n o ~ O E~ O ~ ~ X ~ O
P: V ~ ~: ~ ~ ~ V ~ ~ E~
~ s~ z ~ E ' ~ ~ O :~1 H

H H ~ O ~ ~ N 1~ O X ~
E~ ~ ~ ~ o æ r: z ~ ~ ~ ~ I H E~
.IJ ~ ~ ~A ~ O H ~ X ~ 1 æ ~ ~
~: 1~ Z U~ V ~ U~ 5' Z C~ H Z a O 1~ H 2 ~ I X H ~ H ~ ~ 0 5: ~ Z
E3 ,~ ¢ O z ~ V
E Ul ~ V H E ~ H ~ ~
O H ,~ 1 ~O ~ O 1-1 Z ~ Ll O
V ~ V U~ H ~1U U~ Cl Z C.l H ~1 a ~

o z u H rl C) ~ O
O E
X C~ ~ ~ ~ ~ X
X Z ~ ~ ~C~ ~ Z U ~ O ~ U ~ ~ ~ S
,~ O~ ~ O ~ O
":1 H H a ~ ~ o ~
C E~ O ~ O ~ m--o ~ ~ ~ o ~ a 1 ~ ~ ~ ~ O ~ ~ u v ~ -- o ~
Q, H U --~ --H ~1 m -- ~ v 3 -- ~ -- u~ ~ ~ m ~ -- x ~ ~
H ~ N ¢
E~ 0 ~ U Z U ~
H ~:H a ~ Q C~ a O ~ a Z 1~ 3 C~ H ~ a C~ ~ Q
Z H~ ~1 ~ ~ ~ ~ X ~ ,~ H Q ~ .~1 ~ ~ ~ H ~ ~ ~
H a~ -U ~
O O U~ ..
Pl U U~

zo Il~ O
~ o o a~ o o o ct~ o o o o o ~ O ~ ~1 ~ ul ~ U ~ 1` --1 0 ~9 0 0 a) co o o ~
~ o 1~ o ~ o I ~ o ~ o o u- o o ,i ~ o o o ul ~ o ~ u ~ a ~

u~
~ o ~ 9 ~ a o ~ m a o ~ U') CO ~ m r~ Q '7 ~O 1` ) O O O O O O .-1 .-1 _I ~1 .-1 ~ ~ 1 _I ~1 ~ ~ t"l t`l ~`I ~1 ~`I 1~) ~ ~ r ) r~
OOOOOOOOOOOOOOOOOOOOOOOOOOO

U~
E~ O ~ u~ u~
~:~ Z E~ ~ Z _~
O ~ O O +
U~H E-~ ~ H N
3 ~ U~ X E-~
w ~ o æ
Oz c) ~ Z ~ ~ W
U~O O t`- H :~ O O ~ ~ E-' 1 u~a ~ ~ ~ a ~ o E-WCl: U~ O ~¢ H O a E~ ~: Z
o ~ r~ x a ~ x E~ ~ o O ~ X .¢ Ul H ~ ~,) Z
~ a ~ o ~ o E~
v ~ O O ~ . O
~ ~ o a 3 aJ ~ ~ ~ z v ~ o a ~ a a H ` W ~ ) H O
E~ E ~ U7 ~ ~ X u~ z ` V~ H
O W O W ~ 0 0 ~ H O Z ~
~ ~ ~ ~ ~ ; G ~ a z ~ ~~; ~ ~ ~ 3 W
Z C) H -rl O U~ _~
O E; 0 1:4 +
~:a o aa ~:
~ a~: o E~
XZ ~ ^ ~:--^ O ~ u~ O :r O ~ ~: I
H ~~ a ~ ~ ; o CE~ O _ ,¢ ~ ` In ~ ` O ~ ` ~ ` ~
¢ rl ~ ~ N ~ ~ ~ N ~~ N ~ ~ 5 N ~ 3 N 3 P.l ¢
1!~ ~) ,CI N Z ~ Sl Z ~I z ~ ~ _ H t~
H ~
O) ~ E~ ~ V
H Cl a H 14 a a ~ ~ z Q 3 ~; C~ a ~ ~ z a P~ ~ a a H 1 Z H I ~ ~ ~ ~3 ~ m 1~ H 1-1 V ~ 1- l H ~ ) 1~ H ~1 V 1~
H

O
O ~
1~ H

o ~~ o o O O ~ OO Ul ~
o o 1`
In r~ r~ ~J ~ r,4 0 ~ D O N .4 o .~C m ~ w ~ m ~ ~ v ~ o ~ w ~ N V ~ W ~ I m u ,I v u ~ v~ r~ ~ m c~ N 1~ m v u~
a ~ m ~ v ~
":I ooooooooooooooooooooooo ~L13136S

X
E~ ~
H O X
Z ~ ~ O
H a~ O U~
~ ~ ~ a P~
O ~ E~ ~
3 z Z
O
u~ Z E~ E~ ~ X ~ a H
r~: O ~: I¢ N 1~ ~ Z
~ Z ~ ~ O O H
JJ ~ ~ _ a ~ ~ ~ o o X
U~
~ ~ ~ z z a z c~ a ~
~ ~ H H ~ Z
O H H O O O ~: ~ O ~ O
t~ a a ~ a u ~ æ 0 _ o H S ~ ~ a X E~ ~: _ c~
rl O H ~ O
~- ~ O
0 a A ~ ~ N :~
s~ v ~ ~: a ~ .~C ~ z u~
P~ ¢

~ HaaaaaaH~
H a ~ ~ ~ ~ ~ ~ :q 1~ ,, o v ~ o o o a~ o ~ ,~
a~ ~ ,~ ~ o u~ o o V o o oo o O ~ ~ C~
~ o o o o ~ O U~
O ~ ~ ~ a ~
O ~. ~ ~ ~ o W ~ t~ ~ O

UJ
~ ~ ~ ~ ~ a o ~
r ~: o o o o o o o o o il31365 a Z 1~ :~ o ~I ~ Z E~
X ~ H 2 Z 14 Fd ~'- Z
U O U X~¢ ~ ~ Z O H ~
~ ~ ~ ~ ~ ~J ~7 U~ O P~ ; Z
a~ r~ r O E~ 2 ~1 ) U P~ 1 0 0 ~ E~ 1 N
1~ ~ Z a~ H ~ a z ~ a x X ~ E-~ O H ~ ~ V
E~ XE~ O ~ 1 H U~ H ~ ~ z F~
Z V U~ H H ~ O H Z O P ~ U
H ~ H Z ,~ O ! ~1 X ;~ 0 14 14 0 ~ C
-l H U O O E~
~: ~ ; O ~ C~ ~ 5 E~ H Z t~ H
o ~ E-~ O O ~1 1¢ 0 ~ f~ O P:~ X ~ ~ z E ~: z ~ o ~ E~ ~ ~ æ u ~ a h ~ U U ` E~ a 1-l ~ U~ H ~ 1~ 14 ~ E-~ ~ O U2 I¢ ~¢ I
O H O ~1 ~ t~l EL~ Z O O ~ O l~
U ~ D~ 14 i.Q ~ H H ~ ~ U

z H U
h .-1 O
~ ~ o O O O
~ E _ U ~ ~ ~ + ~ P. ~

2 C o ~ ~4 rn rn E~ ~ ~ U ~ X
X ~ 2 o ;~ _ rn ~ 5~ h rn a T~ a ~c rn ~: ~ U
.,j ~ r ~ ~ rt . ~ ~ ~ o ~ o a ~ Z E~ ~ rn ~ rO r~ ~ H rn 3:: ~
o o ~ o ~ ~ a ~ o ,~ ~ o ~
~ r~ p~ 5 N~ 5 N 0 ~ N~ X N 1~3 ` N ~ ` `
~ 0~ v rn ~ r ~ ~ Z ;~ ~ ~ Z ;~ --Z ~ r~: ~ æ ~; ~ o z :~: ~ N
U
~: 3 ~ s~
Z
8 E-~ U
a ~I H a a ~ a a ~ ~ ~ a ~ ~ ~ a a ~ ~ z a ~ ~ ~ H a ~ 4 a H ~4 ¢ H I G ;~ ~ rn ~ ~ U ~ H 1-:l U 1~ 1~ ~ 1~ U ~~:1 H ~.1 U 1~ ~ ~ ~ r~ ~ ~ r~ 1 a rn ,~
fS E~ a o ~ o ~ ~ ~3 U~
~ ct~ o o ~ ~ ~ o ~ r~l ~ c) ~ o _~
a~ ~r ~ ~ o o o r~ o o o ~ o In o J o r ~1 r~ O ~ O ~ ~ L~ t~) r~ ~ o C~ O ~ r ~: o ,~ u o u~ ¢ o u~ ¢ ~ o o ~D O u~ ~
U r~ ~ _I ~ ~ ~ F~ ~ U ~ I r~ ~i ~ L~ N U r~ ~ (~ ~ m ~ ~ ~ ~ r~ ~
~ ~4 r~ ~ U ~: r~l ~ r ) ~ r~l m u r~ q u r~ r ) ~ ~ r~) ~ U ~ U U

C) ~ ~r u~ r ~ a O r~l rr) ~D r~ a O rr) u~ U a o r~ u ~ ~
r~ r~ r~ r~ r~ r 0 r Co r r~o r ~ ~ a~ ~ r~
N r~l ~ r~ r~l r~l r~l ~ r~ r~ N r~l ~ N (~J r'~l ~ ~ r~l r~l N r~i ~ ~ r~l ~
,:: OOOOOOOOOOOOOOOOOOOOOOOOOOOOO

~313f~5 m a Q
u~ z O O
2 ~~ J O O O
O
Z ~: Z ~ ~ o Q ~ E~
~) O O O O Z ~ 2 ~ ¢ H
x ~ H X H O O O U~ 3 0 ~ Z E-l a X ~ H Z
a ~ L ~ ~ o, ~ H
O U~ O Z t~ H ~ ~1 0 0 U~ H ~ ~ Z ~_) O
~ :~ O H U~ a u~ :~ z u~ E~ 3 E-' H ~ O ~
:~ O ~ ~ H U~ H ~ Z O 0 1~ 0 H ~ ~ 1 ~ ; a a ~ ~ ~ ~- H ~ ~ O `
H Z ~ a Q ~ 3 2 E~ O E~ ~ ~
o ~ ~ u~ o E~ a ~: H ~ ~ O
.C ~ Z ~: O ':~ O ~ Z O ~ O ~ H ~ Q ~ ~ O a ::1 ~ H ~ ~ E~ ~ ~ Z Z ~; 3 0 ~¢ 11 ~ ¢ ~ Z
c ~ m z Q C4 1:4 ~ Z 1:~ Z H H O Q Z ~ X ~1 H O ~
al V O ~ H ~ 3 h ~ rS3 H ~ m ~ 2 Q O
E ` Q ~ Z 2 0 ~ ~1 U
O ~ O O ~ ~ E~O ~ ~ O Z
o ~ m z ~ m u~ u~ tn a m ~ n v u~ a a E~ ~ z m m v z ~

Z
C H t') E-~ rl :~
:~: O
O O ~ O O O
~ ~ I O ~ O
C~aJ ~D~ CO O
æ c E~ ~ + + +
x~ u~ _ a .,, ~ m ~ o ~ .
CO O ~ Q ~` U~
1 ~ ` N ~ l ` ` N 1~ 1 ` 00 N :~
~æ 2 ~ a~- v~z~a~z~
~ 3~
~ ~ u~ u~
z ~
~ E~ Z ~ ~ U
Q~l a H ~ H QaQa~aaaaaaaazaa~zzQ~
~HI ~m~a,~ ~ O ~:1 ~ V ~) H H ~ t.) o ~ .

~1 o a~ O o ~ o o ~
(11 ~ ~ O
O ~ ~ o o o o o o ~ O 1` ~ O O O O O O O
o ~mo~

U~
U~
h ~ ~ m~o~Qo~mQ~o~
~mm~m~aa~Q~a~
OOOOOOOOOOOOOOOOOOOOOOOOOOOO

~13~36~5 x a ~
Z U

o _ a H
Z U~ ~
:~ Y ~ ~ Z ~:
Z
m ~ o H
~m m ~
E a a ~ m E~ o E ~: Z U~ H
O O ~ ~ ~:
O ~ tl~ P~ 3 Z
C H
O E-' '1 O O
; E
~ ~:
X ~ ~: ~ V~
~,i X ~ P~ I
o o ~ c~ m 3 a H
1 ~ ~ ` ` O
G
~5: 3 ~
~1 h Z ~J
U~ U~ U~
a ~ ~ a ~ H ~
H

~ E~
P~ H
O
~ S

U~
JJ
O ~
~9 0 c ~ a ~ ~ o ~: m o ~ ~ m m t~ ~ ~ ~ U
U~
V~
O ~ ~r o o o N ~ t'`l (~ ~ '1 1`~
O O O O O O O

.
.

1 1 3~36~5 n ~;:
n ~ o n n ~ z x ~ o E~ O O E~ _~
Z 1:~ ~ ~ H ~
X l¢ Z ~;
~1 0 (~
I o ~ ~:
c) m o ~ ~ C ~
E ~ ~ H ` IL1 ` P.-~i n I ~ n ~ n ~
O H ~

O
O
Z ~
E~ ~ E~
X:~ ~~ O U
.~ o ~ ~ n ~
c no~ ~ s co ~ n o ~rl `` N `` I
Ql O ~ ~ ~D Z ul N 1::
t) S~
u~ E~ E~
C ~ ~ H a.. 1--1 P- 1 o ~ m ~ m ~;
.

C o r~
u~ oo o o t~ o c o O ~ ~ m N

U~
U~

o ,~ ~ ~9 ~ m ~
c~J
~: o o o o o o o ~131365 E~
U~
E~
o ~ ~ ~ 5 a ~ m ~ z E~
; ~ ~ O
r~ z a 3~ m ~: ~ o E~ m o G ~ ¢Z ~ H Z ~ ~``1 ~ ~r ~) ~ U~ Z U~
z a ~ h ~ O O ~ m z x x x ~ ~
Z ul H ~ ~ U~ ~; .4 E-~ I H Z ~ ~ U~ O
H U~ Z ~ O E-~ ~ Z ~ ~ ~ ~ O a O H E~ O O m ~ ~ ~ ~ C~----u) c~
X E~ a ~ ; o tr; ~ ~ ~: m ~ ~ ~ H O O O O 1~
~¢ ~ H ~ ~ O O P~ 1 ~ m o .¢ E-~ H
a) ~ O m ~: z z a; E~ u~ a E ~ H U7 ~ ~ H H O :~ O ~ ~ ~ O E~
~ ~ X ~ o U~ o o ~ m ~ o ~ ~ z E~
Z ~:~ O O Q~ ~ ~ O 1:'1 ~ I O ~ H
X ~ U~ O O li~ H ~ X ~ t,) L~
U~ U~ 0 0 ~ H
¢ H ~ ,~ (~ I O O O O P~ P~
E~ ~ O E~ . o ~ ~ a ~ a o z o C~ o o H O ~ 3 I:t~ H ~ H H Z

U) E~
z ~n _ Z
O ~
C.) E
U~ U
X X ~
'-I Q X
--~ o u~

o o o o o o o o ~ m ~ o a o o o ~ o o O ~`I O O O N O O O O O O O O ~1 --I r~l ~1 ~ 1 ~1 0 0 ~I O O O
O~:5 oooooooaooooooooo,ooooo~r~oooo ~ 1:1 O O U~ 1 ~ ~ N ~1 N ~ ~1 N ~ `1 N N ~1 N 1¢ 0 0 ~0 ~ 1`
O
H

O ~ o ~ ~
e ~ z ~ 7 ~ H O H
~ E~ X ~ O ~ o o o o cl a s:: z ~ E~ a ,~ ~ ~ O O H H '~ ~ a ~ ~ ~ ~ ~ o O ~ C~
:~ H O U~ ~ ~; H ::~ ~ E~ 3 3 3 o E-~ ~ H H Z

~L~L31365 m E~
z a ~
a a u~ o ~ a ~ a ~
a E~ u~ a m z a ~: X a a ~ H a ~: a P;
O ~ a E~ a o

3 ~ z a æ ~ ~7 H
a a o H ~n z o ~., ,s a ~
Z ~: H U~ ~ ~; H ~ ~>
~ O O E~
C) 5 ~ ~ z ~ ~ ~ ~ u~
E
~ o m ~ ~ H E~ m o o ~ ~ ~; ~
Z ~_) ,¢ 3 U~ ~ C.) ~:
~ O E~
cn m ~ . ~ o u~
O u~ ¢ H
U~ ~ ~ Z ~ a~ ~ x H 1 U~
E~
Z
C
CZ

C.) E

~3 X~ ~
,~a x a a~
c~ x c~ _ o u~
~ t-oooooo~_I~`~nco u ~ ~ u o O O O ~ o a ~
o~a ooooooooo1`oooo ~ ~ O N U ~ r 1 0 0 t~ ~ O t~
O
U

A
S:: ~:1 0 H E~ a o al o o ~ z E~ ~: Z a N
E a E~ H H E-~ U l Ll U ~:; ~ a H
a~ ~ a a ~
~ O ~ ~ ~ ~ ~ ~ o ~ u~
C) ~ ~ ~ P- ~ 3 :~: m ~ ~ H H ~

il31365 o o I a~ I
o~ 0~ C~ 0 5` h ~,1 ~,Q 0 o al ~: aJ u ~q O ~ O ~1 ~1 ~ 0 X 0 ~ ~ OD 1 u~ p. c~ ~CJ ~ E ~ ~ O G~
e E~ ~
o o I o,n ~ 0 0 ~ ~ 0 ~ V
~o ~ oe v~ ~ ~ E d ~ ~
O I ~ 0 0 0 Q~ 0 ~: ~1 o ~ 0 ~)~ .nrl ~ ~ G~ O
o rJ
rl 1:: ~1 ~O ~~ 0 ~ O I ~ O ~
C- ~ ~ C) X
rn D ~a :5 r J ~ l 1 0 ~0 ~ O
~ .~ u V ~ E-~
o~ ~ ,n ~ o ~ 0~ ~: ~,q X d ~ O P

v ~ ~ e d CJ v ~ v dI o a) d ~I Q) 0 E-l rl ~ 0 0 0 ~ aI ~
1 ~ 4~ ~ ~IP~ X ~ :~ I o ~1 o ~ ,a QJ ~
C C~ ~ Ei v ~ cr~ d v e ~1 0 o 0 ,~~1 o ~ d ~a 1 d v 1-1 C,1 5- ~
p ~ e~J r l o O ~ H ~ ~: X ~ O :1 u~ u~ El 0 0 c~ tO ~ ~ 00 d 0 o C~ ` d Ei ~1 0 c~ -rl 3 -rl 0~t o ~ X z 0 u~ E3 O ~ O O ~ ~ ~ v o c~ d QJo ~: o ~ ~ Z ~ æ ~ ~ 0 z v X
z P~
X ~
~ ¢
ra E~
al Z

~4 Z
¢ O a~
~4 .n X
O ~ co C~ Z u~
a u ~ r~
al . . _~
;~
. ~
o U~

c) ~
o o a ~ ~ .
o o ~ ~ 0 tn :~ I I
tn o o~
v tJ ~ o o d o v v o~ -a ç: P. d o o ~1 S~ O P.
~ ~ X
o ~ ¢ O ¢ 0 C~ X P~ ~ ~ ~ ~ S~l --~7--~31365 ~ CS
01 1 ~ a~ ~q C U~ ^ ~, .. ~
C o ~ ~ V .
0~ V oU~ t~~ 00 h t~ V t~ V
E c~ 1 R P~ C 00 ~ C CD R
R ~ 0 ~ ~ 0 ~ t-~
R s~ ~ E ~ C Z ~
V ~ ^C~ I ¢ ^ Z ^
æ ~ c q cq ~ ~ Z J~ Z
R ~ C C ~ ~rl C~ ~C ?
.q X :~ v ~ h1 ~: O E~ qJ Xrl .0 0 U~
o ~ ~ o ~ ~ P. C O R
p~ ff r( ~J W ~ ~-:~ ,Q R ~ ~ ~: cq Q~ J.
1 ~. rQ O ~ o ~
~ _I CJ V ~ V 0~ X ~I ~ R X ~ X
V t~ V
~ c~ B
t~ O V ~ ~
v' V I R
c~ ~ C V ~ R
~-1 B C~ E ~ C~ 1 C:~ ~ C c~
~;1' V 1~ Ul~ V~J ~d ~1 0 H t~ ~ O V
C.) 0 ~ O ~ ~I v o Z; ~ O ~ XV~
L) O ~ 01~ 1 0 ~ ~1 ~ q~l O ~ O O ~ ~ 1~ ~ F: O ~ V t~ ~ R r~ R 1~ ~:
3 ~ C ~) S~ :3 Z ~ Z td ~3 I R æ ,1 a~ z ~ z 0 R E-~ ~ H 0 ~ e u~ ~
o ~c H
Z
X ~
¢
R E-l Z
lY
Z
~C o a~
P~ ~n X B c~
O ~ . ,1 U~
c~ æ ~ ~

C~ O~
C . 0 I b'~
o o _~
a~
a~ o~I _

4~ ~ i~o I~CO U~ OUl ~ U- C`l ~,CO ~' --' C
o ~q V ~ p.U~
~ L~ O ~U~ o ~ V
C~ 0 V ~ V
R ~ U ~ t'JV ~ t~ t~
O
~, ~ ~ co ~ a Q
E~u ~ ~ ~ ~ z Z
o:1 ~ ~ O ~ ~ ¢ ¢
m ~ :2:o ~ z z n tO ~ o ~
æ ~ e~ , v ¢ ~ ) C
E ~ t~ ~ ~ ,1~'.~., X
o ~ o a~ o u, ~ to t~ ~o o C :~ d C ~C O :~
o ~q e~ ~ o o I X
C C C
P. ~ ~ 3 ~-1 O ~
c~ ~ s,~ X ~ K
u~ ~ ,n C
v ~o E
CO >~ P :~ ~
O~ ~ C ~ E lJ
td~ O ^~ ~ X
t J- X ~ S ~ X
e _~ ~ E c) _I t) H 11~ t~
O ul ,`1 ~ ~ O qJ ~:1 ~ O u~
Z ~il C Z :~ ~ Z ~d Z n~ Z o z c ~e ~ ~n e u~ e ~
o ~C
a Z
X :4 ¢ ~
;r aJ æ
P.
P. Z ~
¢ o a) ~d x e o ~ ~
Z _, a V
~ ~, ,~
a~
e~,_ O OU~
O

,..
al ~ ~ a~
e~
O
~L a E Z ~
O~: ~ CC
c~ Z

Claims (12)

The embodiments of the invention in which an exclusive property or privilege is claimed are defined as follows:

1. An improved digital controller of the type having a random-access read/write memory which stores control data that is used in controlling a machine, wherein the improve-ment comprises:
an erasable, read-mostly memory, for nonvolatile storage of control data;
loading means coupled to both the read/write memory and the read-mostly memory for transferring control data from the read/write memory into the read-mostly memory to form a nonvolatile master copy;
data-checking means coupled to the read/write memory for verifying the control data in the read/write memory; and reloading means, coupled to both the read/write memory and the read-mostly memory and responsive to a failure of the data-checking means to verify the control data in the read/write memory, for transferring the master copy of con-trol data from the read-mostly memory into the read/write memory.

2. The improved controller of claim 1, wherein the data-checking means is operable to verify the control data in the read/write memory before this data is used in con-trolling the machine.

3. The improved controller of claim 1, further com-prising:
watchdog timer means for generating fault signals in response to faults that occur during operation of the controller;

wherein the data-checking means is responsive to a watchdog fault signal for testing the control data in the read/write memory; and wherein the reloading means is operable to transfer a master copy of control data from the read-mostly memory into the read/write memory if the control data in the read/write memory is not verified by the data-checking means.

4. The improved controller of claim 1, further com-prising:
mode selection means having a LOAD position and an alternate position; and wherein the loading means is responsive to sense the position of the mode selection means, the loading means being operable, only when the mode selection means is in its LOAD
position, to erase a previously stored master copy of control data in the read-mostly memory and to write updated control data into the read-mostly memory to form a new master copy of control data.

5. The improved controller of claim 1, further com-prising:
a user-operable LOAD control; and wherein the loading means is responsive to sense the status of the user-operable LOAD control prior to the trans-fer of control data from the read/write memory to the read-mostly memory, so that such transfer is conditioned upon the operation of the LOAD control by the user.

6. The improved controller of claim 1, wherein the control data transferred between the read/write memory and the read-mostly memory includes a block of control program instructions for controlling a machine.

7. A digital controller for controlling I/O devices on a machine through execution of control program instructions, the controller comprising:
a read/write program memory which stores status data representing the status of the I/O devices on the machine and which stores control program instructions;
a read-only memory which stores a plurality of processor instructions;
an erasable, read-mostly archive memory for nonvolatile storage of the control program instructions; and controller processor means coupled to the read/write program memory, coupled to the read-only memory and coupled to the read-mostly archive memory, wherein the controller processor means reads the control program instructions from the read/write program memory and executes the control program instructions to operate on the status data , wherein the controller processor means is respon-sive to selected processor instructions in the read-only memory to copy program instructions from the read/write program memory into nonvolatile storage in the read-mostly archive memory, wherein the controller processor means is further responsive to other selected processor instructions in the read-only memory to verify the integrity of the control program instructions stored in the read/write program memory, and wherein the con-troller processor means is further responsive to other selected processor instructions in the read-only memory to reload the copied program instructions from the read-mostly archive memory into the read/write program memory in response to a failure to verify the integrity of the control program instructions stored in the read/write program memory.

8. The digital controller of claim 7, further com-prising:
mode selection means having a LOAD position and an alternate position;
further comprising means for coupling the mode selection means to the processor means;
wherein the controller processor means includes enabling circuit means for controlling write and erase functions on the read-mostly memory; and wherein the controller processor means is further respon-sive to selected processor instructions to read the status of the mode selection means, and is further responsive to other selected processor instructions to signal the enabling circuit means to disable the write and erase functions on the read-mostly memory when the mode selection means is in its alter-nate position to prevent spurious overwriting of any of the contents of the read-mostly memory.

9. The digital controller of claim 7, further com-prising:
a user-operable LOAD control;
further comprising means for coupling the LOAD control to the processor means; and wherein the controller processor means is further respon-sive to other selected processor instructions to sense the status of the LOAD control prior to the transfer of control program instructions from the read/write memory to the read-mostly memory, so that such transfer is conditioned upon the operation of the LOAD control by the user.

10. The digital controller of claim 7, further com-prising:
fault detection circuit means coupled to both processor means and the read/write memory, the fault detection circuit means being responsive to the detection of faults to generate nonmaskable interrupt signals to the processor means, the fault detection circuit means also being responsive to a signal to inhibit the generation of such nonmaskable inter-rupt signals; and wherein the processor means is responsive to a selected processor instruction in the read-only memory to generate the signal to the fault detection means to inhibit the generation of such nonmaskable interrupt signals during the response of the processor means to processor instructions for reloading the copied control program instructions from the read-mostly memory into the random-access memory.

11. The digital controller of claim 7, wherein the read-mostly memory is an electronic memory.

12. In a digital controller for controlling a machine through input and output devices thereon, a programmable module which is electrically coupled to the input and output devices and which executes control program instructions to operate on data representing the status of the output devices in response to data representing the status of the input devices, the programmable module comprising:
a read/write program memory which stores input status data representing the status of the input devices and output status data representing the status of the output devices and which stores control program instructions;
a read-only memory which stores a plurality of processor instructions;
an erasable, read-mostly archive memory for nonvolatile storage of control program instructions;
an address bus and a data bus;
controller processor means coupled through both the address bus and the data bus to each of said memories, and program panel interface means coupled to both the controller processor means and to the read/write program memory through the data bus and further coupled to the controller processor through an interrupt control line, wherein the controller processor means reads the control program instructions from the read/write program memory and executes the control program instructions to examine input status data and determine output status data, wherein the controller processor means is responsive to selected processor instructions in the read-only memory to sequentially couple addresses through the address bus to the read/write program memory and to the read-mostly archive memory to copy program instructions from the read/write program memory into nonvola-tile storage in the read-mostly archive memory through the data bus, wherein the controller processor means is further responsive to other selected processor instructions in the read-only memory to sequentially couple addresses through the address bus to the read/write program memory and to the read-mostly archive memory to reload the copied program instructions from the read-mostly archive memory into the read/write program memory through the data bus, and wherein the controller processor means is further responsive to an interrupt signal generated by the program panel interface means to couple original and edited program instructions through the data bus between the program panel interface means and the read/write program memory, prior to copying such instructions into the read-mostly archive memory.