Controlling a remote base

The ice mine is two kilometres away from the base. Out there a chip controls the pumps, and in the base's control room another one operates it. How the values travel over the distance you saw in remote control. Today is about the side that commands – and about how it notices that something is wrong out there.

The interface#

Both chips share a few Logic Memories:

Every address has exactly one writer. That way no chip ever overwrites what the other one just reported.

Values over the radio link: is the link alive?#

A reading alone does not tell you whether it is fresh. If the radio link stands still, the memory simply shows the last value forever. That is why the outpost counts a heartbeat up, and the control room measures how long it has not moved:

lbn puls SPEICHER HASH("Fern_Puls") Setting Average
seq tmp puls oldPulse               # 1 = no new heartbeat
add age age 1
mul age age tmp                # new heartbeat: age 0
move oldPulse puls
slt link age TIMEOUT

Without a link the control room no longer shows the pressure, but −1. An old value that looks like a current one is more dangerous than none at all.

Commands back#

A command gets a number. The outpost executes it and writes the same number back as an acknowledgement. As long as the two numbers differ, the command is on its way or stuck:

sne tmp ack nr                     # outpost has not executed yet
add pending pending 1
mul pending pending tmp
sgt tmp pending WARTEN

After a restart the control room reads the number from the memory instead of starting at 0 again. Otherwise the outpost would take the next command for an old one.

Safety#

• No commands without a link. A button press into the void would otherwise be executed by surprise later, once the link is back.
• A warning without acknowledgement. Then the operator knows he has to go and look.
• The outpost decides about its own safety. On link loss it goes into its safe state, no matter what the control room wanted last.