A-Level Computer Science

A network 网络 is a set of computing devices connected so they can communicate and share resources. Benefits:

• sharing resources (printers, file servers, internet) — cheaper than equipping each computer.
• sharing data — many users access the same files.
• central management — install software, manage users and back up once on a server.
• communication — email, video calls, messaging.
• remote access — work from anywhere.

A local area network 局域网 (LAN) covers a small area — a home, office or school, usually owned by the organisation, with high data rates and low latency 延迟.

A wide area network 广域网 (WAN) covers a large area — a city, country, or the world (the internet is the largest WAN). It uses telecom-company infrastructure — often the Public Switched Telephone Network 公共交换电话网 (PSTN), leased lines or fibre — with lower data rates and higher latency. A WAN connects LANs together.

For "give two characteristics of a LAN": it covers a small geographical area (one site or building); the hardware is owned by the organisation, not leased from a telecom company; it connects through its own switches, cables and access points. For "two ways a WAN is different": it covers a large geographical area; it uses third-party (leased or public) infrastructure; data rates are lower and latency higher; it usually joins several LANs. A school on one site is a LAN; a company with offices in two cities needs a WAN, with a leased line or the internet between the sites. Justify the choice with the area covered and who owns the links.

Client-server

• powerful machines act as servers 服务器, providing services (files, web pages, email).
• other machines are clients 客户端 that request services.
• central and easy to manage, but the server is a single point of failure unless backed up.

Peer-to-peer (P2P)

• all machines are equal peers; each can be both client and server (peer-to-peer 对等网络).
• resources are spread across the peers — no central server. Robust to one failure, but harder to keep secure and consistent.

Choosing a model. Client-server suits a school or a business: files are stored and backed up centrally, a user logs in with one account from any machine, software and security are managed once, and the server can be a powerful machine. The drawbacks are the cost of the server and of a technician, and that the server is a single point of failure. Peer-to-peer suits a few friends sharing files or a game: no server to buy, easy to set up, and each user keeps control of their own machine. The drawbacks the scheme lists: files are spread across many machines, so they are hard to back up and a file is unavailable when its owner's machine is off; each machine must be secured separately; and a peer that serves the others slows down. An online game played through a web browser with other users is the client-server model: the browser is the client, and the game and its shared virtual world run on the company's server, which keeps every player's view consistent.

A thin client 瘦客户端 does little processing locally and relies on a powerful server (web terminals, remote desktops). A thick client 胖客户端 has strong local processing and storage and runs full applications itself (a normal desktop PC).

The roles: in a thin-client model the server does the processing and stores the data, and the client only sends input and shows the output. A cheap terminal is enough, and everything is backed up and updated on the server, but nothing works if the network or the server fails. In a thick-client model the client runs the software and stores files itself, so it can work with no network connection and puts less load on the server, at the cost of more powerful (and more expensive) clients that must each be updated and secured. A school computer room can run thin clients (cheap, centrally managed); a video editor needs a thick client.

The topology 拓扑 is how the nodes and links are arranged.

• bus 总线 — all devices on one shared cable. Cheap; the whole LAN fails if the bus fails; performance drops as more devices share the bandwidth 带宽.
• star 星形 — every device connects to a central switch. One device failing does not affect others; the switch failing brings all down. Most common today.
• mesh 网状 — every device links directly to others, with many paths. Very fault-tolerant 容错 (traffic reroutes) but needs lots of cabling.
• hybrid — a mix (a star in each office, mesh links between offices).

How packets travel in each topology

Bus: the sending device puts the packet on the shared cable; every device sees it, and only the one whose address matches accepts it. Only one device can transmit at a time, so collisions happen (CSMA/CD, below). Star: the sender passes the packet to the central switch, which reads the destination address and forwards it only down the cable to that device; two other devices can talk at the same time. Mesh: the packet is passed from node to node along one of several possible routes until it reaches the destination; if a link fails, another route is used.

To justify a topology: a star for a classroom or an office (a failed cable affects one device; a device is easy to add; with a switch there are no collisions); a mesh where reliability matters most (a hospital, the internet's backbone); a bus only where cost matters and few devices share it. "Draw the star topology" means: the switch in the middle, one line from the switch to each computer, and the server (and the router, if there is one) on their own lines to the switch.

Cloud computing 云计算 delivers computing services (servers, storage, software) over the internet, hosted by a third party. Benefits: scalability 可扩展性 (pay for what you need), lower cost, access from anywhere, and reliable redundant data centres. Drawbacks: needs internet, your data is held by a third party, and possible vendor lock-in.

For the one-mark definition: cloud computing is on-demand computing services (storage, processing, software) provided over the internet by a third party. A public cloud 公有云 is owned by a provider and shared by many customers over the internet; a private cloud 私有云 is dedicated to one organisation, on its own hardware or hosted for it alone. Benefits the scheme accepts: files are accessible from any device with an internet connection; storage scales up and down as needed; the provider handles the hardware, backups and security updates; there is no local server to buy or maintain. Drawbacks: no access without an internet connection; the data is on a third party's hardware, so security and privacy depend on the provider; an ongoing subscription cost; the provider could fail or be attacked; large files may be slow to transfer. A "why does the company use a public cloud" answer says that they need no hardware of their own, pay only for what they use, and their users can reach it from anywhere.

• wired (Ethernet 以太网 over twisted-pair 双绞线 or fibre-optic 光纤): higher speed, lower latency, fewer errors, more secure.
• wireless (Wi-Fi, Bluetooth, cellular): no cables, devices can move, but slower, prone to interference and eavesdropping.

For the same generation, wired wins on speed and reliability; wireless wins on convenience.

Transmission media

The exam asks for the comparison in both directions. Wired beats wireless on speed, reliability (no interference), security (a cable must be physically tapped) and consistency; wireless beats wired on mobility, the cost of installation, and adding a device without cabling. Allowing both lets students move around with laptops and phones while the fixed desktops keep the faster, more secure connection, and a device with no network port can still connect. Satellite instead of copper reaches places no cable can, but with more delay, weather interference and higher cost.

• network interface card 网络接口卡 (NIC) — lets a device send and receive on the network; has a unique MAC address MAC地址 (a 48-bit hardware address). A wireless device uses a wireless network interface card 无线网络接口卡 (WNIC).
• switch 交换机 — forwards Ethernet frames only to the port for the destination MAC address.
• hub 集线器 — a simpler device that copies traffic to all ports (now obsolete).
• wireless access point 无线接入点 (WAP) — lets wireless clients join a wired LAN.
• cabling — twisted-pair for short runs; fibre-optic for longer, faster runs.
• server — a computer that provides a service to the other devices: files, printing, web pages, email storage.
• bridge 网桥 — joins two LAN segments into one network, passing traffic between them.
• repeater 中继器 — receives a weakened signal and retransmits it at full strength, to extend a cable's reach.

A WNIC's functions, for a four-mark describe: it converts the data into radio signals and back; it carries the device's unique MAC address; it connects the device to a wireless access point and follows the wireless protocol (which channel and frequency to use); and it decodes the incoming signals for the device. Two devices that can physically connect thirty computers with NICs: a switch, or a hub.

A router 路由器 connects different networks and forwards data between them — usually at the boundary of a LAN and the internet. It does:

• forwarding — reads each packet 数据包's destination IP address IP地址 and sends it out the right port, using a routing table 路由表.
• network address translation 网络地址转换 (NAT) — lets many private LAN addresses share one public IP.
• DHCP 动态主机配置协议 — hands out private IP addresses to LAN devices.
• firewall 防火墙 — blocks unwanted incoming traffic.

In packet switching 分组交换 a message is split into packets that are sent independently. Each router reads a packet's destination IP address, looks up the next hop in its routing table and forwards it, so the packets of one message may take different routes and are reassembled in order at the destination. A router does receive packets, forward them between networks and hand out IP addresses; it does not find the IP address for a URL (DNS does that) and it does not store web pages. A home router also contains the modem and the wireless access point, so one box connects the LAN to the internet.

Ethernet is the standard (protocol) for wired LANs: devices are joined by twisted-pair or fibre cable, data is sent in frames that carry the source and destination MAC addresses, and a shared medium uses CSMA/CD to deal with collisions. On shared media a collision 冲突 can happen when two devices send at once. The protocol is CSMA/CD 载波侦听多路访问/冲突检测 (Carrier Sense Multiple Access with Collision Detection):

1. carrier sense — listen before sending; wait if the cable is busy.
2. multiple access — many devices share the medium.
3. collision detection — keep listening while sending; a clash is a collision.
4. on a collision, both stop, send a brief "jam" signal, then wait a random backoff time before retrying.

The three tasks, in the scheme's words: the device listens (senses the carrier) before transmitting; it keeps checking for a collision while it transmits; on a collision it stops, sends a jam signal, waits a random time and retransmits.

Modern switched Ethernet uses full-duplex 全双工 point-to-point links, so collisions no longer happen.

Bit streaming 流式传输 sends multimedia as a continuous stream that the receiver plays as it arrives, instead of downloading the whole file first.

• real-time (live): captured and streamed as it happens (live sport, video calls). You cannot rewind; low latency is vital.
• on-demand: pre-recorded on a server (YouTube, Netflix). You can pause and rewind; the server can buffer 缓冲 ahead.

Real-time streaming works as a short pipeline:

1. capture and sample the source (a camera or microphone).
2. encode it, using compression 压缩 to shrink the data.
3. send it across the network as packets.
4. the receiver buffers a little, then plays it live — dropping any packet that arrives late, because a live stream cannot wait for it.

Lossy 有损 compression is used here: moving pictures hide small losses, and the stream must be small enough to fit the bandwidth.

Why a video is compressed before real-time streaming: the uncompressed stream would need more bandwidth than the connection has, so frames would arrive late and the playback would stall. Compression cuts the number of bits, so the bit rate 比特率 stays below the broadband speed, the delay stays small, and less storage and cost are needed at both ends. The bit rate must be lower than the connection's speed: a higher bit rate gives better quality but needs a faster connection, and if the data arrives more slowly than it is played, the buffer empties and the video freezes. On-demand streaming can buffer more of the file ahead, so it copes with a slower connection; real-time streaming cannot.

The internet 互联网 is a global network of networks using a common protocol 协议 suite (TCP/IP). The World Wide Web 万维网 (WWW) is a service that runs over it: hyperlinked documents identified by URLs, viewed in browsers via HTTP/HTTPS. Email and file transfer are other internet services that are not part of the WWW.

Webmail uses both: the WWW, because the mailbox is a web page reached through a URL in a browser over HTTP; and the internet, because the email itself travels across the network of networks (email is a separate internet service from the web).

Hardware that supports the internet

• modem 调制解调器 — converts the computer's digital signal into an analogue signal for a telephone line, and back again at the other end (modulation and demodulation).
• PSTN — the public telephone network of exchanges and lines; a dial-up or DSL connection carries internet data over it.
• dedicated line 专线 — a leased line between an organisation and its ISP: always on, with a fixed bandwidth that is not shared, so faster and more reliable, but expensive.
• cell phone network 蜂窝网络 — the phone sends data by radio to the nearest cell tower (base station); the towers are linked to the phone company's network, which routes the data to the internet; as the phone moves, it is handed over from one cell to the next.

An IP address uniquely identifies a device.

• IPv4 — 32-bit, four denary numbers 0–255 (192.168.1.10); about $4.3 \times 10^{9}$ addresses (now exhausted).
• IPv6 — 128-bit, eight groups of four hex digits; about $3.4 \times 10^{38}$ addresses.

IPv4 is written as four groups of denary numbers separated by dots; each group is an 8-bit number, so it runs from 0 to 255. IPv6 is written as eight groups of four hexadecimal digits separated by colons, 2001:0db8:0000:0000:0000:ff00:0042:8329, and a run of zero groups can be shortened to ::. So 192.168.3.2 is not IPv6: it has four groups, not eight, separated by dots rather than colons, and its groups are denary, not hexadecimal. 256.0.0.A is not a valid address of either kind: an IPv4 group cannot exceed 255 and cannot be a letter, and IPv6 would need colons and eight groups.

Subnetting

A network can be split into subnets 子网. The IP address splits into a network part and a host part, given by a subnet mask 子网掩码 (e.g. 255.255.255.0 = first 24 bits are network). Subnetting improves management, cuts broadcast traffic, and improves security.

The two parts of an address in a subnetwork: the network ID (the first bits, the same for every device in that subnet, given by the ones in the mask) and the host ID (the remaining bits, unique to each device). Benefits of subnetting, for "describe two benefits": less traffic on each part, because broadcasts stay inside their subnet; better security, because one department's traffic is kept from the others; easier management and fault-finding; more efficient use of the addresses. Two devices with the mask 255.255.255.0 are in different subnets when their first three groups differ.

Public vs private addresses

• private addresses are used within a LAN and are not routable on the internet (e.g. 192.168.0.0/16).
• a public IP address is globally unique and routable, assigned by an ISP 互联网服务提供商.

Devices behind NAT with private addresses are not directly reachable from the internet, giving some protection.

The descriptions the tables want: a public address is visible on the internet and unique across it, allocated by the ISP; a private address is visible only inside the LAN, is reused by many LANs, and needs NAT to reach the internet. A static address never changes (set by hand or reserved, as a server needs); a dynamic address is allocated by DHCP each time the device connects and may change.

Static vs dynamic

• a static IP address is fixed; used for servers that must be found at a known address.
• a dynamic IP address is assigned by DHCP and may change; easier for client devices and uses a limited address pool efficiently.

Worked example. A host has IP address 192.168.10.130 with subnet mask 255.255.255.192. Which network is it on, and is 192.168.10.200 on the same one? The mask's last octet, 192, is 11000000 in binary, so the first 26 bits are the network part and the last 6 bits address the host. That makes the subnets step in blocks of $256 - 192 = 64$: .0, .64, .128, .192. The address 130 falls in the block starting at .128, so the host is on network 192.168.10.128/26, whose usable hosts run .129 to .190 (.191 is the broadcast address). 200 falls in the next block (.192), so it is on a different subnet and traffic between the two must pass through a router. Get the block size from the mask first ($256$ minus the mask octet) - guessing from the first three octets is what makes these go wrong.

A URL 统一资源定位符 (Uniform Resource Locator) locates a resource on the WWW:

https://www.example.com/about/contact.html
protocol     domain name        path

• protocol: http, https, etc.
• domain name 域名: a readable server address.
• path: the resource on that server.

The Domain Name System 域名系统 (DNS, also called the Domain Name Service) is a distributed set of servers that turns domain names into IP addresses. When you type a URL, the browser asks a DNS resolver for the IP, which queries DNS servers (root → top-level → authoritative) until it finds it; the browser then connects to that IP and requests the path. DNS saves humans from memorising IP addresses and lets a site change server without changing its name.

For "explain how the browser uses the URL": the browser splits the URL into the protocol, the domain name and the path; it sends the domain name to a DNS server, which returns the matching IP address (a cache on the computer or at the ISP may answer first); it opens a connection to that IP address using the protocol (HTTPS on port 443); it sends a request for the path; and the web server returns the page, which the browser renders. If the DNS lookup fails, the browser reports that the server cannot be found.

A definition question is marked against fixed wording. Learn these exactly.

• Distinguish LAN vs WAN and client-server vs peer-to-peer by who stores and controls the resources.
• Match each topology (bus, star, mesh) to its advantages and drawbacks (cost, reliability, collisions).
• Know the job of each device: a switch directs within a LAN by MAC address, a router routes between networks by IP.
• Explain bit streaming and why buffering is needed (data arrives at a different rate from playback).
• Distinguish IPv4 vs IPv6 and public vs private addresses; DNS turns a URL into an IP address.

Common mistakes

• Saying a switch works by IP address. A switch forwards by MAC address inside the LAN; the router forwards by IP address between networks.
• Treating the internet and the World Wide Web as the same thing. The web is one service that runs over the internet; email and file transfer are others.
• Giving "faster" as the whole comparison of wired and wireless. Say faster and more reliable and more secure, and give the wireless side (mobility, no cabling) when the question asks for a comparison.
• Writing that a router finds the IP address for a URL. DNS does that; the router forwards packets to it.
• Describing IPv6 with dots and denary groups. Eight groups of four hexadecimal digits, separated by colons.
• Drawing a star topology as a ring or a chain. Every device has its own line to the switch in the middle.

A general-purpose computer has four building blocks:

• input devices 输入设备 — get data in (keyboard, mouse, microphone, scanner, sensors).
• output devices 输出设备 — give results out (monitor, speakers, printer, actuators).
• primary memory 主存储器 — fast memory the processor 处理器 (CPU) reaches directly (RAM and ROM). Holds the running program and its data.
• secondary storage 辅助存储器 — slower, larger, keeps programs and data when not in use (hard disk, SSD, optical disc, USB stick).

The syllabus asks why each is needed. Input devices are needed because the computer can only work on data and instructions that have been entered. Output devices are needed to present the results in a form people can use. Primary memory is needed because the processor can only execute instructions and use data that are held in memory it can address directly, and it must reach them fast. Secondary storage is needed because primary memory is volatile and small: programs and data must survive the power being switched off, in a larger and cheaper store, and removable storage lets data be moved between computers or kept as a backup.

An embedded system 嵌入式系统 is a computer built into another device to do one fixed job (washing machine, microwave, car engine unit, thermostat).

• benefits: optimised for one task, so it is small, uses little power and is cheap to make in volume; reliable, because it runs one fixed program with few chances to go wrong; starts quickly and needs no user set-up; easy to use through a simple interface.
• drawbacks: limited to its one task, so it cannot be upgraded to do more; hard to update (its firmware 固件 may need special tools or cannot be changed at all); difficult to troubleshoot, and usually the whole device must be replaced when it fails; if it is connected to a network it can be a security weakness, because its software is rarely patched.

A "describe the drawbacks" question wants each drawback as a full point: what the limitation is and what it means for the user, for example "the firmware cannot be updated, so a security fault found later cannot be fixed".

Laser printer

A laser printer 激光打印机 scans the page image onto a charged photosensitive drum 感光鼓. Toner 墨粉 sticks to the charged areas, transfers to the paper, and is melted on by a fuser. Fast, sharp, high-volume.

How it works, in the steps the mark scheme lists:

1. The data for the page is sent to the printer's buffer.
2. The drum is given a uniform electrostatic charge.
3. A laser, reflected off a rotating mirror, scans the page image onto the drum, removing the charge where it strikes, so the charge left on the drum matches the image.
4. Toner, a charged powder, is attracted to the charged parts of the drum only.
5. The paper is given the opposite charge and rolled against the drum, so the toner transfers onto it.
6. The fuser 定影器, a pair of heated rollers, melts the toner into the paper. The drum is then discharged and cleaned for the next page.

3D printer

A 3D printer 3D打印机 builds an object layer by layer: FDM melts plastic filament through a nozzle; stereolithography cures liquid resin with a UV laser. Used for prototypes and custom medical parts.

How it works:

1. A model of the object is designed in CAD software (or scanned).
2. Slicing software divides the model into thin horizontal layers and produces the instructions for each one.
3. The printer builds the object one layer at a time: an FDM printer melts plastic filament 塑料丝 and lays it down through a moving nozzle; a resin printer cures liquid resin with a laser or UV light; a powder printer fuses powder with a laser.
4. Each layer bonds to the layer below, and the platform (or nozzle) moves by one layer's thickness.
5. When the last layer is done, any support material is removed. Uses include prototypes, custom medical parts such as prosthetics, and spare parts printed on demand.

Microphone and speakers

A microphone 麦克风 turns sound into an electrical signal (a diaphragm vibrates, changing capacitor 电容器 charge or coil position); the signal is digitised by an analogue-to-digital converter 模数转换器 (ADC). A speaker does the reverse — a varying signal drives a coil in a magnetic field, moving a cone to make sound.

How a microphone works: sound waves make a diaphragm 膜片 vibrate; in a dynamic microphone a coil attached to the diaphragm moves in a magnetic field, so a varying current is induced in it, and in a condenser microphone the diaphragm is one plate of a capacitor whose capacitance changes as it moves; the varying analogue signal is then sampled by an ADC and stored as digital data. A speaker runs the chain backwards: a digital-to-analogue converter 数模转换器 (DAC) produces a varying current, the current in the coil creates a changing magnetic field that pushes against the permanent magnet, the coil and cone move in and out, and the cone's movement makes pressure waves in the air.

Magnetic hard disk (HDD)

A hard disk 硬盘 stores data on spinning platters coated with magnetic material. Each platter has tracks 磁道 divided into sectors 扇区. A read/write head 读写头 floats just above and magnetises tiny regions (write) or senses them (read). Cheap per gigabyte, but slower than SSDs and has moving parts.

How it works: the platters spin at high speed (thousands of revolutions per minute); each surface is divided into concentric tracks and each track into sectors; read/write heads on actuator arms 磁头臂 move across the platters to the right track; to write, the head magnetises a tiny region with one of two polarities, representing 0 or 1; to read, it detects the polarity as the region passes beneath it. The delays, waiting for the arm to reach the track and for the sector to spin round, are why a hard disk is slower than an SSD.

Solid-state (flash) memory

A solid-state drive 固态硬盘 stores data as charge in transistors 晶体管, with no moving parts. Faster random access than HDDs, tougher, lower power, but dearer per gigabyte; each cell wears out after many writes.

How it works: each cell is a floating-gate transistor 浮栅晶体管; a charge trapped on the floating gate represents a bit and stays there when the power is off; a controller chip maps each address to a cell and spreads writes across the cells, because a cell survives only a limited number of writes.

A "why a server uses hard disks rather than SSDs" question wants the left column: cheaper per gigabyte for very large capacities, a long life under constant rewriting, and easier data recovery.

Optical disc

A laser detects reflections from tiny pits on an optical disc 光盘 (CD, DVD, Blu-ray). The drive is an optical disc reader/writer: writing uses a stronger laser to change the surface's reflectivity.

How it works: the disc carries one long spiral track of pits 凹坑 and lands 平台 (the flat areas between them); the disc spins and a laser is focused on the track; light reflected from a land differs from light reflected at the edge of a pit, and a light sensor reads each change as a 1 and no change as a 0. Writing uses a stronger laser to change the reflectivity of a dye or alloy layer. A Blu-ray uses a blue laser with a shorter wavelength, so its pits are smaller and closer together, which is why it holds more data than a DVD.

Touchscreen

A touchscreen 触摸屏 senses contact. Resistive 电阻式: two conductive layers pressed together; works with anything but is less accurate. Capacitive 电容式: a finger disturbs a charge field; accurate, multi-touch, used in phones.

How it works: a resistive screen has two thin conductive layers separated by spacers; pressing pushes the top layer onto the bottom one, closing a circuit at that point, and the controller reads the voltage to find the coordinates. A capacitive screen has a glass layer coated with a transparent conductor that holds a charge; a finger touching it draws a tiny current, the current is measured at each corner, and the controller works out the touch position from the differences. Capacitive screens respond to a light touch and to several fingers at once, but not to a gloved finger or an ordinary stylus.

Virtual reality headset

A virtual reality 虚拟现实 (VR) headset has two small displays (one per eye) and motion sensors (accelerometer 加速度计, gyroscope 陀螺仪) that track head movement so the scene shifts as you look around.

How it works: each eye sees its own display through a lens, and the two images differ slightly, so the brain sees depth; sensors (accelerometer, gyroscope, sometimes cameras) report where the head is and which way it points; the computer re-renders the scene from that viewpoint many times a second, so turning the head turns the view; headphones give sound that matches the direction. Used for games, for training such as flight or surgery simulators, and for viewing designs before they are built.

A buffer 缓冲 is memory that holds data temporarily while it moves between devices of different speeds. Example: the CPU writes a document to a printer buffer quickly, then is free to do other work while the printer prints from the buffer at its own pace. Buffers stop the fast device waiting for the slow one (also used in streaming, the keyboard, and disk access).

"State why a 3D printer needs a buffer": the computer sends the print data much faster than the printer can build the layers, so the data is held in the buffer until the printer is ready for it, and the processor is freed to do other work. When the buffer runs low the printer sends an interrupt 中断 to ask for more (topic 4). A video stream works the same way: the buffer fills ahead of playback so a short drop in the network speed does not stop the picture.

• RAM 随机存取存储器 (Random Access Memory) — volatile 易失性 (loses data without power). Holds the OS, running programs and their data; read and written constantly.
• ROM 只读存储器 (Read-Only Memory) — non-volatile 非易失性 (keeps data without power). Usually written once; holds firmware needed at start-up (the BIOS / boot loader).

ROM starts the system; RAM then holds the active work.

More RAM lets a computer hold more programs and data at once, so it swaps less between memory and disk and runs faster; that is the answer to "explain why the computer with more RAM performs better".

• SRAM 静态RAM (Static RAM) stores each bit in a flip-flop 触发器 of several transistors. Fast, but expensive and not dense. Used for CPU cache 高速缓存.
• DRAM 动态RAM (Dynamic RAM) stores each bit as charge on a tiny capacitor. Cheaper and denser but slower, and must be refreshed 刷新 (rewritten) thousands of times a second. Used for main memory.

Use SRAM for small fast memory (cache); DRAM for large main memory.

"Explain why the embedded system uses DRAM": it needs a large amount of memory at low cost in a small space, and its speed requirement is modest, so the cheaper, denser DRAM is the right choice; SRAM is kept for the small cache where speed matters most.

ROM variants you can program after manufacture:

• PROM (Programmable ROM) — written once (fuses burned by a programmer); cannot be changed.
• EPROM (Erasable Programmable ROM) — erased by strong UV light through a window, then rewritten (whole chip at once).
• EEPROM (Electrically Erasable Programmable ROM) — erased and rewritten electrically, a byte at a time, in circuit. Flash memory is a derivative optimised for block erase.

"Give two differences between EPROM and EEPROM" wants two rows of this table, each stated for both types.

Both read sensors; the difference is what they do next.

• monitoring 监控 — collects and reports data but takes no action (a weather station logging readings).
• control system 控制系统 — uses sensor data to decide and act through actuators, usually in a feedback loop (a thermostat turning a boiler on/off).

The three-mark "describe the differences" answer: a monitoring system only measures, records or displays the readings, and at most raises a warning; a control system compares each reading with a preset value 预设值 and, if it is outside the range, sends signals to actuators that change the physical process; the change is then measured again, so a control system contains feedback and a monitoring system does not. Whether a given system is one or the other is decided by that test: a bridge system that measures a vehicle's height and switches on a warning sign is monitoring, because nothing it does changes the vehicle; a system that lowers a barrier is control.

Worked example. Describe how an automated system opens a door when a person is within 2 metres and closes it when nobody is.

An infra-red or ultrasonic sensor measures the distance to anything in front of the door; the analogue reading is converted to digital by an ADC and sent to the processor; the processor compares the distance with the preset 2 metres; if it is less, the processor sends a signal to the actuator (a motor) to open the door; the sensor keeps measuring, and when no reading below 2 metres is received the processor signals the motor to close the door. The repeated measuring after each action is the feedback that stops the door opening and closing at the wrong times.

Sensors and actuators

A sensor 传感器 turns a physical quantity into a signal: temperature (a thermistor 热敏电阻 or thermocouple), pressure (strain gauge), infra-red, sound. Analogue signals need an ADC first. An actuator 执行器 does the reverse — turns a signal into an action (a motor, valve, heater, buzzer).

Feedback

In a control system the actuator changes the environment, which the sensors then re-measure — a feedback 反馈 loop. Without feedback the system cannot correct itself or know when to stop (a thermostat with no temperature feedback would heat forever).

A logic gate 逻辑门 is a small circuit that does one Boolean 布尔 operation. Inputs and outputs are 0 (false, low) or 1 (true, high). Know the symbol, function and truth table 真值表 for each gate.

NOT (inverter)

AND — output 1 only if all inputs are 1

OR — output 1 if at least one input is 1

NAND (NOT AND) — output 0 only when all inputs are 1

NOR (NOT OR) — output 1 only when all inputs are 0

XOR (Exclusive OR, also called EOR) — output 1 if the inputs are different

A logic circuit 逻辑电路 is a network of gates that carries out a Boolean expression. You should be able to move between a problem statement, a logic expression, a truth table, and a circuit diagram.

The paper writes expressions in words, X = (A AND NOT B) OR (B AND C), and accepts the algebraic form $X = A\overline{B} + BC$ where a dot (or nothing) is AND, a plus is OR, and a bar is NOT. Use whichever the question uses.

From expression to circuit

Draw one gate per operator and wire them up. For $X = (A \text{ AND } B) \text{ OR } (\text{NOT } C)$: a NOT gate on $C$, an AND gate on $A$ and $B$, then an OR gate on the two results.

From circuit to expression

Work forwards from the inputs, labelling each gate's output, until you reach the final output.

Worked example. Write the expression for the circuit below, then complete its truth table.

Label the gate outputs: $P = A \text{ AND NOT } B$, $Q = B \text{ AND } C$, so $X = P \text{ OR } Q = (A \text{ AND NOT } B) \text{ OR } (B \text{ AND } C)$. Then give the truth table a column for each intermediate output, so every row can be checked one gate at a time:

Drawing a circuit from an expression is the same walk in reverse: start from the innermost brackets, draw one gate per operator, draw a NOT gate on the wire of any input that appears with NOT, keep the inputs on the left and the single output on the right, and label the output with its letter. Every line must end at a gate input or the output; a line that goes nowhere loses the mark.

From circuit to truth table

For $n$ inputs there are $2^{n}$ rows. List every input combination; for each, work out the internal gates then the output.

From truth table to expression (sum of products)

For each row that outputs 1, write an AND of the inputs (with NOT on any input that is 0 in that row); OR these together. Example: a table that is 1 only on $(A=0,B=1)$ and $(A=1,B=0)$ gives $\overline{A}B + A\overline{B}$, which is $A \text{ XOR } B$.

From a problem statement

Turn the English into a Boolean expression first: "A and B" → A AND B; "A or B or both" → A OR B; "exactly one of A and B" → A XOR B; "neither A nor B" → A NOR B; "not both" → A NAND B.

Worked example. A machine's alarm $X$ sounds when the guard is open ($A=1$) and either the motor is running ($B=1$) or the temperature is high ($C=1$). Write the Boolean expression, and give the rows where $X=1$. Turn the English into logic one clause at a time: "either B or C" is $B + C$, and "A and that" is $X = A\cdot(B + C)$. For the rows, $X=1$ needs $A=1$ and at least one of $B$, $C$ equal to 1 - so $(A,B,C) = (1,0,1)$, $(1,1,0)$ and $(1,1,1)$, three rows out of eight. Notice $A=0$ can never sound the alarm, whatever $B$ and $C$ do. Bracket the OR before ANDing it: $X = A\cdot B + C$ is a different circuit altogether, one that would sound the alarm on a high temperature even with the guard closed.

A definition question is marked against fixed wording. Learn these exactly, and give one answer only.

• Distinguish RAM (volatile, read/write) from ROM (non-volatile, holds the bootstrap); SRAM (cache, faster) from DRAM (main memory, needs refreshing).
• For a logic circuit, build the Boolean expression gate by gate, then a truth table covering every input combination.
• Learn the symbol, expression and truth table for each gate (AND, OR, NOT, NAND, NOR, XOR).
• Explain a buffer (a temporary store bridging two different speeds) and the role of an interrupt.

Common mistakes

• Naming the device instead of describing its operation. "It uses a laser" earns nothing; the steps (charge the drum, laser removes charge, toner attracted, transferred, fused) earn the marks.
• Saying a monitoring system "controls" something. If nothing changes the physical process, it is monitoring; add the actuator and the feedback and it becomes control.
• Writing that RAM "stores files permanently" or that ROM "stores the user's data". RAM is volatile working memory; ROM holds the fixed start-up instructions.
• A truth table with fewer than $2^{n}$ rows, or rows in a random order. Count in binary from 000 to 111 so no combination is missed.
• Drawing two lines from one output of a gate to be safe, or leaving a wire that ends nowhere. Draw exactly the connections the expression needs.

The Von Neumann architecture 冯·诺依曼体系结构 underlies almost every general-purpose computer:

• a single memory — the Immediate Access Store 立即存取存储器 (IAS) — holds both program instructions and data (the stored program 存储程序 concept).
• a processor 处理器 (CPU) fetches instructions from memory and runs them one at a time.
• instructions run in order unless a branch changes the flow.

The stored-program idea is what makes a computer flexible: change the program and you change what it does, with no rewiring.

All of these parts sit inside one small chip. The diagram later in this section shows how they connect; the photo below shows the real thing.

Arithmetic and Logic Unit (ALU)

The ALU 算术逻辑单元 does the arithmetic (add, subtract, …) and logic (AND, OR, comparisons). It takes operands from registers 寄存器 and puts results back in a register.

Control Unit (CU)

The control unit 控制单元 decodes each instruction and sends the control signals to carry it out — opening data paths, telling the ALU what to do, and controlling memory reads and writes.

System clock

The clock sends a steady stream of pulses that keep the CPU in step. Each instruction takes a fixed number of cycles, and the clock speed 时钟频率 (e.g. 3.8 GHz) is one factor in performance.

"Explain how the CU and the system clock work together": the clock emits pulses at a fixed frequency; the control unit uses each pulse to move the fetch-execute cycle on by one step, sending its control signals in time with the pulses, so every part of the processor changes state together. A faster clock means more steps per second, up to the point where the circuits cannot settle between pulses.

Registers

Registers are tiny, very fast stores inside the CPU. The special purpose registers 专用寄存器 each have a fixed job in the cycle:

• Program Counter 程序计数器 (PC) — the address of the next instruction.
• Memory Address Register 内存地址寄存器 (MAR) — the address being read or written.
• Memory Data Register 内存数据寄存器 (MDR) — the data going to or from memory.
• Current Instruction Register 当前指令寄存器 (CIR) — the instruction being decoded.
• Accumulator 累加器 (ACC) — the value the ALU is working on.
• Status Register 状态寄存器 — holds flags 标志 (carry, zero, negative, overflow) used by branches. Each flag is one bit, set or cleared by the ALU after an operation: the zero flag after a comparison that matched, the carry flag when an addition overflowed the register, the negative flag when a result is negative. A conditional jump reads the flags to decide whether to branch, and an overflow flag can raise an interrupt.
• Index Register 变址寄存器 — an offset added to an address in indexed addressing; incrementing it steps through an array one element at a time.

The "complete the table describing the role of each register" question wants one precise sentence per register in these terms: the PC holds the address of the next instruction to be fetched; the MAR holds the address of the location being read from or written to; the MDR holds the data or instruction just read from, or about to be written to, that location; the CIR holds the instruction currently being decoded and executed; the ACC holds the result of the last arithmetic or logic operation.

General-purpose registers 通用寄存器 are used by the programmer for temporary values during a calculation. Movements of data between registers and memory are written in register transfer 寄存器传送 notation — e.g. MAR ← [PC] ("copy the contents of PC into MAR").

Three internal buses 总线 (sets of parallel wires) connect the parts:

• address bus 地址总线 — carries the memory address. One-way (CPU → memory).
• data bus 数据总线 — carries the data. Two-way.
• control bus 控制总线 — carries control signals (read, write, interrupt). Two-way.

An $n$-bit address bus can reach $2^{n}$ memory locations. The data-bus width sets how many bits move per access (often the word size).

• clock speed — more cycles per second.
• number of cores 核心 — a multi-core CPU runs several threads at once.
• word size 字长 — a 64-bit CPU handles 64-bit chunks per cycle and can address far more memory than a 32-bit one.
• amount of RAM 随机存取存储器 — more RAM holds more of the working set; too little forces the OS to page 页 to disk.
• cache memory 高速缓存 size — more cache cuts average memory access time.
• secondary storage 辅助存储器 type — an SSD loads programs far faster than an HDD.
• bus width and speed — wider/faster buses move data more quickly.

Match the specs to the workload: a quad-core beats a dual-core on parallel work, but higher per-core speed wins on single-threaded work.

Each factor is a two-mark answer with a reason attached:

• More cores: each core can fetch and execute its own instruction at the same time, so several programs, or the threads of one program, run in parallel. But a program must be written to use more than one core, so doubling the cores does not double the speed.
• Higher clock speed: more fetch-execute cycles per second, so more instructions per second; the limit is the heat produced.
• Wider bus: a wider data bus moves more bits in each transfer, so fewer transfers are needed for the same data; a wider address bus can address more memory locations.
• Cache memory: a small, fast memory inside or next to the processor that keeps the instructions and data used most recently or most often. Reading them from cache is much faster than from RAM, so the processor spends less time waiting.

"Explain why the new computer performs better" is answered by comparing the two specifications line by line: a higher clock speed executes more instructions per second, more cores run more tasks at once, more cache means fewer slow accesses to RAM, and more RAM means fewer transfers to disk.

A port 端口 is a physical socket for connecting a peripheral 外围设备:

• USB (Universal Serial Bus) — general-purpose (keyboards, drives, phones).
• HDMI (High Definition Multimedia Interface) — digital video and audio to a screen.
• VGA (Video Graphics Array) — older analogue video output to a monitor.
• Ethernet (RJ-45) — wired LAN. Audio jacks — headphones/microphone.

Different ports use different signals, so an HDMI cable will not fit a USB socket. USB-C is unusual in carrying video, data and power.

"Explain how the computer connects to the monitor through HDMI": the HDMI port sends the video and the audio as one digital signal down a single cable, so no conversion to analogue is needed and the picture is not degraded; the cable carries high-definition resolutions and the monitor's own port decodes the signal. A USB device is plug-and-play: when it is connected the computer detects it, identifies it, loads or installs the driver it needs, and can supply it with power, all without a restart.

The CPU repeats the fetch-execute cycle 取指-执行周期, one run per machine instruction.

Fetch

1. the PC's address is copied to the MAR.
2. the PC is incremented to point to the next instruction.
3. a read signal goes over the control bus.
4. memory puts the instruction on the data bus.
5. it is copied into the MDR, then into the CIR.

The exam asks for these steps in register transfer notation 寄存器传送记法, where [X] means the contents of register X and [[MAR]] means the contents of the memory location whose address is in the MAR:

MAR ← [PC]          the address of the next instruction goes to the MAR
PC  ← [PC] + 1      the PC now points to the following instruction
MDR ← [[MAR]]       the instruction at that address is read into the MDR
CIR ← [MDR]         the instruction is copied into the CIR for decoding

The order matters: the PC is incremented straight after its address has been copied, so that a jump executed later can still overwrite it. During execution the same notation describes each instruction; for LDD 200, for example, MAR ← 200, MDR ← [[MAR]], ACC ← [MDR].

Decode

The CU decodes the instruction in the CIR — what operation, and which operands or addresses.

Execute

The CU carries it out: arithmetic/logic goes to the ALU (result to the ACC); a load/store moves data between memory and a register; a branch changes the PC. Then the cycle repeats.

An interrupt 中断 is a signal that pauses the normal cycle so the CPU can handle an urgent event (a key press, a packet arriving, a hardware fault, division by zero, the OS timer).

Handling one:

1. finish the current instruction.
2. save the state (PC and registers).
3. load the address of the interrupt service routine 中断服务程序 (ISR) into the PC and run it.
4. the ISR handles the event.
5. restore the saved state and carry on.

Interrupts let the system respond promptly without the CPU constantly checking devices, and are how the OS multitasks.

"Explain how an interrupt from an input device is detected and handled in the F-E cycle" is a four-mark answer with these points: the device sends an interrupt signal that sets the interrupt flag in the interrupt register 中断寄存器; the processor checks that register at the end of every fetch-execute cycle, after the current instruction has finished executing; if a flag is set and the interrupt has a higher priority than the current task, the contents of the PC and the other registers are saved onto the stack 栈; the address of the interrupt service routine is loaded into the PC and the routine runs; when it finishes, the saved values are restored from the stack and the interrupted program continues from where it stopped.

Causes worth naming: a hardware interrupt from a device (a key pressed, a printer buffer empty, a network packet arriving), a software interrupt from a fault (division by zero, an illegal instruction, arithmetic overflow), a timer interrupt from the operating system marking the end of a time slice, and a power failure warning.

The CPU actually runs machine code 机器码 — bit patterns, specific to one architecture. Assembly language 汇编语言 is a readable form, with one instruction per machine instruction, written using mnemonics 助记符 like LDD, ADD, JMP. An assembler 汇编器 translates it to machine code.

Two-pass assembler

A two-pass assembler reads the source twice:

• pass 1 builds a symbol table 符号表: each time a label 标签 (like LOOP:) appears, record its address; no code yet.
• pass 2 generates code: translate each instruction, and when one refers to a label (like JMP LOOP), look up its address in the symbol table.

Two passes handle forward references 前向引用 (a jump to a label defined later).

Worked example. Apply the two-pass process to this program, whose first instruction is stored at address 100.

        LDD  COUNT
LOOP:   DEC  ACC
        CMP  #0
        JPN  LOOP
        END
COUNT:  5

Pass 1 reads each line, counts the address it will occupy, and records every label in the symbol table: LOOP = 101 (the DEC line) and COUNT = 105 (the data line). No code is produced. Pass 2 reads the program again and translates each line into machine code, replacing each mnemonic by its opcode 操作码 and each symbolic address by the number from the symbol table: LDD COUNT becomes the opcode for LDD with operand 操作数 105, and JPN LOOP becomes the opcode for JPN with operand 101. The jump back to LOOP could have been resolved in one pass, but a jump forward to a label not yet seen could not, which is why the assembler makes two.

Example instruction set

Cambridge uses a small generic set, printed in the paper's reference table, with one general-purpose register, the accumulator (ACC), and an index register (IX). An operand written #n is a denary number, Bn a binary number and &n a hexadecimal number; <address> is a location number or a label.

The "assembly language instructions are grouped" question wants the group names, and an instruction from each: data movement, input and output, arithmetic, unconditional and conditional jumps, compare, and bit manipulation.

The addressing mode 寻址方式 (the modes of addressing) says how the CPU finds the operand:

• immediate addressing 立即寻址 — the operand is the value in the instruction. LDM #10 loads 10.
• direct addressing 直接寻址 — the instruction holds an address; the operand is the value there. LDD 200.
• indirect addressing 间接寻址 — the instruction holds an address that holds another address, which is the data. LDI 200.
• indexed addressing 变址寻址 — effective address is address + index register; used for arrays. LDX 100 with IR = 5 reads address 105.

(Relative addressing 相对寻址 gives the address as an offset from the PC — used for jumps.)

Worked example. Memory holds: location 200 = 250, location 250 = 99, location 105 = 7. The index register holds 5. What is in the accumulator after each of LDM #200, LDD 200, LDI 200 and LDX 100? Follow how far each mode has to look. LDM #200 is immediate - the operand is the number written in the instruction, so the accumulator holds 200. LDD 200 is direct - go to location 200 and take what is there: 250. LDI 200 is indirect - location 200 holds 250, which is another address, so go on to location 250: 99. LDX 100 is indexed - add the index register to the address, $100 + 5 = 105$, and read location 105: 7. Count the hops to keep them apart: immediate 0, direct 1, indirect 2, indexed 1 (once the index has been added).

To trace it: make a table with columns for the PC, ACC, index register, each variable and any flags. Step through the instructions, updating the table after each; follow branches when they change the PC; stop at END. A common pattern is a loop over an array using indexed addressing.

Worked example. Trace this program. Address 200 holds 5 and address 201 holds 0.

100   LDD  200
101   CMP  #0
102   JPE  108
103   OUT
104   DEC  ACC
105   STO  200
106   LDD  201
107   JMP  100
108   END

Write one row for each instruction executed, filling in only the columns that change:

and so on, until LDD 200 loads 0, the compare sets the equal flag, JPE 108 is taken and the program ends. Three things the examiner checks: a CMP changes no register, only a flag; a jump not taken still counts as executed; and OUT outputs a character, so it goes in the output column, not the ACC column. "State the effect of changing LDD 10 to LDM #10": the ACC would hold the number 10 instead of the contents of address 10.

A logical shift 逻辑移位 moves all the bits left or right by some places, filling new positions with 0.

• left shift by 1 (LSL #1) — bits move left, a 0 enters on the right; for an unsigned number this is × 2.
• right shift by 1 (LSR #1) — bits move right, a 0 enters on the left; for an unsigned number this is integer ÷ 2.

Shifting by $n$ places multiplies or divides by $2^{n}$. Example: 00001011 (11) LSL #1 → 00010110 (22).

Bits shifted off the end are lost, so the multiplication is only correct while they were zeros. LSL #2 on the two's-complement integer 11001010 gives 00101000: the two 1s that fell off the left are gone, the sign bit has changed, and the result is no longer four times the original.

An arithmetic right shift keeps the sign bit so a negative signed number stays negative. A cyclic shift 循环移位 (rotate) feeds the bit that drops off one end back in at the other end, so no bits are lost.

"Show the result of an arithmetic right shift of 3 places on 10011110": copy the sign bit into each vacated place, 11110011. The same shift on 01011100 gives 00001011. A cyclic left shift of 1 on 10000110 gives 00001101: the leading 1 reappears on the right.

The difference between the two right shifts is a single bit. Take 11110000, which is 240 read as unsigned and $-16$ read as signed. LSR #1 brings in a 0 and gives 01111000 $= 120$, which is the correct half of 240. ASR #1 copies the sign bit instead and gives 11111000 $= -8$, which is the correct half of $-16$. Neither is wrong — each halves the value under one reading.

Bit manipulation for monitoring/control

Embedded devices often use one bit 位 of a register per signal (e.g. bit $n$ = LED $n$). Using a mask 掩码 — bit masking — you can:

• set bit $n$: R = R OR a mask with bit $n$ set.
• clear bit $n$: R = R AND a mask with bit $n$ clear and the rest set.
• toggle bit $n$: R = R XOR a mask with bit $n$ set.
• test bit $n$: R AND the mask, then check if the result is non-zero.

Bit manipulation is fast, uses little memory, and lets one byte hold up to 8 on/off states.

In the exam's instruction set these are AND, OR and XOR with a mask written as a denary, binary or hexadecimal operand. With the ACC holding 10101100:

"Write the instruction that sets the least significant bit to 1 and leaves the others unchanged": OR #1, or OR B00000001. To clear a bit use AND with a mask that has a 0 in that place and 1s elsewhere; to test a bit, AND with a mask that has a 1 only in that place, then compare the result with zero. In a monitoring device, one bit of a register per sensor lets a single AND check whether a particular sensor is on, and one OR switches an actuator's control bit on without disturbing the others.

A definition question is marked against fixed wording. Learn these exactly, and give one answer only.

• Learn the fetch-execute cycle in register-transfer terms (PC, MAR, MDR, CIR, ACC) and what increments the PC.
• Name each register's job; the address bus is one-way, the data bus is two-way.
• Distinguish the addressing modes (immediate, direct, indirect, indexed) — a frequent question.
• Explain how clock speed, number of cores, cache size and word length affect performance.
• For a binary shift, state whether it is logical or arithmetic; a left shift multiplies by 2, a right shift divides by 2.

Common mistakes

• Saying the PC holds the current instruction, or the MDR holds an address. The PC holds the address of the next instruction; the MDR holds data or an instruction, never an address.
• Leaving the increment of the PC out of the fetch, or putting it after the execute. It happens as soon as the address has been copied to the MAR.
• Reading LDD 10 as "load 10". LDD 10 loads the contents of address 10; LDM #10 loads the number 10.
• Putting a value in the ACC column for CMP or OUT. A compare sets a flag only; an output goes to the output column.
• Saying an interrupt is handled "immediately". The processor finishes the current instruction and checks for interrupts at the end of the cycle.
• Using a logical right shift on a negative two's-complement number. Only an arithmetic shift keeps the sign bit.

Why a computer needs an OS

Hardware on its own can only fetch and run instructions — it knows nothing about files, programs, networks or users. The operating system 操作系统 (OS) is the software layer that:

• manages the hardware (processor 处理器, memory, I/O, storage) for the running programs.
• provides services (file system, network, user accounts) through a clear interface, so programs need not talk to the hardware directly.
• provides a user interface (command line, GUI, touch).
• lets several programs share the hardware safely — each gets fair CPU time and is kept out of the others' memory.

Without an OS, every program would need its own drivers, and only one program could safely run at a time.

Key management tasks

• process management 进程管理 — load programs, schedule them on the CPU, switch between them, and kill misbehaving ones. (A running program is a process 进程.)
• memory management 内存管理 — give memory to processes, keep them apart, and use virtual memory 虚拟内存 / paging 分页 so the working set can exceed physical RAM 随机存取存储器.
• file management — organise files and folders on secondary storage 辅助存储器, control permissions, prevent write corruption.
• device management (hardware management) — handle I/O and peripherals through device drivers 设备驱动, buffer data, manage interrupts, and give a uniform interface.
• security management — accounts, permissions, firewall, encryption.
• user interface and networking.

Utility software

Most OSes include utility programs 实用程序 to maintain the system:

• disk formatter — a file / disk management tool that prepares a disk (sets up its file system); related tools copy, move and delete files.
• defragmentation software (disk defragmenter 碎片整理) — moves the pieces of fragmented files together on a hard disk to cut seek time (not useful on SSDs).
• disk contents analysis / disk repair software — check disk integrity and fix file-system errors and bad sectors.
• back-up software (backup 备份) — copies user data elsewhere so it can be recovered.
• virus checker (antivirus 杀毒软件) — scans for malware and quarantines threats.
• firewall 防火墙 — filters network traffic by rules.
• file compression (compression 压缩) / archiving; system monitor; updates.

Bundling these with the OS saves the user installing each one.

A program library 程序库 is pre-written code (subroutines 子程序, classes, modules) that programs reuse instead of writing it themselves — e.g. a maths library, a network library, a graphics library.

Benefits: saves time (off-the-shelf code), reliable (well-tested, widely used), and standardised (consistent behaviour).

• a static library 静态库 is copied into the executable at compile time (stands alone, but larger and needs rebuilding to update).
• a dynamic library 动态库 (DLL, Dynamic Link Library; .so) is loaded at run time (smaller executables, shared by many programs, updated once for all).

You write source code; the computer runs machine code 机器码. A translator 翻译器 converts between them.

Assembler

An assembler 汇编器 translates assembly language 汇编语言 into machine code, one instruction per instruction. Used for low-level code (embedded systems, drivers).

Compiler

A compiler 编译器 translates a high-level program into machine code once, before it runs.

• it reports all errors at compile time; once clean, it produces a stand-alone executable 可执行文件 that runs without the compiler installed and can be run many times.
• generally faster at run time (no translation while running), but tied to one CPU/OS — recompile for each platform.

Interpreter

An interpreter 解释器 translates and runs a high-level program one line at a time, producing no executable.

• it reports an error when it reaches that line, then stops; you can fix it and continue — good for development.
• the interpreter must be installed to run the program; generally slower (each run re-translates), but easy to port across platforms.

Choosing between them

Hybrid: Java

Java is compiled into bytecode 字节码 (a platform-independent intermediate form), which a virtual machine 虚拟机 (the JVM) then interprets — or uses just-in-time compilation 即时编译 to turn hot parts into native code. So errors are caught early, the bytecode runs anywhere with a JVM ("write once, run anywhere"), and long-running programs reach near-native speed. C# and Python use similar designs.

Worked example. Java source is compiled to bytecode, which a JVM then interprets. Why use both, instead of compiling straight to machine code? A compiler produces machine code for one processor and operating system, so a program compiled on one machine will not run on another. Java's compiler instead targets a virtual machine, so the bytecode it produces is identical everywhere; each platform then supplies its own JVM to interpret that bytecode into its own native instructions. One compiled file therefore runs anywhere a JVM exists - "write once, run anywhere". The price is speed: interpreting bytecode is slower than running native code, which is why a real JVM also uses JIT compilation to turn frequently-run bytecode into native code while the program runs. Name both sides - the marks are for portability bought at the cost of speed.

An integrated development environment 集成开发环境 (IDE) brings the tools to write, test and debug code into one application:

• source code editor with syntax highlighting 语法高亮 (keywords, strings, comments in different colours), auto-indent and bracket matching.
• auto-complete 自动补全 — suggests names and shows function parameters as you type.
• translator integration — compile/run with one keystroke; errors shown inline.
• debugger 调试器 — set breakpoints 断点 to pause, step through line by line, and inspect variables.
• version control 版本控制 integration (git), project management, a help system, refactoring 重构 tools (safe renaming), and unit test 单元测试 integration.

An IDE speeds development by putting writing → running → debugging → fixing behind one interface. Common IDEs: Visual Studio, PyCharm, Eclipse, VS Code.

• List the OS's jobs (memory, process, file, device and security management) — "manages resources" alone is too vague.
• Compare compiler vs interpreter vs assembler: what each translates and when errors are reported.
• Explain what an IDE provides (editor, debugger, error diagnostics, auto-complete).

These sound alike but mean different things:

• security 安全 — protecting data from unauthorised 未授权 access, change or destruction.
• privacy 隐私 — an individual's right to control who sees their personal data, with consent and a clear purpose.
• integrity 完整性 — the data being accurate and complete — not corrupted or accidentally changed.

A file can be secure (only the right people can open it) but lack integrity (a typo corrupted it); or accurate but not private (anyone can read it). All three are needed.

The differences the scheme wants, one sentence each: security is keeping the data safe from loss and from unauthorised access; privacy is keeping the data confidential, so that only those with the right to see it can; integrity is the data being correct, consistent and complete. So "the difference between security and privacy": security is about protecting the data from being accessed, changed or lost by people who should not; privacy is about the individual's right to decide who may see their personal data. "The difference between security and integrity": security protects the data from unauthorised access; integrity is about the data being accurate and up to date, which validation and verification protect.

Two things to protect: the data itself (keep it confidential, intact and available) and the computer system (a compromised system can attack others, steal credentials, or be held to ransom).

"Why does the school need to keep both secure?" Data: it is personal and confidential, so it must not be read, changed or deleted by an unauthorised person, and its loss would stop the school working. System: an intruder who reaches the computer system can install malware, use it to attack other systems, damage the hardware or software, or lock it with ransomware; a secure system is the first line of defence for the data on it.

Threats fall into three groups.

1. Malware 恶意软件 (malicious software) — harmful programs:

• virus 病毒 — self-copying code that attaches to other programs and spreads when they run.
• worm 蠕虫 — self-copying code that spreads over networks 网络 with no user action.
• Trojan horse 木马 — looks useful but hides malicious code.
• spyware 间谍软件 — secretly collects information (keystrokes, passwords).
• ransomware 勒索软件 — encrypts your files and demands payment.
• adware 广告软件 — pushes unwanted adverts.

2. Tricking people (social attacks):

• phishing 网络钓鱼 — fake emails/sites that trick users into giving credentials.
• pharming 域名欺骗 — redirects a user to a fake site even when they type the correct address.
• social engineering 社会工程 — tricking people into giving up information.

The scheme's descriptions of the four named threats: a virus is malicious software that replicates (copies itself), attaches itself to other files and deletes or corrupts data; spyware is malicious software that records the user's key presses and actions and sends them to a third party, to obtain passwords and personal data; a phishing email pretends to come from a legitimate organisation and contains a link to a fake website where the user is asked for personal or bank details; pharming is malicious code installed on the user's computer or on a web server that redirects the user to a fake website even though they typed the correct address. Similarities of spyware and a virus: both are malware, both are installed without the user's knowledge, both can send data to a third party or damage the system; the difference is that a virus replicates itself while spyware records and transmits information. Phishing and pharming both lead the user to a fake website that collects their data; phishing needs the user to click a link in an email, pharming works through code on the computer or the DNS server and needs no email.

3. Attacks on the network:

• hacking 黑客入侵 by hackers 黑客 — unauthorised access, often via weak passwords or software flaws.
• denial of service 拒绝服务 (DoS/DDoS) — floods a server so real users cannot reach it.
• eavesdropping 窃听 — capturing data in transit (a risk on open Wi-Fi).
• man-in-the-middle 中间人攻击 — an attacker secretly relays or alters messages between two parties.

Worked example. Identify and describe two threats to the data on a school network, and give a different prevention method for each.

Threat 1, malware: a virus copied onto a computer from an email attachment or a download replicates itself and corrupts or deletes files; prevention: anti-virus software that scans files and is kept up to date. Threat 2, hacking: an unauthorised person gains access to the network, for example by guessing a weak password, and reads or changes the data; prevention: a firewall that blocks unauthorised connections, or strong passwords with two-factor authentication. A third pair, phishing: an email leads a user to a fake site that collects their login; prevention: training users to check the sender and the URL, and filtering email. The measure must match the threat: encryption does not stop a virus, and anti-virus software does not stop phishing.

Measures protect both the security of data (against loss, theft or corruption) and the security of the computer system (its hardware, software and network).

A standalone PC

• a strong password; antivirus kept up to date; prompt software updates; backup 备份 to separate media; full-disk encryption 加密; a locked screen.

A networked PC

All the above, plus a firewall 防火墙, per-user permissions (admin rights only for admins), central management of user accounts 用户账户, and audit logs 审计日志 (who logged in, what they touched).

How the measures work, in the wording the scheme awards:

• firewall: examines every incoming and outgoing transmission and compares it with set criteria (a whitelist or blacklist of addresses, ports and protocols); blocks any that do not meet the criteria; can prevent access to certain sites and warn of unauthorised access attempts.
• encryption: the data is scrambled (encoded) with a key into ciphertext, so an intercepted copy cannot be understood without the key; the receiver uses a key to decrypt it. It protects data in transmission and in storage, but it does not stop the data being intercepted or deleted.
• passwords and user accounts: only a user who knows the password can log in; a strong password (long, mixed characters, changed regularly) cannot be guessed; accounts lock after repeated failures; each account carries its own access rights.
• anti-virus and anti-spyware software: scans files and programs against a database of known malware signatures, checks behaviour, quarantines or deletes what it finds, and must be updated so that new malware is recognised.
• access rights: each user (or group) is given permissions for each file or table, such as read-only or read and write, so a user cannot see or change data that is not theirs; a database can also present each user with a view containing only the fields they need.
• biometrics: the device captures an image of the face, fingerprint or iris, converts it to digital data, compares it with the stored data for that user and allows access only on a match; it cannot be forgotten, lent or guessed like a password.
• backups: a copy of the data on separate media, kept off-site, so that lost or corrupted data can be restored.

To restrict the risks of malware, in three marks: install anti-malware software and keep it updated; use a firewall; do not open attachments or download files from unknown sources; keep the operating system and applications patched; and train users.

Across the internet

• VPN 虚拟专用网 — encrypts traffic between the user and the corporate gateway.
• HTTPS / TLS — encrypt web traffic.
• digital signatures 数字签名 — prove who sent a message and that it was not altered in transit.
• intrusion detection — watches traffic for known attack patterns.

How a digital signature authenticates a document (five marks): the sender puts the message through a hash function to produce a digest; the sender encrypts the digest with their private key, and that encrypted digest is the digital signature; the message and the signature are sent together; the receiver decrypts the signature with the sender's public key to recover the digest; the receiver hashes the received message and compares the two digests; if they match, the message came from the sender (only they hold the private key) and was not altered in transmission. A signature proves who sent the message and that it is intact; it does not hide the contents, which is what encryption of the message is for.

• interception in transit → encrypt the data (HTTPS, VPN). Intercepted ciphertext is useless without the key.
• unauthorised access → strong authentication 身份验证 (long passwords; two-factor authentication 双因素认证 with a phone code or key); user authorisation 授权; lock-out after failed logins.
• malware → anti-virus software and anti-spyware 反间谍软件 with real-time scanning; patching; avoid untrusted downloads.
• phishing → user training; email filtering; check the URL before entering credentials.
• internal threats → the least-privilege 最小权限 principle (give each user only what they need); auditing.
• DDoS → rate limiting and traffic filtering.

For confidential data crossing the internet, the scheme's method is encryption: the data is encoded with a key into ciphertext, so that an unauthorised person who intercepts it cannot read it, and only the intended receiver, who has the key, can decode it. For a program file sent by email for testing, the same answer applies (encrypt the file, or send it over an encrypted connection), together with a password on the file itself.