Hybrid dual-duplex fail-operational pattern and generalization to arbitrary number of failures
First Claim
1. A dual-duplex fail-operational control system comprising:
- a primary controller controlling features of devices while operating under non-fault operating conditions, the primary controller comprising;
a first processing unit executing a function utilizing an input data from sensing devices to generate a function result;
a second processing unit simultaneously executing the function utilizing the input data from sensing devices to generate a function result;
a first comparative module comparing the function result from the first processing unit with the function result from the second processing unit to determine whether an error is present in the primary controller, wherein the first comparative module generates a matching function result when the function result from the first processing unit substantially matches the function result from the second processing unit;
a second controller comprising;
a first processing unit executing the function utilizing the input data from sensing devices to generate a function result;
a second processing unit operating in a non-redundant state, the second processing unit not executing the function while in the non-redundant state;
a second comparative module determining whether an error is present in the second controller;
wherein the matching function result identified by the first comparative module of the primary controller is input to the second comparative module of the second controller, wherein the second comparative module determines whether an error is present in the second controller utilizing only the matching function result identified by the first comparative module and the function result determined by the first processing unit of the second controller; and
designating the second controller as a reconfigured primary controller to control the features of the devices when an error is detected in the primary controller, wherein the first processing unit and the second processing unit of the second controller are each enabled to respectively execute the function utilizing the input data from the sensing devices to generate a respective function result so that the second comparative module may compare the respective function results to determine whether an error is present in the second controller.
1 Assignment
0 Petitions
Accused Products
Abstract
A modified dual-duplex fail-operational control system. A primary controller includes a first processing unit and a second processing unit for executing a function. A first comparative module comparing the function results from the first and second processing unit to determine an error the first controller. A second controller includes a first processing unit and second processing unit. The first processing unit executes the function. The second processing unit operating in a non-redundant state and not executing the function while in the non-redundant state. A second comparative module determines whether an error is present in the second controller. A matching function result identified by the first comparative module of the first controller is input to second comparative module of the second controller to determine whether an error is present in the second controller utilizing only the matching function result identified by the first comparative module and the function result determined by the first processing unit of the second controller.
-
Citations
20 Claims
-
1. A dual-duplex fail-operational control system comprising:
-
a primary controller controlling features of devices while operating under non-fault operating conditions, the primary controller comprising; a first processing unit executing a function utilizing an input data from sensing devices to generate a function result; a second processing unit simultaneously executing the function utilizing the input data from sensing devices to generate a function result; a first comparative module comparing the function result from the first processing unit with the function result from the second processing unit to determine whether an error is present in the primary controller, wherein the first comparative module generates a matching function result when the function result from the first processing unit substantially matches the function result from the second processing unit; a second controller comprising; a first processing unit executing the function utilizing the input data from sensing devices to generate a function result; a second processing unit operating in a non-redundant state, the second processing unit not executing the function while in the non-redundant state; a second comparative module determining whether an error is present in the second controller; wherein the matching function result identified by the first comparative module of the primary controller is input to the second comparative module of the second controller, wherein the second comparative module determines whether an error is present in the second controller utilizing only the matching function result identified by the first comparative module and the function result determined by the first processing unit of the second controller; and designating the second controller as a reconfigured primary controller to control the features of the devices when an error is detected in the primary controller, wherein the first processing unit and the second processing unit of the second controller are each enabled to respectively execute the function utilizing the input data from the sensing devices to generate a respective function result so that the second comparative module may compare the respective function results to determine whether an error is present in the second controller. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A method of minimizing software backups in a dual-duplex pattern approach, the method comprising the steps of:
-
executing a function simultaneously in a first processing unit and a second processing unit of a primary controller utilizing an input data from sensing devices, the primary controller controlling features of devices while operating under non-fault operating conditions; comparing, by a comparative module of the primary controller, a function result from the first processing unit with a function result from the second processing unit to determine whether an error is present in the primary controller; executing the function in a first processing unit of a second controller utilizing the input data from sensing devices, wherein a second processing unit of the second controller operates in a non-redundant state, the second processing unit not executing the function while in the non-redundant state; inputting a matching function result identified by the first comparative module to a second comparative module in the second controller; comparing, by the comparative module of the second controller, the function result from the first processing unit of the second controller with the matching function result from the first comparative module; and determining, by the second comparative module, whether an error is present in the second controller utilizing only the matching function result identified by the first comparative module and the function result determined by the first processing unit of the second controller; and designating the second controller as a reconfigured primary controller to control the features of the devices when an error is detected in the primary controller, wherein the first processing unit and the second processing unit of the second controller are each enabled to respectively execute the function utilizing the input data from the sensing devices to generate a respective function result so that the second comparative module may compare the respective function results to determine whether an error is present in the second controller. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18)
-
-
19. A dual-duplex fail-operational control system comprising:
-
a primary controller including a first processing unit and a second processing unit, the first processing unit and the second processing unit operable to simultaneously execute a function utilizing an input data from sensing devices to generate a respective function result, wherein the primary controller further includes a first comparative module operable to compare the respective function result from the first and second processing units to determine an error in the primary controller; a second controller including a first processing unit and second processing unit, the first processing unit operable to execute the function, the second processing unit operable to operate in a non-redundant state and not execute the function while in the non-redundant state, wherein the primary controller further includes a second comparative module operable to determine whether an error is present in the second controller; wherein a matching function result identified by the first comparative module of the primary controller is input to the second comparative module of the second controller to determine whether an error is present in the second controller utilizing only the matching function result identified by the first comparative module and the function result determined by the first processing unit of the second controller; and designating the second controller as a reconfigured primary controller to control the features of the devices when an error is detected in the primary controller, wherein the first processing unit and the second processing unit of the second controller are each enabled to respectively execute the function utilizing the input data from the sensing devices to generate a respective function result so that the second comparative module may compare the respective function results to determine whether an error is present in the second controller. - View Dependent Claims (20)
-
Specification