Providing failover control on a control system

• US 10,169,175 B2
• Filed: 04/11/2016
• Issued: 01/01/2019
• Est. Priority Date: 04/30/2015
• Status: Active Grant

• Current Assignee: GE Aviation Systems LLC (GE Aerospace)
• Original Assignee: GE Aviation Systems LLC (GE Aerospace)
• Inventors: Lassini, Stefano A. M., Theriault, Timothy John, Darnell, Mark Lawrence
• Primary Examiner(s): Wilson, Yolanda L
• Application Number:
  US15/095,285
• Publication Number:
  US 20160321148A1
• Time in Patent Office: 995 Days
• CPC Class Codes: B64C 13/505 having duplication or stand-by provisions
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/1645 and the comparison itself uses redundant hardware
• CPC Class Codes: G06F 11/184 where the redundant components implement processing functionality
• CPC Class Codes: G06F 11/2025 using centralised failover control functionality
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare
• CPC Class Codes: G06F 11/2033 switching over of hardware resources
• CPC Class Codes: G06F 11/2041 with more than one idle spare processing component
• CPC Class Codes: G06F 11/2043 where the redundant components share a common memory address space
• CPC Class Codes: G06F 2201/805 Real-time
• CPC Class Codes: G07C 5/0808 Diagnosing performance data testing of vehicles G01M17/00; testing of electrical installation on vehicles G01R31/005

Abstract

Systems and methods for providing failover control in a control system are provided. For instance, a data stream from a plurality of computing nodes in a computing system can be monitored. A first subset of computing nodes can be selected based on the data streams. Control grant signals can be generated for each computing node of the first subset. An output to one or more computing nodes of the first subset can be activated based at least in part on a number of control grant signals generated for each computing node of the first subset. Control authority can then be granted to the one or more computing nodes of the first subset.

Claims

1. A method of providing failover control in a computing system, the method comprising:

monitoring a data stream generated by a plurality of computing nodes in a computing system; and

selecting a first subset of the plurality of computing nodes based at least in part on the monitored data stream;

generating one or more control grant signals for each computing node of the first subset;

determining that the one or more control grant signals for one or more of the computing nodes in the first subset satisfies a predetermined threshold;

in response to determining the one or more control grant signals for one or more of the computing nodes in the first subset satisfies the predetermined threshold, granting control authority of the computing system to the one or more computing nodes of the first subset;

subsequent to granting control authority of the computing system to the one or more computing nodes of the first subset, identifying at least one control capable computing node that has not been granted control authority of the computing system; and

selecting the at least one control capable computing node as a second subset of the plurality of computing nodes.

2. The method of claim 1, wherein selecting a first subset of the plurality of computing nodes comprises:

identifying a valid data stream from one or more computing nodes of the plurality of computing nodes;

providing a control request signal to the one or more computing nodes of the plurality of computing nodes;

receiving a control ready signal from at least one computing node of the one or more computing nodes of the plurality of computing nodes; and

selecting the at least one computing node as the first subset of computing nodes.

4. The method of claim 1, wherein identifying at least one control capable computing node comprises identifying a valid data stream from at least one computing node that has not been granted control authority of the computing system.

5. The method of claim 1, further comprising:

detecting an invalid data stream from a computing node that has been granted control authority of the computing system;

removing the control authority of the computing system from the computing node corresponding to the invalid data stream; and

granting control authority of the computing system to a computing node from the second subset.

6. The method of claim 1, further comprising:

receiving a signal from a computing node that has been granted control authority of the computing system indicative of a request to relinquish control authority;

removing the control authority of the computing system from the computing node;

granting control authority of the computing system to a computing node from the second subset.

7. The method of claim 5, further comprising resetting the computing node corresponding to the invalid data stream.

8. The method of claim 7, further comprising:

subsequent to resetting the computing node, identifying a valid data stream from the reset computing node; and

adding the computing node to the second subset.

9. The method of claim 7, further comprising receiving a request from at least one additional computing node to reset the computing node corresponding to the invalid data stream;

and

wherein resetting the computing node comprises resetting the computing node based at least in part on the request from the at least one additional computing node.

10. The method of claim 1, wherein each monitored data stream comprise a continuous, serial data stream determined in accordance with one or more predetermined algorithms.

11. The method of claim 1, wherein the computing system comprises an avionics computing system associated with an aircraft.

3. A method of providing failover control in a computing system, the method comprising:

monitoring a data stream generated by a plurality of computing nodes in a computing system; and

selecting a first subset of the plurality of computing nodes based at least in part on the monitored data stream;

generating one or more control grant signals for each computing node of the first subset;

determining that the one or more control grant signals for one or more of the computing nodes in the first subset satisfies a predetermined threshold; and

in response to determining the one or more control grant signals for one or more of the computing nodes in the first subset satisfies the predetermined threshold, granting control authority of the computing system to the one or more computing nodes of the first subset,

wherein selecting a first subset of the plurality of computing nodes comprises;

identifying a valid data stream from one or more computing nodes of the plurality of computing nodes, wherein identifying a valid data stream comprises comparing a sequence of data words in the data stream to a predetermined sequence of data words;

providing a control request signal to the one or more computing nodes of the plurality of computing nodes;

receiving a control ready signal from at least one computing node of the one or more computing nodes of the plurality of computing nodes; and

selecting the at least one computing node as the first subset of computing nodes.

12. A failover control system for granting computing nodes control authority of a computing system, the system comprising:

a plurality of computing nodes;

a failover controller configured to grant control authority to at least one computing node, the failover controller comprising;

a plurality of failover monitors configured to monitor a data stream from each computing node, select a first subset of the plurality of computing nodes based at least in part on the monitored data stream, and generate one or more control grant signals for at least one computing node of the first subset; and

a plurality of control vote circuits, each control vote circuit coupled between the plurality of failover monitors and a computing node, each control vote circuit configured to grant control authority to the corresponding computing node when the control vote circuit receives at least two control grant signals from the plurality of failover monitors.

13. The failover control system of claim 12, wherein the plurality of failover monitors are configured to select a first subset of the plurality of computing nodes by:

identifying a valid data stream from one or more computing nodes of the plurality of computing nodes;

providing a control request signal to the one or more computing nodes of the plurality of computing nodes;

receiving a control ready signal from at least one computing node of the one or more computing nodes of the plurality of computing nodes; and

selecting the at least one computing node as the first subset of computing nodes.

14. The failover control system of claim 13, wherein identifying a valid data stream comprises comparing a sequence of data words in the data stream to a predetermined sequence of data words.

15. The failover control system of claim 12, wherein the plurality of failover monitors is further configured to:

subsequent to granting control authority of the computing system to the one or more computing nodes of the first subset, identify at least one control capable computing node that has not been granted control authority of the computing system; and

select the at least one control capable computing node as a second subset of the plurality of computing nodes.

16. The failover control system of claim 12, wherein each control vote circuit is configured to grant control authority to the corresponding computing node when the control vote circuit receives control grant signals from at least a majority of the plurality of failover monitors.

17. A control system for an aircraft, the control system comprising:

a plurality of computing nodes;

a failover controller configured to grant control authority to at least one computing node, the failover controller comprising;

a plurality of failover monitors configured to monitor a data stream from each computing node, select a first subset of the plurality of computing nodes based at least in part on the monitored data stream, and generate one or more control grant signals for at least one computing node of the first subset; and

a plurality of control vote circuits, each control vote circuit coupled between the plurality of failover monitors and a computing node, each control vote circuit configured to grant control authority to the corresponding computing node when the control vote circuit receives control grant signals from at least a majority of the plurality of failover monitors.

18. The control system of claim 17, wherein the plurality of failover monitors are configured to select a first subset of the plurality of computing nodes by:

identifying a valid data stream from one or more computing nodes of the plurality of computing nodes;

providing a control request signal to the one or more computing nodes of the plurality of computing nodes;

receiving a control ready signal from at least one computing node of the one or more computing nodes of the plurality of computing nodes; and

selecting the at least one computing node as the first subset of computing nodes.

19. The control system of claim 18, wherein identifying a valid data stream comprises comparing a sequence of data words in the data stream to a predetermined sequence of data words.