Fault tolerant computer controlled system

• US 20040195460A1
• Filed: 01/23/2004
• Published: 10/07/2004
• Est. Priority Date: 01/23/2003
• Status: Active Grant

• Current Assignee: Supercomputing Systems AG
• Original Assignee: Supercomputing Systems AG
• Inventors: Sailer, Thomas Michael
• Granted Patent: US 7,263,630 B2
• Time in Patent Office: Days
• US Class Current: 244/194
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems
• CPC Class Codes: G06F 11/184 where the redundant components implement processing functionality

Abstract

An error tolerant computer controlled system comprises several computers working redundantly and controlling actuators based on signals from sensors and input devices. Each data item emitted by each computer is simultaneously sent through differing communication paths to each actuator, such that in normal operation each actuator receives each data item through several paths. This system continues to function properly even in case of a failure without requiring any re-routing of the data items, which makes it easier to design, analyze and test and thereby increases its reliability.

Claims

1. An error tolerant computer controlled system comprising

a plurality of redundant data sources generating at least partially redundant data items,

a plurality of data receivers for receiving the redundant data items and combining them to an error tolerant data item,

a switching assembly with a plurality of inputs and outputs, wherein each input is connected to one data source or to one output and wherein each output is connected to one input or to one data receiver, and wherein each data receiver is connected via separate receiver communication links to at least two outputs,

wherein said switching assembly is adapted to connect any of said data sources to each of said data receivers over at least two different receiver communication links, and wherein said computer controlled system is adapted to send every data item from any given data source to any given data receiver through every one of the at least two different receiver communication links such that the given data receiver receives the same data item through at least two receiver communication links.

2. The system of claim 1 wherein each receiver communication link connects exactly one output to exactly one receiver.

3. The system of claim 1 wherein the number of receiver communication links for each data receiver is smaller than the number of data sources.

4. The system of claim 3 wherein the number of receiver communication links for each data receiver is 2.

5. The system of claim 1 wherein the switching assembly is divided into a plurality of switching units, wherein each input of each switching unit is either connected to one data source or via a switch communication link to one output of another switching unit, wherein each switching unit is connected via at least two switch communication links to other switching units, wherein each switch communication link connects one output to one input, and wherein each data receiver is connected via the receiver communication links to at least two different switching units.

6. The system of claim 5 wherein, for each switching unit, each output can be connected to each input.

7. The system of claim 5 wherein exactly two switch communication links are attached to the inputs of each switching unit and/or wherein exactly two switch communication links are attached to the outputs of each switching unit.

8. The system of claim 5 wherein the number of switching units corresponds to the number of data sources and wherein each switching unit is attributed to one data source, and wherein one input of each switching unit is connected to its attributed data source.

9. The system of claim 8 wherein one output of the switching unit is connected to its attributed data source.

10. The system of claim 1 wherein repetitive time windows are attributed to each data source and wherein, in each time window, the switching assembly connects all receiver communication links to the data source attributed to the time window while disconnecting the remaining data sources from the receiver communication links.

11. The system of claim 10 wherein the switching assembly is divided into a plurality of switching units, wherein each input of each switching unit is either connected to one data source or via a switch communication link to one output of another switching unit, wherein each switching unit is connected via at least two switch communication links to other switching units, wherein each switch communication link connects one output to one input, and wherein each data receiver is connected via the receiver communication links to at least two different switching units, and wherein, in each time window, the switching assembly is adapted to connect all switch communication links to the data source attributed to the time window while disconnecting the remaining data sources from the switch communication links.

12. The system of claim 10 wherein at least part of the data items carries a time stamp and wherein each switching unit comprises a clock synchronized by the time stamps.

13. The system of claim 12 wherein each switching unit is adapted to combine a plurality of received data items carrying time stamps in order to determine a time base.

14. The system of claim 12 wherein each switching unit is adapted to combine a plurality of received data items carrying time stamps in order to determine a time base by determining a median of the time stamps of data items from different data sources

15. The system of claim 1 wherein a unique key is attributed to each data source and each data source is adapted to generate a digital signature for each data item it sends using its unique key, and wherein the data receivers are adapted to check a validity of the signature upon receipt of a data item.

16. The system of claim 1 wherein said data receiver is adapted to check a validity of each of the received data items and to use only those data items of a group of redundant data items that are valid.

17. The system of claim 16 wherein said data receiver is adapted to determine a median or majority value of the valid data items of the group of redundant data items.

18. The system of claim 1 wherein said data receivers comprise actuators.

19. The system of claim 1 further comprising feedback links for transmitting data from said data receivers to said switching assembly.

20. A vehicle comprising the system of claim 1, wherein said data receivers control a drive and steering mechanism of the vehicle.

21. An aircraft comprising the system of claim 1.

22. The aircraft of claim 21 comprising at least one pivotal drive unit for attitude control and for generating lift and forward thrust, and a drive control unit for controlling a tilt angle and a thrust of said drive unit, wherein said control unit is controlled by one of said data receivers.

23. The aircraft of claim 22 wherein said drive unit is driven by an electrical motor.

24. An error tolerant computer controlled system comprising

a plurality of redundant data sources generating at least partially redundant data items,

a plurality of data receivers for receiving the redundant data items and combining them to an error tolerant data item,

a switching assembly with a plurality of inputs and outputs, wherein each input is connected to one data source or to one output and wherein each output is connected to one input or to one data receiver, and

a plurality of receiver communication links, wherein each data receiver is connected via separate receiver communication links to at least two outputs and wherein the number of receiver communication links for each data receiver is smaller than the number of data sources

wherein said switching assembly is adapted to connect any of said data sources to each of said data receivers over at least two different receiver communication links, and wherein said computer controlled system is adapted to send every data item from any given data source to any given data receiver through every one of the at least two different receiver communication links such that the given data receiver receives the same data item through at least two receiver communication links.

25. An error tolerant computer controlled system comprising

a plurality of redundant data sources generating at least partially redundant data items,

a plurality of data receivers for receiving the redundant data items and combining them to an error tolerant data item,

a switching assembly comprising a plurality of switching units, each switching unit having a plurality of inputs and a plurality of outputs, wherein each input of each switching unit is either connected to one data source or via a switch communication link to one output of another switching unit, wherein each switching unit is connected via at least two switch communication links to other switching units, wherein each switch communication link connects one output to one input, and wherein each data receiver is connected via receiver communication links to at least two different switching units,

wherein said switching assembly is adapted to connect any of said data sources to each of said data receivers over at least two different receiver communication links, and wherein said computer controlled system is adapted to send every data item from any given data source to any given data receiver through every one of the at least two different receiver communication links such that the given data receiver receives the same data item through at least two receiver communication links.

26. The error tolerant computer controlled system of claim 25 wherein, for each switching unit, each output can be connected to each input.

27. An error tolerant computer controlled system comprising

a plurality of redundant data sources generating at least partially redundant data items,

a plurality of data receivers for receiving the redundant data items and combining them to an error tolerant data item,

a switching assembly with a plurality of inputs and outputs, wherein each input is connected to one data source or to one output and wherein each output is connected to one input or to one data receiver, and wherein each data receiver is connected via separate receiver communication links to at least two outputs,

wherein said switching assembly is adapted to connect any of said data sources to each of said data receivers over at least two different receiver communication links, and wherein said computer controlled system is adapted to send every data item from any given data source to any given data receiver through every one of the at least two different receiver communication links such that the given data receiver receives the same data item through at least two receiver communication links, and

wherein repetitive time windows are attributed to each data source and wherein, in each time window, the switching assembly connects all receiver communication links to the data source attributed to the time window while disconnecting the remaining data sources from the receiver communication links.