Methods and apparatus for processor system having fault tolerance

• US 20070033511A1
• Filed: 08/05/2005
• Published: 02/08/2007
• Est. Priority Date: 08/05/2005
• Status: Active Grant

• Current Assignee: Raytheon Company (Rtx Corporation)
• Original Assignee: Raytheon Company (Rtx Corporation)
• Inventors: Davies, Steven
• Granted Patent: US 7,272,681 B2
• Time in Patent Office: Days
• US Class Current: 714/799
• CPC Class Codes: G06F 11/1675 Temporal synchronisation or re-synchronisation of redundant processing components
• CPC Class Codes: G06F 11/181 Eliminating the failing redundant component
• CPC Class Codes: G06F 11/184 where the redundant components implement processing functionality

Abstract

A high assurance processing system includes a plurality of data processors coupled in parallel, a bridge coupled to the input/output processor, and an input/output processor coupled to the bridge for coupling to a sensor and an effector. Sensor data passes to the bridge through the input/output processor for processing by the parallel data processors, which generate redundant effector data for comparison by the bridge to detect errors. If data matches are found, data is transmitted to the effector.

Claims

1. A processing system, comprising:

a plurality of data processors coupled in parallel;

a bridge coupled to the input/output processor; and

an input/output processor coupled to the bridge, the input/output processor adapted to be coupled to a sensor and an effector;

wherein sensor data passes to the bridge through the input/output processor for processing by the plurality of data processors, which generate redundant effector data for comparison by the bridge to detect errors and transmission to the effector.

2. The system according to claim 1, wherein the bridge includes a synchronization module to synchronize data processing by the plurality of data processors.

3. The system according to claim 2, wherein the synchronization module includes semaphore bits.

4. The system according to claim 1, wherein the bridge includes a data transfer and voting module to control data transfer between the input/output processor and the plurality of data processors.

5. The system according to claim 4, wherein the data transfer and voting module includes a series of comparators to compare data from the plurality of data processors for identifying errors.

6. The system according to claim 1, wherein the sensor includes a plurality of navigational sensors.

7. The system according to claim 6, wherein the effector includes at least one mechanism to control an aircraft.

8. The system according to claim 1, wherein the input/output processor and/or the data processors are commercial off the shelf processors.

9. The system according to claim 8, wherein at least one bus connected to the bridge is an open standard bus interface.

10. A method, comprising:

receiving data from a sensor at an input/output processor;

receiving the sensor data from the input/output processor at a bridge;

receiving and processing the sensor data at a plurality of data processors coupled in parallel;

comparing data from the plurality of data processors to identify errors;

transmitting the data from the bridge to the input/output processor; and

transmitting the data from the input/output processor to an effector.

11. The method according to claim 10, further including testing comparison and voting logic in the bridge.

12. The method according to claim 10, further including generating a processing exception if there were no matches from the data comparison.

13. The method according to claim 10, further including synchronizing the plurality of data processors using semaphores.

14. The method according to claim 10, wherein the input/output processor and/or data processors are COTS processors.

15. The method according to claim 10, wherein at least one bus coupled to the bridge is an open standard bus interface.

16. The method according to claim 10, wherein the bridge includes a synchronization module and a data transfer and voting module.

17. A vehicle, comprising:

a plurality of data processors coupled in parallel;

a bridge coupled to the input/output processor; and

an input/output processor coupled to the bridge, the input/output processor adapted to be coupled to a sensor and an effector;

wherein sensor data passes to the bridge through the input/output processor for processing by the plurality of data processors, which generate redundant effector data for comparison by the bridge to detect errors and transmission to the effector.

18. The vehicle according to claim 17, wherein the vehicle is an aircraft.

19. The vehicle according to claim 17, wherein the vehicle is a ship.

20. The vehicle according to claim 17, wherein the bridge includes a data transfer and voting module to control data transfer between the input/output processor and the plurality of data processors.