Fault tolerant computing system

• US 20070220367A1
• Filed: 02/06/2006
• Published: 09/20/2007
• Est. Priority Date: 02/06/2006
• Status: Abandoned Application

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Noah, Jason, Smith, Grant, Kammann, Paul
• Application Number:
  US11/348,290
• Publication Number:
  US 20070220367A1
• Time in Patent Office: Days
• US Class Current: 714/48
• CPC Class Codes: G06F 11/1641 where the comparison is not performed by the redundant processing components
• CPC Class Codes: G06F 11/1679 at clock signal level
• CPC Class Codes: G06F 11/181 Eliminating the failing redundant component
• CPC Class Codes: G06F 11/184 where the redundant components implement processing functionality

Abstract

A system for tolerating a single event fault in an electronic circuit is disclosed. The system includes a main processor that controls the operation of the system, a fault detection processor responsive to the main processor, and three or more programmable logic devices responsive to the fault detection processor. The three or more programmable logic devices periodically issue independent input signals to the fault detection processor for determination of one or more single event fault conditions.

Claims

1. A system for tolerating a single event fault in an electronic circuit, comprising:

a main processor that controls the operation of the system;

a fault detection processor responsive to the main processor;

three or more programmable logic devices responsive to the fault detection processor; and

wherein the three or more programmable logic devices periodically issue independent input signals to the fault detection processor for determination of one or more single event fault conditions.

2. The system of claim 1, wherein the main processor is further adapted to interface with at least one memory device.

3. The system of claim 2, wherein the at least one memory device is a double-data rate synchronous dynamic read-only memory.

4. The system of claim 1, wherein the fault detection processor is one of an application-specific integrated circuit, a microcontroller, and a programmable logic device.

5. The system of claim 1, wherein the three or more programmable logic devices are three or more of a field-programmable gate array, a complex programmable logic device, and a field-programmable object array.

6. The system of claim 1, wherein determination of one or more single event fault conditions further comprises:

reconfiguration of one of the three or more programmable logic devices that indicates a sufficient occurrence of one or more single event fault conditions; and

resynchronization of the three or more programmable logic devices.

7. The system of claim 6, wherein reconfiguration of the one of the three or more programmable logic devices further comprises a transfer of at least one set of default configuration software machine-coded instructions from the fault detection processor to the logic device.

8. A circuit for detecting one or more sufficient single event fault conditions, the circuit comprising:

means for generating a decision based on one or more logic readings provided by each of the one or more input signals;

means, responsive to the means for generating, for indicating whether at least one of the one or more input signals is affected by the one or more sufficient single event fault conditions; and

means, responsive to the means for indicating, for automatically reconfiguring the means for generating affected by the one or more sufficient single event fault conditions.

9. The circuit of claim 8, wherein the means for generating further includes three or more programmable logic devices.

10. The circuit of claim 9, wherein the three or more programmable logic devices are three or more of a field-programmable gate array, a complex programmable logic device, and a field-programmable object array.

11. The circuit of claim 8, wherein the means for indicating further includes a decision from at least one set of external triple modular redundancy voting logic.

12. The circuit of claim 8, wherein the means for automatically reconfiguring the means for providing further includes a configuration manager of an external fault detection processor.

13. A device for comparing one or more electronic signals, comprising:

voter logic that provides a first output signal to a multiplexer and a second output signal to one or more fault counters;

three or more word synchronizers that receive the one or more electronic signals and provide three or more adjusted outputs to the voter logic whereby the three or more adjusted outputs each provide a reading that the voter logic determines to be sufficiently in agreement; and

if one of the three or more adjusted outputs is not sufficiently in agreement with two or more remaining adjusted outputs, the device automatically reconfigures a source of the one of the three or more adjusted outputs not sufficiently in agreement.

14. The device of claim 13, wherein the device is one of an application-specific integrated circuit, a microprocessor, and a programmable logic device.

15. The device of claim 13, wherein the one or more fault counters further comprises one or more cumulative error counters that generate statistics on one or more occurrences of single event fault conditions over a specific time period.

16. The device of claim 13, wherein the three or more word synchronizers further comprise alignment of the one or more electronic signals to support comparisons made by the voter logic circuit on a periodic basis.

17. The device of claim 13, wherein the source of the one of the three or more adjusted outputs not sufficiently in agreement is a programmable logic device.

18. The device of claim 17, wherein the programmable logic device is one of a field-programmable gate array, a complex programmable logic device, and a field-programmable object array.

19. A method for tolerating a single event fault in an electronic circuit, comprising the steps of:

periodically receiving a logic reading from each of three or more programmable logic devices;

identifying a suspect device when the logic reading from the suspect device is no longer sufficiently in agreement with at least two logic readings that correspond to at least two remaining programmable logic devices;

comparing an adjustable threshold level to a number of times the three or more programmable logic devices have not been sufficiently in agreement; and

if the adjustable threshold level is exceeded, automatically reconfiguring the suspect device within a minimum amount of time.

20. The method of claim 19, wherein the step of periodically receiving the logic reading from each of the three or more programmable logic devices further comprises determining when one of the three or more programmable logic devices changes state.

21. The method of claim 19, wherein the step of comparing an adjustable threshold level to a number of times the three or more programmable logic devices have not been sufficiently in agreement further comprises determining when more than an acceptable number of disagreeing logic readings have occurred sequentially.

22. The method of claim 19, wherein the step of automatically reconfiguring the suspect device further comprises maintaining a sufficient level of reliability in the electronic circuit.

23. The method of claim 22, wherein the step of maintaining a sufficient level of reliability in the electronic circuit further comprises:

automatically compensating for the suspect device; and

if the at least two remaining programmable logic devices are no longer in agreement, automatically reconfiguring the at least two remaining programmable logic devices along with the suspect device.

24. A method for synchronizing data during one or more single event fault conditions, comprising the steps of:

routing one or more original input signals through a voter logic circuit;

aligning each of the one or more original input signals with a frame signal;

transferring an aligned input signal into a known time domain within the voter logic circuit; and

determining if the aligned input signal has been substantially modified by the one or more single event fault conditions.

25. The method of claim 24, wherein the one or more original input signals further comprise a control signal and a data signal.

26. The method of claim 24, wherein the one or more original input signals are of equal length.

27. The method of claim 24, wherein the step of aligning each of the one or more original input signals with the frame signal further comprises passing each of the one or more original input signals through a circular buffer.

28. The method of claim 24, wherein the step of determining if the aligned input signal has been substantially modified by the one or more single event fault conditions further comprises the steps of:

comparing an adjustable threshold level once every clock cycle in the known time domain to a number of times the aligned input signal has not been sufficiently in agreement; and

if the adjustable threshold level is exceeded, automatically reconfiguring a programmable logic device that generates the aligned input signal.

29. The method of claim 28, wherein the programmable logic device that generates the aligned input signal is one of a field-programmable gate array, a complex programmable logic device, and a field-programmable object array.