ERROR FILTERING IN FAULT TOLERANT COMPUTING SYSTEMS

• US 20070260939A1
• Filed: 04/21/2006
• Published: 11/08/2007
• Est. Priority Date: 04/21/2006
• Status: Abandoned Application

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Kammann, Paul, Smith, Grant, Parmet, Darryl
• Application Number:
  US11/379,633
• Publication Number:
  US 20070260939A1
• Time in Patent Office: Days
• US Class Current: 714/48
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/184 where the redundant components implement processing functionality

Abstract

A system for tolerating a single event fault in an electronic circuit is disclosed. The system includes a main processor, a fault detection processor responsive to the main processor, the fault detection processor further comprising a voter logic circuit, three or more logic devices responsive to the fault detection processor, each output of the three or more logic devices passing through the voter logic circuit, and a programmable error filter. An output of the voter logic circuit is coupled to the programmable error filter.

Claims

1. A system for tolerating a single event fault in an electronic circuit, comprising:

a main processor;

a fault detection processor responsive to the main processor, the fault detection processor further comprising a voter logic circuit;

three or more logic devices responsive to the fault detection processor, each output of the three or more logic devices passing through the voter logic circuit; and

a programmable error filter, wherein an output of the voter logic circuit is coupled to the programmable error filter.

2. The system of claim 1, wherein the main processor is one of a microcontroller and a programmable logic device.

3. The system of claim 1, wherein the fault detection processor is one of an application-specific integrated circuit, a microcontroller, and a programmable logic device.

4. The system of claim 1, wherein the three or more logic devices comprise at least one of a field-programmable gate array, a complex programmable logic device, and a field-programmable object array.

5. The system of claim 1, wherein the programmable error filter determines whether an error count has exceeded a programmable error threshold.

6. The system of claim 1, wherein the programmable error filter determines whether an error count has exceeded a programmable error threshold, and if the error count exceeds the programmable error threshold, the programmable error filter indicates to the main processor a predetermined threshold occurrence of sequential single event fault conditions.

7. The system of claim 1, wherein the programmable error filter determines whether an error count has exceeded a programmable error threshold, and if the error count exceeds tie programmable error threshold, the programmable error filter indicates to the main processor a predetermined threshold occurrence of sequential single event fault conditions, the predetermined threshold occurrence of sequential single event fault conditions comprising:

a reconfiguration of one of the three or more programmable logic devices whose error count exceeded the programmable error threshold; and

a resynchronizing of the three or more programmable logic devices.

8. The system of claim 1, wherein the programmable error filter determines whether an error count has exceeded a programmable error threshold, and if the error count exceeds the programmable error threshold, the programmable error filter indicates to the main processor a predetermined threshold occurrence of sequential single event fault conditions, the predetermined threshold occurrence of sequential single event fault conditions comprising:

a reconfiguration of one of the three or more programmable logic devices whose error count exceeded the programmable error threshold;

a resynchronizing of the three or more programmable logic devices; and

wherein the reconfiguration of the one of the three or more programmable logic devices further comprises a transfer of at least one set of default configuration software machine-coded instructions from the fault detection processor to tie logic device.

9. A device for comparing one or more electronic signals, comprising:

three or more word synchronizers that output the one or more electronic signals as three or more adjusted outputs;

an error filter counter;

a voter logic circuit that;

updates the error filter counter based on a current condition of the three or more adjusted outputs, and

filters an output signal through the error filter counter; and

if the output signal indicates that one of the three or more adjusted outputs is not in agreement with two or more remaining adjusted outputs, and a count of the error filter counter exceeds a programmable error threshold, the device automatically reconfigures a source of the one of the three or more adjusted outputs not in agreement.

10. The device of claim 9, wherein the device is one of an application-specific integrated circuit, a microprocessor, and a programmable logic device.

11. Tie device of claim 9, wherein the three or more word synchronizers align the one or more electronic signals to support at least one comparison made by the voter logic circuit on a periodic basis.

12. The device of claim 9, wherein the error filter counter:

decrements for each reading the voter logic circuit determines to be in agreement; and

increments for each reading the voter logic determines not to be in agreement.

13. The device of claim 9, wherein the source of the one of the three or more adjusted outputs not in agreement is a logic device.

14. The device of claim 9, wherein the source of the one of the three or more adjusted outputs not in agreement is at least one of a field-programmable gate array, a complex programmable logic device, and a field-programmable object array.

15. A method for tolerating a single event fault in an electronic circuit, comprising the steps of:

periodically receiving a logic reading from each one of three or more logic devices;

identifying a suspect device if the logic reading from the suspect device is no longer in agreement with at least two logic readings corresponding to at least two remaining logic devices of the three or more logic devices;

updating an error filter counter based on a current state of the logic reading from each one of the three or more logic devices;

comparing a programmable error threshold level to a number of times the three or more logic devices have not been in agreement; and

if the programmable error threshold level is exceeded, automatically reconfiguring the suspect device within a minimum amount of time.

16. The method of claim 15, wherein the periodically receiving step further comprises a step of determining if one of the three or more logic devices changes state.

17. The method of claim 15, wherein the identifying step further comprises a step of filtering the logic reading from the suspect device through a programmable error filter.

18. The method of claim 15, wherein the updating step further comprises the steps of:

incrementing the error filter counter for each time the current state of the logic reading from each one of the three or more logic devices detects the suspect device; and

decrementing the error filter counter for each set of logic readings from the three or more logic devices that are in agreement.

19. The method of claim 15, wherein the comparing step further comprises a step of determining if an error count indicated by the error filter counter exceeds the programmable error threshold level.

20. The method of claim 15, wherein the automatically reconfiguring step further comprises the steps of:

automatically compensating for the suspect device; and

if the at least two remaining programmable logic devices are no longer in agreement, automatically reconfiguring the at least two remaining programmable logic devices along with the suspect device.