ARBITRATION SYSTEM FOR REDUNDANT CONTROLLERS, WITH OUTPUT INTERLOCK AND AUTOMATIC SWITCHING CAPABILITIES

• US 20090055002A1
• Filed: 10/28/2008
• Published: 02/26/2009
• Est. Priority Date: 04/07/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: FAHR, Gerald J., HARRINGTON, Raymond J., ANDERSON, Gary D.
• Granted Patent: US 7,681,073 B2
• Time in Patent Office: Days
• US Class Current: 700/82
• CPC Class Codes: G06F 11/20 using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
• CPC Class Codes: G06F 11/2017 where memory access, memory control or I/O control functionality is redundant redundant communication control functionality G06F11/2005; redundant storage control functionality G06F11/2089

Abstract

An arbitration mechanism is provided for arbitrating between redundant controllers having outputs electrically connected together and provided as input to at least one device under control. The arbitration mechanism includes logic for automatically determining which controller of the redundant controllers is active controller, and a hardware output interlock for the redundant controllers to ensure that output controlled by only the active controller is enabled as input to the at least one device. The arbitration mechanism also includes logic for monitoring the active controller for failure, and upon detection of failure, for automatically switching active control to another controller of the redundant controllers transparent to the at least one device.

Claims

1. A system for providing arbitration for redundant controllers comprising:

logic for automatically determining which controller of redundant controllers is active controller, wherein outputs of the redundant controllers are electrically directly wired together and provided as input to at least one device;

multiple arbitration components, the multiple arbitration components including a first hardware arbitration component for a first controller of the redundant controllers, and a second hardware arbitration component for a second controller of the redundant controllers, the first hardware arbitration component being connected to the outputs of the first controller, and the second hardware arbitration component being connected to the outputs of the second controller, the first hardware arbitration component ensuring that the outputs of the first controller are enabled as input to the at least one device only when the first controller is the active controller, and the second hardware arbitration component ensuring that the outputs of the second controller are enabled as input to the at least one device only when the second controller is the active controller, and wherein the first hardware arbitration component and the second hardware arbitration component are separate hardware components which communicate and cooperate as a distributed hardware interlock mechanism that ensures outputs of only one of the first controller or the second controller of the redundant controllers are enabled at a time; and

wherein the first hardware arbitration component and the second hardware arbitration component each comprise a hardware state machine to enable/disable the outputs of its associated controller of the redundant controllers and ensure that outputs of only the active controller are enabled as input to the at least one device.

2. The system of claim 1, further comprising means for providing a unique identification for each controller of the redundant controllers, wherein the logic for automatically determining comprises means for employing the unique identifications to automatically determine which controller of the redundant controllers is active controller.

3. The system of claim 2, wherein the means for providing unique identifications for the redundant controllers comprises means for providing hardwired identification bits for each controller of the redundant controllers.

4. The system of claim 1, further comprising logic for monitoring the active controller for possible failure, and upon detection of failure, for automatically switching active control to another controller of the redundant controllers, wherein the automatically switching of active control is transparent to the at least one device.

5. The system of claim 4, wherein the logic for monitoring comprises means for employing a watch dog timer for the active controller of the redundant controllers, and for detecting failure of the active controller when the watch dog timer of the active controller expires.

6. The system of claim 1, wherein each arbitration component of the multiple arbitration components further includes a watchdog timer for its associated controller of the redundant controllers, and wherein the hardware arbitration components are coupled together to provide status of the individual watchdog timers to each hardware state machine of the arbitration components as input, wherein the hardware state machines employ the status of the watchdog timer signals to determine, separately from the logic for automatically determining, which controller of the redundant controllers is to have outputs enabled for input to the at least one device.