Synchronized, fail-operational, fail-safe multi-computer control system

• US 4,354,230 A
• Filed: 05/19/1980
• Issued: 10/12/1982
• Est. Priority Date: 08/31/1978
• Status: Expired due to Term

• Current Assignee: United Technologies Corporation (Raytheon Technologies Corporation d/b/a RTX)
• Original Assignee: United Technologies Corporation (Raytheon Technologies Corporation d/b/a RTX)
• Inventors: Murphy, Richard D., Clelford, Douglas H.
• Primary Examiner(s): Shaw, Gareth D.
• Assistant Examiner(s): Chan, Eddie P.
• Application Number:
  US06/151,489
• Time in Patent Office: 876 Days
• Field of Search: 364/200 MS File, 364/900 MS File
• US Class Current: 712/1
• CPC Class Codes: G05D 1/0077 using redundant signals or controls
• CPC Class Codes: G06F 11/08 Error detection or correction by redundancy in data representation, e.g. by using checking codes
• CPC Class Codes: G06F 11/1633 using mutual exchange of the output between the redundant processing components
• CPC Class Codes: G06F 11/165 with continued operation after detection of the error
• CPC Class Codes: G06F 11/1683 at instruction level
• CPC Class Codes: G06F 11/1691 using a quantum
• CPC Class Codes: G06F 11/277 with comparison between actual response and known fault-free response
• CPC Class Codes: G06F 15/167 using a common memory, e.g. mailbox

Abstract

For each of two computer systems, logic flowcharts describe background program in which highly detailed memory checksum tests of fixed memory and complementary tests of variable memory are performed, the background program being interrupted for utility programs which are for the most part responsive to transducer or other sensor and discrete inputs to calculate control values for operation of control actuators or other responsive devices. The utility programs include specific self test routines. A direct memory access unit is included in each computer for moving data between inputs of either computer and memories of both, and between the memories of both computers. Periodic testing of fault codes registering the health of each computer is done during utility program routines, any variation from normal causing further health-analysis routines to be performed until dispositive action-causing conditions are determined. Neither computer checks the internal health of other, but inputs, results and data link transmissions must compare equally between the two computers, or routines determine whether one computer will recognize itself (or a component thereof) as being faulty, and disable itself. If not, then each computer disables itself after disabling the other. A variety of self tests and other checks and routines are included. Disablement is accomplished in a complex fashion of each computer'"'"'s output, by itself, and additional disablement if instituted by the other computer.

Claims

1. A multi-computer processing control system including a plurality of computer systems, each of said computer systems comprising:

a central processing unit (CPU) operating under a program of instructions and having interrupt handling capability for running a plurality of asynchronous, unrelated programs;

a plurality of memory devices;

a plurality of input sources for providing data to said computer system in response to which said computer system contributes to the control of said process;

a data link to another one of said computer systems;

a direct memory access controller for communicating data between said input sources, at least one memory of the related computer system and, over said data link, at least one memory of said another one of said computer systems; and

a master clock means for providing a variety of clock signals for the control of the related computer system and a series of real time interrupt commands for interrupting said CPU, the master clock means of said computer system being interconnected with the master clock means of said another one of said computer systems for recognizing the first to be generated, specific one of said real interrupt command of any of the interconnected master clock means, in all of said computer systems to, said computer system and said other computer systems each interrupting the related CPU in response to said first to be generated real time interrupt command thereby synchronizing said computer system, said master clock means being connected to said direct memory access controller to synchronize said direct memory access controller with the related CPU of said computer system.

2. A multi-computer process control system according to claim 1 wherein each of said CPUs operates under a program of instructions providing for a background program of self tests and a plurality of utility programs reached by corresponding ones of said series of real time interrupt commands, said master clock providing said real time interrupt commands at intervals of time which are much smaller than the time interval required for the performance of said background program.

3. A multi-computer process control system according to claim 2 in which each of said master clocks provides said real time interrupts at timed intervals which are significantly larger than the time intervals required for the performance of said utility programs, whereby the performance of said utility programs is interspersed with the performance of said background program.