Multiple-redundant fault detection system and related method for its use
First Claim
1. A multiple-redundant computer system, comprising:
- a plurality of synchronized computational devices, each of which has a processor and a memory, and a data path between its processor and its memory;
an equal plurality of data buses associated one with each of the computational devices;
means in each computational device for intercepting data on the data path between the memory and its associated processor, and transmitting the intercepted data to the data bus associated with the computational device;
an equal plurality of voter circuits associated one with each of the computational devices and each connected to receive inputs from all of the plurality of data buses and to supply a single voted output to its associated computational device;
an equal plurality of fault determination logic circuits associated one with each of the computational devices, and each connected to receive inputs from all of the plurality of data buses and to each generate a fault status word indicative of any fault conditions in the system; and
means associated with each computational device, for periodically reading the fault status word from the fault determination logic onto the associated data bus and through the associated voter circuit to the associated computational device, wherein each of the computational devices is periodically supplied with a voted fault status word indicative of any fault conditions in the system as determined by a majority of the fault determination logic circuits.
7 Assignments
0 Petitions
Accused Products
Abstract
A multiple-redundant computer system having multiple computational devices operating in synchronism, multiple voter circuits to provide voted memory reading operations for the devices, and multiple fault detection logic for the detection of failures of the computational devices. Fault status words generated by the fault detection logic are also subject to a voted read by the multiple computational devices, thereby permitting detection of errors in the fault detection logic itself, as well as in the computational devices. The module structure of the invention also permits removal and replacement of circuit modules, each including a computational device and fault detection logic, without disconnecting power from the entire system.
-
Citations
20 Claims
-
1. A multiple-redundant computer system, comprising:
-
a plurality of synchronized computational devices, each of which has a processor and a memory, and a data path between its processor and its memory; an equal plurality of data buses associated one with each of the computational devices; means in each computational device for intercepting data on the data path between the memory and its associated processor, and transmitting the intercepted data to the data bus associated with the computational device; an equal plurality of voter circuits associated one with each of the computational devices and each connected to receive inputs from all of the plurality of data buses and to supply a single voted output to its associated computational device; an equal plurality of fault determination logic circuits associated one with each of the computational devices, and each connected to receive inputs from all of the plurality of data buses and to each generate a fault status word indicative of any fault conditions in the system; and means associated with each computational device, for periodically reading the fault status word from the fault determination logic onto the associated data bus and through the associated voter circuit to the associated computational device, wherein each of the computational devices is periodically supplied with a voted fault status word indicative of any fault conditions in the system as determined by a majority of the fault determination logic circuits. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8)
-
-
9. A triple-redundant computer system, comprising:
-
three synchronized computational devices, each of which has a processor and a memory, and a data path between its processor and its memory; three data buses associated one with each of the computational devices; means for intercepting data on the data path between the memory and the processor, and transmitting it to be corresponding data bus; three voter circuits associated one with each of the computational devices and connected to receive inputs from all three of the data buses and to supply a single voted output to its computational device; three bus comparison logic circuits, each connected to the three data buses and providing three bus comparison output signals indicative of the agreement or lack of agreement between each possible pairing of data bus signals; three fault determination logic circuits associated one with each of the computational devices, each connected to receive as inputs the bus comparison signals from its associated bus comparison logic circuit, and each operative to generate a fault status word indicative of any fault conditions in the system; and means associated with each computational device, for periodically reading the fault status word from the fault determination logic onto the associated data bus and through the associated voter circuit to the associated computational device, wherein each of the computational devices is periodically supplied with a voted fault status word indicative of any fault conditions in the system as determined by a majority of the fault determination logic circuits. - View Dependent Claims (10, 11, 12, 13, 14, 15, 16)
-
-
17. A method for detecting errors in fault determination logic in a triple-redundant computer system, comprising the steps of:
-
simulating an error condition in one of three synchronized computational subsystems; generating a resultant set of first fault status conditions in fault determination logic associated with each of the three subsystems; reading the first fault status conditions onto three associated data buses and thence by majority vote into each of the three computational systems; and generating a second fault status condition in the fault determination logic as a result of reading the first fault status conditions, the second fault status condition providing the identity of any improperly operating fault determination logic. - View Dependent Claims (18, 19)
-
-
20. Apparatus for detecting errors in fault determination logic in a triple-redundant computer system, the apparatus comprising:
-
means for simulating an error condition in one of three synchronized computational subsystems; means for generating a resultant set of first fault status conditions in fault determination logic associated with each of the three subsystems; means for reading the first fault status conditions onto three associated data buses and thence by majority vote into each of the three computational systems; and means for generating a second fault status condition in the fault determination logic as a result of reading the first fault status conditions, the second fault status condition providing the identity of any improperly operating fault determination logic.
-
Specification