Fault recovery mechanism, transparent to digital system function

• US 4,996,687 A
• Filed: 10/11/1988
• Issued: 02/26/1991
• Est. Priority Date: 10/11/1988
• Status: Expired due to Term

• Current Assignee: Honeywell Incorporated (Honeywell International Inc.)
• Original Assignee: Honeywell Incorporated (Honeywell International Inc.)
• Inventors: Yount, Larry J., Liebel, Kurt A., Hess, Richard F.
• Primary Examiner(s): Smith, Jerry
• Assistant Examiner(s): Baker, Stephen M.
• Application Number:
  US07/256,060
• Time in Patent Office: 868 Days
• Field of Search: 371/7, 371/9.1, 371/10.1, 371/11.1, 371/11.3, 371/12, 371/13, 364/245.2, 364/268.5, 364/945.3, 364/970, 364/970.1, 364/970.4, 364/945, 364/266.5, 365/228
• US Class Current: 714/15
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/141 for bus or memory accesses

Abstract

A method and apparatus allows fault recovery in a digital computer based control system whereby system upsets induced by external transient noise conditions can be accommodated. A CPU is coupled to its main memory and its I/O interfaces by a common address/data bus, these three elements being susceptible to having data thereon or therein corrupted by transient noise. Also coupled to the bus, but in a hardened environment, are first and second supplemental memories which, under memory control, operate on alternating even and odd computational frames defined by the CPU'"'"'s real-time clock to store the same words as are then being entered into the CPU'"'"'s main memory. As computational frames are entered into one or the other of these two memories by eaves-dropping on the common bus, the other supplemental memory is transferring its contents to a backup memory which is also housed in the noise-immune environment. The backup memory is connected in a read-only mode to the address/data bus and, because of the manner of operation, always contains the computational frame that is delayed one cycle of the CPU'"'"'s real-time clock from the frame in progress. Should a transient upset occur, it may be followed by a transfer of the information from the backup memory into the computer'"'"'s main memory such that computations can then continue with data that is uncorrupted.

Claims

1. In a digital computing system of the type including a central processing unit having an address/data bus coupled thereto, a main RAM, means coupled to said address/data bus for storing digital words comprising computational frames at addressable locations therein, main memory control means for effecting the writing of digital words comprising said computational frames into said main RAM at or from addresses originating at said central processing unit, apparatus for maintaining the integrity of the words comprising said computational frames stored in said main RAM in spite of system upsets due to external transient noise conditions impacting on said system, comprising:

(a) supplemental memory control means;

(b) first and second supplemental RAMs;

(c) first switching means controlled by said supplemental memory control means for alternatively coupling said first and second supplemental RAMs to said address/data bus on successive ones of said computational frames, such that the same digital words comprising a given frame being written in said main RAM are simultaneously copied into one or the other of said first and second supplemental RAMs;

(d) a backup RAM coupled to said address/data bus;

(e) second switching means controlled by said supplemental memory control means for coupling said backup RAM to said first and second supplemental RAMs such that during the time words are being copied into said first supplemental RAM, selected words stored in said second supplemental RAM during an immediately preceding computational frame are transferred into said backup RAM and during the time words are being entered into said second supplemental RAM, selected words stored in said first supplemental RAM during the immediately preceding computational frame are transferred into said backup memory means;

(f) means coupled to said supplemental memory control means for sensing system upsets due to transient noise; and

(g) means controlled by said supplemental memory control means following the sensing of a system upset for transferring the contents of said backup RAM to said main RAM.

2. The apparatus as in claim 1 wherein said first and second supplemental RAMs, said supplemental memory control means and said backup RAM are isolated from external transient noise.

3. The apparatus as in claim 1 and further including update log means for storing flag bits identifying which words in a computational frame stored in said main RAM have been altered by write operations;

and means in said supplemental memory control means for sensing said flag bits whereby only those words stored in said first and second supplemental RAMs are transferred to said backup memory means.

4. The apparatus as in claim 3 wherein said first and second supplemental RAMs, said supplemental memory control means, said backup RAM and said update log means are isolated from said external transient noise.

5. A method for restoring a digital computing system of the type including a central processing unit having a real-time clock, a main RAM memory and an address/data bus coupling said CPU and main RAM together, to an error-free operational state following an external transient disturbance to said CPU, said main RAM or said bus, comprising the steps of:

(a) storing a copy of the digital words comprising even computational frames in a first supplemental RAM as they are being written in said main RAM;

(b) storing a copy of the digital words comprising odd computational frames in a second supplemental RAM as they are being written into said main RAM, said even and odd computational frames being determined by successive cycles of said real-time clock;

(c) transferring the contents of said first and second supplemental RAMs to a backup RAM on an alternating basis such that as digital words comprising a current computational frame are being simultaneously written in said main RAM and one of said first and second supplemental RAMs, the preceding computational frame stored in the other of said first and second supplemental RAMs is transferred to said backup RAM;

(d) monitoring said CPU, said main memory and said address/data bus for occurrences of an external transient noise event; and

(e) replacing the contents of said main RAM with the contents of said backup RAM following the occurrence of an external transient noise event.

6. The method as in claim 5 and further including the steps of:

(a) providing for each of said first and second supplemental RAMs a flag bit register whose length is equal to the number of words comprising a computational frame;

(b) storing a flag bit in the bit position of the flag register associated with the first supplemental RAM corresponding to words in even computational frames that are altered by a write operation in said first supplemental RAM;

(c) storing a flag bit in the bit position of the flag register associated with the second supplemental RAM corresponding to words in odd computational frames that are altered by a write operation in said second supplemental RAM; and

(d) transferring only those words associated with a flag bit from said first and second supplemental RAMs to said backup RAM during alternating computational frames.

7. A method for allowing a control system incorporating digital computing means having a main memory, a central processing unit, and input/output means intercoupled by an address/data bus to recover from the occurrence of soft errors impacting the system, comprising the steps of:

(a) providing an odd frame memory, an even frame memory, a backup memory and memory control means in an enclosure which effectively shields them from external transient noise, said even frame memory, odd frame memory and backup memory being connectable by switching means to said address/data bus;

(b) writing words during even computational frames into said even frame memory as they are being written into said main memory;

(c) writing words during odd computational frames into said odd frame memory as they are being written into said main memory;

(d) maintaining a log of those words in said even and odd frame memories that are updated during the even and odd computational frames, respectively;

(e) during the time that words are being written into said even frame memory or said odd frame memory on a current computational frame, transferring to said backup memory those words in said odd frame memory or even frame memory, respectively, which are identified by said log as having been updated in the immediately preceding computational frame;

(f) sensing the occurrence of external transient disturbances to said central processing unit, said main memory or said address/data bus;

(g) transferring the contents of said backup memory to said main memory at the conclusion of the computational frame in which said disturbance occurred, such that said main memory is returned to the same state as it was during the computational frame preceding the occurrence of said disturbance.