Computer network for real time control with automatic fault identification and by-pass

• US 5,086,499 A
• Filed: 05/23/1989
• Issued: 02/04/1992
• Est. Priority Date: 05/23/1989
• Status: Expired due to Fees

• Current Assignee: Daimler Chrysler Company LLC (Stellantis NV)
• Original Assignee: AEG Westinghouse Transportation Systems, Inc.
• Inventors: Mutone, Gioacchino A.
• Primary Examiner(s): Fleming, Michael R.
• Assistant Examiner(s): HAUSER, ROBERT
• Application Number:
  US07/356,546
• Time in Patent Office: 987 Days
• Field of Search: 371/8.2, 371/9.1, 371/11.1, 371/11.2, 371/11.3, 371/68.1, 371/68.2, 371/68.3, 371/69.1, 364/200, 364/228.3, 364/268.3, 364/268, 364/240.2, 364/268.1, 364/229.4
• US Class Current: 714/3
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems
• CPC Class Codes: G06F 11/1633 using mutual exchange of the output between the redundant processing components
• CPC Class Codes: G06F 11/165 with continued operation after detection of the error
• CPC Class Codes: G06F 11/2007 using redundant communication media

Abstract

A computer network for real time control having redundant components for automated fault identification and automated bypass of identified faulty components. The system includes at least two main computers, each coupled to at least two independent parallel data channels. A plurality of satellite computer pairs are connected to these channels, each pair receiving information from a plurality of I/O racks which are connected to redundant sensors for detecting information and to redundant actuators for implementing system control. The main computers are continuously crosslinked and perform evaluation of their respective input and output streams comparing these streams for consistency between the main computers. In the event that an inconsistency is detected in the data streams, the system checks for faulty components to determine the origin of the inconsistency. The system utilizes an evaluation method whereby each main computer independently accesses each of the parallel data channels, satellite computers, I/O racks, sensors and actuators to locate inconsistencies in the data stream. The system then allows for operation with one of the redundant components while the identified defective redundant component is repaired or replaced.

Claims

1. A computer system comprising:

first and second main computers, each computer having a primary data interface and a secondary data interface each interface for sending and receiving system signals including sensor system signals and actuator system signals;

a first data highway for conveying said system signals, connected to said primary data interface of said first main computer and to said secondary data interface of said second main computer;

a second data highway for conveying said system signals, connected to said primary data interface of said second main computer and to said secondary data interface of said first main computer;

first and second satellite computers for relaying said system signals, each connected to said first and second data highways;

first and second I/O racks, each connected to said first and second satellite computers;

a sensor pair for generating said sensor system signals, connected to each of said I/O racks, and

an actuator pair, connected respectively to each of said I/O racks and having means for comparing said actuator system signals, for reacting to system signals which are in agreement with each other.

2. The computer system of claim 1, wherein said first main computer comprises first comparing and detecting means, coupled to said second main computer, for comparing said system signals received by said first main computer with said system signals received by said second main computer, and for detecting discrepancies between said system signals received by said first main computer and said system signals received by said second main computer;

and

said second main computer comprises second comparing and detecting means, coupled to said first main computer, for comparing said system signals received by said first main computer with said system signals received by said second main computer, and for detecting discrepancies between said system signals received by said first main computer and said system signals received by said second main computer.

3. A method for diagnosis of a computer system according to claim 2, comprising the steps of:

detecting discrepancies between said system signals received by said first main computer and said system signals received by said second main computer;

monitoring said primary data interface and said secondary data interface of said first main computer and comparing the system signals received thereon for consistency;

utilizing said first satellite computer to relay said system signals between said first I/O rack and said first and second data highways;

utilizing said first I/O rack to establish a data path between said sensor pair and said first and second satellite computers.

4. The computer system of claim 1, wherein said first main computer further comprises first monitoring means, coupled to said primary data interface and said secondary data interface of said first main computer, for selectively monitoring either said primary data interface or said secondary data interface of said first main computer;

and

said second main computer further comprises second monitoring means, coupled to said primary data interface and said secondary data interface of said second main computer, for selectively monitoring either said primary data interface or said secondary data interface of said second main computer.

5. The computer system of claim 4, wherein said first main computer further comprises first comparing and detecting means, coupled to said first monitoring means and connected to said second main computer, for comparing said system signals received by said first main computer with said system signals received by said second main computer, and for detecting discrepancies between said system signals, and wherein

said second main computer further comprises second comparing and detecting means, coupled to said second monitoring means and connected to said first computer, for comparing said system signals received by said first main computer with said system signals received by said second main computer, and for detecting discrepancies between said system signals received by said first main computer with said system signals received by said second main computer, wherein said first monitoring means and said second monitoring means are responsive to said first comparing and detecting means and said second comparing and detecting means, respectively, to configure said first and second main computers to simultaneously monitoring of one of said first and second data highways.

6. The computer system of claim 1, further comprising:

first satellite enabling means, coupled to said first main computer and said second main computer and connected to said first satellite computer, for selectively enabling said first satellite computer to relay said system signals to said first and second data highways; and

second satellite disabling means, coupled to said first main computer and said second main computer and connected to said second satellite computer, for selectively disenabling said second satellite computer from relaying said system signals while said first satellite enabling means selectively enables said first satellite computer to relay said system signals to said first and second data highways.

7. The computer system of claim 1, further comprising:

second satellite enabling means, coupled to said first main computer and said second main computer and connected to said first satellite computer, for selectively enabling said second satellite computer to relay said system signals to said first and second data highways; and

first satellite disabling means, coupled to said first main computer and said second main computer and connected to said first satellite computer, for selectively disabling said first satellite computer from relaying said system signals while said second satellite enabling means selectively enables said second satellite computer to relay said system signals to said first and second data highways.

8. The computer system of claim 1, further comprising:

first signal path establishing means, coupled to said first main computer and said second main computer and connected to said first I/O rack, for establishing a signal path between said sensor pair and said first and second satellite computers via said first I/O rack; and

second signal path blocking means, coupled to said first main computer and said second main computer and connected to said second I/O rack, for blocking a signal path between said sensor pair and said first and second satellite computers via said second I/O rack while said first signal path establishing means establishes said path between said sensor pair and said first and second satellite computers.

9. The computer system of claim 1, further comprising:

second signal path establishing means, coupled to said first main computer and said second main computer and connected to said first I/O rack, for establishing a signal path between said sensor pair and said first and second satellite computers via said second I/O rack; and

first signal path blocking means, coupled to said first main computer and said second main computer and connected to said first I/O rack, for blocking a signal path between said sensor pair and said first and second satellite computers via said first I/O rack while said first signal path establishing means establishes said path between said sensor pair and said first and second satellite computers.

10. A method for monitoring and controlling sensors and actuators, comprising the steps of:

providing first and second main computers;

providing a first signal pathway divided into a plurality of first discrete coupling segments for coupling said first main computer with sensors and a first actuator and for coupling said second main computer with said sensors and said first actuator;

providing a second signal pathway divided into a plurality of second discrete coupling segments for coupling said first main computer with said sensors and a second actuator and for coupling said second main computer with said sensors and said second actuator, said second signal pathway being redundant and parallel to said first signal pathway and said plurality of second discrete coupling segments corresponding to said plurality of first discrete coupling segments;

selectively monitoring and controlling said sensors and said first actuator with said first main computer via said first signal pathway;

selectively monitoring and controlling said sensors and said second actuator with said second main computer via said second signal pathway;

comparing during said monitoring by said first computer and said monitoring by said second computer system signals at points in said plurality of first discrete coupling segments and points in said plurality of secondary discrete coupling segments corresponding to said plurality of first discrete coupling segments and generating a discrepancy signal whenever said comparing step determines that there is a discrepancy between said system signals.

11. A method according to claim 10, wherein said step of selectively monitoring with said first computer includes the step of:

selectively bypassing in response to said discrepancy signal, at least one of said plurality of first discrete coupling segments of said first signal pathway, and substituting therefor one of said plurality of second discrete coupling segments of said second signal pathway corresponding to said at least one of said plurality of first discrete coupling segments.