Redundant microprocessor control system using locks and keys

• US 5,136,704 A
• Filed: 06/28/1989
• Issued: 08/04/1992
• Est. Priority Date: 06/28/1989
• Status: Expired due to Fees

• Current Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Danielsen, Carl M., Dabbish, Ezzat A., Puhl, Larry C.
• Primary Examiner(s): Baker, Stephen M.
• Application Number:
  US07/372,746
• Time in Patent Office: 1,133 Days
• Field of Search: 371/3, 371/7, 371/8.1, 371/9.1, 371/11.1, 371/11.3, 371/14, 371/15.1, 371/16.1, 371/16.3, 371/62, 371/67.1, 371/68.1, 371/68.3, 371/23, 364/268.1, 364/267.9, 395/575
• US Class Current: 714/11
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/1641 where the comparison is not performed by the redundant processing components
• CPC Class Codes: G06F 11/1645 and the comparison itself uses redundant hardware
• CPC Class Codes: G06F 11/165 with continued operation after detection of the error
• CPC Class Codes: G06F 11/1654 where the output of only one of the redundant processing components can drive the attached hardware, e.g. memory or I/O

Abstract

A redundant processing system includes a pair of processors, each processor having an error detector, a key generator, and a lock circuit. The error detectors sense the outputs generated by their processors and generate an error signal when defective data is sensed. The key generators develop multi-bit codes of known patterns that are disrupted in response to receipt of an error signal from an error detector. The codes generated by the key generators are supplied to lock circuits which produce the same known multi-bit codes, and which compare their own codes to the codes supplied by the key generators. If a mis-match is detected, it will be due to a disrupted code that resulted from an error signal. Data from the processor associated with the error signal is rejected.

Claims

1. A redundant processing system, comprising:

at least two processors for generating a plurality of signals, including output data signals;

at least two error detectors, each error detector being associated with a different one of the processors, each error detector receiving at least one of the signals generated by its associated processor for detecting errors in the received signal, and for generating an error signal when an error is detected;

at least two key generators, each key generator being associated with a different one of the error detectors, and each key generator developing a changing, multi-bit code of a certain sequence in the absence of an error signal received from its associated error detector, and wherein said sequence is disrupted in the presence of an error signal;

at least one lock circuit receiving the multi-bit codes from the key generators, developing a corresponding changing multi-bit code of the same certain sequence, and comparing its own code to the codes received from the key generators, and generating an output signal for identifying a processor having a signal in which an error has been detected when a mismatch occurs between a key generator'"'"'s code and the lock circuit'"'"'s code;

a data output port;

a logic circuit, coupled between the lock circuit and the data output port, receiving the output data signals from the processors, and responsive to the output signal from the lock circuit, for excluding, from the output port, an output data signal generated by a processor that is identified as having a signal with a detected error, and for coupling to the output port the output data signal generated by a processor that is not identified as having a signal with a detected error; and

a watchdog timer coupled to the logic circuit for disabling the control system when an output data signal fails to appear at the output port for a predetermined time period.

2. A redundant processing system, comprising:

at least two processors for generating a plurality of signals, including output data signals;

at least two error detectors, each error detector being associated with a different one of the processors, each error detector receiving at least one of the signals generated by its associated processor for detecting errors in the received signal, and for generating an error signal when an error is detected;

at least two key generators, each key generator being associated with a different one of the error detectors, and each key generator developing a changing multi-bit code of a certain sequence in the absence of an error signal received from its associated error detector, and wherein said sequence is disrupted in the presence of an error signal;

at least one lock circuit receiving the multi-bit codes from the key generators, developing a corresponding changing multi-bit code of the same certain sequence, and comparing its own code to the codes received from the key generators, and generating an output signal for identifying a processor having a signal in which an error has been detected when a mismatch occurs between a key generator'"'"'s code and the lock circuits'"'"'s code;

a data output port;

a logic circuit, coupled between the lock circuit and the data output port, receiving the output data signals from the processors and responsive to the output signal from the lock circuit, for excluding, from the output port, an output data signal generated by a processor that is identified as having a signal with a detected error, and for coupling to the output port the output data signal generated by a processor that is not identified as having a signal with a detected error, and wherein the logic circuit also identifies differences between the data output signal of one processor and the data output signal of the other processor; and

a monitor circuit coupled to the logic circuit and to the lock circuit for generating a shut-down signal in response to the output of the lock circuit being indicative of no errors in the processors'"'"' signals while the logic circuit indicates a difference between the processors'"'"' output data signals.

3. A redundant processing system, comprising:

a first processor receiving input data and generating a plurality of signals, including an output data signal;

a second processor receiving the same input data and generating a plurality of signals, including an output data signal which corresponds to the output data signal from the first processor when both processors are operating without errors;

a first error detector receiving at least one signal generated by the first processor for detecting errors in the received signal and for generating an error signal when an error is detected;

a second error detector receiving at least one signal generated by the second processor for detecting errors in the received signal and for generating an error signal when an error is detected;

a first key generator coupled to the first error detector for generating a first multi-bit code of a certain sequence and for disrupting the certain sequence in response to an error signal received from the first error detector;

a second key generator coupled to the second error detector for generating a second multi-bit code of a certain sequence and for disrupting the certain sequence in response to an error signal received from the second error detector;

a first lock circuit generating a multi-bit code of the same certain sequence as the code from the first key generator, for comparing its own code against the code generated by the first key generator, and for indicating the presence of an error when a mismatch occurs as a result of such comparison;

a second lock circuit generating a multi-bit code of the same certain sequence as the code from the second key generator, for comparing its own code against he code generated by the second key generator, and for indicating the presence of an error when a mismatch occurs as a result of such comparison;

means receiving the output data signals from the first and second processors and responsive to the indications from the first and second lock circuits, for selecting a data output signal from a processor that has not been identified as having an error in any of its signals; and

a watchdog system associated with each processor, each watchdog system including;

a watchdog processor for checking the output of its associated processor and for generating an output;

an error detector for sensing errors in the output of the watchdog processor;

a key generator coupled to the error detector; and

a lock circuit coupled to the key generator.