Logical, fail-functional, dual central processor units formed from three processor units

• US 5,838,894 A
• Filed: 06/07/1995
• Issued: 11/17/1998
• Est. Priority Date: 12/17/1992
• Status: Expired due to Term

• Current Assignee: HTC Corporation
• Original Assignee: Tandem Computers Incorporated (HP Inc.)
• Inventors: Horst, Robert W.
• Primary Examiner(s): An, Meng-Ai T.
• Application Number:
  US08/484,281
• Time in Patent Office: 1,259 Days
• Field of Search: 395/180, 395/182.09, 395/182.1, 395/200.01, 395/420, 395/421.04, 395/840, 395/853, 395/881, 370/58.2
• US Class Current: 714/11
• CPC Class Codes: G01R 31/31727 Clock circuits aspects, e.g. test clock circuit details, timing aspects for signal generation, circuits for testing clocks G01R31/31725 takes precedence; concerning scan test G01R31/318552, for tester hardware G01R31/31922
• CPC Class Codes: G01R 31/318533 using scanning techniques, e.g. LSSD, Boundary Scan, JTAG
• CPC Class Codes: G06F 1/12 Synchronisation of different clock signals provided by a plurality of clock generators
• CPC Class Codes: G06F 11/004 Error avoidance G06F11/07 and subgroups take precedence
• CPC Class Codes: G06F 11/10 Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's
• CPC Class Codes: G06F 11/1044 with specific ECC/EDC distribution
• CPC Class Codes: G06F 11/1604 where the fault affects the clock signals of a processing unit and the redundancy is at or within the level of clock signal generation hardware
• CPC Class Codes: G06F 11/1633 using mutual exchange of the output between the redundant processing components
• CPC Class Codes: G06F 11/1645 and the comparison itself uses redundant hardware
• CPC Class Codes: G06F 11/165 with continued operation after detection of the error
• CPC Class Codes: G06F 11/1658 Data re-synchronization of a redundant component, or initial sync of replacement, additional or spare unit
• CPC Class Codes: G06F 11/167 Error detection by comparing the memory output
• CPC Class Codes: G06F 11/1679 at clock signal level
• CPC Class Codes: G06F 11/1683 at instruction level
• CPC Class Codes: G06F 11/1687 at event level, e.g. by interrupt or result of polling
• CPC Class Codes: G06F 11/1695 which are operating with time diversity
• CPC Class Codes: G06F 11/20 using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
• CPC Class Codes: G06F 11/2043 where the redundant components share a common memory address space
• CPC Class Codes: G06F 11/2097 maintaining the standby controller/processing unit updated initialisation or re-synchronisation thereof G06F11/1658 and subgroups
• CPC Class Codes: G06F 11/2736 using a dedicated service processor for test
• CPC Class Codes: G06F 12/0815 : Cache consistency protocols
• CPC Class Codes: G06F 12/1483 : using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 2201/845 : Systems in which the redundancy can be transformed in increased performance
• CPC Class Codes: H04L 12/56 : Packet switching systems
• CPC Class Codes: H04L 47/10 : Flow control; Congestion control
• CPC Class Codes: H04L 49/90 : Buffering arrangements
• CPC Class Codes: H04L 49/901 : using storage descriptor, e.g. read or write pointers
• CPC Class Codes: H04L 49/9057 : Arrangements for supporting packet reassembly or resequencing
• CPC Class Codes: H04L 69/40 : for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection management of faults, events, alarms or notifications in data switching networks H04L41/06

Abstract

A computing system includes a pair of central processor units structured to operate in substantial synchronism to each execute the same instruction at substantially the same moment in time of identical instruction streams to achieve a logical central processor unit with fail-functional operation. One of the central processor units includes a pair of processors that execute, instruction by instruction, the instruction stream with checking for fail-fast operation. The other central processor unit includes only a single processor element. The system achieves a low cost fail-functional architecture.

Claims

1. A fault tolerant processing system, comprising:

a first central processing unit comprising a pair of first processor devices operating to execute each instruction of an instruction stream at substantially the same moment in time;

a second central processing unit comprising a second processor device operating to execute each instruction of substantially an identical copy of the instruction stream, the pair of first processor devices and the second processor device executing identical instructions of the instruction stream and the identical copy of the instruction stream at substantially the same moment in time;

whereby the first and second central processing units operate in synchronism to perform substantially the same operations at substantially the same moments in time, including providing output data; and

a data checking element connected to receive and compare the output data from the first and second central processing units, and selectively outputting the output data from the first or the second central processing unit;

wherein said first and second central processing units operate in error-checking redundancy, duplexed pair.

2. The fault tolerant processing system of claim 1, wherein the pair of first processor devices and the second processor device are each microprocessors.

3. The fault tolerant processing system of claim 1, wherein the data checking element is a data communicating element having at least one output and first and second inputs respectively connected to the first and second central processing units, the data communicating element operating to receive output data from the first and second central processing units.

4. The fault tolerant processing system of claim 3, including a data sending device coupled to the output of the data communicating device for receiving input data thereat, and wherein the data communicating element replicates the received input data and transmits the received input data to the first and second central processor elements at substantially the same time.

5. A fail-functional processing system, comprising:

a first central processor unit including a pair of processor elements constructed to execute identical instructions at substantially the same moment in time of a first instruction stream;

a second central processor unit having a single processor element constructed to execute instructions of a second instruction stream;

the first and second central processor units operating in a first mode in which the first and second instruction streams are different, and a second mode in which the first and second instruction streams are identical, and the pair of processor elements and the single processor element execute identical instructions at substantially the same moment in time; and

a data checking element coupled to the first and second central processor units to receive and compare output data therefrom and to issue an indication of a mis-compare if output data received from the first central processor unit does not match output data received from the second central processor unit when the first and second central processor units are operating in the second mode;

wherein said first and second central processing units operate in error-checking redundancy, duplexed pair.

6. The processing system of claim 5, including at least one peripheral device, and wherein the data checking element is included in a routing unit that is coupled to communicate output data from the first and second central processor units to the peripheral device.

7. The processing system of claim 6, wherein the routing unit operates to communicate only output data received from the first central processor unit for communication to the peripheral device when the first and second processor units are operating in the second mode.