System and method for distinguishing a device failure from an inter-device communication failure

• US 6,351,829 B1
• Filed: 10/28/1998
• Issued: 02/26/2002
• Est. Priority Date: 10/28/1998
• Status: Expired due to Term

• Current Assignee: Honeywell Incorporated (Honeywell International Inc.)
• Original Assignee: Honeywell Incorporated (Honeywell International Inc.)
• Inventors: Dupont, Anthony J., Payne, Paul A.
• Primary Examiner(s): LE, DIEU MINH T
• Application Number:
  US09/181,095
• Time in Patent Office: 1,217 Days
• Field of Search: 714/48, 714/11, 714/12, 714/13, 714/14
• US Class Current: 714/48
• CPC Class Codes: G06F 11/0736 in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function testing or monitoring of automated control systems G05B23/02
• CPC Class Codes: G06F 11/0772 Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers
• CPC Class Codes: G06F 11/0778 Dumping, i.e. gathering error/state information after a fault for later diagnosis
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare

Abstract

For use in a control system containing first and second devices coupled together for inter-device communication, a circuit for and method of distinguishing a failure of the first device from a failure of the inter-device communication and a real-time process control system employing the circuit or the method. In one embodiment, the circuit includes: (1) a device failure signal generator, associated with and separately powered from the first device, that communicates a device failure signal to the second device upon occurrence of a predetermined condition and (2) a device failure signal detector, associated with the second device, that detects the device failure signal. Detection of the device failure signal contraindicates a failure of the inter-device communication.

Claims

1. For use in a control system containing first and second devices coupled together for inter-device communication, a circuit for distinguishing a failure of said first device from a failure of said inter-device communication, comprising:

a device failure signal generator, associated with and separately powered from said first device, that communicates a device failure signal to said second device upon occurrence of a predetermined condition; and

a device failure signal detector, associated with said second device, that detects said device failure signal, detection of said device failure signal contraindicating a failure of said inter-device communication.

2. The circuit as recited in claim 1 wherein said first and second devices are primary and secondary controllers of said control system, respectively.

3. The circuit as recited in claim 1 wherein said predetermined condition is a loss of power to said first device.

4. The circuit as recited in claim 1 wherein said predetermined condition is receipt of a selected one of:

a hardware command,

a software command, and

a signal generated by hardware external to a processor that monitors system integrity.

5. The circuit as recited in claim 1 wherein said device failure signal contains a predetermined data pattern.

6. The circuit as recited in claim 1 wherein said device failure signal generator is powered by a power supply that derives power from a power supply of said first device.

7. The circuit as recited in claim 1 wherein said inter-device communication occurs over a selected one of:

an electrical conductor, and

an optical fiber.

8. For use in a control system containing first and second devices coupled together for inter-device communication, a method of distinguishing a failure of said first device from a failure of said inter-device communication, comprising the steps of:

communicating, with a device failure signal generator associated with and separately powered from said first device, a device failure signal to said second device upon occurrence of a predetermined condition; and

detecting said device failure signal at said second device, detection of said device failure signal contraindicating a failure of said inter-device communication.

9. The method as recited in claim 8 wherein said first and second devices are primary and secondary controllers of said control system, respectively.

10. The method as recited in claim 8 wherein said step of communicating is carried out upon a loss of power to said first device.

11. The method as recited in claim 8 wherein said step of communicating is carried out upon receipt of a selected one of:

a hardware command,

a software command, and

a signal generated by hardware external to a processor that monitors system integrity.

12. The method as recited in claim 8 wherein said device failure signal contains a predetermined data pattern.

13. The method as recited in claim 8 wherein said device failure signal generator is powered by a power supply that derives power from a power supply of said first device.

14. The method as recited in claim 8 wherein said step of communicating comprises the step of transmitting said device failure signal over a selected one of:

an electrical conductor, and

an optical fiber.

15. A real-time process control system, comprising:

a primary controller that controls said system;

a secondary controller that assumes control of said system upon failure of said primary controller;

a communication channel coupling said primary and secondary controllers that allows said primary and secondary controllers to communicate; and

a circuit for distinguishing a failure of said primary controller from a failure of said communication channel, including;

a device failure signal generator, associated with and separately powered from said primary controller, that communicates a device failure signal to said secondary controller upon occurrence of a predetermined condition, and

a device failure signal detector, associated with said secondary controller, that detects said device failure signal, detection of said device failure signal contraindicating a failure of said communication channel and prompting said secondary controller to assume said control of said system.

16. The system as recited in claim 15 wherein said predetermined condition is a loss of power to said primary controller.

17. The system as recited in claim 15 wherein said predetermined condition is receipt of a selected one of:

a hardware command,

a software command, and

a signal generated by hardware external to a processor that monitors system integrity.

18. The system as recited in claim 15 wherein said device failure signal contains a predetermined data pattern.

19. The system as recited in claim 15 wherein said device failure signal generator is powered by a power supply that derives power from a power supply of said primary controller.

20. The system as recited in claim 15 wherein said communication channel is over a selected one of:

an electrical conductor, and

an optical fiber.