Method and apparatus for processing control using a multiple redundant processor control system related applications

• US 6,754,846 B2
• Filed: 08/22/2002
• Issued: 06/22/2004
• Est. Priority Date: 12/18/1998
• Status: Expired due to Term

• Current Assignee: Schneider Electric Systems USA, Inc. (Schneider Electric SE)
• Original Assignee: Invensys Systems Incorporated (Invensys PLC)
• Inventors: Popp, Ronald L., Gabler, John C., Rasmussen, David C.
• Primary Examiner(s): BADERMAN, SCOTT T
• Application Number:
  US10/226,454
• Publication Number:
  US 20030188221A1
• Time in Patent Office: 670 Days
• Field of Search: 714/11, 714/12, 714/797
• US Class Current: 714/11
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/24186 Redundant processors are synchronised
• CPC Class Codes: G05B 2219/24187 Redundant processors run identical programs
• CPC Class Codes: G05B 2219/24195 Compare data in channels at timed intervals, for equality
• CPC Class Codes: G05B 2219/24196 Plausibility check in channels for correct sequence or result
• CPC Class Codes: G05B 2219/25428 Field device
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems
• CPC Class Codes: G06F 11/1443 Transmit or communication errors
• CPC Class Codes: G06F 11/1683 at instruction level
• CPC Class Codes: G06F 11/182 based on mutual exchange of the output between redundant processing components
• CPC Class Codes: G06F 11/183 by voting, the voting not being performed by the redundant components
• CPC Class Codes: G06F 11/184 where the redundant components implement processing functionality
• CPC Class Codes: G06F 11/188 where exact match is not required
• CPC Class Codes: G06F 11/20 using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
• CPC Class Codes: G06F 11/2005 using redundant communication controllers
• CPC Class Codes: G06F 11/2015 Redundant power supplies power supply failure G06F1/30
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare
• CPC Class Codes: G06F 11/2051 in regular structures
• CPC Class Codes: H04L 1/22 using redundant apparatus to increase reliability

Abstract

A control system for executing an application program is disclosed herein. The control system includes a plurality of main processor modules. The control system further includes a plurality of input/output modules for providing input process data to associated ones of the plurality of main processor modules. A voting system is operative to compare the input process data associated with first and second of the plurality of main processor modules to the input process data associated with a third of the main processor modules. This results in generation of voted input process data utilized by the third main processor module in executing the application program. In certain implementations the system includes a high-speed bus for distributing the voted input process data to the first and second main processor modules, each of which also executes the application program based upon the voted input process data.

Claims

1. A control system for executing an application program, said control system comprising:

a plurality of main processor modules;

a plurality of input/output modules for providing input process data to associated ones of said plurality of main processor modules; and

a voting system which compares said input process data associated with first and second of said plurality of main processor modules to said input process data associated with a third one of said main processor modules in order to thereby generate voted input process data, said third one of said main processor modules executing said application program based upon said voted input process data.

2. The control system of claim 1 further including a high-speed bus for distributing said voted input process data to said first and second of said plurality of main processor modules wherein said first and second of said plurality of main processor modules execute said application program based upon said voted input process data.

3. The control system of claim 1 wherein said voting system compares output data generated by said first and second of said plurality of main processor modules as a result of execution of said application program to output data generated by said third one of said main processor modules in order to thereby generate voted output data, said third one of said main processor modules providing said voted output data to the one of said plurality of input/output modules associated therewith.

4. The control system of claim 3 wherein said high-speed bus further distributes said voted output data to said first and second of said plurality of main processor modules to enable said first and second of said plurality of main processor modules to the ones of said plurality of input/output modules respectively associated therewith.

5. The control system of claim 1 further including a time synchronization system for synchronizing timing of said plurality main processor modules.

6. A multiple redundant processor control system comprising:

a plurality of synchronized main processor modules each configured to execute an application program;

an equal plurality of input/output modules respectively associated with corresponding ones of said plurality of main processor modules;

an equal plurality of data buses connected between said equal plurality of input/output modules and said corresponding ones of said plurality of synchronized main processor modules; and

an equal plurality of voting modules respectively incorporated with said plurality of synchronized main processor modules, each of said equal plurality of voting modules receiving input process data from all of said equal plurality of data buses and generating voted input process data utilized by its associated one of said plurality of synchronized main processor modules during execution of said application program.

7. The control system of claim 6 further including means for comparing output data generated by said plurality of synchronized main processor modules as a result of execution of said application program in order to thereby generate voted output data, each of said plurality of synchronized main processor modules providing said voted output data to the one of said equal plurality of input/output modules associated therewith.