Method and apparatus for processing control using a multiple redundant processor control system

• US 6,988,221 B2
• Filed: 05/17/2004
• Issued: 01/17/2006
• Est. Priority Date: 12/18/1998
• Status: Expired due to Term

• Current Assignee: Schneider Electric Systems USA, Inc. (Schneider Electric SE)
• Original Assignee: Triconex
• Inventors: Rasmussen, David C., Gabler, John G., Popp, Ronald L.
• Primary Examiner(s): BADERMAN, SCOTT T
• Application Number:
  US10/848,542
• Publication Number:
  US 20050022054A1
• Time in Patent Office: 610 Days
• Field of Search: 714/11, 714/12, 714/797, 713/375
• US Class Current: 714/12
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/24186 Redundant processors are synchronised
• CPC Class Codes: G05B 2219/24187 Redundant processors run identical programs
• CPC Class Codes: G05B 2219/24195 Compare data in channels at timed intervals, for equality
• CPC Class Codes: G05B 2219/24196 Plausibility check in channels for correct sequence or result
• CPC Class Codes: G05B 2219/25428 Field device
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems
• CPC Class Codes: G06F 11/1443 Transmit or communication errors
• CPC Class Codes: G06F 11/1683 at instruction level
• CPC Class Codes: G06F 11/182 based on mutual exchange of the output between redundant processing components
• CPC Class Codes: G06F 11/183 by voting, the voting not being performed by the redundant components
• CPC Class Codes: G06F 11/184 where the redundant components implement processing functionality
• CPC Class Codes: G06F 11/188 where exact match is not required
• CPC Class Codes: G06F 11/20 using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
• CPC Class Codes: G06F 11/2005 using redundant communication controllers
• CPC Class Codes: G06F 11/2015 Redundant power supplies power supply failure G06F1/30
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare
• CPC Class Codes: G06F 11/2051 in regular structures
• CPC Class Codes: H04L 1/22 using redundant apparatus to increase reliability

Abstract

A system and method for synchronizing a plurality of main processors. At a first time and in response to a first time reference, a first rendezvous signal is sent from a first to a second of the plurality of main processors. At a second time, and in response to a second time reference, a second rendezvous signal is sent from the second of the plurality of main processors, to the first of said plurality of main processors. After the first rendezvous signal is received by the second of the plurality of main processors and the second rendezvous signal is received by the first of said plurality of main processors, substantially simultaneous scanning of control information is initiated by the first and second of the plurality of main processors. In variations, a difference between the first and second times signals a fault condition.

Claims

1. A method for synchronizing a plurality of main processors comprising:

sending from a first of said plurality of main processors, at a first time and in response to a first time reference, a first rendezvous signal to a second of said plurality of main processors;

sending from said second of said plurality of main processors, at a second time and in response to a second time reference, a second rendezvous signal to said first of said plurality of main processors; and

initiating, after said first rendezvous signal is received by said second of said plurality of main processors and said second rendezvous signal is received by said first of said plurality of main processors, substantially simultaneous scanning of control information by said first and second of said plurality of main processors.

2. The method of claim 1 wherein said first time reference is established by a first clock associated with said first of said plurality of main processors and said second time reference is established by a second clock associated with said second of said plurality of main processors.

3. The method of claim 2 including:

adjusting said first clock based upon a difference between said first time and a time when said second rendezvous signal is received by said first of said plurality of main processors.

4. The method of claim 1 including:

identifying, based upon a difference between said first time and a time when said second rendezvous signal is received by said first of said plurality of main processors, a fault condition.

5. The method of claim 1 including

sending, from a third of said plurality of main processors, at a third time and in response to a third time reference, a third rendezvous signal to said first and said second of said plurality of main processors;

wherein said initiating includes initiating substantially simultaneous scanning by said first, second and third of said plurality of main processors after said first rendezvous signal is received by said second of said plurality of main processors, said second rendezvous signal is received by said first of said plurality of main processors and said third rendezvous signal is received by said first and second of said plurality of main processors.

6. A synchronization system for synchronizing a plurality of main processor modules, said main processor modules being configured to process control information related to control elements, said synchronization system comprising:

a communication system configured to couple each of said plurality of main processor modules to all others of said plurality of main processor modules; and

a plurality of timers, each of said plurality of timers being coupled to a corresponding one of said plurality of main processor modules;

wherein each of said plurality of main processor modules is configured to send a rendezvous signal to all others of said plurality of main processor modules in response to an indication of an elapsed time provided by a corresponding one of said plurality of timers.

7. The synchronization system of claim 6 wherein each of said plurality of timers is internal to said corresponding one of said plurality of main processor modules.

8. The synchronization system of claim 6 wherein said communication system includes a communication bus coupled to each of said plurality of main processor modules.

9. The synchronization system of claim 6 wherein each of said main processor modules is configured to begin a scan for said control information after receiving rendezvous signals from all others of said plurality of main processor modules.

10. The synchronization system of claim 6 wherein at least one of said plurality of main processor modules includes:

a plurality of capture registers for capturing times when said at least one of said plurality of main processor modules sent a rendezvous signal and when said at least one of said plurality of main processor modules received rendezvous signals from all others of said plurality of main processor modules.

11. The synchronization system of claim 10 wherein said at least one of said plurality of main processor modules is configured to update one of said plurality of timers corresponding to said at least one of said plurality of main processor modules as a function of differences between said times.

12. The synchronization system of claim 10 wherein said at least one of said plurality of main processor modules is configured to detect a fault of one of said all others of said plurality of main processor modules based upon differences between said times.

13. A synchronization system for synchronizing a plurality of main processors comprising:

means for sending from a first of said plurality of main processors, at a first time and in response to a first time reference, a first rendezvous signal to a second of said plurality of main processors;

means for sending from said second of said plurality of main processors, at a second time and in response to a second time reference, a second rendezvous signal to said first of said plurality of main processors; and

means for initiating, after said first rendezvous signal is received by said second of said plurality of main processors and said second rendezvous signal is received by said first of said plurality of main processors, substantially simultaneous scanning of control information by said first and second of said plurality of main processors.

14. The synchronization system of claim 13 wherein said first time reference is established by a first clock associated with said first of said plurality of main processors and said second time reference is established by a second clock associated with said second of said plurality of main processors.

15. The synchronization system of claim 14 including:

means for adjusting said first clock based upon a difference between said first time and a time when said second rendezvous signal is received by said first of said plurality of main processors.

16. The synchronization system of claim 13 including:

means for identifying, based upon a difference between said first time and a time when said second rendezvous signal is received by said first of said plurality of main processors, a fault condition.

17. The synchronization system of claim 13 including

means for sending, from a third of said plurality of main processors, at a third time and in response to a third time reference, a third rendezvous signal to said first and said second of said plurality of main processors;

wherein said means for initiating includes means for initiating substantially simultaneous scanning by said first, second and third of said plurality of main processors after said first rendezvous signal is received by said second of said plurality of main processors, said second rendezvous signal is received by said first of said plurality of main processors and said third rendezvous signal is received by said first and second of said plurality of main processors.

18. A method for identifying a fault condition in a synchronization system comprising:

sending, at a first time and in response to a first time reference of a first main processor, a first rendezvous signal to a second main processor and a third main processor;

sending, at a second time and in response to a second time reference of said second main processor, a second rendezvous signal to said first main processor and said third main processor;

sending, at a third time and in response to a third time reference of said third main processor, a third rendezvous signal to said first and said second main processors;

receiving said second rendezvous signal and said third rendezvous signal at said first main processor at a fourth time and a fifth time, respectively; and

identifying a fault condition of one of said at least three main processors based upon differences between said first time and said fourth time and between said first time and said fifth time.

19. The method of claim 18 including:

adjusting a clock associated with said first time reference based upon differences between said first time and said fourth time and between said first time and said fifth time.

20. The method of claim 18 further including:

receiving said first rendezvous signal and said third rendezvous signal at said second of said at least three main processors at a sixth time and a seventh time, respectively; and

adjusting a clock associated with said second time reference based upon differences between said second time and said sixth time and said second time and said seventh time.

21. The method of claim 18 wherein each of said first, second and third time references are established by a corresponding one of a first, second and third clocks.