Hot standby method and apparatus

• US 7,437,605 B2
• Filed: 09/09/2003
• Issued: 10/14/2008
• Est. Priority Date: 09/10/2002
• Status: Expired due to Fees

• Current Assignee: Ansaldo STS SPA
• Original Assignee: Union Switch & Signal, Inc. (Hitachi, Ltd.)
• Inventors: Blevins, Joseph S. Sr.
• Primary Examiner(s): DUNCAN, MARC M
• Application Number:
  US10/526,951
• Publication Number:
  US 20070168710A1
• Time in Patent Office: 1,862 Days
• Field of Search: 714/10, 714/11, 714/12
• US Class Current: 714/11
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems
• CPC Class Codes: G06F 11/0796 Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element
• CPC Class Codes: G06F 11/2038 with a single idle spare processing component

Abstract

An apparatus provides hot standby operation with normal and standby processors, each of which includes vital inputs electrically interconnected with the vital inputs of the other processor, vital outputs, and an application routine inputting the vital inputs and outputting the vital outputs. Communication ports communicate with communication ports of the other processor. A health routine provides a health status after communication is established with the other processor. A vital relay includes an input controlled by a vital output and an output to a vital input of the other processor. A synchronization routine provides a synchronization status through the communication ports. The application routine outputs the vital outputs when the synchronization status is set. The standby processor includes a reset routine, which resets the standby processor when the health status of that processor is not provided. A vital “OR” circuit outputs from the vital outputs of the normal and standby processors.

Claims

1. An apparatus for providing hot standby operation, said apparatus comprising:

a normal processor;

a standby processor;

each of said normal and standby processors comprising;

a plurality of vital inputs, at least some of said vital inputs being electrically interconnected with at least some of said vital inputs of the other one of said standby and normal processors,

a plurality of vital outputs,

means for communicating with the other one of said standby and normal processors,

a health routine providing a health status after communication is established with the other one of said standby and normal processors through said means for communicating,

a vital relay including an input controlled by one of said vital outputs and an output to one of said vital inputs of the other one of said standby and normal processors,

a synchronization routine providing a synchronization status through said means for communicating with the other one of said standby and normal processors, and

an application routine outputting said vital outputs when said synchronization status is set and inputting said vital inputs;

said standby processor further comprising a reset routine, which resets said standby processor when said health status of said standby processor is not provided; and

means for outputting from some of said vital outputs of said normal processor and from some of said vital outputs of said standby processor.

2. The apparatus of claim 1 wherein said normal and standby processors operate in at least one mode selected from the group comprising:

a first mode wherein both of said normal and standby processors output through at least one of said some of said vital outputs of said normal and standby processors, respectively, without restriction;

a second mode wherein said normal processor outputs through at least one of said some of said vital outputs of said normal processor without restriction and said standby processor verifies through said means for communicating of said standby processor that said standby processor agrees with said normal processor before outputting through at least one of said some of said vital outputs of said standby processor and, otherwise, said standby processor being reset; and

a third mode wherein both of said normal and standby processors verify through said means for communicating of said normal and standby processors, respectively, that said normal and standby processors, respectively, agree with said standby and normal processors, respectively, before outputting through at least one of said some of said vital outputs of said normal and standby processors, respectively, and, otherwise, said normal and standby processors being reset.

3. The apparatus of claim 2 wherein for said first mode the application routines of said normal and standby processors enable said some of said vital outputs of said normal and standby processors, respectively, if the output of said vital relay of said standby and normal processors, respectively, is set and if the health routine of said normal and standby processors, respectively, determines said health status.

4. The apparatus of claim 2 wherein for said second mode the application routine of said normal processor enables said some of said vital outputs of said normal processor if the output of said vital relay of said standby processor is set and if the health routine of said normal processor determines said health status.

5. The apparatus of claim 2 wherein for said second mode the application routine of said standby processor enables one of said some of said vital outputs of said standby processor if the output of said vital relay of said normal processor is set, if the health routine of said standby processor determines said health status, and if said standby processor verifies through said means for communicating of said standby processor that said one of said some of said vital outputs of said standby processor agrees with a corresponding one of said some of said vital outputs of said normal processor.

6. The apparatus of claim 2 wherein for said third mode the application routines of said normal and standby processors enable one of said some of said vital outputs of said normal and standby processors, respectively, if the output of said vital relay of said standby and normal processors, respectively, is set, and if the health routine of said normal and standby processors, respectively, determines said health status, and if said normal and standby processors verify through said means for communicating of said normal and standby processors, respectively, that said one of said some of said vital outputs of said normal and standby processors, respectively, agrees with said standby and normal processors, respectively.

7. The apparatus of claim 1 wherein both of said normal and standby processors operate in a mode in which said normal and standby processors output through at least one of said some of said vital outputs of said normal and standby processors, respectively, without restriction.

8. The apparatus of claim 1 wherein said normal and standby processors operate in modes wherein said normal processor outputs through at least one of said some of said vital outputs of said normal processor without restriction and said standby processor verifies through said means for communicating of said standby processor that said standby processor agrees with said normal processor before outputting through at least one of said some of said vital outputs of said standby processor and, otherwise, said standby processor being reset.

9. The apparatus of claim 8 wherein the application routine of said standby processor enables one of said some of said vital outputs of said standby processor if the health routine of said standby processor determines said health status and if said standby processor verifies through said means for communicating of said standby processor that said one of said some of said vital outputs of said standby processor agrees with a corresponding one of said some of said vital outputs of said normal processor.

10. The apparatus of claim 8 wherein said some of said vital outputs of said normal and standby processors include signal lighting outputs.

11. The apparatus of claim 1 wherein said normal and standby processors operate in mode wherein both of said normal and standby processors verify through said means for communicating of said normal and standby processors, respectively, that said normal and standby processors, respectively, agree with said standby and normal processors, respectively, before outputting through at least one of said some of said vital outputs of said normal and standby processors, respectively, and, otherwise, said normal and standby processors are reset.

12. The apparatus of claim 11 wherein said some of said vital outputs of said normal and standby processors include lock outputs.

13. The apparatus of claim 12 wherein said lock outputs include a first lock output and a second lock output;

wherein the first lock output of said normal processor is in agreement with the first lock output of said standby processor;

wherein both of said first lock outputs are set to an unlocked state;

wherein the second lock output of said normal processor is not in agreement with second lock output of said standby processor; and

wherein both of said second lock outputs are set to a locked state.

14. The apparatus of claim 12 wherein said lock outputs include a first lock output and a second lock output;

wherein the first lock output of said normal processor is in agreement with the first lock output of said standby processor;

wherein both of said first lock outputs are set to a locked state;

wherein the second lock output of said normal processor is not in agreement with second lock output of said standby processor; and

wherein both of said second lock outputs are set to a locked state.

15. The apparatus of claim 2 wherein both of said normal and standby processors are operating and capable of outputting through said means for outputting to a single output device.

16. The apparatus of claim 15 wherein said means for outputting includes a first diode having an anode and a cathode and a second diode having an anode and a cathode;

wherein said cathodes are adapted for electrical connection to said single output device;

wherein the anode of said first diode is electrically connected to one of said some of said vital outputs of said normal processor; and

wherein the anode of said second diode is electrically connected to a corresponding one of said some of said vital outputs of said standby processor.

17. The apparatus of claim 15 wherein said means for outputting includes a first diode array having an input and an output and a second diode array having an input and an output;

wherein said outputs of said first and second diode arrays are adapted for electrical connection to said single output device;

wherein the input of said first diode array is electrically connected to one of said some of said vital outputs of said normal processor, and wherein the input of said second diode array is electrically connected to a corresponding one of said some of said vital outputs of said standby processor.

18. The apparatus of claim 17 wherein each of said first and second diode arrays includes a first pair of series-connected diodes and a second pair of series-connected diodes, said first pair of series-connected diodes being electrically connected in parallel with said second pair of series-connected diodes, said first and second pairs having a pair of anodes as the input of the corresponding one of said first and second diode arrays, said first and second pairs having a pair of cathodes as the output of the corresponding one of said first and second diode arrays.

19. The apparatus of claim 1 wherein said means for outputting includes a vital OR circuit having a first input from one of said some of said vital outputs of said normal processor, a second input from one of said some of said vital outputs of said standby processor, and an output adapted to output to a single output device.

20. The apparatus of claim 1 wherein said means for communicating includes at least one communication port adapted for communication with the other one of said standby and normal processors.

21. The apparatus of claim 20 wherein said at least one communication port is at least one serial communication port.

22. The apparatus of claim 21 wherein said at least one serial communication port includes an output serial communication port for outputting serial data from one of said standby and normal processors to the other of said standby and normal processors, and further includes an input serial communication port for inputting serial data from the other one of said standby and normal processors to said one of said standby and normal processors.

23. The apparatus of claim 1 wherein said normal and standby processors form an interlocking control system.

24. The apparatus of claim 1 wherein said health routine of said normal and standby processors periodically exchanges health information with said health routine of said standby and normal processors, respectively, in order to provide said health status when said one of said vital inputs of the other one of said standby and normal processors is set and said health information is periodically received.

25. The apparatus of claim 24 wherein said normal and standby processors operate in a mode wherein both of said normal and standby processors verify through said means for communicating of said normal and standby processors, respectively, that said normal and standby processors, respectively, agree with said standby and normal processors, respectively, before outputting through at least one of said some of said vital outputs of said normal and standby processors, respectively, and, otherwise, said normal and standby processors being reset;

wherein the application routines of said normal and standby processors enable one of said some of said vital outputs of said normal and standby processors, respectively, if the output of said vital relay of said standby and normal processors, respectively, is set, and if the health routine of said normal and standby processors, respectively, determines said health status, and if said normal and standby processors verify through said means for communicating of said normal and standby processors, respectively, that said one of said some of said vital outputs of said normal and standby processors, respectively, agree with said standby and normal processors, respectively.

26. The apparatus of claim 24 wherein the health routine of said normal processor outputs a reset command to said standby processor whenever the input of said vital relay controlled by said one of said vital outputs of said normal processor is set and the synchronization routine of said normal processor loses said synchronization status;

and wherein said reset routine of said standby processor employs said reset command to reset said standby processor.

27. The apparatus of claim 26 wherein said reset routine of said standby processor initially ignores said reset command when said synchronization status is not set.

28. The apparatus of claim 1 wherein said application routine outputs said vital outputs:

(a) when said one of said vital inputs of the other one of said standby and normal processors is not set; and

(b) when said one of said vital inputs of the other one of said standby and normal processors is set and said synchronization status is set.

29. The apparatus of claim 1 wherein said one of said vital inputs of both of said normal and standby processors is set;

wherein said standby processor verifies through said means for communicating of said standby processor that said standby processor disagrees with said normal processor before outputting through at least one of said some of said vital outputs of said standby processor; and

wherein said reset routine of said standby processor resets said standby processor.

30. The apparatus of claim 1 wherein said one of said vital inputs of both of said normal and standby processors is set;

wherein said normal processor verifies through said means for communicating of said normal processor that said standby processor disagrees with said normal processor before outputting through at least one of said some of said vital outputs of said normal processor; and

wherein said reset routine of said normal processor outputs a reset command through said means for communicating of said normal processor to reset said standby processor.

31. The apparatus of claim 1 wherein said synchronization routine of said normal and standby processors sets said synchronization status when said one of said vital inputs of the other one of said standby and normal processors, respectively, is set, and when said normal and standby processors, respectively, verifies through said means for communicating that said one of said some of said vital outputs of said normal and standby processors, respectively, agrees with the corresponding one of said some of said vital outputs of said standby and normal processors, respectively.

32. The apparatus of claim 1 wherein when said synchronization status of one of said standby and normal processors is not set, when said one of said vital inputs of the other one of said standby and normal processors is set, and when said one of said normal and standby processors, respectively, verifies through said means for communicating of said normal and standby processors, respectively, that said standby processor disagrees with said normal processor, said at least one of said some of said vital outputs is disabled.

33. A hot standby method comprising:

employing a normal processor;

employing a standby processor;

with each of said normal and standby processors;

employing a plurality of vital inputs,

electrically interconnecting at least some of said vital inputs with at least some of said vital inputs of the other one of said standby and normal processors,

employing a plurality of vital outputs,

communicating with the other one of said standby and normal processors,

providing a health status after communication is established with the other one of said standby and normal processors,

employing a vital relay including an input controlled by one of said vital outputs and an output to one of said vital inputs of the other one of said standby and normal processors,

providing a synchronization status associated with said communicating with the other one of said standby and normal processors, and

employing an application routine for outputting said vital outputs when said synchronization status is set and inputting said vital inputs;

employing with said standby processor a reset routine, which resets said standby processor when said health status of said standby processor is not provided; and

outputting from some of said vital outputs of said normal processor and from some of said vital outputs of said standby processor.

34. The method of claim 33 further comprising

operating said normal and standby processors in a mode wherein both of said normal and standby processors output through at least one of said some of said vital outputs of said normal and standby processors, respectively, without restriction;

and

enabling said some of said vital outputs of said normal and standby processors, respectively, if the output of said vital relay of said standby and normal processors, respectively, is set and if said normal and standby processors, respectively, determine said health status.

35. The method of claim 33 further comprising

operating said normal processor in a mode to output through at least one of said some of said vital outputs of said normal processor without restriction;

and

operating said standby processor in a mode to verify through said communicating that said standby processor agrees with said normal processor before outputting through at least one of said some of said vital outputs of said standby processor and, otherwise, resetting said standby processor.

36. The method of claim 35 further comprising

enabling said some of said vital outputs of said normal processor if the output of said vital relay of said standby processor is set and if said normal processor determines said health status.

37. The method of claim 35 further comprising

enabling one of said some of said vital outputs of said standby processor if the output of said vital relay of said normal processor is set, if said standby processor determines said health status, and if said standby processor verifies through said communicating that said one of said some of said vital outputs of said standby processor agrees with a corresponding one of said some of said vital outputs of said normal processor.

38. The method of claim 33 further comprising

operating said normal and standby processors in a mode wherein both of said normal and standby processors verify through said communicating that said normal and standby processors, respectively, agree with said standby and normal processors, respectively, before outputting through at least one of said some of said vital outputs of said normal and standby processors, respectively, and, otherwise, resetting said normal and standby processors.

39. The method of claim 38 further comprising

enabling one of said some of said vital outputs of said normal and standby processors, respectively, if the output of said vital relay of said standby and normal processors, respectively, is set, and if said normal and standby processors, respectively, determine said health status, and if said normal and standby processors verify through said communicating that said one of said some of said vital outputs of said normal and standby processors, respectively, agrees with said standby and normal processors, respectively.

40. The method of claim 33 further comprising

operating said normal and standby processors in a mode wherein both of said normal and standby processors verify through said communicating that said normal and standby processors, respectively, agree with said standby and normal processors, respectively, before outputting through at least one of said some of said vital outputs of said normal and standby processors, respectively, and, otherwise, resetting said normal and standby processors.

41. The method of claim 33 further comprising

employing a vital OR circuit having a first input from one of said some of said vital outputs of said normal processor, a second input from one of said some of said vital outputs of said standby processor, and an output adapted to output to a single output device.

42. The method of claim 33 further comprising

forming an interlocking control system with said normal and standby processors.

43. The method of claim 33 further comprising

periodically exchanging health information between said standby and normal processors, respectively, in order to provide said health status when said one of said vital inputs of the other one of said standby and normal processors is set and said health information is periodically received.

44. The method of claim 43 further comprising

ignoring said reset command when said synchronization status is not set.

45. The method of claim 33 further comprising

outputting said vital outputs:

(a) when said one of said vital inputs of the other one of said standby and normal processors is not set; and

(b) when said one of said vital inputs of the other one of said standby and normal processors is set and said synchronization status is set.

46. The method of claim 33 further comprising

setting said one of said vital inputs of both of said normal and standby processors;

and

verifying through said communicating that said standby processor disagrees with said normal processor before outputting through at least one of said some of said vital outputs of said standby processor, and responsively resetting said standby processor.

47. A method for providing normal and standby processors, said method comprising:

employing a normal processor;

employing a standby processor;

with each of said normal and standby processors;

employing a plurality of vital inputs,

electrically interconnecting at least some of said vital inputs with at least some of said vital inputs of the other one of said standby and normal processors,

employing a plurality of vital outputs,

communicating with the other one of said standby and normal processors,

providing a health status after communication is established with the other one of said standby and normal processors,

employing a vital relay including an input controlled by one of said vital outputs and an output to one of said vital inputs of the other one of said standby and normal processors,

providing a synchronization status associated with said communicating with the other one of said standby and normal processors, and

employing an application routine for outputting said vital outputs when said synchronization status is set and inputting said vital inputs;

employing with said standby processor a reset routine, which resets said standby processor when said health status of said standby processor is not provided;

outputting from some of said vital outputs of said normal processor and from some of said vital outputs of said standby processor; and

disabling said some of said vital outputs of said standby processor if the output of said vital relay of said normal processor is set.