Remote multiplexer terminal with redundant central processor units

• US 4,610,013 A
• Filed: 11/08/1983
• Issued: 09/02/1986
• Est. Priority Date: 11/08/1983
• Status: Expired due to Fees

• Current Assignee: JM Huber Corporation
• Original Assignee: Avco Corporation (Textron Inc)
• Inventors: Long, James R., Harrill, Roy L.
• Primary Examiner(s): Fleming, Michael R.
• Application Number:
  US06/549,776
• Time in Patent Office: 1,029 Days
• Field of Search: 364/200, 364/900, 371/62, 371/8, 371/9, 371/12, 371/66, 371/62, 371/5
• US Class Current: 714/11
• CPC Class Codes: G06F 11/0724 in a multiprocessor or a multi-core unit multiprocessors per se G06F15/80
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/1679 at clock signal level
• CPC Class Codes: G06F 11/2017 where memory access, memory control or I/O control functionality is redundant redundant communication control functionality G06F11/2005; redundant storage control functionality G06F11/2089
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare
• CPC Class Codes: G06F 11/2033 switching over of hardware resources
• CPC Class Codes: G06F 11/2038 with a single idle spare processing component

Abstract

An approach is disclosed for accomplishing redundancy in the central processor units of a remote multiplexer terminal (RMT). Through execution of a stored software program the RMT receives data from input/output devices, processes that data and transmits it to external equipment. The system uses two central processor units (CPU'"'"'s), each with its own input/output (I/O) bus. Both CPU'"'"'s actively and continuously monitor the status of the I/O subsystems. The software program designates one CPU as the "Master", the other CPU as the "Slave". The CPU designated as "Master" performs active control functions so long as error detection circuitry within each CPU determines that the operational status of the "Master" is good. Error detection is accomplished by incorporation of a "Watch Dog Timer" in each CPU. A failing CPU is redesignated to be a Slave (and is halted) and the previously designated Slave CPU is redesignated as a Master. Since it has been "shadowing" the old Master CPU, the new Master CPU has a current record of the status of the I/O subsystems stored in its memory. Using this data, the new Master CPU assumes control over all of the I/O functions that were previously being controlled by the old Master CPU. No physical switchover occurs - only a software failover.

Claims

1. Apparatus for providing a remote multiplexer terminal with a failover capability from a first central processor unit to a second central processor unit without loss of data, said remote multiplexer terminal being a data acquisition and control system capable of receiving data at a clocked rate from a multiplicity of input/output devices and after processing that data according to a software program, delivering the results to an external equipment, the software program additionally serving to designate the first central processor unit as the "Master" and the second central processor unit as the "Slave", the apparatus being integral with the central processor units and comprising:

dual ported bus architecture circuits allowing the multiplicity of input/output devices to simultaneously present all input/output data to both central processor units thereby enabling both of said central processor units to receive and process the same data concurrently;

encircuiting means providing each of said central processor units with a watch dog timer for continuously monitoring the operational performance of its associated central processor unit, each watch dog timer including provision for repetitiously monitoring the ability of its associated central processor unit to properly decode a periodically sent predetermined message sequence, an improper result signifying a malfunction, said watch dog timer for the central processor unit functioning as "Master" further having the capability to transfer control of said remote multiplexer terminal to the "Slave" central processor unit when said "Master" malfunctions; and

parallel linkage means between the dual central processor units serving to transfer control over all input/output functions without delay or loss of data when failover occurs on the malfunction of the first or "Master" central processor unit.

2. The invention as defined in claim 1 wherein each of said first and second central processor units comprises a printed circuit board assembly which includes and encircuits a microprocessor, a system timing controller, an interrupt controller and a CPU-to-CPU parallel link module.

4. The invention as defined in claim 2 and including linkages connecting the CPU-to-CPU parallel link module of said first central processor unit with the CPU-to-CPU parallel link module of said second central processor unit.

5. The invention as defined in claim 2 wherein the system timing controller is a software programmable multiple counter integrated circuit.

6. The invention as defined in claim 5 wherein the watch dog counter comprises one section of the system timing controller.

3. The invention as defined in claim 3 wherein the microprocessor is a 16 bit unit.