초록 ▼

A system and method for reintegration of a redundant controller after occurrence of a fault is provided, comprising synchronizing outputs of a primary controller with outputs of secondary controllers. The controller is placed in a different mode of operation in which its output is not used in system

A system and method for reintegration of a redundant controller after occurrence of a fault is provided, comprising synchronizing outputs of a primary controller with outputs of secondary controllers. The controller is placed in a different mode of operation in which its output is not used in system control. A meta-controller is activated to drive the primary controller to the same states at which the secondary or redundant controllers operate. A voting mechanism is used to determine a fault in an output to a controlled device. Control of the device using the secondary outputs is effected. The primary controller recalculates the primary output, based upon the primary output; a feedback signal; and, the secondary outputs. Control using the primary output is permitted when the primary output is within an allowable range of the secondary outputs.

대표청구항 ▼

Having thus described the invention, it is claimed: 1. Fault-tolerant control system, comprising: a primary controller, operable to determine a primary output based upon a first input signal, a first secondary controller, operable to determine a secondary output based upon a second input signal; a

Having thus described the invention, it is claimed: 1. Fault-tolerant control system, comprising: a primary controller, operable to determine a primary output based upon a first input signal, a first secondary controller, operable to determine a secondary output based upon a second input signal; a second secondary controller, operable to determine a secondary output based upon a third input signal; a voting mechanism, operable to determine an output to a controlled device based upon the primary output and the secondary outputs; and, a storage medium having a computer program encoded therein for effecting a method to synchronize the primary output and the secondary outputs, the method comprising: a. effecting control of the controlled device using the secondary outputs; b. permitting the primary controller to recalculate the primary output, based upon: the primary output from the primary controller; a feedback signal from the controlled device; and, the secondary outputs from the secondary controllers; and, c. effecting control of the controlled device using the primary output when the primary output is within an allowable range of the secondary outputs. 2. The system of claim 1, wherein the computer program for effecting the method to synchronize the primary output and the secondary outputs is executed based upon feedback from the voting mechanism. 3. The system of claim 2, wherein the voting mechanism is operable to determine the output command of the primary controller is outside the allowable range. 4. The system of claim 1, wherein the voting mechanism comprises an algorithm resident in each controller. 5. The system of claim 1, wherein the voting mechanism comprises an algorithm resident in a separate controller. 6. The system of claim 1, wherein the voting mechanism comprises an algorithm resident in the device. 7. The system of claim 1, wherein the storage medium having the computer program for effecting the method to synchronize the primary output and the secondary outputs is resident in the primary controller. 8. The system of claim 7, further comprising the computer program for effecting the method to synchronize the primary output and the secondary outputs being resident in each of the secondary controllers. 9. The system of claim 1, wherein the first, second, and third input signals comprise a common signal from a sensor. 10. The system of claim 1, wherein the first, second, and third input signals each comprise an independent signal from first, second, or third redundant sensors. 11. The system of claim 1, wherein each output comprises a linear signal. 12. The system of claim 1, wherein each output comprises a pulse-width modulated signal. 13. The system of claim 1, wherein each output comprises a discrete signal. 14. The system of claim 1, wherein the primary controller, the first and second secondary controllers, and the controlled device are each signally connected via a local area network. 15. The system of claim 1, wherein the computer program encoded for effecting the method to synchronize the primary output and the secondary outputs, including permitting the primary controller to recalculate the primary output, comprises: permitting the primary controller to recursively recalculate the primary output. 16. Method to synchronize outputs from a primary controller with a first and a second secondary controller, each controller an element of a distributed control system comprising a plurality of controllers signally connected via a local area network, comprising: monitoring a primary output from the primary controller; monitoring secondary outputs from the first and second secondary controllers; effecting control using the secondary outputs; permitting the primary controller to recalculate the primary output, based upon: the primary output from the primary controller; a feedback signal from a controlled device; and, the secondary outputs; and, effecting control using the primary output when the primary output is within an allowable range of the secondary outputs. 17. The method of claim 16, wherein effecting control with the device using the secondary outputs further comprises effecting control with the device using the secondary outputs based upon an output of a voting mechanism. 18. The method of claim 16, further comprising executing the method to synchronize outputs from the primary controller and the second controllers when a fault has occurred in the primary controller. 19. The method of claim 16, further comprising executing the method to synchronize outputs from the primary controller and the second controllers based upon a predetermined schedule. 20. The method of claim 16, further comprising effecting control with the device using the secondary outputs when a fault has occurred in the primary controller. 21. The method of claim 16, further comprising effecting control with the device using the secondary outputs when the primary output from the primary controller is substantially different from the secondary outputs. 22. Fault-tolerant control apparatus comprising: a plurality of redundant controllers operable to provide independently determined respective outputs to a voting mechanism; said voting mechanism operable to determine a system control output based on the respective outputs and to determine which one of the plurality of redundant controllers is providing a respective output that is unacceptable; each of the plurality redundant controllers operable to effect off-line operation of the one of the plurality of redundant controllers providing a respective output that is unacceptable such that during off-line operation the system control output is determined from the remaining ones of the plurality of redundant controllers; and, the respective output of the one of the plurality of redundant controllers operating off-line is recalculated based on the respective outputs of the remaining ones of the plurality of redundant controllers.