IPC분류정보
국가/구분 |
United States(US) Patent
등록
|
국제특허분류(IPC7판) |
|
출원번호 |
US-0316966
(2008-12-18)
|
발명자
/ 주소 |
|
출원인 / 주소 |
|
대리인 / 주소 |
Renner, Kenner, Greive, Bobak, Taylor & Weber
|
인용정보 |
피인용 횟수 :
24 인용 특허 :
14 |
초록
▼
A multiple redundant computer system includes three primary processor modules (PPM) and three redundant processor modules (RPM) operating synchronously. Primary and redundant processor modules are dissimilar in hardware and software for decreasing the probability of a common cause system failure. Ea
A multiple redundant computer system includes three primary processor modules (PPM) and three redundant processor modules (RPM) operating synchronously. Primary and redundant processor modules are dissimilar in hardware and software for decreasing the probability of a common cause system failure. Each primary and redundant processor module receives input data from associated primary and redundant input modules respectively, executes control program and transfers output data to an output module. The output module produces a system output as the result of 2-out-of-3 voting among output data generated by PPMs. In response to PPMs hard failures, the output module still produces the system output as the result of 2-out-of-3 voting among output data generated by any combination of the PPM and the RPM. As such, the system is able to operate properly even though five-out-of six processor modules have failed. The output module also compares output data that it has received from each pair of the associated PPM and RPM for detecting a disparity between said output data due to the occurrence of transient faults. Additionally, the output module produces the system output as the result of 2-out-of-2 and 1-out-of-1 voting upon the occurrence of disparity of output data generated by the associated PPM and RPM in one and two pairs of the associated PPM and RPM respectively.
대표청구항
▼
What is claimed is: 1. A multiple redundant control system comprising:a) at least one primary input module including first, second, and third input circuits operating in parallel for receiving process data for each controlled point;b) at least one output module including first, second, and third out
What is claimed is: 1. A multiple redundant control system comprising:a) at least one primary input module including first, second, and third input circuits operating in parallel for receiving process data for each controlled point;b) at least one output module including first, second, and third output circuits operating in parallel, outputs of said output circuits are connected together for providing system output for each controlled point;c) each of said output circuits including a first and a second interface;d) a first, a second, and a third primary processor module operating in parallel;e) said first, second, and third primary processor modules respectively connected to said first, second, and third input circuits of the primary input module for receiving input data from the associated input circuit, and for using the input data as input to a control program to generate output data by execution of the control program;f) said first, second, and third primary processor modules coupled together for sending a status and input/output data to each other to provide synchronous operation of said primary processor modules;g) said first, second, and third primary processor modules are connected to the first interface of said first, second, and third output circuits respectively for delivering an output data to the associated output circuit;h) at least one redundant input module including first, second, and third input circuits operating in parallel for receiving process data for each controlled point;i) a first, a second, and a third redundant processor module operating in parallel;j) said first, second, and third redundant processor modules respectively connected to said first, second, and third input circuits of the redundant input module for receiving input data from the associated input circuit, and for using the input data as input to said control program to generate output data by execution of the control program;k) said first, second, and third redundant processor modules coupled together for sending a status and input/output data to each other to provide synchronous operation of said redundant processor modules;l) said first, second, and third redundant processor modules are connected to the second interface of said first, second, and third output circuits respectively for delivering output data to the associated output circuit;m) said first, second, and third primary processor modules are respectively connected to said first, second, and third redundant processor modules for allowing each said primary processor module to send a command to the associated redundant processor module to begin said control program execution, thereby allowing each said primary processor module and the associated redundant processor module to synchronously execute said control program;n) means in the output circuit for detecting the occurrence of a fault in the associated primary processor module, and using output data received from the redundant processor module in the event that the primary processor module fails;o) means in the output module for producing a system output as the result of two-out-of-three voting among output data generated by said first, second, and third primary processor module;p) means in the output module for producing the system output as the result of two-out-of-three voting among output data generated by said first, second, and third redundant processor modules if said first, second, and third primary processor module concurrently fail;q) means in the output module for producing the system output as the result of two-out-of-three voting among output data generated by three processor modules, each of said processor modules comprising said primary processor module or said associated redundant processor module if said primary processor module fails;r) means in the output module for producing the system output as the result of two-out-of-two voting among output data generated by two processor modules, each of said processor modules comprising said primary processor module or said associated redundant processor module if said primary processor module fails and all other said processor modules fail;s) means in the output module for producing the system output as the result of one-out-of-one voting of output data received from said primary processor module or from said redundant processor module if all other processor modules fail, thereby allowing the system to remain operational even though five processor modules out of six fail; andt) means in output module for driving the system output to a safe condition in the event that all primary and redundant processor modules concurrently fail.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.