WO1987007793A1 - Procede et systeme electronique a l'epreuve de derangements - Google Patents

Procede et systeme electronique a l'epreuve de derangements Download PDF

Info

Publication number
WO1987007793A1
WO1987007793A1 PCT/FI1986/000062 FI8600062W WO8707793A1 WO 1987007793 A1 WO1987007793 A1 WO 1987007793A1 FI 8600062 W FI8600062 W FI 8600062W WO 8707793 A1 WO8707793 A1 WO 8707793A1
Authority
WO
WIPO (PCT)
Prior art keywords
output
outputs
module
modules
gate
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/FI1986/000062
Other languages
English (en)
Inventor
Tapio Antti Pulli
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
VTT Technical Research Centre of Finland Ltd
Original Assignee
VTT Technical Research Centre of Finland Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by VTT Technical Research Centre of Finland Ltd filed Critical VTT Technical Research Centre of Finland Ltd
Priority to PCT/FI1986/000062 priority Critical patent/WO1987007793A1/fr
Publication of WO1987007793A1 publication Critical patent/WO1987007793A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/18—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits
    • G06F11/183—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits by voting, the voting not being performed by the redundant components
    • H—ELECTRICITY
    • H03—ELECTRONIC CIRCUITRY
    • H03K—PULSE TECHNIQUE
    • H03K19/00—Logic circuits, i.e. having at least two inputs acting on one output; Inverting circuits
    • H03K19/003—Modifications for increasing the reliability for protection
    • H03K19/00392—Modifications for increasing the reliability for protection by circuit redundancy
    • H—ELECTRICITY
    • H03—ELECTRONIC CIRCUITRY
    • H03K—PULSE TECHNIQUE
    • H03K19/00—Logic circuits, i.e. having at least two inputs acting on one output; Inverting circuits
    • H03K19/20—Logic circuits, i.e. having at least two inputs acting on one output; Inverting circuits characterised by logic function, e.g. AND, OR, NOR, NOT circuits
    • H03K19/23—Majority or minority circuits, i.e. giving output having the state of the majority or the minority of the inputs
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/18—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits
    • G06F11/187—Voting techniques

Definitions

  • the present invention relates to realizing a fault-tolerant electronic system, the said system comprising three or jpaore similar modules and a voter for testing the output signals of the system and for choosing the output signals in accordance with the majority of the modules.
  • the invention also relates to a corresponding system. This system functions correctly outwards irrespective of failure in any of the components.
  • the fault-tolerance of the system is achieved by means of redundancy.
  • Extra components or parts are added to the system, which components perform the respective tasks in case one of the system components or parts is damaged.
  • Electronic systems can be provided with several different redundancy methods. These methods can be divided into static redundancy and dynamic redundancy.
  • NMR _ ftodular Redundancy
  • TMR Triple Modular Redundancy
  • the module outputs must also be compared to the system outputs.
  • this is realized so that both the output signals and the signals from two other modules are fed Into each module, and the faults in any one module or in the system outputs are detected by means of comparison by software.
  • the drawback of this arrangement is the location of the voter in a separate module, for instance a microcircuit, in which case, if for example the modules include 16 signals to be voted, there is needed a voter circuit of at least 66 pins (3 x 16 input signals from the modules, 16 output signals of the system plus the supply voltage and ground pins).
  • the feedback required by the fault indication means that in the system of the said US patent, there are needed 48 additional pins in the modules', which must also be provided with additional logic and additional programmes in order to realize the comparison and the fault indication tasks.
  • the voter is located in a separate module means that more space is needed on the circuit board.
  • the fault indication likewise requires more circuit board space. If the number of the signals to be- voted is increased, the number of the voter pins is increased by four per each additional signal.
  • the voter should be realized by means of several microcircuits, because microcircuits with 66 or possibly even more pins are not in standard production at present. This, however, would reduce the reliability of the voter.
  • the voter in the system is in series with respect to certain ways of suffering damage, so that the voter defines the reliability properties of the system, often during short mission times, because an ideal TMR is extremely reliable with such mission times that are short compared to the meantime to failure of the modules.
  • the method of the present invention for realizing a fault-tolerant electronic system, and the corresponding system, bring forth an improvement to the above described drawbacks.
  • the method of the invention is mainly characterized in that the mutually corresponding outputs of the modules are combined into system outputs, the states whereof are determined according to the states of the majority of the outputs from the modules, so that the voting logics connected to the modules compare the states of the system outputs to the states of the internal outputs of the modules, and on the basis of this comparison there are set specific signals for the voting logic outputs, by the aid of which signals, and together with the signal received from the voting logic of a possible preceding module and indicating the state of the said module, or together with a corresponding predetermined signal, the voting logics in fault situations define the damaged module and prevent the module fault from affecting the system outputs.
  • Another characteristic feature of the method of the present invention is that by logically processing the signals of the first outputs from the voting logics of the modules in each voting logic, in the second output of each module there is created a signal, these signals are connected to a common output, and the signal received therefrom indicates the faultless or faulty condition of the system outputs.
  • a TMR system or more generally a NMR system can be realized, a separate voter module is not necessarily needed, and a fault indication is received from the system in most cases when there is a failure in the system outputs.
  • a fault indication is also received if any of the modules functions incorrectly, even if the system outputs were faultless. All this can be realized with relatively small-scale arrangements, by connecting to the modules separate or directly integrated additional logics. I.e. voting logics. Irrespective of the amount of the signals to be voted, the number of additional pins needed In the integrated modules is only seven in the case of a three-module redundancy.
  • the integration of the voting logic to the modules means increased reliability, because it is a well-known fact that integration improves the reliability per each basic task. From the reliability point of view, the integrated voting logic is in series also with respect to certain fault mechanisms, but the fault frequency of such critical faults is comparable to the failure rate of the critical faults in a separate voter.
  • Fault detection and repairs are most often easily arranged in the case of an integrated voter.
  • the system can be made to directly indicate the faulty module, which can be replaced by a faultless one even during operation, or a by-pass module can be used during the replacement.
  • the replacing can be carried out extremely quickly, which is a remarkable advantage while aiming at a high degree of availability.
  • Figure 1 illustrates the fault-tolerant electronic system according to the present invention, composed of three modules and provided with voting logic
  • FIGS. 1A, 2B and 2C are block diagrams of the voting logics connected to the modules of figure 1;
  • FIG. 3 is a detailed illustration of a voting logic connected to a module
  • Figure 4 illustrates an electronic system of the invention, integrated into one microcircuit
  • Figure 5 illustrates an output buffer which can also be used as an input buffer or as an output buffer connected to a bus of several users.
  • the system according to the invention which in figure 1 is indicated by the dotted lines and marked with the reference number 1, is formed of three modules 2, 3 and 4.
  • the modules 2, 3 and 4 contain the module logics 29, 30 and 31 proper, the voting logics 15, 16 and 17 and the output buffers 18, 19 and 20.
  • the mutually corresponding outputs 5, 6 and 7 of the modules are wired together to form the system output 8.
  • the said outputs are binary outputs, so that the voltage of the output is either positive, five volts (logical "1", or state one according to positive logic) or zero volts (logical "0", or state zero according to positive logic).
  • the output buffers 18, 19 and 20 are three-state buffers, a high-impedance state is possible.
  • the output buffers 18, 19 and 20 can also be of the open-collector type, in which case each separate system output must, after a known fashion, be connected to the supply voltage by means of a pull-up resistor.
  • the number of the output signals in the module outputs 5, 6 and 7 and in the system output 8 is not limited in any way.
  • each voting logic 15, 16 and 17 are illustrated in figures 2A, 2B and 2C.
  • the voting logics are similar in structure. Differences occur only in the couplings between their internal elements, which will be explained further below.
  • the voting logics 15, 16 and 17 comprise the majority indicators 60a, 60b and 60c, the status register 61a, 61b, and 61c and the comparator 35a, 35b and 35c.
  • a detailed Illustration of the voting logic 15 connected to the module 2 is provided in figure 3. The separate components thereof are marked with reference numbers without letters.
  • the module logics proper 29, 30 and 31, contained in the modules 2, 3 and 4 may be any kind of electronic devices provided with binary outputs or equivalent logic outputs - for example microprocessors, analog to digital converters, memories etc.
  • the information to be processed in the module logics 29, 30 and 31 is fed, in the form of binary or analogic signals or the like, into these devices for instance through the inputs 9', 10' and 11'.
  • Each module 2, 3 or 4 as a whole can be an integrated circuit, whereto the corresponding voting logic 15, 16 or 17 is also integrated.
  • the modules 2, 3 or 4 can be Integrated Into one fault- tolerant microcircult.
  • the couplings between the separate parts of the system of the present invention are in essential elements as follows (figures 1, 2 and 3).
  • the outputs 5, 6 and 7 from the output buffers 18, 19, 20 are combined, as was stated above, to form the system output 8, and this is further connected to the first inputs of the comparator 35; 35a, 35b, 35c of the voting logic 15, 16, 17.
  • the internal outputs 9, 10, 11 of each module logic 29, 30, 31 is connected to the respective output buffer 18, 19, 20, and to the corresponding inputs of the comparator of the voting logic.
  • the output of the comparator in each voting logic is connected to the inputs 12a', 12b, 12c of the majority indicators 60a, 60b, 60c of all of the voting logics.
  • the majority indicators, for instance 60 are in turn connected to the respective status register 61, and the status registers 61a, 61b and 61c of the voting logics 15, 16 and 17 of the separate modules 2, 3 and 4, are interconnected at the outputs 28a, 28b and at the inputs 27b, 27c.
  • the comparator 35; 35a, 35b, 35c of each voting logic compares the states of the system outputs 8 to the states of the Internal outputs 9, 10 and 11 of the modules 2, 3 and 4, and on the basis of this comparison it gives a signal to the majority indicators 60; 60a, 60b, 60c of every voting logic, and the said majority indicators transmit the information concerning the states of the outputs 9, 10 and 11 of the modules 2, 3 and 4 further to the status registers 61; 61a, 61b, 61c, by means of which register, and together with the signals possibly received from other status registers and Indicating the state of the respective modules, the faulty module is detected in case of a fault, and the influence of this fault to the system outputs 8 is prevented by sending a masking signal to the output buffer 18, 19, 20 through the output 53a,. 53b, 53c of the status register of the module in question.
  • the comparator 35a, 35b, 35c, the majority detector 60a, 60b, 60c and the status register 61a, 61b, 61c of each voting logic 15, 16 and 17 can be realized for instance in the fashion represented in the appended drawings.
  • Each comparator 35 (figure 3) is composed of a required number of exclusive-or gates 351, 352, 353..., to the first input whereof there are connected the external outputs 5; 501, 502, 503... of a module, for instance 2, and to the second input whereof there are connected the external outputs 9; 91, 92, 93... from the same module.
  • the majority indicator 60; 60a, 60b, 60c of each voting logic 15, 16 and 17 is composed of an or-gate 38, 40 and of an inverter 39.
  • the status register 61 comprises the Inputs 27, 34, 54, 55, the clock C2 and the outputs 21, 28 and 53, as well as the or-gates 41, 48, the and-gates 42, 44, 45, 49, the inverter 43 and two flip-flops or corresponding intermediate registers, the first 46 being advantageously a flip-flop of the D-type, and the second 47 advantageously of the JK-type.
  • the iput 27 is connected to the first input 411 of the or- gate 41 and to the input 431 of the inverter 43; the input 34 is connected to the reset input CLR of both flip-flops 46 and 47; the input 54 is connected to the second input 482 of the or-gate 48 and to the second input 492 of the and-gate 49; the input 55 Is connected to the second input
  • the first input 461 of the first flip-flop 46 is connected to the output 53 of the status register and to the clock input 471 of the second flip-flop 47.
  • the second inverted output 462 of the first flip-flop 46 is connected to the first input 481 of the or-gate 48.
  • the output 474 of the second flip-flop 47 is connected to the third input 423 of the and-gate 42 and to the third input 453 of the and-gate 45.
  • the J-input 472 of the flip-flop 47 is connected to five volts and the K-input 473 to zero volts.
  • the output 413 of the or-gate 41 is connected to the first input 421 of the and-gate 42.
  • the output 483 of the or-gate 48 is connected to the second input 422 of the and-gate 42 and to the second input 442 of the and-gate 44.
  • the output 443 of the and-gate 44 is connected to the data input D of the first flip-flop 46.
  • the output 432 of the inverter 43 is connected to the first input 451 of the and-gate 45, and the clock C2 to the second input 452 of the and-gate 45.
  • the output 454 of the and-gate 45 is connected to the clock input CK of the first flip-flop 46.
  • the output 424 of the and-gate 42 is connected to the output 28 of the status register, and the output 493 of the and-gate 49 is connected to the output 21 of the status register.
  • the input 27a (in figures 1 and 2, the respective inputs of the modules 3 and 4 are 27b and 27c) of the module 2 is coupled to zero voltage, i.e. to the ground reference
  • the output 28a in figures 1 and 2 the respective outputs of the modules 3 and 4 are 28b and 28c
  • the output 28b of the module 3 is coupled to the input 27c of the module 4.
  • the output 28c of the module 4 is coupled to the ground through the resistor 23.
  • a set pulse is fed to the input 34a of every module (in figures 1 and 2, the inputs of the modules 3 and 4 are marked 34b and 34c), which set pulse sets the output 53 of the status register 61, i.e. the "Q-output 461 of the D- type flip-flop 46 (figure 3), to zero.
  • the Q " -output of the flip-flop 46 i.e. its complement 462 sets to state one
  • the Q-output 474 of the JK-type flip-flop 47 also sets to state one.
  • the Q-output 461 of the D-type flip- flop 46 i.e.
  • the external outputs (in figure 3 outputs 501, 502, 503) of the module 2 follow, in their inverted form, the Internal output signals of the module (in figure 3 marked 91, 92, 93) so that any possible changes in the outputs 501, 502, 503 take place on the leading edge of the pulse of the clock Cl.
  • the external outputs 5, 6, 7 from the modules 2, 3, 4, i.e. also the system outputs 8, are either in the high-impedance state or in state one.
  • the module logics 29, 30, 31 proper (figure 1) are in the start-up of the electronic system 1 set to the same state, then the comparison of the output signals of the outputs 9, 10 and 11 of the internal, i.e. proper module logics, with the output signals of the external outputs 5, 6 and 7, i.e. the system outputs 8, in the comparator 35 gives the same result in all modules.
  • the comparator 35 is formed of open-collector type exclusive- or-gates 351, 352, 353... (figure 3).
  • the outputs of the exclusive-or-gates 351, 352, 353 are coupled to one output 12a of the comparator 35.
  • the respective outputs of the comparators 35b, 35c of the modules 3 and 4 are in figure 1 marked with the reference numbers 13b and 14c.
  • the outputs 12a, 13b and 14c of the comparators 35a, 35b, 35c are connected to all of the modules 2, 3, 4 as is apparent from figure 1, and inside the modules, in the voting logics 15, 16 and 17, the outputs 12a, 13b and 14c are coupled to the inputs of the majority Indicator 60 at the or-gates 38 and 40.
  • the specific internal comparison signal of the module 2 is transmitted, through the input 12a' (in the module 3 input 13b' and in the module 4 input 14c') to the gate 40, inverted by the inverter 39.
  • the outputs 5; 501, 502 and 503 of the module 2 are activated, and the signals contained in the internal outputs 9; 91, 92, 93, which were stored in the output buffers 18; 181, 182, 183 on the leading edge of the pulse of the clock Cl, gain access to the outputs 5; 501, 502 and 503.
  • the comparison signals of the outputs 12a, i3b and 14c remain in state one, with the exception of the time between the change of the internal signals 9, 10 and 11 and the successive change of the states of the system outputs 8 controlled by the clock Cl.
  • the internal outputs and the system output differ, and the signals in the outputs 12a, 13b and 14c are set to zero.
  • the signals in the outputs 12a, 13b and 14c are also set to state one.
  • the phase difference of the pulses of the clocks Cl and C2 must be such that the signals in the outputs 12a, 13b and 14c, as well as the rest of the voting logic, have sufficient time to be set by the time of the leading edge of the pulse of the clock C2.
  • the pulses of the clock C2 are best formed in each module 2, 3 and 4, with a suitable delay, of the pulses of the clock Cl, which in turn are formed for instance by means of the clock pertaining to the module logics " 29, 30, 31.
  • the outputs 5 of the module 2 are active and determine the. system outputs 8.
  • the outputs 6 and 7 of the modules 3 and 4 are masked (either by three- state buffers, i.e. output buffers 19, 20 to be in the high-impedance state or by open-collector buffers to be in state one), but the module logics 30 and 31 are continuously operated in a normal fashion, and the voting logics 16 and 17 compare the internal outputs 10 and 11 with the system outputs 8.
  • the and-gate 49 (figure 3), the output whereof ⁇ is marked with the reference number 21a, is of the open- collector type, and the outputs 21a, 21b, 21c of each module 2, 3, 4 are wired together (figure 1).
  • the signal in the output 21 (figure 1) is in state one (except for changes), because the signals in the outputs of the gates 38 and 40 are in state one, and appear as inputs in the and-gate 49.
  • the fault occurs in either one of the module logics with masked outputs.
  • the signal of the output 53 of the voting logic of the module 3 sets to state one.
  • the faultless module 4 notices that the signals in the output 8 are faultless, and the comparison signals 13b and 14c of the modules 3 and 4 are set to state one.
  • each module at least one of the inputs of the or- gates 38 and 40 is in state one, and consequently their output signals are likewise in state one, i.e. the signal in the output 21 is also five volts indicating the faultless condition of the signals in the system output 8.
  • the signal in the output 12a remains continuously In state zero. If, however, the module 2 only has a transient fault or such a permanent fault which is not all the time apparent in its internal outputs 9, the signal in the output 12a may occasionally or even permanently be set to state one. The module 2 still remains masked, unless a new set pulse is fed to the input 34, because the signal in the output 474 of the JK-type flip-flop of the status register 61 in the module 2 Is set to zero and prevents any changes of state in the output 461 of the D-type flip-flop 46, and simultaneously in the output 53a of the status register 61.
  • the strategy is to replace the faulty module as quickly as possible, and the system is reset by means of the set pulse through the input 34, so that the outputs 5 from the module 2 are active, i.e. the states of the output 5 determine the states of the system output 8.
  • the outputs from the module 4 are activated according to the previously described mechanism. Thereafter a new cycle will be successful only after the set pulse is fed into the input 34.
  • the fault occurs In one of the module logics with masked outputs. In that case the fault does not proceed to the system outputs 8, but it is only apparent in the internal signals of the faulty module.
  • the module logic 31 of the module 4 is faulty, and the outputs from the module 2 are active; now the comparator 35c of the module 4 notices the dlsageement, and the signal in the output 14c is set to zero.
  • the rest of the comparison signals in the outputs 12a and 13b remain in state one.
  • the inputs of the or-gates 38 and 40 receive at least one signal in state one, so that the output signals of the or-gates are In state one in every one of the modules 2, 3, and 4.
  • the fault may also occur in the module logic 30, in which case the system functions in the above described fashion.
  • the operation of the system is fault-tolerant in case of fault in any of the module logics 29, 30 or 31.
  • the modules 2, 3 and 4 there may also occur faults in the voting logics 15, 16 and 17, or in the output buffers 18, 19 and 20.
  • the majority is of a type which does not in itself cause a failure in the system outputs, but part of them do not give fault indication either.
  • the situation is similar in the prior art NMR systems.
  • the critical ones are such that cause a signal be erroneously ' set to zero in the output 21, because this signal is used for fault indication and for instance for interrupting the operation.
  • Latent faults can be revealed by means of occasional testing.
  • the output buffers 18, 19 and 20 are the most critical elements in all NMR systems of n modules. Failure in the outputs always causes a system fault in the prior art NMR systems. In the system of the present invention, however, part of the faults in the output buffers can also be masked. Thus, If all or part of the output buffers 18, 19 or 20 are in any of the modules 2, 3 or 4 remain permanently in state one or in the high- impedance state, then the respective buffer of another module is able to control the output in question. If the faulty buffer is included in a module with inactive outputs, the situation does not require any particular treatment, but on the other hand the fault is unfortunately not even detected without separate testing.
  • the comparison signals of the comparators 35a, 35b and 35c in the outputs 12a, 13b and 14c are set to zero, because the signals or the states in the output 8 are in disagreement with all states of the internal outputs 9, 10 and 11. Then all signals In the outputs of the or-gate 38 are in state zero, i.e. the second input of the and-gate 49 is set to zero and consequently sets also the signal in the output 21 to zero.
  • the output signal of the or-gate 48 is also set to zero in the module 2, so that one of the input signals of the and-gate 44 is set to zero, which causes the output signal of the gate to be set to zero and the signal entering the data Input of the D- type flip-flop 46 to be set to zero.
  • the signal in the output 53 of the status register 61 is set to zero, and the outputs 5 of the module 2 are masked.
  • the output signal of the or-gate 48 in the module 2 has, while setting to zero, also set to zero the output signal of the and-gate 42, i.e.
  • the signal in the output 28a which in turn sets to zero the signal in the input 27b in the module 3, where both of the input signals of the and-gate 44 are now in state one, the two input signals of the and-gate 45 are in state one, and the third signal, i.e. the clock pulse from the clock C2 gains access to the clock input of the D-type flip-flop 46.
  • the output signal of the and-gate 44 i.e. the signal of the data input of the D-type flip-flop 46 is in state one
  • the signal in the output 461 of the D-type flip-flop in the module 3, i.e. in the output 53b of the voting logic 16 sets to state one, so that the Internal signals 10 now determine the states of the system output 8.
  • the signal in the output 21 must be used so that it prevents erroneous information from proceeding to the successive stages after the system 1.
  • the or-gate 38 of the majority indicator 60 ensures that the signal of the output 21 remains in state zero when one of the output buffers 18, 19 or 20 is damaged so that all states of the internal outputs 9, 10 and 11 are in continuous disagreement with the states of the outputs 8. This is the situation for instance when one of the output buffers 181, 182, 183... permanently and erroneously remains in state zero.
  • One of the problems with TMR systems is the synchronizing of all modules so that the same signals to be voted in the separate modules appear simultaneously. and so that It is possible to know the right moment for voting.
  • the present invention does not include improvements as regards synchronizing, but the synchronizing must be carried out according to prior art methods, for instance those described in the US patent 4,375,683.
  • the pulse frequency and synchronizing of the clocks Cl and C2 must be realized so that the phenomena connected to the changes in the internal signals 9, 10 and 11 and occurring in the voting logics 15, 16 and 17 have been balanced by the time the leading edges of the pulses of the clock C2 enter the clock inputs of the D-type flip-flops 46 of the status registers 61 in the separate modules.
  • Figure 4 illustrates a method of the present invention integrated into one microcircuit. Then the system of figure 1 is integrated on one silicon chip, and only 3 extra pins are needed in the circuit: the output 21, the input 34 for the set pulse, and the fault indication output"24 of one of the module logics 29, 30 or 31, the said fault indication output being formed in the outputs 12a, 13b and 14c of the comparators 35a, 35b and 35c, at the and-gate 50.
  • the set pulse in the input 34 may also be arranged in common with the set pulses of the module logics 29, 30 and 31.
  • the comparison signals of the comparators 35a, 35b and 35c in the outpus 12a, 13b and 14c can be utilized in the realization of a fault register to be supplied in the system.
  • the fault register includes a logic and memory circuit, where all faults occurring in the module logics are registered on the basis of the signals 12a, 13b and 14c in a desired fashion, so that for instance by means of an alarm signal and a light indication the control or maintenance personnel is informed of the faulty module.
  • the signal in the output 21 may also be used to give an alarm in case there is a failure in the outputs 8.
  • the output buffer is marked with the reference number 181; let us assume that it is the first unit of the output buffer 18 in the module 2.
  • a normal output buffer comprises an intermediate register such as the D-type flip-flop 62 and the inverting gates 63.
  • the first signal output 91 of the internal output 9 in the module 2 is connected to the D-input of the flip- flop 62, the output of the clock Cl is connected to the clock input and the output of the status register 61a is connected to the control input 633 of the inverting gate 63.
  • the input 631 of the gate 63 is connected to the Q- output of the flip-flop 62, and the output 632 is connected to the first signal output 501 of the external output 5 in the module 2.
  • the internal signal output 91 determines the state of the external signal output 501.
  • a masking signal is received from the status register 61a of the voting logic 15 through the output 53a to the input 633 of the gate 63, the gate is closed either in the high-impedance state or in state one, and thus prevents the internal signal output 91 from affecting the external signal output 501.
  • an intermediate register in the output buffer such as the Dr-type flip-flop 62
  • the internal outputs 9, 10, 11 of all modules are registered in the D-type flip-flops 62 of the respective output buffers, then the faults occurring thereafter and before the following leading edge of the pulse of the clock Cl in the module logics 29, 30, 31 (and particularly in the one which has active outputs) cannot proceed to the system outputs 8.
  • inverting gates are coupled in parallel with the output buffers 181, 182, 183 in question in the opposite direction, an example of such a gate being the gate 64 in figure 5.
  • the input 641 of the gate 64 is connected to the first signal output 501, and the output 642 is connected to the first signal output 91 of the internal output in the module 2, as well as to the D-input of the flip-flop 62.
  • the control input 643 of the gate 64 is connected to the input 37a of the output buffer 181.
  • the three-state gate 64 can be controlled by means of a control signal received from the module logic 29, which signal is fed Into the input 37a of the output buffer 18 so that when the bus is occupied by others, the gate 64 serves as an inverter. Thus erroneous changes in the signals are avoided in the outputs 12a, 13b and 14c of the comparators 35a, 35b and 35c.
  • the output buffer provided with the gate 64 and other corresponding means can also be used as the input buffer of the modules. Then the possible external inputs 9', 10', 11' of the module logics 29, 30, 31 can be replaced by the said input buffer.
  • the invention is by no means limited to the preferred embodiment described above, for example the different synchronization requirements of various electronic appliances result in that the system can be realized even without the clocks Cl and C2.
  • the voting logics 15, 16 and 17 can be realized in various different ways, and figures 2 and 3 illustrate only one practicable application.
  • the invention limited to systems utilizing three module redundancy, but within the basic idea of the invention, redundancy systems of more than three modules can also be realized. It is likewise possible to construct a hybrid system where one or several modules are arranged to be in the reserve.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Quality & Reliability (AREA)
  • General Physics & Mathematics (AREA)
  • Hardware Redundancy (AREA)

Abstract

Un procédé permet d'obtenir un système électronique à l'épreuve de dérangements. Le système comprend trois ou plusieurs modules similaires et un scrutateur de contrôle des signaux de sortie du système et de sélection des signaux de sortie en fonction de la majorité des modules. L'invention concerne également ce système, qui fonctionne correctement par rapport à l'éxterieur indépendamment de dérangements d'un de ses composants. Les sorties respectives (5, 6, 7) des modules (2, 3, 4) sont combinées dans la sortie (8) du système dont l'état est déterminé par la majorité des modules; les éléments logiques scrutateurs (15, 16, 17) connectés aux modules comparent l'état des sorties (8) du système avec les sorties (9, 10, 11) des modules et les signaux déterminants les sorties (12a, 13b, 14) des éléments logiques scrutateurs sont réglés sur la base de cette comparaison. A l'aide de ces signaux, avec les signaux reçus les éléments logiques scrutateurs (15, 16) d'un module précédent éventuel (2, 3) et indiquant l'état de ce module, ou avec signal prédéterminé correspondant, les éléments logiques scrutateurs (15, 16, 17) s'assurent normalement de l'état normal du système, et lors de dérangements détectent le module défectueux et empêchent le dérangement d'un module d'affecter les sorties (8) du système. Par le traitement des signaux des premières sortie (12a, 13b, 14c) des éléments logiques scrutateurs (15, 16, 17) des modules, un signal est crée dans la deuxième sortie (21a, 21b, 21c) de chaque module, ces signaux étant connectés à un sortie commune (21). Le signal reçu de celle-ci indique si les états des sorties (8) du système sont corrects ou incorrects.
PCT/FI1986/000062 1986-06-13 1986-06-13 Procede et systeme electronique a l'epreuve de derangements Ceased WO1987007793A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/FI1986/000062 WO1987007793A1 (fr) 1986-06-13 1986-06-13 Procede et systeme electronique a l'epreuve de derangements

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/FI1986/000062 WO1987007793A1 (fr) 1986-06-13 1986-06-13 Procede et systeme electronique a l'epreuve de derangements

Publications (1)

Publication Number Publication Date
WO1987007793A1 true WO1987007793A1 (fr) 1987-12-17

Family

ID=8556401

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/FI1986/000062 Ceased WO1987007793A1 (fr) 1986-06-13 1986-06-13 Procede et systeme electronique a l'epreuve de derangements

Country Status (1)

Country Link
WO (1) WO1987007793A1 (fr)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2238143A (en) * 1989-10-10 1991-05-22 Univ Essex Voters for fault-tolerant computer systems
EP0507299A3 (en) * 1991-04-05 1994-08-17 Hitachi Ltd Loosely coupled multiplexing control apparatus and method
FR2784765A1 (fr) * 1998-10-19 2000-04-21 Ela Medical Sa Dispositif medical actif, comprenant des registres proteges pour l'ajustement numerique de parametres de fonctionnement
WO2015092487A1 (fr) 2013-12-18 2015-06-25 Freescale Semiconductor, Inc. Élément de stockage à circuit de surveillance de stockage et d'arbre d'horloge, et procédés correspondants

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US3770982A (en) * 1972-04-16 1973-11-06 Lorain Prod Corp Majority logic system
WO1981002821A1 (fr) * 1980-03-26 1981-10-01 Y Takefuji Porte de tolerance d'erreur

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US3770982A (en) * 1972-04-16 1973-11-06 Lorain Prod Corp Majority logic system
WO1981002821A1 (fr) * 1980-03-26 1981-10-01 Y Takefuji Porte de tolerance d'erreur

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
DERWENT'S ABSTRACT, No. 84-211991/34; & SU,A,1062707. *

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2238143A (en) * 1989-10-10 1991-05-22 Univ Essex Voters for fault-tolerant computer systems
EP0507299A3 (en) * 1991-04-05 1994-08-17 Hitachi Ltd Loosely coupled multiplexing control apparatus and method
FR2784765A1 (fr) * 1998-10-19 2000-04-21 Ela Medical Sa Dispositif medical actif, comprenant des registres proteges pour l'ajustement numerique de parametres de fonctionnement
EP0996063A1 (fr) * 1998-10-19 2000-04-26 Ela Medical Dispositif médical actif, comprenant des registres protégés pour l'ajustement numérique de paramètres de fonctionnement
US6230058B1 (en) 1998-10-19 2001-05-08 Ela Medical S.A. Active medical device having protected memory registers for storing adjustable parameter values
WO2015092487A1 (fr) 2013-12-18 2015-06-25 Freescale Semiconductor, Inc. Élément de stockage à circuit de surveillance de stockage et d'arbre d'horloge, et procédés correspondants
US9589637B1 (en) 2013-12-18 2017-03-07 Nxp Usa, Inc. Storage element with storage and clock tree monitoring circuit and methods therefor

Similar Documents

Publication Publication Date Title
US5784386A (en) Fault tolerant synchronous clock distribution
KR950005527B1 (ko) 다중 여분식 고장 검출 시스템 및 그 사용 방법
US4375683A (en) Fault tolerant computational system and voter circuit
US7890797B2 (en) Vehicle including a processor system having fault tolerance
US5349654A (en) Fault tolerant data exchange unit
US4843608A (en) Cross-coupled checking circuit
EP0349539B1 (fr) Appareil de controle de synchronisation logique numerique
US5381416A (en) Detection of skew fault in a multiple clock system
US4700346A (en) Self-checking, dual railed, leading edge synchronizer
WO1987007793A1 (fr) Procede et systeme electronique a l'epreuve de derangements
EP0461041A2 (fr) Circuit multivibrateur bistable
US3814920A (en) Employing variable clock rate
US3713095A (en) Data processor sequence checking circuitry
US4701917A (en) Diagnostic circuit
US3750110A (en) Data transfer systems
FI72396C (fi) Foerfarande foer aostadkommande av ett elektroniskt system som tolererar fel samt motsvarande system.
KR100538487B1 (ko) 철도신호 제어장치의 다수결 투표기
SU1499489A1 (ru) Счетное устройство с контролем
JPS61115141A (ja) 自己検査性順序回路
EP0675437A2 (fr) Bus d'entrée/sortie d'ordinateur avec autotest et transactions sécurisées
JPS6019532B2 (ja) エラー検出制御方式
JPS6227814A (ja) 故障検出回路
JPS6093844A (ja) デ−タ伝送方法
SU1748155A1 (ru) Устройство дл реконфигурации резервируемых блоков
JPH09101904A (ja) 多重系装置

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): DK JP NO US

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): AT BE CH DE FR GB IT LU NL SE