Redundant device control unit

Claim 1

An industrial, digitally controlled processing system including two nominally identical electronic devices each operable in response to instructions from a control unit and to data derived from operations being performed by the processing system, each said electronic device being connected in the system in a manner such that one of the devices functions as an active device in the system regulating an operating sequence of the system including a plurality of specific, different system routines and the other device functions as a standby device, each said electronic device comprising internal diagnostic means operative for diagnosing the operating status of said device and selecting means for placing said device in a condition to operate as an active device or a standby device, and each said electronic device comprising a back-up control unit comprising: communications means including an optical fiber link for establishing communication between said device and the other nominally identical device; control means connected to said communication means for determining whether said device is presently functioning as an active or standby device and for receiving, from said communication means, signals indicating whether the other nominally identical device is functioning as an active or a standby device; synchronizing means connected to said communication means for synchronizing the operation of the device acting as an active device with that of the other nominally identical device acting as the standby device at selected limited points in the operating sequence of the system at which specific routines thereof are completed to maintain the nominally identical standby device substantially synchronized with the active device as the active device responds to data derived from operations being performed by the processing system; and switching means connected to said communication means and responsive, when said device is functioning as the standby device, to the occurrence of a failure in the other nominally identical device during performance of a routine in the operating sequence of the system for causing said device to begin operating as the active device promptly after ending of said routine with improved synchronization relative to the operating sequence of the system.