Non-interrupting power control for fault tolerant computer systems

Claim 2

A non-intrusive power control apparatus comprising: a plurality of central processing units (CPUs) (32) operating a running software application synchronously, each operating step of each of said plurality of CPUs (32) being accomplished in parallel and substantially simultaneously with each of the other of said plurality of CPUs (32) each clock cycle of said CPUs (32), each one of said plurality of CPUs (32) having an input (33i) and an output (33o); a voter (34) having a voted output (35); said voter (34) coupled to each of said plurality of CPUs (32) and receiving said CPU output (33o); said voter (34) using redundant voting of said CPU output (33o) to detect a fault in any of said plurality of CPUs (32) whose output (33o) disagrees with CPU output (33o) of a majority of said plurality of CPUs (32); each said CPU output (33o) being compared one with another by said voter (34) each said clock cycle; a power bus (20) for furnishing a supply voltage (24) to each of said plurality of CPUs (32), said power bus (20) connected to each one of said plurality of CPUs (32); and said supply voltage (24) being removed from an affected CPU (32) and said CPU input (33i) being limited to non-stressed condition for said affected CPU (32) without terminating said running software application, when a potentially destructive fault is detected by said voter (34) in said affected CPU (32).

Claim 3

An apparatus as claimed in claim 1, in which said CPU input (33i) is limited by placing it at ground potential to prevent damage to said CPU (32) when said supply voltage (24) is removed from said CPU (32).

Claim 4

An apparatus as claimed in claim 1, in which said CPU input (33i) is limited by removing return/ground (23) from said affected CPU (32) and placing said CPU input (33i) at said supply voltage.

Claim 5

An apparatus as claimed in claim 1, in which said plurality of CPUs (32), numbers at least three.

Claim 6

An apparatus as claimed in claim 1, in which said plurality of CPIJs (32) are reduced instruction set CPUs (RISC).

Claim 7

An apparatus as claimed in claim 1, further comprising: a power switch (22) electrically interposed between said power bus (20) and each one of said plurality of CPUs (32); said power switch (22) coupled to said interface control (28) and receiving a signal (26) therefrom; said power switch (22) being capable of connecting and removing said supply voltage (24) to each one of said plurality of CPUs (32) upon receiving said signal (26) from said interface control (28); and said interface control (28) reacting to said fault in one of said CPUs (32) by providing said signal (26) to said power switch (22), said supply voltage (24) being removed thereby and simultaneously said CPU input (33i) being adjusted to prevent damage to said CPU (32); said running software application being permitted to continue in operation.

Claim 8

An apparatus as claimed in claim 6, further comprising: a system bus (12); a first computer (11a); said first computer (11a) including said plurality of CPUs (32), said voter (34), said interface control (28), said power switch (22) and said couplings; said first computer (11a) coupled to said system bus (12); said first computer (11a) further including a system memory (46); a memory controller (36); said memory controller (36) coupled to said voter (34), said memory (46) and said system computer bus (12); a second computer (11b); said second computer (11b) being substantially identical to said first computer (11a); said second computer (11b) being coupled to said system bus (12) and maintained as an error-free replacement for said first computer (11a); said system memory (46) providing memory output signals (37a) to said memory controller (36); said memory output signals (37a) being distributed equally as said CPU input (33i) to each of said plurality of CPUs (32), through said memory controller (36) and said voter (34); agreement in said voter (34) of a majority of said CPU outputs (33o) resulting in said voted output signal (35) having a value of said majority of said CPU outputs (33o); and disagreement of any said CPU output (33o) with a majority of said CPU outputs (33o) being detected by said voter (34), an error signal being produced thereby; said error signal prompting re-synchronizing (130) of said plurality of CPUs (32) in said first computer (11a).

Claim 9

An apparatus as claimed in claim 7, in which disagreement of said CPU outputs (33o) being supplied to said voter (34) when less than two of said plurality of CPUs 32 are without error, results in said second computer (11b) being substituted for said first computer (11a).

Claim 10

An apparatus as claimed in claim 7, in which said re-synchronizing (130), said supply voltage (24) being removed and said CPU input (33i) limiting is controlled by software (205) run by said plurality of CPUs (32).

Claim 11

An apparatus as claimed in claim 7, in which agreement of less than two of said CPUs (32) results in said second computer (11b) being substituted for said first computer (11a).

Claim 12

An apparatus as claimed in claim 10, in which each one of said plurality of CPUs (32) is in one of the following stable states: enabled and voting; commanded disabled; non-agreement and disabled; bypassed; and powered down.

Claim 13

An apparatus as claimed in claim 7, in which a failure of two of said plurality of CPUs (32) results in said second computer (11b) being substituted for said first computer (11a).

Claim 14

The apparatus (10) as claimed in claim 1, in which said plurality of CPUs (32) are commercial non-radiation hardened chips.

Claim 15

A non-intrusive power control apparatus comprising: a first computer (11a) having a plurality of central processing units (CPUs) (32) operating in synchronism running a software application, each operating step of each of said plurality of central processing units (32) being accomplished in parallel and substantially simultaneously with each of the other of said plurality of CPUs (32) each CPU clock cycle; each of said plurality of central processing units (CPUs) (32) having an input (33i) and an output (33o); a bi-directional system bus (12); said computer (11a) further including a voter (34); said voter (34) having an interface control circuit (28) and having a voted output (35); said voter (34) being radiation tolerant; a memory (46); a memory controller (36) having a vote status and control circuit (38), a memory interface (40) and a system bus interface (42); said voter (34) being coupled to said bidirectional system bus (12) through said system bus interface (42); said memory controller (36) being coupled to said voter (34), coupled to said system bus (12) through said system bus interface (42), and coupled to said memory (46) through said memory interface (40); said memory (46) providing memory output signals (37a) to said memory controller (36); said memory output signals (37a) being distributed equally as CPU input (33i) to each of said plurality of CPUs (32) through said memory controller (36) and said voter (34); each of said plurality of CPUs (32) providing said CPU output (33o) as input to said voter (34) for comparison; said CPU outputs (33o) being compared by said voter (34); said voted output (35) being provided by said voter (34) as input (37b) to said system memory (46), said vote status and control circuit (38) and to said system bi-directional bus (12); a second, error-free computer (11b) substantially equivalent to said first computer (11a); agreement of a majority of said CPU outputs (33o) supplied to said voter (34) resulting in said voted output (35) having a value of said majority of said CPU output signals (33o); said CPU outputs (33o) which do not agree with a majority of all said CPU outputs (33o) being detected by said voter (34); said voter producing error signals (68) thereby; said error signals (68) being sent as input (39b) to said vote status and control circuit (38); said vote status and control circuit (38) reacting to said error signals (68) by prompting re-synchronizing of said plurality of CPUs (32); said vote status and control circuit (38) reacting to said error signals (68) by prompting said interface control circuit (28) to remove said supply voltage (24) from an affected said CPU (32) and to limit said CPU input (33i) to near-ground potential without terminating said running software application when persistent said disagreement indicates a potentially destructive fault condition in said affected CPU (32); and said vote status and control circuit (38) reacting to said error signals (68) by substituting said error-free second computer (11b) for a dysfunctional said first computer (11a) when less than two of said plurality of CPUs (32) is without error.

Claim 16

A non-intrusive power control apparatus comprising: a first computer (11a) having a plurality of central processing units (CPUs) (32) operating in synchronism running a software application, each operating step of each of said plurality of central processing units (32) being accomplished in parallel and substantially simultaneously with each of the other of said plurality of CPUs (32) each CPU clock cycle; each of said plurality of central processing units (CPUs) (32) having an input (33i) and an output (33o); a bi-directional system bus (12); said computer (11a) further including a voter (34); said voter (34) having an interface control circuit (28) and having a voted output (35); said voter (34) being radiation tolerant; a memory (46); a memory controller (36) having a vote status and control circuit (38), a memory interface (40) and a system bus interface (42); said voter (34) being coupled to said bidirectional system bus (12) through said system bus interface (42); said memory controller (36) being coupled to said voter (34), coupled to said system bus (12) through said system bus interface (42), and coupled to said memory (46) through said memory interface (40); said memory (46) providing memory output signals (37a) to said memory controller (36); said memory output signals (37a) being distributed equally as CPU input (33i) to each of said plurality of CPUs (32) through said memory controller (36) and said voter (34); each of said plurality of CPUs (32) providing said CPU output (33o) as input to said voter (34) for comparison; said CPU outputs (33o) being compared by said voter (34); said voted output (35) being provided by said voter (34) as input (37b) to said system memory (46), said vote status and control circuit (38) and to said system bi-directional bus (12); a second, error-free computer (11b) substantially equivalent to said first computer (11a); agreement of a majority of said CPU outputs (33o) supplied to said voter (34) resulting in said voted output (35) having a value of said majority of said CPU output signals (33o); said CPU outputs (33o) which do not agree with a majority of all said CPU outputs (33o) being detected by said voter (34); said voter producing error signals (68) thereby; said error signals (68) being sent as input (39b) to said vote status and control circuit (38); said vote status and control circuit (38) reacting to said error signals (68) by prompting re-synchronizing of said plurality of CPUs (32); said vote status and control circuit (38) reacting to said error signals (68) by prompting said interface control circuit (28) to remove said supply voltage (24) from an affected said CPU (32) and to limit said CPU input (33i) to near-ground potential without terminating said running software application when persistent said disagreement indicates a potentially destructive fault condition in said affected CPU (32); and said vote status and control circuit (38) reacting to said error signals (68) by substituting said error-free second computer (11b) for a dysfunctional said first computer (11a) when less than two of said plurality of CPUs (32) is without error.

Claim 17

An apparatus as claimed in claim 14, in which said plurality of CPUs (32) numbers at least three.

Claim 18

An apparatus as claimed in claim 14, in which said plurality of CPUs (32) are commercial non-radiation hardened chips.

Claim 19

An apparatus as claimed in claim 14, in which said plurality of CPUs (32) are reduced instruction set CPUs (RISC).

Claim 20

An apparatus as claimed in claim 14, in which each of said plurality of CPUs (32) is in one of the following stable states: enabled and voting; commanded disabled; disagreeing and disabled; bypassed; and powered down.

Claim 23

A method as claimed in claim 18, further comprising the steps of: interposing electrically a power switch (22) between said power bus (20) and each one of said plurality of CPUs (32); coupling said power switch (22) to said interface control (28) and receiving a signal (26) therefrom; connecting and removing said supply voltage (24) to each one of said plurality of CPUs (32) upon receiving with said power switch (22) said signal (26) from said interface control (28); and reacting to said faults in each of said plurality of CPUs (32) by providing said signal (26) to said power switch (22) from said interface control circuit (28), removing said supply voltage (24) and simultaneously adjusting said CPU input (33i) to prevent damage to each of said plurality of CPUs (32); the fault-free CPUs of said plurality of CPUs (32) being permitted to continue operating without affecting a running software application.

Claim 24

A method as claimed in claim 20, in which the step of operating a plurality of CPUs (32) includes operating at least three CPUs (32).

Claim 25

A method as claimed in claim 20, in which in which the step of operating a plurality of CPUs (32) includes operating said CPUs (32) which are commercial, non-radiation hardened chips.

Claim 26

A method as claimed in claim 20, in which the step of operating a plurality of CPUs (32) includes operating said CPUs (32) which are reduced instruction set CPUs (RISC) (32).

Claim 27

A method as claimed in claim 20, further comprising the steps of: providing a system bus (12); providing a first computer (11a); said first computer (11a) including said plurality of CPUs (32), said voting logic (252), said interface control (28), said power switch (22) and said couplings; coupling said first computer (11a) to said system bus (12); further providing in said first computer (11a) a system memory (46); a memory controller (36); coupling said memory controller (36) to said voting logic (252), said system memory (46) and said system bus (12); providing a second computer (11b) substantially identical to said first computer (11a); coupling said second computer (11b) to said system bus (12) and maintaining said second computer (11b) as an error-free replacement for said first computer (11a); providing a memory output (37a) to said memory controller (36) with said system memory (46); distributing equally said memory output (37a) to each of said plurality of CPUs (32) as said CPU input (33i), through said memory controller (36) and said voting logic (252); obtaining a voted output signal (35) having a value of said majority of said CPU outputs (33o) by agreement of a majority of said CPU outputs (33o) in said voting logic (252); detecting disagreement of any said CPU output (33o) with a majority of said CPU outputs (33o) in said voting logic (252) and producing an error signal (68)thereby; and re-synchronizing (130) said plurality of CPUs (32) in said first computer (11a) upon prompting by said error signal (68); and removing said supply voltage (24) from a disagreeing said CPU (32) and simultaneously adjusting said CPU input (33i) to said disagreeing CPU (32) to prevent damage when a persistent said disagreement indicates a latchup condition.

Claim 28

A method as claimed in claim 24, further including the step of substituting said second computer (11b) for said first computer (11a) upon disagreement of said CPU outputs (33o) being supplied to said voting logic (252) when less than two of said CPUs (32) is without error.

Claim 29

A method as claimed in claim 25, in which the steps of re-synchronizing said CPUs (32), removing said supply voltage (24) and substituting said second computer (11b) for said first computer (11a) are controlled by software run by said plurality of CPUs (32).

Claim 30

A method as claimed in claim 25, further including the step of substituting said second computer (11b) for said first computer (11a) when at least two of said plurality of CPUs (32) have failed.

Claim 31

A method as claimed in claim 27, in which each one of said plurality of CPUs (32) is in one of the following stable states: enabled and voting; commanded disabled; non-agreement and disabled; bypassed; and powered down.

Claim 34

A method as claimed in claim 29, further including the step of substituting an error-free computer (11b) for a faulty said computer (11a) by action of said vote status and control circuit (36) when less than two of said plurality of CPUs (32) are without error.

Claim 35

A method as claimed in claim 30, further including the step of substituting an error-free computer (11b) for a faulty said computer (11a) when at least two said CPUs (32) have failed.