Duplex processor with an update bus and method for operating the update bus

[0002] 1. Field of the Invention

[0003] The present invention relates to a duplex controller having a write through update bus connecting an active processor circuit and a redundant standby processor circuit for updating the memory of the standby processing circuit when the memory of the active processing circuit is updated.

[0004] 2. Description of the Related Art

[0005] The fault tolerance of a data processing system relates to the ability of the system to continue performing a task after the occurrence of a fault. One of the ways in which systems achieve increased fault tolerance is by incorporating hardware redundancy. Fault tolerance is extremely important in systems which require high reliability such as aircraft control systems, life-support systems, and other industrial control systems. Redundant or duplicative data processors are used in controllers to increase the availability and reliability of the systems in which they are used.

[0006] Controllers which have standby processors may comprise many different configurations. For example, some systems include a quasi-duplicative arrangement in that only some of the parts of the circuit are duplicated. In other configurations in which high reliability is extremely critical, the entire circuits are duplicated. However, even in those systems in which an entire hardware circuit is duplicated, some amount of time is required to switch from using the active controller to the standby controller. For example, if the standby controller lacks the state information of the failed active side, the system must re-initialize to allow the standby side, which is now the active side, to recreate or reproduce a useful state, which is time consuming. This associated delay deteriorates the availability of the overall device which may include many of these redundant circuits. One way to avoid this delay is to have the standby controller perform ongoing tasks simultaneously with the active controller. In this way, the standby processor is always in the same state as the active processor and can assume control immediately. However, this arrangement consumes approximately double the power of a single circuit and may therefore be prohibitive in many systems in which numerous components have a redundant standby device. Also, these types of circuits normally require additional complex circuitry for ensuring that the active and standby circuits are performing the same operations simultaneously and producing the same results.

[0007] The present invention provides a duplex controller with a pair of redundant processor circuit members connected by an update bus. The duplex controller is designed for use in a system which requires high reliability. To that end, each of the redundant processor circuit members is individually capable of performing the tasks of the duplex controller. Thus, the controller remains operable when one of the processor circuit members fails. In addition, the update bus is connected such that when the active member executes a write command, the write command is also effected at the standby circuit. The memory of the standby circuit is maintained so that when control of the duplex controller is transferred to the standby circuit, the memory of the standby circuit is instantaneously ready with up to date information, thereby limiting the delay time required for switching control to the standby circuit and maximizing the availability of the overall system.

[0008] Each processor circuit member includes a processor, memory, and an update bus interface. At any given time, one of the processor circuit members is in an active state. The active member executes applications and software programs to perform tasks. The second member is in a standby state and stands by ready to become active, if needed. The update bus connects the pair of processor circuits so that each member has access to the other member's memory. In a normal update mode of the duplex controller, all writes to the memory of the active processor are transmitted via the update bus to the standby processor's memory, thereby keeping the standby processor's memory and registers up to date, so that the standby member can immediately assume control when required.

[0009] The connection between the pair of processors may be disabled, loosely coupled, or tightly coupled. In loosely coupled operation, either memory may be accessed by the other of the active and standby members. In tightly coupled operation, all writes to the active member memory are automatically mapped to both the active and standby members, with no intervention from software.

[0010] The update bus may be operated in the following modes:

[0011] Normal Mode—In this mode, the two members are tightly coupled. All read operations are directed to the local side only. However, each write operation is performed at the local (active) side with a matching write to the mate (standby);

[0012] Forced Local—This mode is used when it is desired that only the local memory space is to be accessed, without disturbing devices on the mate side;

[0013] Forced Mate—This mode is used when it is desired that only the mate memory space be accessed, without disturbing the devices on the local side; and

[0014] Forced Both—This mode is very similar to Normal Mode except that both local and mate memories are accessed during both read and write operations. This mode may be used when it is necessary to trigger the same strobe point on both the local and mate sides.

[0015] As stated above, the write through update bus according to the present invention is designed to limit the amount of time required to switch control from the active processing circuit to the standby processing circuit. Therefore, the circuit operates most efficiently if it is operated in Normal Mode as often as possible. This ensures that the standby processing circuit is always ready to assume control of the duplex controller with up-to-date memory.

[0016] Other objects and features of the present invention will become apparent from the following detailed description considered in conjunction with the accompanying drawings. It is to be understood, however, that the drawings are designed solely for purposes of illustration and not as a definition of the limits of the invention, for which reference should be made to the appended claims.

[0017] In the drawings, wherein like reference characters denote similar elements throughout the several views:

[0018] FIG. 1 is a block diagram of a duplex processor constructed in accordance with the present invention; and

[0019] FIG. 2 is a block diagram of another embodiment of the duplex processor of the invention.

[0020] FIG. 1 depicts a duplex processor 50 in accordance with a first preferred embodiment of the present invention. Duplex processor 50 includes a first processing unit 11 and a second processing unit 12 which are redundant processing units. First processing unit 11 includes a processor 31, a memory 41 and a bus interface 21, and a second processing unit 12 likewise includes a processor 32, a memory 42 and a bus interface 22. The processors 31 and 32 are preferably microprocessors operative for performing specific types of tasks but may also comprise any type of processor. The memories 41 and 42 may be implemented by any type of computer memory devices. The bus interfaces 21 and 22 are each connectable to one or more external devices via a communication channel such, for example, as an I/O Bus 60 which connects the duplex processor 50 with the peripheral devices of a system in which the duplex processor 50 operates. The bus interfaces 21 and 22 are also connected to each other by an update bus 100. The bus interfaces 21, 22 include controls which direct the flow of data to and from the I/O Bus 60 and the flow of data between the first and second processing circuits 11, 12 via the update bus 100. This control is effected via logic contained in bus interfaces 21, 22 that is responsible for bus arbitration, control of the update bus, and decoding addresses.

[0021] Since the first and second processing circuits 11 and 12 are redundant, only one is required to perform the tasks required of the duplex processing circuit 50. During operation, one of the first and second processing units 11, 12 is considered to be in an active state and the other of the first and second processing units 11, 12 is considered to be in a standby state. Generally, the processing unit that is in the active state is referred to as the active member and the processing unit in the standby state is called the standby member. In addition, when one of the members of a duplex pair is discussed, it is referred to as the local member and the other member is referred to as the mate. In the following description, the first processor 11 is assumed by way of illustrative example to be the active member and local member and the second processor 12 is assumed to be the standby member and mate member. Since the first and second processors are redundant, it will be recognized that the first processor 11 may also be the standby member and mate member, in which case the second processor 12 will be the active member and local member.

[0022] The active member 11 of the duplex processor 50 receives instructions from the I/O Bus 60 for executing a task and transmits a result back to the I/O Bus 60. The standby member is, by definition, not active. If the standby member 12 is not out-of-service, then it is ready to become active when required. The standby member 12 will be required to become active, for example, when a fault occurs in the active member 11 or when active member 11 becomes disabled for any reason. The standby member 12 may be out-of-service for many reasons including repairs, diagnostic testing, and if the unit is suspected to be faulty. When the standby member 12 is out-of-service, the memory of standby member 12 is not accessible. To ensure that the memory of standby member 12 which has been out-of-service is updated as soon as possible, the memory of the standby member is updated to match the memory of the active member as soon as the standby member 12 is returned to service.

[0023] The update bus 100 is used to connect the first and second processing units 11 and 12 so that each has full access to the other's memory. Update bus 100 may be one of disabled, operated as loosely coupled, or operated as tightly coupled. In loosely coupled operation, either memory may be accessed by the other of the active and standby members. In tightly coupled operation, all writes to the active member memory are automatically mapped to both the active and standby members, with no intervention from software. The bus interfaces 21 and 22 may operate the update bus 100 in one of four modes. In normal mode, the update bus 100 is operated as tightly coupled with all read operations directed to the active member 11 and each write operation directed to both the active member 11 and the standby member 12. This keeps the memory 42 of standby member 12 dynamically equivalent to the memory 41 of active member 11 so that, if required, the standby member 12 may immediately be switched to active and take over the processing responsibilities of the active members without having to first download information from the prior active member 11.

[0024] Other modes of operation of the update bus 100 include a forced local mode in which only the local memory 41 is accessed for both read and write operations, and a forced mate mode in which only the mate memory 42 is accessed. Yet another mode in which the update bus 100 may be operated is the forced both mode; in this mode, both the local and mate memories 41, 42 are accessed for both read and write operations. Forced both mode is used, for example, when it is necessary to trigger the same strobe point (i.e., an address in memory which causes some side-effect when appropriately accessed) on both the active member 11 and standby member 12.

[0025] In an alternative embodiment, shown in FIG. 2, each of the first and second processing units 11 and 12 of FIG. 1 additionally includes a buffer 21aand 22a, respectively, for transmitting information over the update bus 100. The buffers 21a, 22aare controlled by the respective bus interfaces 21, 22. The buffers 21a, 22amay be separate from the bus interfaces 21, 22 or may form as an integrated part of the bus interfaces.

[0026] When the standby member 12 is busy and temporarily unable to process or handle a new write command, the buffer 21astores the write and thus allows processor 31 continue its ongoing or a new task. The capacity of update bus 100 is designed to be greater than the long term average write rate. However, buffer 21ais useful because the write commands in active member 11 may occur within a short time period at a rate much faster than the write-through update bus 100 can transmit them. The buffers 21aand 22athus help to smooth out these busy periods.

[0027] FIG. 2 also shows the processors 31, 32 connected to the I/O Bus 60 instead of the bus interfaces 21, 22 as in FIG. 1. In the FIG. 2 embodiment, commands received from I/O Bus 60 may be processed directly in the processor. However, bus control information is passed from the processor 31 to bus interface 21. In both embodiments shown, either the bus interfaces 21, 22 or the processors 31, 32 can be connected to the I/O bus 60.

[0028] While there have been shown and described and pointed out fundamental novel features of the invention as applied to preferred embodiments thereof, it will be understood that various omissions and substitutions and changes in the methods described and in the form and details of the devices illustrated, and in their operation, may be made by those skilled in the art without departing from the spirit of the invention. For example, it is expressly intended that all combinations of those elements and/or method steps which perform substantially the same function in substantially the same way to achieve the same results are within the scope of the invention. Substitutions of elements from one described embodiment to another are also fully intended and contemplated. It is the intention, therefore, to be limited only as indicated by the scope of the claims appended hereto.