Redundant clock module

[0001] This application claims the benefits of U.S. Provisional Application No. 60/482,557, filed Jun. 25, 2003, the disclosure of which is incorporated herein by reference.

[0002] The present invention relates generally to electronic oscillators, and more particularly to a redundant clock module for use in electronic circuits requiring a stable fail-safe oscillator. The present invention provides a primary clock source with at least one other alternate clock source that takes over for the primary clock source in the event of a failure or out of tolerance condition with the primary clock source. If the primary clock source fails or is out of tolerance, the circuitry of the present invention will detect the failure or out of tolerance condition and seamlessly switch to an alternate clock source.

[0003] Crystal controlled oscillators are key system components that synchronize and distribute data signals for a wide variety of electronic equipment. The oscillators provide clock signals used for timing and synchronizing of electronic circuits. These oscillators have common failure modes that are not presently adequately addressed in the prior art. Crystal controlled oscillators commonly fail to start at the correct frequency, but will generate a signal that is often within the operational range of the circuitry that it is driving. These incorrect frequencies can be approximately 1% from the desired frequency in the case of an oscillator that is free running near the crystal frequency, 0.1% in the case of an oscillator operating in a spurious mode of the crystal frequency, or 0.01% in the case of an oscillator that has aged out of tolerance. In these instances, the electronic circuitry may continue to operate, but at an unwanted frequency.

[0004] Failures of a crystal controlled oscillator are not limited to a clock source that is stuck high or low, but an oscillator that is out of frequency tolerance due to the oscillator operating on the wrong crystal overtone order or mode, an oscillator operating in a spurious mode of the crystal, or an oscillator not operating on the crystal at all. In mission critical applications, it is imperative that the crystal controlled oscillator be working and be within tolerance at all times. Therefore, it would be highly desirable to have electronic circuitry which would monitor the oscillator and seamlessly switch to another oscillator if the primary oscillator fails or is out of tolerance.

[0005] Electronic circuitry for monitoring the health of an oscillator and switching to an alternate oscillator if a failure in the primary oscillator is detected is known in the prior art. Motorola, Cypress and Integrated Circuit Systems have each developed phase lock loop (PLL)-based clock generator integrated circuits (ICs) that generate clock signals from redundant clock sources after detecting a failure of the original clock source. The Motorola MPC9893/MPC9894/MPC9993 series of PLL-based clock generators all contain logic for clock redundant applications, such as clock failure detection and auto switching capabilities. These ICs utilize a fully integrated PLL to generate system clock signals for up to four redundant clock sources and continuously monitor two input clock signals. On detection of a clock failure, the circuit is designed to switch to a secondary clock for phase/frequency alignment. The Cypress CY23020 PLL-based zero delay buffer IC is designed for high-speed clock distribution applications. If a failure is detected in a clock source, the circuit switches to a redundant clock source. The Integrated Circuit Systems ICS879931 PLL clock driver with clock switch IC is designed specifically for redundant clock applications. The circuit continuously monitors the two input clock signals. Upon detection of a failure (clock stuck high or low for at least one period), the circuit switches the PLL reference clock to the other clock input signal and phase/frequency alignment will occur with minimal output phase disturbance. Disadvantages of the above ICs is that they don't detect free running clocks (oscillators that are not crystal controlled, but still within the operating frequency range of the IC) and they don't detect out of tolerance conditions. Another disadvantage of the above ICs is that they have higher jitter and phase noise than most high stability applications can tolerate, compared to the hybrid solution of the present invention.

[0006] Accordingly, a need exists for an improved redundant clock module that monitors a clock source for failures and out of tolerance conditions and seamlessly switches to an alternate clock source upon detection of a failure or out of tolerance condition of the primary without any system shutdown, glitch, or crash.

[0007] The redundant clock module of the present invention preferably comprises at least two crystal oscillators, detection circuitry, switching circuitry and control circuitry. The redundant clock module of the present invention targets mission critical applications where clock redundancy is required. The redundant clock module supplies a highly reliable fixed clock reference output based on one of the at least two internal reference oscillators that are monitored to make sure that they are operating properly and within tolerance. If the primary oscillator fails or is out of tolerance, the redundant clock module will detect the failure or out of tolerance condition and switch to a secondary working oscillator to take over primary timing functions. The redundant clock module provides a slow seamless transition between switching to assure no significant phase shift or runt pulses will affect the end user application.

[0008] As mentioned above, the redundant clock module includes at least two reference oscillators that provide an output to an end user application. The oscillators also provide outputs to the detection circuitry for monitoring operation of the oscillators and detecting a failure or out of tolerance condition. In the event that an oscillator fails or is out of tolerance, the redundant clock module will disconnect power to the failed oscillator and switch to a working oscillator to provide the output to the end user application.

[0009] The detection circuitry preferably includes a detection control loop for monitoring inputs from the oscillators. A separate detection circuit is provided for each reference oscillator. The oscillators are monitored by comparing the oscillator output frequency to a voltage controlled oscillator (VCO) frequency on the detection circuitry. A VCO is an oscillator whose output frequency depends on the input control voltage. By knowing the voltage versus frequency characteristic of the VCO, the control voltage of the VCO can be monitored using analog voltage comparators to determine if the reference oscillators are working and within the frequency tolerance requirement. The detection circuit further includes analog voltage comparators to compare the control voltage of the VCO to a fixed reference voltage generated in the detection circuit that is the voltage equivalent of the frequency limit established by the tolerance desired and the VCO characteristic. The detection circuitry thus provides analog monitoring of control voltage rather than frequency or time sampling.

[0010] The detection circuitry compares the control voltage of each monitoring circuit VCO for the associated reference oscillator and determine if the oscillator is operational and within frequency tolerance. The detection circuitry generates an error signal that indicates that an oscillator has failed. Each oscillator being monitored has its own independent error signal. If a failure or out of tolerance condition is detected by the detection circuitry, the switching circuitry will remove power from the failed oscillator and switch to a working oscillator. The detection circuitry monitors all oscillator outputs to make sure that an oscillator is operating and within tolerance before the switching circuitry switches to it.

[0011] The switching circuitry receives inputs from the detection circuitry for initializing a error signal for a failed or out of tolerance oscillator, removing power from the failed or out of tolerance oscillator and selecting and switching to a working and in tolerance oscillator. The switching circuitry holds off the error signal until power is established. After power is established, the switching circuitry will output an enable signal to enable the output of the redundant clock module. The switching circuitry also controls which oscillator is selected by sending out control signals to control circuitry for the oscillators, which are based on the error signals and reset signals. Digital control circuitry is used to switch to a new working and in tolerance oscillator.

[0012] A separate switching control loop is used to monitor the oscillator frequency and determine when to switch to another oscillator. The switching control loop is independent of the detection control loop. This is done so that the detection control loop has a fast response time to detect a failure, but the switching control loop has a slow response time to switch from a failed or out of tolerance oscillator to a working and in tolerance oscillator. The switching control loop response time is slower than the detection control loop response time to allow the output frequency of the switching VCO to change slowly in the event that an oscillator fails. The output frequency of the switching VCO will slowly lock to a new oscillator once it is selected. A new working and within tolerance oscillator output is seamlessly provided at the output of the redundant clock module for continuing to provide an uninterrupted clock signal to the end user application.

[0013] Advantages of the present invention include the ability to detect an oscillator output that is stuck high or low, an oscillator that is free running at a different frequency from the crystal frequency, an oscillator that is no longer stable or no longer crystal controlled, an oscillator running on a wrong overtone order, or an oscillator running on a spurious mode of the crystal. Other advantages of the present invention include the ability to provide a redundant clock module in a hybrid design rather than an IC design, the ability to provide a seamless transition between switching from a failed or out of tolerance oscillator to a working and in tolerance oscillator, the ability to provide analog monitoring of the oscillators, the ability to provide low jitter and phase noise, and the ability for the module to detect out of tolerance oscillators. The hybrid design provides added versatility and customization. If the frequency of an oscillator is out of tolerance, the module of the present invention will detect it, and switch to an alternate operational and in tolerance oscillator.

[0014] Various other features, objects, and advantages of the invention will be made apparent to those skilled in the art from the following detailed description, claims, and accompanying drawings.

[0022] The redundant clock module of the present invention is preferably comprised of at least two crystal oscillators, detection circuitry, switching circuitry and control circuitry. The redundant clock module of the present invention is designed to continuously supply a highly reliable fixed clock reference at its output. The clock reference output is based on one of at least two internal clock references that are continuously monitored and eliminated from use if they fail or are not operating within tolerance. A slow transition between oscillator references during switching is controlled to assure no significant phase shift or runt pulses will affect the end user application. The frequency range of the redundant clock module of the present invention is preferably from 20.000 MHz to 250.000 MHz, with a user specified frequency tolerance from ±100 ppm, jitter of 5 psec rms max, and ECL compatible outputs.

[0023] Referring now to the drawings, FIG. 1 is a block diagram of the redundant clock module 10 of the present invention. The redundant clock module 10 includes a reference oscillator input stage 12; at least two frequency detect stages 14A, 14B; a frequency detect logic stage 16; a power, startup, reset stage 18; an oscillator select logic stage 20; and an output control loop path stage 22.

[0024] The reference oscillator input stage 12 preferably includes at least two reference oscillators 24, 26 depending on the level of reliability or redundancy required. One of the reference oscillators is a primary oscillator and the other reference oscillator is a redundant secondary oscillator. The reference oscillator input stage 12 provides an output I to the output control loop path stage 22, outputs A, C, to the frequency detect stages 14A, 14B, and outputs G, H to the oscillator select logic stage 20. The reference oscillator input stage 12 receives inputs K, L from the oscillator select logic stage 20. Each oscillator 24, 26 is operating and their outputs A, C are monitored by the frequency detect stage 14A, 14B. Although only the primary oscillator needs to be operating and monitored, monitoring of the redundant secondary oscillator gives the end user confidence that there is an operational backup oscillator if the primary oscillator fails. In the event that one of the oscillators fail, the frequency detect stage 14 will disconnect power to the failed oscillator to minimize damage that could occur due to the failed oscillator. An output K of the oscillator select logic stage 20 is used to select a channel in a multiplexer to provide a good oscillator clock signal I to the output control loop path stage 22.

[0025] The frequency detect stages 14A, 14B receive inputs A, C from oscillators 24, 26 on the reference oscillator input stage 12. The frequency detect stages 14A, 14B provide outputs B, D to the frequency detect logic stage 16. The frequency detect stages 14A, 14B monitor the oscillator outputs A, C to make sure that the oscillators 24, 26 are operating. All oscillators are monitored to determine which oscillator fails or is out of tolerance, providing a means for self-testing of the redundant clock module. Each reference oscillator output A, C is monitored by the frequency detect stages 14A, 14B during operation. A separate frequency detect stage is included for each reference oscillator. The frequency detect is accomplished by comparing the oscillator output A, C frequency to a voltage controlled oscillator (VCO) frequency on the frequency detect stages 14A, 14B. A VCO is an oscillator whose output frequency depends on the input control voltage. By knowing the voltage versus frequency characteristic of the VCO, the control voltage B, D of the VCO can be monitored using analog voltage comparators on the frequency detect logic stage 16 to determine if the reference oscillators are operating and within the frequency tolerance requirement.

[0026] The frequency detect logic stage 16 receives inputs B, D from the frequency detect stages 14A, 14B to compare the control voltage B, D of each monitoring circuit for the associated reference oscillator and determine if the oscillator is operational and within frequency tolerance. The frequency detect logic stage 16 includes analog voltage comparators 54, 56 to compare the control voltages B, D to a fixed reference voltage 50 generated in the frequency detect logic stage 16 that is the voltage equivalent of the frequency limit established by the tolerance desired and the VCO characteristic. Each oscillator being monitored will have an independent error signal E, F output from the frequency detect logic stage 16 to be used to switch to an operational and within tolerance reference oscillator and shut off power to the failed oscillator.

[0027] The power, startup, reset stage 18 receives inputs E, F from the frequency detect logic stage 16 to reset the power and monitoring circuits of the frequency detect stage 14A, 14B by reset signals Reset and O in the event that a failed or out of tolerance oscillator is replaced or if circuit conditions have changed. The power, startup, reset stage 18 also holds off error signals E, F from the frequency detect logic stage 16 until the output control loop path stage 22 has had a chance to lock when first powered up. Error signals E, F become error signals M, N after power has been established. After power has been established, the power, startup, reset stage 18 will output an enable signal P to enable the Output in the output control loop path stage 22.

[0028] The oscillator select logic stage 20 controls which oscillator is to be used by the output control loop path stage 22 by sending out control signals L, K to the reference oscillator input stage 12, which are based on error signals M, N and reset signal O from the power, startup, reset stage 18.

[0029] The output control loop path stage 22 uses the same circuitry as used in the frequency detect stage 14 except the control voltage 116 for the VCO 104 in the output control loop path stage 22 is not monitored, since monitoring is done in the frequency detect stage 14A, 14B, and the control loop response in the output control loop path stage 22 is slower than in the frequency detect stage 14A, 14B. This allows the output frequency of the VCO 104 to change slowly in the event that the primary reference oscillator fails. The output frequency of the VCO 104 will slowly lock to the new reference oscillator once it is selected. The input I for the output control loop path stage 22 is selected in the reference oscillator input stage 12. Thus, there will be no glitches, large phase shifts, or runt pulses from the Output of the output control loop path stage 22 that is used to drive the user's application. The output enable signal P of the output control loop path stage 22 is controlled by the power, startup, reset stage 18.

[0030] FIG. 4 is a schematic diagram of the reference oscillator input stage 12 of the redundant clock module of the present invention. Primary reference oscillator 24 and secondary reference oscillator 26 supply the frequency sources G, H for the redundant clock module. Power to the oscillators 24, 26 is switched via analog switches 28 (MAX4742EUA) based on error signals L, K from the oscillator select logic stage 20. The oscillator output I used to drive the output control loop path stage 22 is selected by a multiplexer 30 (SY100EL58) based on the error signal K from the oscillator select logic stage 20. When the error signal K is low the multiplexer 30 selects the primary reference oscillator 24 and conversely when the error signal K is high the multiplexer 30 selects the secondary reference oscillator 26.

[0031] FIG. 2 is a schematic diagram of the frequency detect stage 14 of the redundant clock module of the present invention. The frequency detect stage 14 includes a phase-frequency detector 32 (SY100EP140) to compare the phase between the reference oscillator output A, C driving this stage and the output 34 of the VCO 36 (MAX2620EUA and associated discrete components) for this stage. The output 38A, 38B of the phase-frequency detector 32 is filtered by a low pass filter 40A, 40B comprising discrete components at the output 38A, 38B of the phase-frequency detector 32 and the gain is controlled using an operational amplifier 44 (KM4100). The VCO 36 preferably comprises an integrated RF oscillator with buffered outputs (MAX2620EAU) and associated discrete components. A differential receiver 46 (SY100EL16VC) is used to further buffer the VCO output 34 and drive the input 42 of the phase-frequency detector 32. The frequency detect stage 14A, 14B generates the voltage reference B, D for the frequency detect logic stage 16 to compare and determine if the oscillators are operating and within tolerance.

[0032] FIG. 3 is a schematic diagram of the frequency detect logic stage 16 of the redundant clock module of the present invention. A precision voltage reference IC 48 (ADR291RU) supplies the precision voltage reference signal 50 used to create the voltage used to determine the frequency limits for a valid oscillator output frequency. A resistor voltage divider 52 is used to make the final adjustment to these limits based on the VCO voltage verses frequency characteristic. A pair of dual voltage comparators 54, 56 are used to detect the high and low levels for each oscillator based on the reference voltage already established compared to the loop filter voltage B, D. The frequency detect logic stage 16 uses analog voltage monitoring of the VCO voltage to determine if the oscillators are operating. A pair of OR gates 58, 60 are used to combine the outputs 62, 64 and 66, 68 of the dual voltage comparators 54, 56 to give one error signal per oscillator E, F. Common high and low limits are used in this example for both the primary and secondary oscillators, but separate high and low limits may be required depending on the application.

[0033] FIG. 5 is a schematic diagram of the oscillator select logic stage 20 of the redundant clock module of the present invention. The positive edge of oscillator error signals M, N from the power, startup, reset stage 18 are used to toggle a dual flip flop 70 (74AC109). The latched signals K, L are provided to the reference oscillator input stage 12. A reset pulse O is supplied by the power, startup, reset stage 18 to reset the latch once a repair has been made or failed condition has been corrected. Optional LED indicators 72, 74 are used as a visual means for a repair technician to determine which reference oscillator has failed, using the error signals K, G, L, and H to indicate green for working oscillators and red for failed or out of tolerance oscillators.

[0034] FIG. 6 is a schematic diagram of the power, startup, reset stage 18 of the redundant clock module of the present invention. A reset pulse O initiated by an external signal /RESET, by initial power up, or by pressing an optional reset switch 76 (EVQ-P2K02Q) is generated by a timer 78 (MIC1555BM5). The initial power up initiates the reset by the resistor capacitor time constant 80 through an OR gate 82 and an inverter 84 used to trigger a timer 86 (MIC1555BM5) and the associated discrete components. Oscillator error signals E, F are combined with the reset signal O with AND gates 88, 90 and are delayed from the reset signal O using two inverters 92, 94 and 96, 98 before each error signal M, N is sent to the oscillator select logic stage 20.

[0035] FIG. 7 is a schematic diagram of the output control loop path stage 22 of the redundant clock module of the present invention. The output control loop path stage 22 is nearly identical to the frequency detect stage 14, FIG. 2, except the output control loop response is selected to be slower so that it does not change frequency quickly during switching from one oscillator to the other, and the voltage that controls the VCO is not supplied to other stages. The output control loop path stage 22 includes a phase-frequency detector 100 (MC100EP140) to compare the phase between the reference oscillator output I driving this stage and the output 102 of the VCO 104 for this stage. The output 106A, 106B of the phase-frequency detector 100 is filtered by a low pass filter 108A, 108B via the discrete components at the output 106A, 106B of the phase-frequency detector 100 and the gain is controlled using an operational amplifier 110 (KM4100). The VCO 104 preferably comprises an integrated RF oscillator with buffered outputs (MAX2620EAU) and associated discrete components. A differential receiver 112 (SY100EL16VC) is used to further buffer the VCO output 114 and drive the input 102 of the phase-frequency detector 100. The Output from the differential receiver 112 can be used to drive the end user's application or be used to drive other devices such as fanout buffers to drive multiple outputs.

[0036] While the invention has been described with reference to preferred embodiments, it is to be understood that the invention is not intended to be limited to the specific embodiments set forth above. Thus, it is recognized that those skilled in the art will appreciate that certain substitutions, alterations, modifications, and omissions may be made without departing from the spirit or intent of the invention. Accordingly, the foregoing description is meant to be exemplary only, the invention is to be taken as including all reasonable equivalents to the subject matter of the invention, and should not limit the scope of the invention set forth in the following claims.