Patent Application
20050273653
The present invention relates generally to the field of redundant systems and, in particular, to single fault tolerance in an architecture with redundant systems.
At times, electronic systems can operate outside normal parameters thereby producing faulty data. In some circumstances, the failure of these systems can be catastrophic. For example, failure of an electronic control system in a jet engine or other aerospace vehicle can cause the vehicle to depart from a desired trajectory thereby endangering lives of passengers, passengers of other vehicles or bystanders on the ground. As a consequence, many systems include redundant components so that when one system fails, a back-up system is brought on line to function in place of the primary unit.
To further complicate matters, it is not always directly apparent when an electronic system is not functioning properly. For example, the system may still produce data, although the data may be incorrect. This is commonly referred to as the “Byzantine Generals problem” since, in combat, Generals may not always get accurate data from observers during a battle. To combat this problem, data from multiple sources is commonly consulted so that faulty data can be isolated. Similarly in electronic systems, voting mechanisms are used to identify good data from faulty data. The voting mechanisms look at the simultaneous output of redundant systems to determine the correct data.
One assumption with voting mechanisms is that only one fault occurs at a time. This single fault assumption allows identification of the faulty output. Typically, three systems operate simultaneously so that if one system fails, it can be identified by the other two. Essentially, the third system casts the tie-breaking vote. If only two systems are used, it is possible to identify an error, but, not which output is correct.
Navigation systems in aerospace vehicles, e.g., missiles, are subject to potential faults that could cause the vehicle to depart from a programmed trajectory. One type of navigation system is referred to as a Space based Integrated Global positioning/Inertial navigation system (SIGI). To overcome the Byzantine problem, it is possible to use three redundant SIGI systems. This however, is a very expensive proposition due to the expense of each SIGI system.
Therefore, there is a need in the art for an improved architecture that provides a lower cost solution to overcome the Byzantine problem in an architecture having redundant systems.
Embodiments of the present invention address the Byzantine problem by using dual processors in redundant systems to thereby reduce the need for a third system. In one embodiment, an electronic module is provided. The electronic module includes a first system and a second, redundant system. The first and second redundant systems include at least three processors having health management tasks that operate independently to perform a voting function to identify faults within the electronic module.
In the following detailed description of the preferred embodiments, reference is made to the accompanying drawings that from a part hereof, and in which is shown by way of illustration specific embodiments in which the invention may be practiced. It is to be understood that other embodiments may be utilized and structural changes may be made without departing from the scope of the present invention.
In first and second systems 102 and 122, each of the processors 104, 116, 124 and 136 are programmed to perform specified functions for the normal operation of the system 100. For example, the processors in an E-SIGI system provide flight control and navigation functions for the associated aerospace vehicle. In one embodiment, processors 104 and 124 perform the navigation functions for the aerospace vehicle. In one embodiment, the other processors 116 and 136 performs flight control and mission processes.
In addition to the normal system functions performed by each processor, embodiments of the present invention leverage the existence of the four processors to overcome the Byzantine Generals problem by independently running a health management application on each of the processors. This provides four votes to identify system components that are not operating within normal parameters. Thus, each processor 104, 116, 124 and 136 performs two distinct functions. One of these functions includes normal system function represented by system processes 106, 118, 126 and 138. Each processor also performs a health management function represented by health management processes 108, 120, 128 and 140. In terms of the health management process, each of the processors 104, 116, 124, and 136 operates independently of the other processors in system 100.
Processors 104, 116, 124 and 136 are inter-connected with a health management bus 142. The health management bus provides the health information as determined by each processor to the health management process running on each of the other processors. The health status of each voter (processor) is shared by each of the other voters and enables to determine how the first and second systems 102 and 122 are performing. When one of the processors provides different information that the other processors, a fault has been isolated.
The health management bus 142 provides data on a number of parameters between the various processors, e.g., monitored voltages, check sums, status of sub-modules (whether GPS receiver in init mode or operating mode), etc. The status of each submodule provides extended detail of possible faults such as invalid word counts, invalid message number, hardware configuration mismatch, oscillator monitor failure, D/A comparison, temperature sensor failure, digitizer saturation failure, etc.
The function of the health management bus is to communicate the health status of the systems between the processors. In one embodiment, the health management system is performed over either a fault tolerant 1553 bus or an opto-coupled bus. In one embodiment, the health management bus is a transformer coupled bus.
A voting process is performed using all the processors to determine the status of various parameters and consequently faults within the system 100. Each processor receives the same information and performs the same functions during a voting process. Typically, one of processors functions as the coordinator of the voting process.
One embodiment of a voting process for identifying faults is described below in conjunction with
In
The embodiment of
Embodiments of the present invention have been described. The embodiments provide a redundant architecture that can overcome the Byzantine problem. Ordinarily, three systems are required to establish a proper vote and thereby increasing the overall cost of the architecture. This invention defeats this problem and reduces the cost of the architecture allowing only two systems to determine which system has the problem.
Although specific embodiments have been illustrated and described in this specification, it will be appreciated by those of ordinary skill in the art that any arrangement that is calculated to achieve the same purpose may be substituted for the specific embodiment shown. This application is intended to cover any adaptations or variations of the present invention.
