The invention relates to redundant control systems in which a plurality of redundantly arranged control units, such as computers, are monitored for fault conditions by circuitry that automatically responds to one or more failures by selecting a nonfaulty unit (or units) to control the system.
Such redundant control systems are used in a number of environments where failsafe operation is essential to the reliability and performance of the equipment. Digital flight controls in modern-day commercial and military aircraft are a prime example of one important application of such redundant systems. Other applications include traffic control, industrial plant or process control systems, spacecraft instrumentation, data processing systems, and telephone switching equipment.
Digital flight control systems must, for apparent reasons, meet high reliability requirements. Normally, these requirements can be met only with redundant hardware, since it is virtually impossible to totally eliminate malfunctions of individual hardware components. In the management of redundant systems, there is a problem in distinguishing between operational and failed units and in selecting a proper configuration from the available, or remaining, healthy units. An automatic means and method for making this selection may be performed by logic circuitry that receives failure information signals from the redundant computers or other control units and makes the proper selection based on such information.
In developing the logic by which the selection circuitry chooses one control unit over another, a common design approach is to monitor the output states of the redundant control units and, by comparison voting of the outputs, determine by majority rule any faulty control units that should be excluded from participating in the control of the system. A variation of this logic scheme is to provide means associated with each control unit for cross-checking the health status of the remaining units and again voting the cross-checks so that when a majority of the control units determines that one or more minority control units have failed, those failed units will be excluded from system control. Systems based on such majority voting schemes work well as long as a majority of control units are available for voting down a minority of faulty units. When, however, the vote is even, such as where two remaining control units vote against each other as a result of cross-checks, then the system is at loggerheads and is unable to make a meaningful selection from the available fault information.
Other proposed designs provide selection logic schemes that operate to select a certain control unit given a predetermined set of input fault conditions, even though another control unit is currently in control and has the same fault status. Such fixed, unflexible operating logic results in excessive switching between control units of equal probability of failure. Changing the unit in control, when unjustified by relative fault conditions, increases rather than decreases the likelihood of a malfunction in the overall system.
Still another shortcoming of some existing selection logic circuits is their inability to recover from transient faults. Momentary fault conditions, including apparent (but not real) faults, may occur even though the monitored control unit is basically in good operating order. If the selection logic permanently excludes (deselects) a control unit because of a transient fault, the overall reliability of the redundant system rapidly deteriorates because the excluded control unit can no longer participate in a voting or other comparison scheme. On the other hand, if units are allowed to be brought back on line after they have recovered from a transient failure, then the overall system is better able to respond to future equipment failures.