Multi-channel control switchover logic

Patent metadata

Field	Value
Publication number	US-9625894-B2
Application number	US-201113239791-A
Country	US
Kind code	B2
Filing date	Sep 22, 2011
Priority date	Sep 22, 2011
Publication date	Apr 18, 2017
Grant date	Apr 18, 2017

Abstract

A multi-channel control system includes a first primary control microprocessor and a second primary control microprocessor operable to control a device, and a first secondary control microprocessor and a second secondary control microprocessor operable to control the device. Each of the first and second primary control microprocessors and the first and second secondary control microprocessors are arranged as an independent control channel.

First claim

The invention claimed is:

1. A method of electronically controlling a device comprising:
controlling a device using a first primary control microprocessor under normal conditions;
controlling said device using a second primary control microprocessor when said first primary control microprocessor is unhealthy and said second primary control microprocessor is healthy;
controlling said device using a first secondary control microprocessor or a second secondary control microprocessor when said first primary control microprocessor and said second primary control microprocessor are unhealthy;
each of said first primary control microprocessor, said second primary control microprocessor, said first secondary control microprocessor, and said second secondary control microprocessors that is not controlling said device accepting a channel in-control signal from one of said first primary control microprocessor, said second primary control microprocessor, said first secondary control microprocessor, and said second secondary control microprocessor wherein the microprocessor originating the channel in-control signal is controlling said device; and
wherein said channel in-control signal prohibits each of said first primary control microprocessor, said second primary control microprocessor, said first secondary control microprocessor, and said second secondary control microprocessors that is not controlling said device from asserting control.

2. The method of claim 1 , wherein said channel in-control signal indicates that a channel originating the channel in-control signal is healthy and controlling said device.

3. The method of claim 1 , wherein said first secondary control microprocessor takes control of said device when said first primary control microprocessor and said second primary control microprocessor are in a failure state and when said first primary control microprocessor was an immediately previous active control microprocessor.

4. The method of claim 3 , wherein said second secondary control microprocessor takes control of said device when said first primary control microprocessor and said second primary control microprocessor are in the failure state, and said first secondary control microprocessor becomes unhealthy.

5. The method of claim 1 , wherein said second secondary control microprocessor takes control of said device when said first primary control microprocessor and said second primary control microprocessor are in a failure state and when said second primary control microprocessor was an immediately previous active control microprocessor.

6. The method of claim 1 , wherein a microprocessor is healthy when the microprocessor exhibits no faults, and the microprocessor is unhealthy when the microprocessor exhibits at least one fault.

7. An electrical control configuration comprising: at least a first primary control microprocessor and a second primary control microprocessor operable to control a device; at least a first secondary control microprocessor and a second secondary control microprocessor operable to control said device; each of said first and second primary control microprocessors and said first and second secondary control microprocessors being arranged as an independent equivalent control channel;
wherein each of said first and second primary control microprocessors and said first and second secondary control microprocessors further comprises a control input, and wherein a signal received at said control input is a positive voltage when another of said first and second primary control microprocessors and said first and second secondary control microprocessors is healthy and controlling said device; and wherein said control input is operable to prevent each of said first and second primary control microprocessors and said first and second secondary control microprocessors from asserting control over said device when said signal received at said control input is the positive voltage.

8. The electrical control configuration of claim 7 , wherein each of said first and second primary control microprocessor and said first and second secondary control microprocessor comprises a corresponding switchover logic gate series, wherein each of said switchover logic gate series comprises a plurality of logic gates operable to generate control inputs for switching the corresponding control microprocessor to an active status.

9. The electrical control configuration of claim 8 , wherein said switchover logic gates are operable to cause said first secondary control microprocessor to take control of said device when said first primary control microprocessor and said second primary control microprocessor are in a failure state and when said first primary control microprocessor was an immediately previous active control microprocessor.

10. The electrical control configuration of claim 8 , wherein said switchover logic gates are operable to cause said second secondary control microprocessor to take control of said device when said first primary control microprocessor and said second primary control microprocessor are in a failure state, and said first secondary control microprocessor becomes unhealthy.

11. The electrical control configuration of claim 8 , wherein said switchover logic gates are operable to cause control to be transitioned from said first secondary control microprocessor to said second primary control microprocessor when said second primary control microprocessor enters a healthy state, and said second primary control microprocessor was unhealthy.

12. The electrical control configuration of claim 8 , wherein said switchover logic gates are operable to cause said second secondary control microprocessor to take control of said device when said first primary control microprocessor and said second primary control microprocessor are in a failure state and when said second primary control microprocessor was an immediately previous active control microprocessor.

13. The electrical control configuration of claim 8 , wherein said switchover logic gates are operable to cause said first primary control microprocessor to take control of said device when said first primary control microprocessor is currently healthy and was previously in a failure state and said second primary control microprocessor is in a failure state, and said second secondary control microprocessor was control microprocessor in-control but subsequently becomes unhealthy.

14. The electrical control configuration of claim 7 , wherein a microprocessor is healthy when the microprocessor exhibits no faults, and the microprocessor is unhealthy when the microprocessor exhibits at least one fault.

Assignees

• Kamenetz Jeffry K
• Johnston Mark A
• Marotta Edward John
• Bleier Cathleen R
• O'Neil John M
• Hamilton Sundstrand Corp

Inventors

• Kamenetz Jeffry K
• Johnston Mark A
• Marotta Edward John
• Bleier Cathleen R
• O'Neil John M

Classifications

• G05B2219/24186

  Redundant processors are synchronised · CPC title

• G05B2219/24183

  If error, spare unit takes over, message to leader, confirm new configuration · CPC title

• G05B2219/14014

  Redundant processors and I-O · CPC title

• G05B19/0428

  Safety, monitoring (G05B19/0423 takes precedence) · CPC title

• G06F11/2033

  switching over of hardware resources · CPC title