Redundant Two-Processor Controller Synchronization Error Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing safety architectures with two redundant processors face challenges in maintaining high availability and error tolerance, particularly after a lockstep error occurs, as they often result in complete system shutdown without proper error evaluation, which is unsuitable for safety-relevant applications.
Innovation Solution
A redundant two-processor control device with a restoration control unit that monitors and tests processor synchronization, determines which processor has an error, and reconfigures the system to ensure only the error-free processor acts on peripheral units, allowing continued operation with maintained safety levels and increased availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If two redundant processors operate in lockstep mode with continuous monitoring, then system reliability is improved, but the system shuts down completely after a synchronization error without proper error evaluation
Solution Approach 1:
The patent segments the error handling process into distinct phases: error detection by the comparison unit, error evaluation by the restoration control unit, and selective processor isolation. This segmentation allows the system to evaluate errors before taking action, preventing unnecessary complete shutdowns while maintaining reliability through structured error management.
Solution Approach 2:
The restoration control unit acts as an intermediary between the comparison unit (which detects synchronization errors) and the processors (which execute control programs). It evaluates the detected errors and determines the appropriate response, including whether to isolate a processor or allow continued operation, thereby preventing premature system shutdowns.
2Reliability
If the system shuts down completely after a lockstep error, then safety is maintained, but availability is reduced
Solution Approach 1:
The restoration control unit performs preliminary error evaluation before the system shuts down. By analyzing the synchronization error and determining whether it indicates a genuine safety-critical failure or a recoverable condition, the system can avoid unnecessary complete shutdowns and maintain availability while preserving safety through informed decision-making.
Solution Approach 2:
The system dynamically changes its operational parameters based on error evaluation results. When errors are evaluated as non-critical, the system transitions from a safe shutdown state to a continued operation state with the faulty processor isolated. This parameter change allows the system to maintain both safety and availability under varying error conditions.
3Difficulty of detecting and measuring
If parity checking is used to detect errors, then error detection capability is improved, but false decisions occur with multi-bit errors
Solution Approach 1:
The comparison unit continuously monitors processor outputs and provides feedback to the restoration control unit. This feedback mechanism enables real-time detection of synchronization errors and allows the restoration control unit to evaluate the nature of errors (including multi-bit errors) before making decisions, improving both detection capability and decision accuracy compared to simple parity checking.
Data Source
AI summary
A redundant two-processor controller having a first processor (1) and a second processor (1) for the synchronous execution of a control program. The controller having at least a first multiplexer (70, 91) for optionally connecting at least a first peripheral unit (72, 95) to be actuated to one of the two processors (1, 2), and at least a first Comparison unit (70, 91) for monitoring the synchronization state of the two processors (1, 2) and for detecting a synchronization error. A restoration control unit (44) is designed to monitor the execution of at least one test program by the two processors (1, 2) after the occurrence of a synchronization error and to evaluate the test results, and which is designed to configure at least the first multiplexer (70, 91).