Honeywell International Inc.

Honeywell G.m.b.h.

Richard F Hess

Kent Stange

Randy Rogers

Gerald B Kelley

Larry James Yount

Brendan Hall

Devesh Bhatt

Timothy D Mahoney

Clarence S Smith

William M McMahon

John Teager

Philip E Rose

Gerald B Kelly

Kurt A Liebel

Scot E Griffiths

A method and system for redundancy management is provided for a distributed and recoverable digital control system. The method uses unique redundancy management techniques to achieve recovery and restoration of redundant elements to full operation in an asynchronous environment. The system includes a first computing unit comprising a pair of redundant computational lanes for generating redundant control commands. One or more internal monitors detect data errors in the control commands, and provide a recovery trigger to the first computing unit. A second redundant computing unit provides the same features as the first computing unit. A first actuator control unit is configured to provide blending and monitoring of the control commands from the first and second computing units, and to provide a recovery trigger to each of the first and second computing units. A second actuator control unit provides the same features as the first actuator control unit.

Method and system for redundancy management of distributed and recoverable digital control system

A distributed engine control system is provided. The engine control system includes first and second engine data concentrators. Each of the first and second engine data concentrators include a processor module, a signal conditioning module coupled to the processor module, a data transfer module coupled to the processor module, and a data bus coupled between the first and second engine data concentrators and a hydro-mechanical unit (HMU).

Distributed engine control system

System and methods for providing a recoverable real time multi-tasking computer system are disclosed. In one embodiment, a system comprises a real time computing environment, wherein the real time computing environment is adapted to execute one or more applications and wherein each application is time and space partitioned. The system further comprises a fault detection system adapted to detect one or more faults affecting the real time computing environment and a fault recovery system, wherein upon the detection of a fault the fault recovery system is adapted to restore a backup set of state variables.

Fault recovery for real-time, multi-tasking computer system

A method for optimizing the use of digital computing resources to achieve reliability and availability of the computing resources is disclosed. The method comprises providing one or more processors with a recovery mechanism, the one or more processors executing one or more applications. A determination is made whether the one or more processors needs to be reconfigured. A rapid recovery is employed to reconfigure the one or more processors when needed. A computing system that provides reconfigurable and recoverable computing resources is also disclosed. The system comprises one or more processors with a recovery mechanism, with the one or more processors configured to execute a first application, and an additional processor configured to execute a second application different than the first application. The additional processor is reconfigurable with rapid recovery such that the additional processor can execute the first application when one of the one more processors fails.

Methods and systems for providing reconfigurable and recoverable computing resources

A monitoring system and methods are provided for a distributed and recoverable digital control system. The monitoring system generally comprises two independent monitoring planes within the control system. The first monitoring plane is internal to the computing units in the control system, and the second monitoring plane is external to the computing units. The internal first monitoring plane includes two in-line monitors. The first internal monitor is a self-checking, lock-step-processing monitor with integrated rapid recovery capability. The second internal monitor includes one or more reasonableness monitors, which compare actual effector position with commanded effector position. The external second monitor plane includes two monitors. The first external monitor includes a pre-recovery computing monitor, and the second external monitor includes a post recovery computing monitor. Various methods for implementing the monitoring functions are also disclosed.

Monitoring system and methods for a distributed and recoverable digital control system

A real-time multi-tasking digital control system with rapid recovery capability is disclosed. The control system includes a plurality of computing units comprising a plurality of redundant processing units, with each of the processing units configured to generate one or more redundant control commands. One or more internal monitors are employed for detecting data errors in the control commands. One or more recovery triggers are provided for initiating rapid recovery of a processing unit if data errors are detected. The control system also includes a plurality of actuator control units each in operative communication with the computing units. The actuator control units are configured to initiate a rapid recovery if data errors are detected in one or more of the processing units. A plurality of smart actuators communicates with the actuator control units, and a plurality of redundant sensors communicates with the computing units.

Distributed and recoverable digital control system

An interface between memories having different write times is described. The interface includes a latch for capturing address and data information during a memory access by a processor of a first memory device. The interface also includes an index counter for providing frame management. The interface also includes a variable identity array logic for determining what data is to be written into a second memory device and address generation logic to determine where the data is to be stored in the second memory device. Additionally, the interface includes data validity logic to ensure that the data being written into the second memory device is valid. As a result, the processor can operate in substantially real time and can restore itself after detecting an event upset using the data stored in the second memory device.

Interface for writing to memories having different write times

A control system architecture suitably includes sufficient computation redundancy and control command management to isolate and recover a faulted processor and/or to recover all processing units in the redundant system without adverse effects. Computational redundancy may be provided with multiple processors and/or processing units within computers or computing platforms. In addition to isolating and recovering from internal faults, various embodiments allow computing units to detect faults in other system elements such as sensors, adaptors, actuators and/or effectors. Further embodiments may also include one or more actuator adaptor units that detect faults in other system components and issue discrete instructions to trigger a recovery. In some embodiments, the recovery is performed within one or two computing frames, or otherwise in a short enough time period so as to have only minimal affects, if any, on system performance or redundancy.

High integrity control system architecture using digital computing platforms with rapid recovery

A memory system for a digital computer includes a non-volatile random access memory for storing past and present values of state variables is immune from electromagnetic transients and other disturbances which can affect the integrity of the memory. Each memory cell is designed with an energy storage device and logic devices which control the logic sequence for charging of the energy storing devices. These memory cells are aligned in an array and specially designed system is included with this that takes into account the length of time required in order to charge each cell in the array.

Memory with high integrity memory cells

In a computer system having fault recoverable capability, there is included a first and second data processing unit (DPU), wherein each of the first and second DPU is executing the same task essentially in parallel. Each DPU comprises a processor, a memory and a protected memory. The protected memory stores system data, such that the system data stored in the protected memory is immune from transient conditions. Also included is a monitor, which is operatively connected to the monitor of the other DPU. The monitor detects the occurrence of an upset to reinitialize the DPU, the DPU being reinitialized to a condition just prior to the occurrence of the upset thus avoiding utilization of any potentially erroneous data, and thereby permitting the DPU to return to its normal processing with valid data.

Fault recoverable computer system

A method and apparatus allows fault recovery in a digital computer based control system whereby system upsets induced by external transient noise conditions can be accommodated. A CPU is coupled to its main memory and its I/O interfaces by a common address/data bus, these three elements being susceptible to having data thereon or therein corrupted by transient noise. Also coupled to the bus, but in a hardened environment, are first and second supplemental memories which, under memory control, operate on alternating even and odd computational frames defined by the CPU's real-time clock to store the same words as are then being entered into the CPU's main memory. As computational frames are entered into one or the other of these two memories by eaves-dropping on the common bus, the other supplemental memory is transferring its contents to a backup memory which is also housed in the noise-immune environment. The backup memory is connected in a read-only mode to the address/data bus and, because of the manner of operation, always contains the computational frame that is delayed one cycle of the CPU's real-time clock from the frame in progress. Should a transient upset occur, it may be followed by a transfer of the information from the backup memory into the computer's main memory such that computations can then continue with data that is uncorrupted.

Fault recovery mechanism, transparent to digital system function

A digital data processor architecture immune from digital computer upset including a non-volatile random access memory for storing past and present values of state variables. An index counter is utilized to offset the store and retrieve instruction base addresses to effect the multiple storage of the state variables in the non-volatile memory. A monitor detects disruptions in data processing and vectors the processor to a reinitialization and restart routine in which the past values of the state variables are utilized.

Growing community of inventors

Glendale, AZ, United States of America

Richard F Hess