The Boeing Company

Todd Hill

David G Bond

David T Kirkland

John R Woods

Vincent A Caluori

Derek J VanAlen

Paul D Weis

Michael L Raftery

A data exchange system for use in a system that includes a plurality of redundant channels (12). A data exchange unit (30) is provided to process data, ensuring that consistent data are used by each of the channels. The data exchange unit votes the data so that an output is provided that is identical in non-faulty channels. The data exchange units communicate over an inter-channel net that includes a consistency port (160), which serves as a separate second fault containment region for each channel, enabling the data exchange system to be Byzantine resilient. If input data are provided by a single one of the redundant channels, the data are distributed to each of the data exchange units for all channels in the system using two rounds of communication. However, if nominally identical data are input to each of the data exchange units in the redundant channels, a single round of communication and a simple voting process are used to determine a consistent output for each channel. A multiplexer (112) is used to select the data source for distribution to the consistency ports of each of the data exchange units. A 16-bit voter circuit (130) in each data exchange unit votes on the data received by the data exchange unit from the consistency ports for all of the channels to determine the output that is used by each channel.

Fault tolerant data exchange unit

A fault tolerant clock system in which synchronization of the clocks continuing to operate after a fault occurs is maintained within a skew limit. The clock system includes a plurality of clock channels (10), each including a clock unit (12) and an isolation port (14). A local clock signal produced by a crystal oscillator (16) is enabled to provide a clock channel output signal while a counter (24) in the clock unit accumulates a predetermined number of local clock pulses. After the predetermined number is reached, the counter disables the clock channel output signal and produces a sync pulse, which is input to a voter block (48). In response to the second sync pulse to be received from each of the clock channels, each voter block produces a load pulse signal that is input to the isolation port of that clock channel. Corresponding isolated load signals are produced by the isolation port and provided to voter blocks (72) in each of the clock units. The voter blocks respond to the second isolated load signal to be received, producing a load enable signal that is input to the counter. Upon receipt of the load enable signal, the counter resumes counting and again enables the clock channel output signal, in synchronization with the other clock channel output signals. Up to N simultaneous faults may be sustained in the clock system, without loss of synchronization in the clock channels that continue to operate properly, so long as 2N+1 clock channels are provided.

Autonomous N-modular redundant fault tolerant clock system

Growing community of inventors

Tukwila, WA, United States of America

Todd Hill