System and method for fault tolerant computing using generic hardware
View Patent ↗A dual redundant process controller is provided. The controller comprises a process control application that executes on a first and a second module. When executed by the first module, a first application instance writes a first synchronization information to the second module, reads a second synchronization information from the first module, and, when the second disagrees with the first synchronization information after passage of a time-out interval, performs a resynchronization function; and wherein, when executed by the second module, the second application instance writes the second synchronization information to the first module, reads the first synchronization information from the second module, and, when the first disagrees with the second synchronization information after passage of the time-out interval, performs the resynchronization function. The first application instance calls the synchronization function provided by the multitasking real-time operating system before invoking a set events function provided by a multitasking real-time operating system.
1. A dual redundant process controller, comprising:
a first processor;
a first memory;
a first instance of a multitasking real-time operating system (RTOS);
a first instance of a process control application stored in the first memory;
a second processor;
a second memory;
a second instance of the multitasking real-time operating system; and
a second instance of the process control application stored in the second memory,
wherein, when executed by the first processor in a context provided by the first instance of the multitasking real-time operating system, the first instance of the process control application:
writes a first synchronization information to the second memory using a synchronization function provided by the first instance of the multitasking real-time operating system,
reads a second synchronization information from the first memory,
performs a resynchronization function when the second synchronization information disagrees with the first synchronization information after passage of a predetermined time-out interval, and
calls the synchronization function provided by the first instance of the multitasking real-time operating system before invoking a set events function provided by the first instance of the multitasking real-time operating system, and
wherein, when executed by the second processor, the second instance of the process control application:
writes the second synchronization information to the first memory using the synchronization function provided by the second instance of the multitasking real-time operating system,
reads the first synchronization information from the second memory, and
performs the resynchronization function when the first synchronization information disagrees with the second synchronization information after passage of the predetermined time-out interval.
2. The controller of claim 1 , wherein the first synchronization information is written to the second memory via an Ethernet transmission from the first processor to the second processor and wherein the second synchronization information is written to the first memory via an Ethernet transmission from the second processor to the first processor.
3. The controller of claim 1 , wherein the process control application comprises a state sequencer, wherein the first instance of the process control application executes a first state sequencer that tracks the execution state of the first instance of the process control application, and wherein the second instance of the process control application executes a second state sequencer that tracks the execution state of the second instance of the process control application.
4. The controller of claim 3 , wherein the first instance of the state sequencer determines the first synchronization information and wherein the second instance of the state sequencer determines the second synchronization information.
5. The controller of claim 1 , wherein the synchronization function provided by the first instance of the multitasking real-time operating system promotes synchronizing on a clock tick generated by the first instance of the multitasking real-time operating system.
6. A dual redundant process controller, comprising:
a first processor;
a first memory;
a first instance of a multitasking real-time operating system (RTOS);
a first instance of a process control application stored in the first memory;
a second processor;
a second memory;
a clock;
a second instance of the multitasking real-time operating system; and
a second instance of the process control application stored in the second memory,
wherein, when executed by the first processor in a context provided by the first instance of the multitasking real-time operating system, the first instance of the process control application:
writes a first synchronization information indicating a clock tick synchronization to the second memory using a synchronization function provided by the first instance of the multitasking real-time operating system,
writes a second synchronization information to the second memory using the synchronization function provided by the multitasking real-time operating system,
reads a third synchronization information from the first memory, and
performs a resynchronization function when the third synchronization information disagrees with the second synchronization information after passage of a predetermined time-out interval, and
wherein, when executed by the second processor, the second instance of the process control application adjusts the clock based on the first synchronization information stored in the second memory.
7. The controller of claim 6 , further comprising a high-level data link control (HDLG) communication controller coupled to the first processor, wherein the first instance of the multitasking real-time operating system further:
forms a first message comprising a first data payload and a first cyclic redundancy check (CRC), and
transmits the first message to the high-level data link control communication controller, and
wherein the high-level data link control communication controller is configured to:
receive the first message,
transmit the first message to a field device,
receive the transmitted first message,
calculate a second cyclic redundancy check based on receiving the transmitted first message, and
transmit an error message to the first processor when the second cyclic redundancy check is different from the first cyclic redundancy check.
8. The controller of claim 6 , wherein the second synchronization information and third synchronization information are exchanged to synchronize state between the first and the second instance of the process control application.
9. The controller of claim 8 , wherein the process control application comprises a state sequencer, wherein the first instance of the process control application executes a first state sequencer that tracks the execution state of the first instance of the process control application, and wherein the second instance of the process control application executes a second state sequencer that tracks the execution state of the second instance of the process control application.
10. The controller of claim 6 , wherein the first synchronization information is written to the second memory via an Ethernet transmission from the first processor to the second processor.