System and method for fault tolerant computing using generic hardware

1. A dual redundant process controller, comprising:

a first processor;

a first memory;

a first instance of a process control application stored in the first memory;

a second processor;

a second memory; and

a second instance of the process control application stored in the second memory,

wherein, when executed by the first processor, the first instance of the process control application writes a first synchronization information to the second memory, reads a second synchronization information from the first memory, and, when the second synchronization information disagrees with the first synchronization information after passage of a predetermined time-out interval, performs a resynchronization function; and

wherein, when executed by the second processor, the second instance of the process control application writes the second synchronization information to the first memory, reads the first synchronization information from the second memory, and, when the first synchronization information disagrees with the second synchronization information after passage of the predetermined time-out interval, performs the resynchronization function.

2. The controller of claim 1 , wherein the first synchronization information is written to the second memory via an Ethernet transmission from the first processor to the second processor and wherein the second synchronization information is written to the first memory via an Ethernet transmission from the second processor to the first processor.

3. The controller of claim 1 , wherein a first instance of a multitasking real-time operating system (RTOS) executes on the first processor, wherein the first instance of the process control application executes in a context provided by the first instance of the real-time operating system, wherein a second instance of the multitasking real-time operating system executes on the second processor, and wherein the second instance of the process control application executes in a context provided by the second instance of the real-time operating system.

4. The controller of claim 3 , wherein the first instance of the process control application writes the first synchronous information to the second memory using a system call provided by the multitasking real-time operating system and wherein the second instance of the process control application writes the second synchronous information to the first memory using a system call provided by the real-time operating system.

5. The controller of claim 1 , wherein the process control application comprises a state sequencer, wherein the first instance of the process control application executes a first state sequencer that tracks the execution state of the first instance of the process control application, and wherein the second instance of the process control application executes a second state sequencer that tracks the execution state of the second instance of the process control application.

6. The controller of claim 5 , wherein the first instance of the state sequencer determines the first synchronization information and wherein the second instance of the state sequencer determines the second synchronization information.

7. The controller of claim 1 , wherein the process control application executes synchronization functions of a multitasking real-time operating system to synchronize state.

8. The controller of claim 7 , wherein the synchronization function promotes synchronizing on a clock tick generated by the multitasking real-time operating system.

9. The controller of claim 1 , wherein the first processor and the second processor execute a recovery procedure if resynchronization happens too often.

10. The controller of claim 9 , wherein the recovery procedure is accomplished via establishing the second processor that was formerly operating in a shadow mode as operating in a primary mode and establishing the first processor that was formerly operating in the primary mode as operating in the shadow mode; and establishing the first processor that was formerly operating in the shadow mode as operating in the primary mode and establishing the second processor that was formerly operating in the primary mode as operating in the shadow mode.

11. The controller of claim 10 , wherein the recovery procedure is accomplished via further performing diagnostics on the processor that has been determined to be inaccurate.

12. The controller of claim 1 , further comprising the second processor operating in a shadow mode to detect the differences between the first synchronization information and the second synchronization information and periodically adjusting to align with the first processor operating in a primary mode; and the first processor operating in a shadow mode to detect the differences between the first synchronization information and the second synchronization information and periodically adjusting to align with the second processor operating in a primary mode.

13. The controller of claim 1 , further comprising the second processor determining an average rate of clock drift between the two processors and prophylactically correcting itself to minimize the clock drift experienced; and the first processor determining an average rate of clock drift between the two processors and prophylactically correcting itself to minimize the clock drift experienced.

14. A dual redundant process controller, comprising:

a first processor;

a first memory;

a first instance of a process control application stored in the first memory;

a second processor;

a second memory; and

a second instance of the process control application stored in the second memory,

wherein, when executed by the first processor, the first instance of the process control application writes a first synchronization information to the second memory, reads a second synchronization information from the first memory, and, when the second synchronization information disagrees with the first synchronization information by a value representative of a need for resynchronization, performs a resynchronization function; and

wherein, when executed by the second processor, the second instance of the process control application writes the second synchronization information to the first memory, reads the first synchronization information from the second memory, and, when the first synchronization information disagrees with the second synchronization information by a value representative of a need for resynchronization, performs the resynchronization function.

15. The controller of claim 14 , wherein the value representative of a need for resynchronization is a time difference.

16. The controller of claim 15 , wherein the time difference is a value within a range of about 50 μs to about 50 ms.

17. The controller of claim 14 , wherein the process control application executes synchronization functions of a multitasking real-time operating system to synchronize state.

18. The controller of claim 17 , wherein the synchronization function promotes synchronizing on a clock tick generated by the multitasking real-time operating system.

19. The controller of claim 14 , further comprising the second processor operating in a shadow mode to detect the differences between the first synchronization information and the second synchronization information and periodically adjusting to align with the first processor operating in a primary mode; and the first processor operating in a shadow mode to detect the differences between the first synchronization information and the second synchronization information and periodically adjusting to align with the second processor operating in a primary mode.

20. The controller of claim 14 , further comprising the second processor determining an average rate of clock drift between the two processors and prophylactically correcting itself to minimize the clock drift experienced; and the first processor determining an average rate of clock drift between the two processors and prophylactically correcting itself to minimize the clock drift experienced.