Ensuring a correct program sequence in a dual-processor architecture
A method of ensuring a correct program sequence in a dual-Processor module that includes Processor A and Processor B. Processor A and Processor B are both coupled to a common memory. Processor A and Processor B each execute a first safety program and each generate an instruction stream therefrom. At one or more points in time while running the first safety program, Processor A reads its program counter value from a current instruction being executed and generates therefrom a current Processor A CRC value, and Processor B reading its program counter value from the same current instruction being executed generates therefrom a current Processor B CRC value. Processor A transfers its current CRC value to Processor B and/or Processor B transfers its current CRC value to Processor A, and these CRC values are compared. A safety action is triggered if the comparing determines non-matching current CRC values.
1. A method of ensuring correct program sequences in a dual-processor module that includes Processor A and Processor B both coupled to a common memory, comprising:
said Processor A and Processor B each including a program counter and executing a first safety program including a plurality of processor instructions in a program sequence to generate an instruction stream therefrom;
at one or more selected points in time while said executing said first safety program, said Processor A reading a program counter value from its said program counter from a current instruction being executed and then calculating a current Processor A cyclic redundancy check (CRC) value from said program counter value corresponding to said instruction stream at said selected point in time in said program sequence, and said Processor B reading a program counter value from its program counter from said current instruction being executed and then calculating a current Processor B CRC value from said program counter value corresponding to said instruction stream at said selected point in time in said program sequence;
at least one of said Processor A transferring its current CRC value to Processor B and said Processor B transferring its current CRC value to said Processor A;
comparing said current Processor A CRC value to said current Processor B CRC value, and
triggering a safety action if said comparing determines that said current Processor A CRC value does not match said current Processor B CRC value.
2. The method of claim 1 , wherein said comparing comprises both said Processor A and said Processor B comparing said current Processor A CRC value to said current Processor B CRC value.
3. The method of claim 1 , wherein said selected points in said program sequence are automatically selected from said program counter values.
4. The method of claim 1 , wherein said selected points in time total less than said plurality of processor instructions.
5. The method of claim 1 , wherein said dual-processor module comprises a first and a second safety controller configured together as a redundant safety controller.
6. The method of claim 1 , wherein said dual-processor module comprises a redundant first and second input/output (I/O) module configured together as a redundant I/O module.
7. The method of claim 1 , wherein said Processor A and said Processor B both comprise microprocessors.
8. The method of claim 1 , wherein a plurality of said dual-processor modules within a fault-tolerant industrial control system comprises:
a first said dual-processor module as a first safety controller and a second dual-processor module as a second safety controller configured together in a redundant safety controller, and
a third said dual-processor module as a first input/output (I/O) module and fourth said dual-processor module as a second input/output (I/O) module configured together in a redundant I/O module,
wherein said first and second I/O modules are both coupled to field devices that are coupled to processing equipment.
9. A dual-processor module, comprising:
a Processor A and a Processor B both coupled to a common memory;
said Processor A and said Processor B each including a program counter for executing a logical sequence monitoring for dual-processors algorithm and a first safety program including a plurality of processor instructions in a program sequence to generate an instruction stream therefrom; said logical sequence monitoring algorithm implementing a method of ensuring a correct program sequence, comprising;
at one or more selected points in time while said executing said first safety program, said Processor A reading a program counter value from its said program counter from a current instruction being executed and then calculating a current Processor A cyclic redundancy check (CRC) value from said program counter value corresponding to said instruction stream at said selected point in time in said program sequence, and said Processor B reading a program counter value from its program counter from said current instruction being executed and then calculating a current Processor B CRC value from said program counter value corresponding to said instruction stream at said selected point in time in said program sequence;
at least one of said Processor A transferring its current CRC value to Processor B and said Processor B transferring its current CRC value to said Processor A;
comparing said current Processor A CRC value to said current Processor B CRC value, and
triggering a safety action if said comparing determines that said current Processor A CRC value does not match said current Processor B CRC value.
10. The dual-processor module of claim 9 , wherein said dual-processor module comprises a first and a second safety controller configured together as a redundant safety controller.
11. The dual-processor module of claim 9 , wherein said dual-processor module comprises a redundant first and second input/output (I/O) module configured together as a redundant I/O module.
12. The dual-processor module of claim 9 , wherein said comparing comprises both said Processor A and said Processor B comparing said current Processor A CRC value to said current Processor B CRC value.
13. The dual-processor module of claim 9 , wherein said selected points in said program sequence are automatically selected from said program counter values.
14. The dual-processor module of claim 9 , wherein said selected points in time total less than said plurality of processor instructions.
15. The dual-processor module of claim 9 , wherein a plurality of said dual-processor modules within a fault-tolerant industrial control system comprises:
a first said dual-processor module as a first safety controller and a second dual-processor module as a second safety controller configured together in a redundant safety controller, and
a third said dual-processor module as a first input/output (I/O) module and a fourth said dual-processor module as a second input/output (I/O) module configured together in a redundant I/O module,
wherein said first and second I/O modules are both coupled to field devices that are coupled to processing equipment.
16. The dual-processor module of claim 9 , wherein said Processor A and said Processor B both comprise microprocessors.