Methods and apparatus for dynamically isolating fault conditions in a fault tolerant multi-processing environment

What is claimed is:

1. A fault tolerant processing system comprising:

at least two processing planes, each one of the processing planes being operable for processing an input signal comprising a number of signal components; and

plane termination logic for receiving an output signal from each one of the processing planes to generate a non-redundant output signal, wherein:

each processing plane comprises:

means for detecting a fault in the plane; and

means for substituting, in response to detection of a fault in the plane, a signal component representing a logical zero for each one of those components of the processed input signal that are affected by the detected fault; and

the plane termination logic comprises means (37; 172) for logically OR'ing the received output signals to generate the non-redundant output signal.

2. A fault tolerant processing system according to claim 1, wherein the said means for logically OR'ing performs the OR'ing of the received output signals on a bit-by-bit basis.

3. A fault tolerant processing system according to claim 1, wherein the input signals to the processing planes are identical and the processing planes are identical with respect to the processing of the input signals.

4. A fault tolerant processing system according to claim 1, wherein the said fault detecting means comprises at least one of the following: a parity checker, an incorrect checksum detector, a line code error detector and a lost frame alignment detector.

5. A fault tolerant processing system according to claim 1, wherein the fault detecting means comprises:

duplicated processing hardware in the processing plane; and

circuitry for comparing the output signals of the duplicated processing hardware, wherein a fault is considered as detected when the compared output signals differ from each other.

6. A fault tolerant processing system according to claim 1, wherein each processing plane further comprises:

means for detecting an "idle pattern" in the processed input signal; and

means for substituting, in response to detection of an "idle pattern", a signal component representing a logical zero for each signal component of the "idle pattern".

7. A fault tolerant processing system according to claim 6, wherein the system further comprises means for substituting, in response to detection of an "idle pattern" in each one of the processing planes, signal components representing the "idle pattern" for the corresponding signal components of the non-redundant output signal.

8. A fault tolerant processing system according to claim 1, wherein the system further comprises means for substituting, in response to detection of a respective fault in each one of the processing planes and where the detected faults affect corresponding signal components in all the planes, signal components representing an "idle pattern" for those signal components of the non-redundant output signal that are associated with the detected faults.

9. A fault tolerant processing system according to claim 1, wherein each one of the processing planes comprises at least one of the following: a switching unit a multiplexor and a demultiplexor.

10. A fault tolerant processing system comprising:

at least two processing planes, each one of the processing planes being operable for processing an input signal comprising a number of signal components; and

plane termination logic for receiving an output signal from each one of the processing planes to generate a non-redundant output signal, wherein:

each processing plane comprises:

means for detecting a fault in the plane; and

means for substituting, in response to detection of a fault in the plane, a signal component representing a logical one for each one of those components of the processed input signal that are affected by the detected fault; and

the plane termination logic comprises means for logically AND'ing the received output signals to generate the non-redundant output signal.

11. A fault tolerant processing system according to claim 10, wherein said means (217;372) for logically AND'ing performs the AND'ing of the received output signals on a bit-by-bit basis.

12. A fault tolerant processing system according to claim 10, wherein the input signals to the processing planes are identical and the processing planes are identical with respect to the processing of the input signals.

13. A fault tolerant processing system according to claim 10, wherein the said detecting means comprises at least one of the following: a parity checker, an incorrect checksum detector, a line code error detector and a lost frame alignment detector.

14. A fault tolerant processing system according to claim 10, wherein the fault detecting means comprises:

duplicated processing hardware in the processing plane; and

circuitry for comparing the output signals of the duplicated processing hardware, wherein a fault is considered as detected when the compared output signals differ from each other.

15. A fault tolerant processing system according to claim 10, wherein each processing plane further comprises:

means for detecting an "idle pattern" in the processed input signal; and

means for substituting, in response to detection of an "idle pattern", a signal component representing a logical one for each signal component of the "idle pattern".

16. A fault tolerant processing system according to claim 15, wherein the system further comprises means for substituting, in response to detection of an "idle pattern" in each one of the processing planes, signal components representing the "idle pattern" for the corresponding signal components of the non-redundant output signal.

17. A fault tolerant processing system according to claim 10, wherein the system further comprises means for substituting, in response to detection of a respective fault in each one of the processing planes and where the detected faults affect corresponding signal components in all the planes, signal components representing an "idle pattern" for those signal components of the non-redundant output signal that are associated with the detected faults.

18. A fault tolerant processing system according to claim 10, wherein each one of the processing planes comprises at least one of the following: a switching unit, a multiplexor and a demultiplexor (328/330).

19. A fault tolerant processing system comprising:

at least two processing planes, each one of said processing planes being operable for processing an input signal to generate an output signal, the input signal and the output signal each comprising a number of signal components; and

plane termination logic for receiving the output signals from said processing planes to generate a non-redundant output signal,

wherein each processing plane comprises:

means for detecting a fault in the plane; and

means for substituting, in response to detection of a fault in the plane, a signal component, hereinafter referred to as control component, representing a predetermined logical state for each one of those components of the processed input signal that are affected by the detected fault; and

the plane termination logic comprises means for performing logical operations on the received output signals such that, in the generation of the non-redundant output signal, unaffected signal components in a received output signal override corresponding control components in another received output signal.

20. A fault tolerant processing system according to claim 19, wherein the said means for performing logical operations performs the logical operations on the received output signals on a bit-by-bit basis.

21. A fault tolerant processing system according to claim 19, wherein the input signals to the planes are identical and the processing planes are identical with respect to the processing of the input signals.

22. A fault tolerant processing system according to claim 19, wherein the fault is a hardware detectable fault.

23. A fault tolerant processing system according to claim 19, wherein each one of the processing planes comprises at least one of the following: a switching unit, a multiplexor and a demultiplexor.

24. A fault tolerant processing system according to claim 19, wherein each processing plane further comprises:

means for detecting an "idle pattern" in the processed input signal; and

means for substituting, in response to detection of an "idle pattern", a control component for each signal component of the "idle pattern".

25. A fault tolerant processing system according to claim 24, wherein the system further comprises means for substituting, in response to detection of an "idle pattern" in each one of the processing planes, signal components representing the "idle pattern" for the corresponding signal components of the non-redundant output signal.

26. A fault tolerant processing system according to claim 19, wherein the system further comprises means for substituting, in response to detection of a respective fault in each one of the processing planes and where the detected faults affect corresponding signal components in all the planes, signal components representing an "idle pattern" for those signal components of the non-redundant output signal that are associated with the detected faults.

27. A fault tolerant processing system according to claim 19, wherein each processing plane further comprises means for substituting, in response to detection of a fault in the plane affecting a word of the processed input signal, a signal representing an "idle pattern" for the affected word.

28. A processing plane for use with at least one like processing plane in a fault tolerant system, the processing plane being operable for processing an input signal comprising a number of signal components, wherein the processing plane comprises:

means for detecting a fault in the plane; and

means for substituting, in response to detection of a fault in the plane, a signal component representing a predetermined logical state for each one of those components of the processed input signal that are affected by the detected fault.

29. A processing plane according to claim 28, wherein the processing plane includes at least one of the following: a switching unit, a multiplexor, and a demultiplexor.

30. A processing plane according to claim 28, wherein the fault is a hardware detectable fault.

31. A method of operating a fault tolerant processing system having at least two processing planes, each one of the processing planes being operable for processing an input signal to generate an output signal, the input signal comprising a number of signal components, wherein the output signals of the processing planes are terminated into a non-redundant output signal, the method comprising the steps of:

detecting a fault in a processing plane, the fault affecting at least one of the signal components of the processed input signal of the processing plane; and

substituting, in response to detection of a fault, a signal component representing a logical zero for each one of those signal components of the processed input signal that are affected by the detected fault; and

logically OR'ing the output signals of the processing planes to generate the non-redundant output signal.

32. A method of operating a fault tolerant processing system having at least two processing planes, each one of the processing planes being operable for processing an input signal to generate an output signal, the input signal comprising a number of signal components, wherein the output signals of the processing planes are terminated into a non-redundant output signal, the method comprising the steps of:

detecting a fault in a processing plane, the fault affecting at least one of the signal components of the processed input signal of the processing plane; and

substituting, in response to detection of a fault, a signal component representing a logical one for each one of those signal components of the processed input signal that are affected by the detected fault; and

logically AND'ing the output signals of the processing planes to generate the non-redundant output signal.

33. A method of operating a fault tolerant processing system having at least two processing planes, each one of the processing planes being operable for processing an input signal to generate an output signal, the input signal and the output signal comprising a number of signal components, wherein the output signals of the processing planes are terminated into a non-redundant output signal, the method comprising the steps of:

detecting a fault in a processing plane, the fault affecting at least one of the signal components of the processed input signal of the processing plane; and

substituting, in response to detection of a fault, a signal component, hereinafter referred to as a control component, representing a predetermined logical value for each affected signal component of the processed input signal; and

performing logical operations on the output signals of the processing planes to generate the non-redundant output signal in such a way that unaffected signal components in an output signal override the corresponding control components in another output signal.

34. A method of operating a fault tolerant system according to claim 33, it further comprising the steps of:

detecting an "idle pattern" in the processed input signal of a processing plane; and

substituting, in response to detection of an "idle pattern", a control component for each signal component of the "idle pattern" in the processed input signal.

35. A method for terminating at least two processed signals into a non-redundant signal, each one of the processed signals including a number of signal components, it comprising the steps of:

detecting a fault affecting at least one of the signal components of a first processed signal;

substituting, in response to detection of a fault, a signal component, hereinafter referred to as a fault control component, representing a predetermined logical state for each affected signal component of the first processed signal; and

performing logical operations on the processed signals to terminate the processed signals such that unaffected signal components in a second processed signal override corresponding fault control components in the first processed signal.

Description Submit all comments and votes

BACKGROUND

The present invention generally relates to a fault tolerant processing system and to a method of operating a fault tolerant processing system as well as a method for terminating a number of processed signals into a non-redundant signal.

In many processing systems, a redundant system architecture is utilized to meet the requirements on safety and reliability and to increase the mean time between system failure (MTBSF). Redundancy in a processing system is ensured by using multiple processing units that operate in parallel. With this arrangement, a faulty processing unit can easily be switched out of operation while the remaining and still-functioning processing units will maintain proper operation of the overall processing system. In the following, the processing units are normally referred to as processing planes.

A redundant system generally has a termination point at which the redundancy is terminated. In the termination point, plane termination logic determines which one of the processing planes that should be used, and the output signal of that plane is utilized as a non-redundant output signal of the processing system.

In the specific field of telecommunications, switches and switching systems are normally made redundant, using multiple switching planes, to maintain a desired quality of service for the users of the switching network. In known switching systems, the redundancy is terminated by using plane selection bits provided in the transmitted time slots.

FIG. 1 schematically illustrates an example of a conventional redundant switching system. The switching system 10 comprises a control system 1, and a switching arrangement 2. The switching arrangement 2 comprises a distribution unit 3, a number of identical and parallel switching planes 4, 5, 6, and plane termination logic 7. In the illustrated example, there are three switching planes. The distribution unit 3 receives an input signal, and is designed to distribute the incoming input signal to each one of the switching planes 4, 5, 6. The output signals of the switching planes 4, 5, 6 are sent to the termination logic 7. In conventional switching systems, each transmitted time slot in each plane is provided with a plane selection bit such that each time slot includes a byte of information and a plane selection bit. The plane selection bits from the switching planes are utilized in a plane selection algorithm 8 incorporated in the termination logic 7 to determine, for each time slot, which one of the switching planes to use. When all switching planes function properly, it does not matter which plane is selected, and the selection algorithm 8 simply selects a predetermined one of the switching planes. However, if two of the planes are determined to be faulty by the overall control system 1, then the control system 1 sets the corresponding plane selection bits to "invalid", and the remaining still-functioning plane is selected by the selection algorithm 7.

In conventional control systems, a software analysis of disturbances or faults in the switching planes is performed in order to determine the status (OK/faulty) of the planes. In a switching network, there are many examples of disturbances, such as parity errors, sporadic bit-errors and line code errors. Some of these disturbances are unavoidable, and there is generally no reason to intervene for a single disturbance. However, it is necessary to monitor the disturbance rate. If the rate of, for example, bit-errors in a switching plane rises to an unacceptable level, then the software has to react and set the plane selection bits of that plane to "invalid", thus isolating the faulty plane.

With this prior art arrangement, the determination by the software that a plane is faulty takes place long after the actual occurrences of the disturbances. Consequently, the disturbances can not be corrected for.

In addition, the disturbances tend to propagate through the switching network and generate additional disturbances such that the control system software is flooded by different types of alarms.

SUMMARY OF THE INVENTION

The present invention overcomes these and other drawbacks of the prior art arrangements.

It is a general object of the present invention to provide a fault tolerant processing system that is improved with respect to isolation of faults occurring in the system.

It is another object of the present invention to provide a processing plane, for use with at least one like processing plane in a fault tolerant system, which in the event of a fault in the plane generates an output signal that facilitates recovery of valid processed data from the other processing planes.

It is yet another object of the invention to provide a method of operating a fault tolerant processing system.

Still another object of the invention is to provide a method for terminating at least two processed signals into a non-redundant signal.

The invention is especially applicable to a fault tolerant system having at least two processing planes, where each plane is operable for processing an input signal to generate an output signal, and plane termination logic for receiving the output signals of the processing planes to generate a non-redundant output signal.

In accordance with a first aspect of the invention, the processing planes operate continuously in parallel with each other, and, in one embodiment, the output signals of the processing planes are OR'ed together in the plane termination logic to generate the non-redundant output signal of the system. According to the same embodiment, each processing plane comprises means for detecting a fault or disturbance in the plane, and means for substituting, in response to detection of a fault in the plane, a signal component representing a logical zero for each one of those components of the processed input signal that are affected by or otherwise associated with the detected fault. Since signal components affected by a fault are "set" to zero, valid bits from the still-functioning plane or planes will be presented as output bits in the non-redundant output signal due to the OR-operation in the plane termination logic.

According to another embodiment, the "resetting" of affected signal components to logical zero and logically OR'ing the output signals of the planes are replaced by "setting" the affected signal components to logical one combined with logically AND'ing the output signals of the planes.

It will be appreciated that in a more general form of the invention, each one of the signal components that are affected by a detected fault is substituted by a signal component, referred to as a control component, of a predetermined logical state. In this context, it should be understood that the logically OR'ing and logically AND'ing are merely examples of the more general function of performing logical operations on the output signals of the planes such that, in the generation of the non-redundant output signal, unaffected signal components in a processed signal will override corresponding control components in another processed signal. Since unaffected signal components override affected signal components, the unaffected and valid signal components will be presented in the non-redundant output signal.

The processing performed by the processing planes is preferably switching, or switching in combination with some other processing, such as multiplexing and demultiplexing, associated with switching.

The invention runs counter to the predominant trend in the prior art in that it does not propose isolation of faulty processing planes, but instead proposes dynamic and local isolation of faults directly in the planes.

In addition, the redundancy termination according to the invention does not use plane selection bits, and hence the bandwidth demand is reduced.

In accordance with a second aspect of the invention, a processing plane for use with at least one like processing plane in a fault tolerant system is provided. The processing plane is operable for processing an input signal, and comprises means for detecting a fault in the plane, and means for substituting a signal component representing a predetermined logical state for each one of those signal components of the processed input signal that are affected by the detected fault.

The invention offers the following advantages:

Fast and dynamic fault isolation (isolation of faults as they occur);

Reduced bandwidth demand;

No propagation of faults;

Other advantages offered by the present invention will be appreciated upon reading of the below description of the embodiments of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as other features and advantages thereof will be best understood by reference to the detailed description of the specific embodiments which follows, when read in conjunction with the accompanying drawings, wherein:

FIG. 1 schematically illustrates an example of a conventional redundant switching system;

FIG. 2 is a schematic diagram of an illustrative example of a switching system according to a first embodiment of the invention;

FIG. 3 is a schematic diagram of the termination unit of FIG. 2;

FIG. 4 is a schematic diagram of an illustrative example of a switching system according to a second embodiment of the invention;

FIG. 5 is a schematic diagram illustrating the SNT 150 of FIG. 4 in greater detail, together with a unit for handling "idle pattern" in special circumstances;

FIG. 6 is a schematic diagram of an alternative detecting and substituting unit according to the invention;

FIG. 7 is a schematic diagram of an illustrative example of a switching system similar to that of FIG. 2;

FIG. 8 is a schematic diagram of the termination unit of FIG. 7;

FIG. 9 is a schematic diagram of an illustrative example of a switching system similar to that shown in FIG. 4; and

FIG. 10 is a schematic flow diagram of a method for terminating at least two processed signals into a non-redundant signal.

DETAILED DESCRIPTION

The invention will now be described with reference to illustrative examples of a specific processing system, namely a fault tolerant switching system. However, the invention is not limited thereto, and it will be appreciated that the invention may be applied to other types of switching, and other types of processing as well.

FIG. 2 is a schematic diagram of an illustrative example of a switching system according to a first embodiment of the invention. The switching system 20 comprises a distribution unit 22, two parallel switching planes A and B, and a termination unit 36. Each switching plane comprises a switch 24/26 and a detecting and substituting (D&S) unit 28/32. Although only two switching planes are illustrated, it should be understood that more than two switching planes can be used.

The distribution unit 22 receives an incoming input signal and is designed to distribute the incoming input signal to each one of the switches 24, 26 such that the switches receive identical input signals. As an example, the switches 24, 26 are conventional telecommunication switches. Preferably, the user data carried by the input signals are placed in time slots, and the time slots are normally arranged in frames. In the switches 24, 26, user data is moved between different time slots and frames. This is accomplished by delaying the user data in memories. The output signals of the switches 24, 26 are sent to the termination unit 36. The termination unit 36 comprises circuitry 37 for logically OR'ing the received output signals to generate a non-redundant output signal. Preferably, the circuitry 37 for logically OR'ing the received output signals from the switches 24, 26 is in the form of a plurality of OR-gates such that the OR-operation is performed on a bit-by-bit basis.

Furthermore, each plane comprises at least one D&S-unit 28/32. Each D&S-unit is capable of detecting faults in the plane that affect one or more signal components of the processed input signal. In response to detection of a fault, the D&S-unit substitutes a signal component representing a logical zero for each one of those components of the processed signal that are affected by a detected fault. In the illustrated example, the D&S-unit 28 is provided in the line between the switch 24 and the termination unit 36, and the D&S-unit 32 is provided between the switch 26 and the termination unit 36. However, it should be understood that the D&S-units 28, 32 may be incorporated into the system at any suitable place. In this example, the D&S-unit 28 comprises a detecting unit 29 and an AND-circuit 30. The detecting unit 29 receives the output signal of the switch 24 to detect faults associated with one or more signal components of the signal. The detecting unit 29 generates a control signal which is high at detection of a fault and low otherwise. The AND-circuit 30 receives the output signal of the switch 24 and the control signal from the detecting unit 29 in inverted form due to an inverting input terminal. Preferably, the AND-circuit 30 is in the form of a plurality of AND-gates such that the output signal is logically AND'ed with the inverted control signal on a bit-by-bit basis. The D&S-unit 32 also comprises a detecting unit 33 and an AND-circuit 34 connected in the same way as in the D&S-unit 28.

Preferably, the detecting units detect hardware faults by parity errors, incorrect checksums, lost frame alignment or, if the switching system utilizes line coding, even line code errors. So, the detecting units may include parity checkers, incorrect checksum detectors, line code error detectors and detectors for lost frame alignment.

In the example of FIG. 2, serial interfaces are used throughout the switching system.

If the system utilizes transmission with parity, the system 20 is provided with a parity generator (not shown) which provides each transmitted byte with one or more parity bits, and a parity checker arranged at a receiving side to detect a fault causing a parity error. There are many examples of conventional parity checkers. Advanced conventional parity checkers may even point out which bit in the transmitted byte that is incorrect.

As an example, assume that the detecting unit 33 in the D&S-unit 32 of plane B includes a parity checker which has detected a parity error associated with a byte of information in the output signal from the switch 24. Then the control signal of the detecting unit 33 will be high for the affected byte. The inverting input terminal of the AND-circuitry transforms the high state, "1", of the control signal into a low state, "0". In the AND-circuit 34, each one of the bits in the affected byte will be AND'ed with a "0". Consequently, each one of the affected bits will be substituted by a logical zero, "0".

Of course, if the detecting part in the D&S-unit is configured to detect faults that affect single bits, the D&S-unit may, if appropriate, isolate single bits instead of whole bytes.

FIG. 3 is a schematic diagram of the termination u