Digital data processor with high reliability

Digital data processor apparatus characterized at least in part by continued operation in the event of an error-producing fault, said apparatus having at least first, second, and third functional units, one of which is a first central processing unit, another of which is a first memory unit, and another of which is a first control unit for a peripheral device, each said functional unit being responsive to input signals for producing output signals, said apparatus having the improvement comprising

• A. bus means having at least first and second redundant buses, each of which is arranged for transferring signals between all said functional units and furhter arranged for applying to all said units information which is transferred to said bus means by any said unit,
• B. fault detection means connected with said units and said buses for checking information transferred between said units and said buses for fault conditions on said buses, and
• C. logic means connected with said fault detection means and with said units and being responsive to said fault detection means, said logic means responding to the absence of any detected fault condition on said first and second buses for providing at least selected information transfers identically and simultaneously on both said buses, and responding to the detection of a fault on a single one of said buses for conditioning said units to perform information transfers exclusively on the other of said buses.

Digital data processor apparatus having plural functional units including at least a central processing unit, a random access memory unit, and a control unit for a peripheral device, each said functional unit being responsive to input signals for producing output signals, and apparatus being characterized by

• A. at least first and second buses, each of which is connected for transferring signals between said functional units and is further arranged for applying to all said units information transferred to that bus by any said unit,
• B. at least a fourth functional unit arranged with said first bus and with said second bus for transferring information with other of said functional units identically as a selected one of said processor, memory, and peripheral control units, said fourth unit duplicating said one selected unit and responding to input signals received from any of said first and second buses to produce output signals identically to the response of said one selected unit to such input signals,
• C. fault detection means connected with said units for checking information transfers of said units for detecting fault conditions in any said unit and in any said bus, and
• D. logic means connected with said fault detection means and with said units and being responsive to said fault detection means, said logic means
• (i) responding to the absence of any detected fault condition for providing information transfers on both said buses identically and simultaneously in at least one direction with both said one selected and fourth units,
• (ii) responding to the detection of a fault condition in one of said one selected and fourth units for disabling that unit from driving information-transferring signals onto either said bus, and
• (iii) responding to the detection of a fault condition on one said bus for conditioning all said units to respond only to information-transferring signals on the other said bus.

Digital data processor apparatus for continuous operation in the event of at least certain faults, said apparatus having plural functional units including at least a central processing unit, a memory unit, and a control unit for a synchronous peripheral device, one of said units being termed a first functional unit, each said functional unit being responsive to input signals for producing output signals, said apparatus having the improvement comprising

• A. bus means arranged for trasnferring signals at least between said processing unit and said memory unit and between said processing unit and said peripheral control unit,
• B. system clock connected with said bus means and with said functional units for providing signals for synchronizing signal transfers between said first, second, and third functional units and for providing operational timing signals for said first, second, and third functional units,
• C. a fourth functional unit arranged with said bus means for synchronously transferring information with selected other of said units identically as said first unit, said fourth unit duplicating said first unit and responding to input signals to produce output signals identically to the response of said first unit to such input signals, said fourth unit being arranged with said bus means for receiving operational timing signals from said system clock,
• D. fault detection means connected with said first and fourth units for checking the operation of each of said first and fourth functional units and for determining a fault condition in any such unit, and
• E. logic means connected with said fault detection means and with at least said first and fourth units and being responsive to the detection of a fault condition in any one of said first or fourth functional units for inhibiting the unit detected as being faulty from applying potentially-faulty signals to said bus means, said logic means comprising means for operating said first and fourth units, in the absence of a detected fault condition in either of them, in lock-step synchronism with one another.

An information processing method for digital data processor apparatus having functional units including at least a first central processing unit, a first memory unit, and a first control unit for a peripheral device, each said functional unit including a first signal processing section arranged for receiving signals transferred from other said functional units and for processing said received signals for producing output signals for transfer to other said functional units, and further having bus means for transferring signals between said functional units, said method being characterized by at least partial continuous operation in the event of at least certain error-producing faults, and by the steps of

• A. duplicating the response of a selected one of said processor, memory, and peripheral control units with a fourth unit that responds to input signals to produce output signals identical to the response of said one selected unit to such input signals, said fourth unit including a first signal processing section arranged for receiving signals transferred from other of said units and for processing said received signals for producing output signals identically to the response to said one selected unit to such received signals and for transferring said output signals to other of said units,
• B. transferring information signals between said processor, memory, and peripheral control units, and further transferring information signals between said fourth unit and other of said units identically as between said selected one unit and other of said units,
• C. providing system timing signals for synchronizing signal transfers between said first, second, and third functional units and for providing said operational timing signals to said first, second, and third functional units,
• D. checking the operation of each of said one selected unit and said fourth unit in response to input signals each such unit receives identically with the other such unit, to detect a fault in the operation of either of said units, said checking step comprising duplicating the processing of signals received by each of said one selected and fourth units, said duplicative processing being performed by second signal processing means arranged for at least receiving signals transferred from other of said units and for processing said signals synchronously and substantially identically with the first signal processing sections of each of said one selected and fourth units, and
• E. responding to a fault detection in either of said one selected and fourth units for inhibiting the unit detected as being faulty from applying information signals to other of said units.