System and method of operation of dual redundant controllers

A computer suitable or use in an application requiring reliability of operation, the computer comprising:

• a first controller, the first controller operating as an active controller;
• a second controller, the second controller operating as a standby controller, wherein the second controller is capable of assuming the operations performed by the first controller, the first and second controller forming a pair of redundant controllers;
• a first logic device connected to and associated with the first controller, wherein the first logic device is suitable to receive status signals from the first controller;
• a second logic device connected to and associated with the second controller, wherein the second logic device is suitable to receive status signals from the second controller;
• two triggering means, each triggering means connected to and associated with a controller, the triggering means further connected to the logic device associated with the controller with which the triggering means is associated, the triggering means providing a signal to the controller;
• and
• two communications links providing for communications between the first and second logic devices.

A state machine for the arbitration of control between two redundant controllers, the state machine being implemented as logic on a logic device wherein the state machine permits only one of the two redundant controllers to be an active controller, the two controllers being able to set status signals in a manner indicting either their current or future status, the state machine comprising:

• an active state wherein the active controller resides in the active state when the redundant controllers are not arbitrating to determine the active controller;
• a standby state wherein the controller that is not the active controller resides in the standby state when the controllers not arbitrating to determine the active controller;
• a first decision front, the first decision front being entered when the standby controller forcibly attempts to become the active controller;
• a second decision front, the second decision front being entered when the active controller requests to become the standby controller;
• a third decision front, the third decision front being entered by the active controller when the active controller is to become the standby controllers;
• and
• wherein the active controller and the standby controller are monitored by a plurality of monitors.

A method by which a standby controller forcibly becomes the active controller, the method comprising:

• setting a parameter low by the standby controller, the parameter indicating that the standby controller is to forcibly become the active controller;
• entering a first decision front of a state machine, the first decision front containing a plurality states;
• setting a status signal of the standby controller to indicate it is the active controller;
• and
• maintaining the status signal of the standby controller to indicate it is the active controller throughout the plurality of states in the first decision front, wherein the active and standby controllers are operable to communicate status signals through monitors associated with the active and standby controllers, the monitors being able to monitor status signals of the controller with which they are associated and status signals of the controller with which they are not associated.

A method by which a standby controller becomes the active controller when the active controller has indicated it is to become the standby controller by setting a status signal indicating it is the active controller low;

• the method comprising:
• setting a status signal of the standby controller high, indicating the standby controller is to remain the standby controller;
• monitoring a status signal of the active controller, by the monitor associated with the standby controller;
• remaining as the standby controller if the status signal of the active controller is set low;
• setting a status signal of the standby controller high, indicating the standby controller is to remain the standby controller if an identification parameter of the standby controller has a certain value;
• monitoring a status signal of the active controller, by the monitor associated with the standby controller;
• and
• remaining as the standby controller if the status signal of the active controller is set low, wherein the active and standby controllers are operable to communicate status signals through monitors associated with the active and standby controllers, the monitors being able to monitor status signals of the controller with which they are associated and status signals of the controller with which they are not associated.

An active controller and standby controller system, comprising:

• means for setting a status signal of the active controller low, indicating the active controller is to remain the active controller;
• means for monitoring a status signal of the standby controller, by the monitor associated with the active controller;
• means for remaining as the active controller if the status signal of the standby controller is set high;
• means for setting a status signal of the active controller high, indicating the active controller is to remain the active controller;
• means for monitoring a status signal of the active controller, by the monitor associated with the standby controller;
• and
• means for remaining as the active controller if the status signal of the standby controller is set high, wherein the active and standby controllers are operable to communicate status signals through monitors associated with the active and standby controllers, the monitors being able to monitor status signals of the controller with which they are associated and status signals of the controller with which they are not associated.