Our experience with the system described in this paper has shown that the HIFT design with distributed ASIC voters provides fault tolerance with extremely thorough and fast fault detection. We feel that the HIFT approach is far superior to software-implemented approaches, which require extensive and cumbersome software diagnostics to detect and isolate faults. Such software approaches tend not to have adequately high fault coverage and take longer to operate and detect faults than the HIFT approach. Furthermore, the controller's operating system has been kept simple and straightforward, lending itself to analysis, verification, and testing. The HIFT architecture also offers flexibility in extending the fault protection boundary beyond the controller itself. By using redundant input modules and guarded redundant output modules, the fault tolerant boundary can be extended to the process sensors and actuators. In summary, the HIFT approach provides high performance and flexible fault tolerance with minimal software complexity. This has yielded a design that meets our original goals of keeping the equipment simple to ensure the eits failure modes are understandable and controllable and that the system can be easily analyzed and maintained. In addition to meeting these goals, the design also provides: • ⊎ a very high degree of fault coverage, • ⊎ high-speed performance, • ⊎ tractable safety analysis, and • ⊎ simplified software feature upgrades and maintenance. A production prototype of the machine described in this paper was developed in April 1986, followed by eight months of environmental qualification testing and fault-injection testing. A beta test program was run from October, 1986 through May, 1987. Production unit deliveries began in June of 1987. Applications include electric power grid control, safety-critical process control, and emergency shutdown systems.
Read full abstract