Multi-channel control switchover logic

Abstract

A multi-channel control system includes at least a primary control microprocessor and a back-up control microprocessor operable to control a device. The primary control microprocessor and the back-up control microprocessor assert control over a controlled device according to a locally stored method of controlling a back-up microprocessor assumption of control of a device.

1 . A method of controlling a primary microprocessor assumption of control of a device in a multi-channel control device comprising the steps of:
 entering a control process in one of two possible control states, wherein said two possible control states are a primary microprocessor in-control state and a primary microprocessor not in-control state;   evaluating a plurality of conditions dependent upon which of said possible control states is true;   entering one of a plurality of actions based on said evaluating of said plurality of conditions, wherein said plurality of actions includes an is channel-in-control output signal wrap-around false check, a take/keep control action, and a give-up control action; and   performing an action in response to entering said one of said plurality of actions.   
     
     
         2 . The method of  claim 1 , wherein said step of evaluating a plurality of conditions dependent upon which of said possible control states is true further comprises evaluating a first set of conditions when said control process is in a first control state and a second set of conditions when said control process is in a second control state. 
     
     
         3 . The method of  claim 2 , wherein
 said first set of conditions includes at least three conditions and corresponds to the primary microprocessor in-control state and wherein said three conditions are the back-up microprocessor is in-control, multiple channels are in-control or the primary microprocessor controller is healthier than the remote primary microprocessor controller, and all other states;   said back-up microprocessor is in-control condition is the highest priority condition;   said multiple channels are in-control condition or the primary microprocessor controller is healthier compared to remote primary microprocessor controller is a middle priority condition;   and said all other states condition is a lowest priority condition.   
     
     
         4 . The method of  claim 3 , wherein
 said method enters the is channel-in-control output signal false check when said back-up microprocessor is in-control condition is true or both the local and the remote channels are in control and the local channel is a predefined channel or the local primary microprocessor controller has a higher health than a latest determined remote primary microprocessor health; and   said method enters the give-up control action when said all other states condition is true, said back-up microprocessor is in-control condition is false and said multiple channels are in-control condition is false.   
     
     
         5 . The method of  claim 4 , wherein said method enters a set channel-in-control wrap-around fault flag action when the channel-in-control wrap-around indicates that the channel-in-control is false and wherein said method enters the take/keep control action when the channel-in-control wrap-around indicates that the channel-in-control is true, 
     
     
         6 . A method of controlling a back-up microprocessor assumption of control of a device in a multi-channel control device comprising the steps of:
 entering a control process in one of two possible control states, wherein said two possible control states are a back-up microprocessor in-control state and a back-up microprocessor not in-control state;   evaluating a plurality of conditions dependent upon which of said possible control states is true;   entering one of a plurality of actions based on said evaluating of said plurality of conditions, wherein said plurality of actions includes a take/keep control action and a give-up control action; and   performing an action in response to entering said one of said plurality of actions.   
     
     
         7 . The method of  claim 6 , wherein said step of evaluating a plurality of conditions dependent upon which of said possible control states is true further comprises evaluating a first set of conditions when said control process is in said back-up microprocessor in-control state and a second set of conditions when said control process is in said back-up microprocessor not in-control state. 
     
     
         8 . The method of  claim 7 , wherein said first set of conditions includes at least three conditions and wherein;
 a highest priority condition of said at least three conditions is met when a local hardware wrap-around fault exists within a local channel or when the back-up microprocessor does not meet a minimum health requirement;   a second highest priority condition of said at least three conditions is met when multiple remote channels are channel-in-control and the local channel is a predefined channel, or a remote channel is not in-control and when both channels are unhealthy or the back-up microprocessor has been in-control since an initial power up of the control system; and   a lowest priority condition of said at least three conditions is met when none of the highest, or second highest priority conditions are met.   
     
     
         9 . The method of  claim 8 , wherein
 the method enters the give-up control action when the highest priority conditions are met, and when the lowest priority condition is met simultaneous with the second highest priority condition not being met; and   the method enters the take/keep control action when the highest and third highest priority conditions are not met and the second highest priority condition is met.   
     
     
         10 . The method of  claim 7 , wherein said second set of conditions includes at least two conditions and wherein said at least two conditions include:
 a highest priority condition, said highest priority condition being met at least when a remote channel is not in-control, the remote channel's primary microprocessor controller is not healthy, a local channel's primary microprocessor controller is not healthy, there is no critical fault in the back-up microprocessor, the back-up microprocessor is not disabled, a time since power-up exceeds a set time period, and the back-up microprocessor has not been in-control within a set time period; and   a lowest priority condition, said lowest priority condition being met when said highest priority condition is not met.   
     
     
         11 . The method of  claim 10 , wherein the method enters a take/keep control action when the highest priority condition is met and the method enters a give up control action when the lowest priority condition is met. 
     
     
         12 . The method of  claim 7 , wherein the step of performing an action in response to entering said one of said plurality of actions further comprises said method controlling a controlled device using a back-up microprocessor in response to the method entering the take/keep control action. 
     
     
         13 . The method of  claim 7 , wherein the step of performing an action in response to entering said one of said plurality of actions further comprises said method disabling back-up controls to a controlled device in response to entering the give-up control action. 
     
     
         14 . An electrical control configuration comprising:
 at least a first primary control microprocessor and a first back-up control microprocessor operable to control a device, said first primary control microprocessor and said first back-up microprocessor being located in a first control channel;   a second control channel including at least one control microprocessor operable to control the device; and   each of said first primary control microprocessors and said first back-up control microprocessors being arranged as an independent equivalent control channel.   
     
     
         15 . The electrical control configuration of  claim 14 , wherein said first control channel includes a hardware lock operable to prevent said back-up control microprocessor from asserting control when said primary microprocessor is in-control of the device and operable to prevent said primary control microprocessor from asserting control when said back-up microprocessor is in-control of the device. 
     
     
         16 . The electrical control configuration of  claim 14 , wherein said first primary control microprocessor and said first back-up microprocessor are electrically isolated from each other. 
     
     
         17 . The electrical control configuration of  claim 16 , wherein said electrical isolation is a resistive barrier. 
     
     
         18 . The electrical control configuration of  claim 14 , wherein said at first control channel includes a redundant primary control microprocessor in-control logic circuit, a redundant back-up control microprocessor in-control logic circuit and a redundant channel-in-control microprocessor circuit. 
     
     
         19 . The electrical control configuration of  claim 18 , wherein said redundant channel-in-control microprocessor is operable to output an channel-in-control signal when at least one fault is present in the redundant primary control microprocessor in-control logic circuit, the redundant back-up control microprocessor in-control logic circuit and the redundant channel-in-control microprocessor circuit. 
     
     
         20 . The electrical control configuration of  claim 14 , wherein said second channel mirrors said first channel.