GB2037034A - Improvements in or relating to telephone exchanges - Google Patents

Abstract

In a triplicated system whose outputs S1, S2, S3 are majority voted 1, the majority decision output is compared 2, 3, 4 with each of the original system outputs to isolate a fault. Delays are introduced in the setting of toggles 17-19 by the fault signals so that occasional faults between two consecutive transitions of the majority decision output are ignored. However, the staticising of detected fault conditions in the toggles enables a persistent fault to be detected. The arrangement is described in its application to a processor-controlled telephone exchange. <IMAGE>

Description

SPECIFICATION Improvements in or relating to telephone exchanges This invention relates to an arrangement for fault detection and indication in highly secure electronic data processing systems. One example of such a system is a processor controlled automatic telecommunication exchange.

In highly secure systems it is common practice for the critical faults of the system to be triplicated, with majority decision operations performed on the output signals of these triplicated parts. A disadvantage of many known systems of this type is that if one of the three security sections fails, that fault condition remains dormant as long as the other two sections continue to function correctly. It is then only when a further section fails that the faulty condition is detected.

This invention has for its object the provision of a relatively simple circuit which enables the above disadvantage to be at least minimised.

According to the invention there is provided a fault detection and indication circuit, which includes a majority decision circuit to which three nominally identical versions of the same signal are applied and which given a majority decision output in respect of each said signal, a set of comparators each of which compares the majority decision output with a different one of the three versions of the signal, so that if one of the versions differs from the majority decision output then the appropriate one of the comparators gives an output which indicates which version is at fault, a set of output toggles each associated with one of the comparators and each adapted to be set in accordance with the output condition of its one of said comparators, and delay means whereby the setting of the appropriate one of the toggles is delayed from the time at which the majority decision output is produced by a period less than the period between two successive signals to be monitored.

An embodiment of the invention intended for use as part of the central system of an automatic telephone exchange will now be described with reference to the accompanying drawing.

The data processing system in which the circuit shown in the drawing is used in a processor-controlled telephone exchange in which the main processing units are triplicated. For each processing operation to be executed, a majority decision operation is performed on the output of the triplicated unit in question, and the results of that operation are taken as the correct result. The circuit shown deals with the output signals S1, S2 and S3 from the three separate security sections of each such unit, and it is assumed that each signal S1, S2 and S3 is either 1 or 0.

The signals S1, S2 and S3 are applied to a majority decision gate 1 which performs the majority decision vote and gives an output 1 or 0 accordingly. The signals S1, S2, S3 are also applied to three comparators 2, 3 and 4, respectively, where they are compared with the majority decision output S. If any of these signals differs from the signal S it is assumed to be faulty. That is, one or other of the fault signals F1, F2 and F3 would assume an O condition. Thus the effective output from any of these comparators is 1 in the presence of a fault, because the outputs are "not" outputs.

The fault outputs F1, F2 and F3 are "or-ed" in the gates 5 and 6, of which 5 is a NAND gate while 6 acts as an inverter. Thus the output from gate 6 is the inverse F of a fault signal.

Hence if a fault is detected we get a signal which positively indicates that a fault has in fact occurred.

The output S from the majority decision gate 1 is also applied to a gate 7, which responds to a transition in the output from the gate 1, and after the occurrence of that transition enables a binary counter 8. This counter then starts counting the FAST CLOCK pulses, whose pulse rate is at least four times as great as the maximum possible rate at which transitions in S can occur. With the outputs being monitored single bits, which occur serially, FAST CLOCK is therefore at least four times the operational bit rate of the system.

After a preset number of FAST CLOCK pulses have been counted, the counter 8 generates a sample pulse P. This pulse is applied via a gate 9 to the LOAD input of the counter 8, which is thereafter reset to make the counter ready to respond to the next transition in S. The pulse P is also applied to a a toggle 1 0, which thus "remembers" the last state of the signal S. Its output is connected to the gate 7, which is a comparator.

Thus gate 7 compares the current state of S with the last state thereof, so that it responds to any transitions in the signal S.

As already indicated, the signal F goes low when a fault is detected in respect of any one of the Si, S2 or S3 signals. The F output from the gate 6 is applied to a current 11-12-13.

being applied via a gate 12 to the toggle 13: this, with the toggle 11 is a fault store. Hence the fault indication is stored.

When the sample pulse P, which occurs shortly after the signal F, occurs it sets the toggle 13, which then stays set for the next two transitions of the signal S. This follows from a consideration of the operations of these circuit elements, as indicated above.

We now return to a consideration of the fault signals F, F2 or F3: these signals are also applied to gates 14, 1 5 or 1 6 respectively, these gates also being controlled from the output of the toggle 13. Now if any of these signals goes low during the next two transitions of S, the corresponding gate 14, 15 or 16 develops a logic 1 signal. This logic 1 signal is then stored in the corresponding one of the toggles 17, 1 8 and 19. Any one of these toggles being set gives an indication that a fault has been detected, and also indicates which one of the signals is at fault.

Thus the circuit not only indicates that a fault has occurred, but introduces a small delay into the giving of that indication. This means that a fleeting fault, which is in most cases relatively harmless, can be ignored. It ignores occasional faults which occurs between two consecutive transitions of the signal S being monitored. However, by virture of the three toggles 17, 18, 19 and the manner of their control they staticise the fault condition. This enables the detection of many dormant faults, i.e. when one of the triplicated signals gets "stuck" in one logical condition, and also when two or more faults are seen in three consecutive signal transitions. However, internal faults within the inputs of element 1 will not be detected. Note also that the signals being monitored may be periodic or nonperiodic.

Claims (2)

1. A fault detection and indication circuit, which includes a majority decision circuit to which three nominally identical versions of the same signal are applied and which gives a majority decision output in respect of each said signal, a set of comparators each of which compares the majority decision output with a different one of the three versions of the signal, so that if one of the versions differs from the majority decision output then the appropriate one of the comparators gives an output which indicates which version is at fault, a set of output toggles each associated with one of the comparators and each adapted to be set in accordance with the output conditions of its one of said comparators, and delay means whereby the setting of the appropriate one of the toggles is delayed from the time at which the majority decision output is produced by a period less than the period between two successive signals to be monitored.

2. A fault detection and indication circuit, substantially as described with reference to the accompanying drawing.