| ??? 05/30/08 17:06 Read: times |
#155296 - Nothing's perfect Responding to: ???'s previous message |
Erik Malund said:
... Shivaram Kumara Cunchala never answer questions.
so, let me repeat some, and I suggest that if not answered, there can be no help 1) why is failsafe not good enough? 2) why do you reject using the watchdog Unfortunately, the watchdog only responds to a stopped or runaway MCU. It's conceivable that an errant MCU might still enter the "kick the dog" routine when required, despite the fact that some flag or register is "broken." 3) if you are to run 3 parallels where are you going to find the teams/persons to write #2 and #3
if you use the majority-logic method I mentioned, it doesn't require different code in each MCU, and, in fact requires that they be exactly alike. 4) are you aware that, whatever you do it can fail (there will ALWAYS be some part that can cause catastrophic failure, all you can do is reduce the likelyhood)
5) re 4) which 'failsafe' are you going to add if you are, indeed, going for triplicate. 6) why have you not revealed YOUR method/thoughts/hardware/code (the method/thoughts/hardware/code, not just "I want to do standby controller for emergency") 7) which method are you going to use to verify the "standby procesor" is, indeed, functioning before it is called into action 7) how are you going to ensure that e.g. a power spike is not going to take all 2 or 3 systems out 8) how many watts are your diesel power backup generator capable of 9) Pleaase fill in any other details you might have Erik At NASA, on the shuttle's main engine controller they used a second, redundant, processor, with code to manage the situation and disable the malfunctioning controller in the event of a failure. That was due to weight, cost, and size constraints. In this case, using more MCU's with the same code would be much easier, though there's always a single-point failure risk. Frankly, I'm curious what could be so critical about a temperature controller that it needs more than just a watchdog. The most common reason for watchdog resets is not hardware failure, but, rather, badly written code. RE |
