T8110B T8110C ICS TRIPLEX Trusted TMR Processor

T8110B T8110C

The Trusted TMR Processor is a fault tolerant design based on a Triple Modular Redundant

(TMR) architecture operating in a lock-step configuration. Figure 1 shows, in simplified

terms, the basic structure of the Trusted TMR Processor module.

The module contains three Processor fault containment regions (FCR), each containing a

Motorola Power PC series Processor and its associated memory (EPROM, DRAM, Flash ROM,

and NVRAM), memory mapped I/O, voter and glue logic circuits. Each Processor FCR has

voted two-out-of-three (2oo3) read access to the other two Processor’s FCR memory

systems to eliminate divergent operation.

The module’s three Processors store and execute the application program, scan and update

the I/O modules and detect system faults. Each Processor executes the application program

independently, but in lock-step synchronisation with the other two. Should one of the

Processors diverge, additional mechanisms allow the failed Processor to re-synchronise with

the other two.

Each Processor has an interface which consists of an input voter, discrepancy detector logic,

memory, and an output driver bus interface to the Inter-Module Bus. The output of each

Processor is connected by the module connector to a different channel of the triplicated

Inter-Module Bus.