T8310 ICS Triplex Trusted TMR Expander Processor

T8310 ICS Triplex Trusted TMR Expander Processor

The Trusted TMR Expander Processor Module resides in the processor socket of the Trusted Expander Chassis and provides a "slave" interface between the Expander Bus and the Expander Chassis backplane. The Expander Bus allows for multiple chassis systems to be implemented using Unshielded Twisted Pair (UTP) cabling while maintaining the fault tolerant, high bandwidth Inter-Module Bus (IMB) functionality.

The module provides fault containment for the Expander Bus, the module itself, and the Expander Chassis, ensuring that the effects of these potential failures are localized and maximizing system availability. ​​The module provides the fault tolerance capabilities of the HIFT TMR architecture. Comprehensive diagnostics, monitoring, and testing allow for rapid identification of faults. Supports hot spare and module spare configurations, allowing for both automatic and manual repair strategies

The TMR expander processor is a fault-tolerant design based on the TMR architecture in a lockstep configuration. Figure 1 shows the basic structure of the TMR expander processor in a simplified manner.

The module has three main fault containment areas (FCR A, B, and C). Each master FCR contains interfaces to the expander bus and inter-module bus (IMB), primary/backup interfaces to other TMR expander processors in the chassis, control logic, communication transceivers, and power supplies.

Communication between the modules and the TMR processor occurs through the TMR expander interface module and the triple expander bus. The expander bus is a triple point-to-point architecture. Each channel of the expander bus contains separate command and response media. The expander bus interface provides voting capabilities to ensure that cable failures can be tolerated and the rest of the expander processor can operate in full triple mode even if a cable failure occurs.

Communication between modules and I/O modules in the expander chassis occurs through the IMB on the expander chassis backplane. The IMB is identical to the IMB within the controller chassis, providing the same fault-tolerant, high-bandwidth communications between the interface modules and the TMR processors. As with the expander bus interface, all transactions are voted on, and if a failure occurs, the fault is localized to the IMB.

The fourth FCR (FCR D) provides non-critical monitoring and display functions and is also part of the inter-FCR Byzantine voting structure.

Where interfaces are required, isolation is provided between FCRs to ensure that faults do not propagate between them.