GB2279780A - Radiation-resistant computing system - Google Patents

Abstract

In an electronic computing system a memory 36, an output device 13, a power supply arrangement 17 and a timing device 18 which is responsive to onset of ionizing radiation are hardened against the effects of such radiation. Other components of the system, such as a processor 30 and an input device 34 for the processor 30 are not radiation-hardened, and the power supply arrangement 17 is responsive to signals from the timing device 18 consequent on onset of radiation to depower the non-hardened components for the duration of the radiation. The output device 13 includes means responsive to signals from the timing device 18 to retain signals present at the onset of radiation, for the duration of that radiation. <IMAGE>

Description

RADIATION-RESISTANT ELECTRICAL CIRCUITS It is known to make electronic components which are designed to operate satisfactorily at predetermined values of ionizing radiation, as for example that resulting from a nuclear explosion. Occurrence of such radiation is commonly referred to as a "nuclear event" and such components are commonly known as "nuclearhardened components Such components are expensive, and many subsystems which are required for a particular function may not be available in nuclear-hardened form.

It has been proposed in US-A-4687622 to provide a system having a nuclear-hardened radiation detector which effectively shuts down the remainder of the system for a time which is anticipated as being the duration of the damaging radiation. It is a disadvantage that operation of the system is lost for the whole of that time, which may be critically disadvantageous in a computer system.

It is an object of the invention to provide an electronic computing system in which not all components are nuclear hardened, but in which the effective operation of the system is interrupted for a minimum time. This object is achieved by providing that only essential and vulnerable components of the system are nuclear-hardened and that other vulnerable components are depowered for a time, hereinafter referred to as the "critical period", which is at least as long as that required for the ionizing radiation to fall below a level critical for those components, hereinafter referred to as the "critical level". The object is further obtained by causing output signals from the system to be maintained for the depowered period at values existing at the start of that period.

According to the invention there is provided an electronic computing system having a processor, input and output devices for said processor, a memory, a power supply arrangement, a timing device responsive to a nuclear event, as herein defined, for generating control signals, said memory, output device, power supply arrangement and timing device being nuclear hard, as herein defined, said control signals having a duration which is at least equal to the critical period, as herein defined, of at least said processor and said input device, means responsive to said control signals for isolating power from said supply arrangement to components of the system other than said nuclear hard components, means responsive to said control signals for resetting said processor at the end of said critical period, said output device including means, responsive to said control signals for retaining signals present therein at the beginning of said critical period, for the duration thereof.

In a preferred embodiment said processor is a digital processor.

A particular embodiment includes input-output buffers for said memory and means responsive to said control signals for inhibiting writing operations into said memory for the duration of said control signals.

A further embodiment includes a second memory, and means for isolating said second memory from said power supply arrangement for the duration of said control signals.

An embodiment of the invention will now be described by way of example only and with reference to the accompanying drawings in which: Figure 1 shows, diagrammatically, the principle of the present invention, Figure 2 is a diagram of an electrical control system for an electrically powered actuator, Figure 3 is a diagram of a power supply arrangement and of one element of a timer arrangement forming part of Figure 2, and Figure 4 is a diagram of an output device forming part of Figure 2.

Figure 1 shows a control system for an electrical actuator 110. A microprocessor 111 communicates via a bus 112 with a RAM 113 and an EPROM 114. Program instructions from the EPROM 14 are decoded in a logic circuit 115 and used by the microprocessor 111 to generate digital commands for the actuator 110. The digital commands are supplied on the bus 112 to a digital-to-analog converter 116 whose analog output is applied via a sample and hold circuit 117 to an amplifier 118, the output from which operates the actuator 110.

Feedback signals from the actuator 110 are supplied on a line 119 to the input of the amplifier 118, and also to an analog-to digital converter 120, which supplies digital signals to the bus 112. The microprocessor 111 communicates via the bus 112 with a dual-port RAM 121 which can store status parameters of the system, for communication to a further microprocessor (not shown).

The microprocessor 111, the RAM 113 and the EPROM 114, the logic circuit 115 and the circuits 116,120 may be considered as forming a block 122. The sample and hold circuit 117, the amplifier 118, the dual-port RAM 121 and a device 124 may be considered as included in a block 123. The device 124 responds to the onset of a nuclear event by generating a signal on a line 125, the duration of that signal being at least as long as the longest critical period of any of the components in the block 122. All of the components in the block 123, and the actuator 110, are nuclear hardened.

The action of the signal on line 125 is to depower the components in the block 122 for at least their critical periods, and to inhibit "write" operations from the microprocessor 111. At the end of a signal on line 125 the components in the block 122 are re-powered and reset. Since the RAM 121 is hardened, and because of the absence of "write" operations during a nuclear event, the status information in the RAM 121 is immediately available thereafter to continue normal operation. The hardened sample and hold circuit 117 maintains the output signals to the actuator at their value immediately preceding a nuclear event, for the duration of that event.

Figure 2 shows a system for controlling current supply to a torque motor 10 which controls a valve 11.

In the described embodiment the valve 11 forms part of a gas turbine engine fuel control system. The torque motor 10 is responsive to signals on a line 12 from an output device 13, shown in more detail in Figure 4, which is in turn responsive to digital signals on a bus 14 and to position feed-back signals on a line 15 from the valve 11. The output device 13 is energized by a 15 volt supply on a line 16 from a power supply arrangement 17, shown in detail in Figure 3. The device 13 is supplied with a control signal from a timer arrangement 18 which is responsive to a critical level of ionizing radiation, to generate control signals on lines 19, 20, 21, 22.

The system shown in Figure 2 includes first and second microprocessors 30, 31 which respectively communicate with the bus 14 and a bus 46 through respective buffer circuits 32, 33. The bus 14 receives signals from an input device 34 which is responsive to signals on lines 35, these latter corresponding to parameters to which the valve 11 is required to respond.

Also communicating with the respective buses 14, 46 are first and second memories 27, 28, each of which includes both EPROM and RAM devices. The microprocessors 30,31 can intercommunicate via a dual port RAM 36 which interconnects the two buses 14, 46 and which is used to store "status" information, that is information which will enable the processor 30, 31 to be reset quickly on receipt of a signal on the line 21, to a condition which existed immediately prior to a nuclear event. The memory 36 includes tri-state buffers which are responsive to the signal on line 20 to disconnect that memory from the buses 14, 46, the information on which may be corrupted during a nuclear event.

A discrete output register 29 supplies a plurality of discrete signals for the system. One of these signals is applied on a line 86 to the output circuit 13, the function of that signal being described below.

In addition to the 15 volt supply on the line 16 the power supply arrangement provides 15 volts on a line 37 to a DC-DC converter 38, and 5 volts supply on a line 39 to the microprocessors 30, 31, the buffers 32, 33, the input device 34 and the memories 27, 28. The converter 38 provides a 5 volt supply on a line 40 to the memory 36.

The timer arrangement 18 includes additional timer units which generate the control signals on 19 to 22.

The signal on line 19 is applied to the device 13 to hold the output signal therein at a value existing at the onset of the nuclear event. The control signal on line 20 is applied to the memory 36 to stop information being written in that memory for the duration of the nuclear event. The signal on line 20 also ensures that a "write" operation, once initiated, is allowed to be completed. A signal on line 21 is applied to the microprocessor 30, 31 to reset these after the end of the critical period. The signal on line 22 is applied to the buffers 32, 33 to disable them for the duration of the critical period.

As shown in Figure 3 the power supply arrangement 17 comprises a transformer 41 having a primary winding 42 supplied with AC and secondary windings 43, 44, 45 from which the DC supplies on respective lines 16, 37, 40 are derived. Figure 2 also shows one timer unit 50 of the timer arrangement 18. The unit 50 includes an npn transistor 51 across the base and collector of which is connected a positive, intrinsic negative (PIN) diode 52.

The base and emitter of the transistor 51 are connected to a +15 volt rail 53 through respective resistors 54, 55. The collector is also connected to the rail 53 through a capacitor 56 and to a control line 57 through a resistor 58.

A p-channel FET 70 is connected in the +5 volt line 71 of the supply 39, and an n-channel FET 72 is connected between the line 71 and a 0 volt rail 73. The control line 57 is collected directly to the gate of the FET 70 and to -15 volt through series resistors 74, 75.

The junction of resistors 74, 75 is connected to the gate of FET 72. The arrangement is such that when the diode 52 is not conducting, voltage on the base of the transistor 51 isolates the line 57 from the 15 volt rail 53, and the gates of FETs 70 and 72 are negative, so that FET 70 conducts and FET 72 is open circuit. The diode 52 conducts in response to a critical level of ionizing radiation, turning on transistor 51 and switching off FET 70 which isolates the +5 volt line 71 and de-energises all components supplied thereby. A short time later the FET 72 switches on, shorting the line 71 and de-latching any latched-up components powered thereby. The FETs 70, 72 respectively remain off and on for a time determined by the capacitor 56 and resistors 74, 75, that time being at least equal to the longest critical period of the microprocessor 30, 31, the buffers 32,33 the input device 34 and the memories 27, 28. These latter components are thus de-powered for at least that period.

As shown in Figure 4 the output device 13 is associated with a D-A converter 80 responsive to output signals on the bus 14. Analog signals from the converter 80 are supplied to a sample and hold circuit 81 which is responsive to control signals on the line 19 to retain the most recent value of the analog signal from the converter 80, that value representing a desired operating position of the valve 11 (Figure 2). The analog value in circuit 81 is applied to one input of a difference amplifier 82, whose other input receives the position feed-back signal on line 15 from the valve 11. The amplifier 82 provides an output signal on line 12 to the torque motor 10. When the system is operating, an enable signal for the torque motor 10 is normally provided on a line 86 from the discrete output register 29. That signal may cease when the processors 30, 31 and the memories 27, 28 are shut down, and the "write" function of the memory 36 is interrupted during a nuclear event.

Accordingly, the control signal on line 19 is also applied to a relay 84 which connects the line 83 to a voltage supply 85, thereby maintaining the torque motor 10 in an enabled condition, whereby it may be held in its last operated position for the duration of the signal on line 19.

The components of the output device 13, as well as the torque motor 10 and valve 11, are either inherently nuclear-hard, or can relatively inexpensively be made so.

This is also the case with the power supply arrangement 17, the timer arrangement 18 and the DC-DC converter 38.

The remaining elements of the system, with the expectation of memory 36, are depowered and/or inhibited for the duration of a nuclear event. Thus the only part of the system which requires specific effort to effect nuclear hardening is the memory 36. Furthermore the system is out of action only for the duration of the signals on lines 19, 20 and 22, that is for about 10 msec, and is immediately reset thereafter, the torque motor 10 and valve 11 being held stationary for that 10 msec period.

The valve 11 is thus maintained in a closed-loop control for the duration of the nuclear event rather than being merely "frozen". This is achieved by holding the valve demand at the value obtaining immediately prior to the event. No time is therefore required for the valve analog circuitry to reset when normal operation is resumed.

Claims (8)

1 An electronic computing system having a processor, input and output devices for said processor, a memory, a power supply arrangement, a timing device responsive to a nuclear event, as herein defined, for generating control signals, said memory, output device, power supply arrangement and timing device being nuclear hard, as herein defined, said control signals having a duration which is at least equal to the critical period, as herein defined, of at least said processor and said input device, means responsive to said control signals for isolating power from said supply arrangement to components of the system other than said nuclear hard components, means responsive to said control signals for resetting said processor at the end of said critical period, said output device including means, responsive to said control signals for retaining signals present therein at the beginning of said critical period, for the duration thereof.

2 A system as claimed in claim 1 in which said power supply arrangement includes a portion for supplying power to said non-nuclear hard components only, said portion including a switching device responsive to one of said control signals.

3 A system as claimed in claim 3 in which said switching device comprises a first switch component for isolating an output supply line from an input voltage source, and a second switch component for shorting said output supply line to ground.

4 A system as claimed in any preceding claim in which said output device includes means for supplying an enabling signal and an output control signal to an external device, said output device being responsive to a control signal from said timing device to isolate said external device from said output control signal and to derive said enabling signal from a voltage supplied by said power supply arrangement.

5 A system as claimed in claim 4 in which said output device comprises a digital-to-analog converter and an analog sample and hold device for retaining the latest analog signal from said converter.

6 A system as claimed in any preceding claim in which said memory is adapted to store information whose status corresponds to that existing immediately prior to a nuclear event.

7 A system as claimed in claim 6 in which said memory includes means responsive to one of the control signals from said timer, for isolating said memory from said microprocessor and said input and output devices.

8 A system as hereinbefore described with reference to Figure 1 or Figures 2 to 4.