阅读说明：本技术 三路冗余循环数据的监测 (Monitoring of three-way redundancy cycle data ) 是由 S·费雷拉 J·林赛 于 2020-09-27 设计创作，主要内容包括：表决器电路和方法在每个载有循环数据的多个输入中确定表决输出。为了提供表决输出,通过以下方式计算统计平均值(例如,均值或中值)：将多个输入分组成对,并且针对每一对,通过选择(a)该输入对之间的绝对差和(b)该输入对之间的绝对差的共轭中的最小值来生成最小角度差。表决输出是从最小角度差生成的统计平均值。监测器电路和方法通过如下方式评估多个输入中的有效性：逐对地比较输入对,针对每对生成最小角度差,并且将该差与阈值进行比较,并确认持续时间。监测器宣告与其配对的所有其他输入都与之不一致的输入是无效的。(Voter circuits and methods determine a voted output among a plurality of inputs each carrying cycle data. To provide a voting output, a statistical average (e.g., mean or median) is calculated by: the plurality of inputs are grouped into pairs, and for each pair, a minimum angle difference is generated by selecting a minimum of (a) an absolute difference between the input pairs and (b) a conjugate of the absolute difference between the input pairs. The voting output is the statistical average generated from the minimum angle difference. The monitor circuit and method evaluate validity in a plurality of inputs by: the input pairs are compared pair by pair, a minimum angular difference is generated for each pair, and the difference is compared to a threshold and the duration is confirmed. The monitor declares an input to which all other inputs paired with it are inconsistent invalid.)

1. A monitor circuit for assessing validity in each of a plurality of inputs carrying cycle data, the monitor circuit comprising:

a comparison processor programmed to compare the plurality of inputs on a two-by-two basis to establish the validity of each input by: grouping the plurality of inputs into pairs, and for each pair, generating a minimum angle difference by selecting a minimum of:

(a) the absolute difference between the pair of inputs, and

(b) the conjugate of the absolute difference between the pair of inputs; and is

Wherein the processor is further programmed to test each generated minimum angular difference with a predetermined threshold, declaring a pair inconsistent if the minimum angular difference for the pair exceeds the predetermined threshold;

wherein the processor is further programmed to evaluate and declare invalid an input with which all other inputs paired therewith are inconsistent.

2. The monitor circuit of claim 1, further comprising a low pass filter coupled to process the minimum angular difference of each pair, the filter having a predetermined cutoff frequency selected to exclude intermittent differences and detect oscillatory differences between the pair of inputs.

3. The monitor circuit of claim 1, wherein the processor is further programmed to evaluate and declare invalid an input to which all other inputs paired therewith are inconsistent for a predetermined duration.

4. The monitor circuit of claim 1, further comprising a memory circuit that stores at least one of an evaluated validity state and an evaluated invalidity state for each input.

5. The monitor circuit of claim 1, further comprising an input circuit that receives, for each of the plurality of inputs, a predetermined acquisition valid state selected from the group consisting of data acquisition valid and data acquisition invalid, and wherein the processor is further programmed to declare an input for which the corresponding acquisition valid state reflects a data acquisition invalid condition is invalid.

6. A monitor method for assessing validity in each of a plurality of inputs carrying cycle data, the monitor method comprising:

comparing the plurality of inputs two by two to establish the validity of each input by: grouping the plurality of inputs into pairs, and for each pair, generating a minimum angle difference by selecting a minimum of:

(a) the absolute difference between the pair of inputs, and

(b) the conjugate of the absolute difference between the pair of inputs; and is

Testing each generated minimum angle difference with a predetermined threshold, declaring a pair inconsistent if the minimum angle difference of the pair exceeds the predetermined threshold;

an input that is declared inconsistent with all other inputs that are paired with it is invalid.

7. The monitor method according to claim 6, further comprising low pass filtering the minimum angular difference of each pair using a predetermined filter cut-off frequency selected to exclude intermittent differences and detect oscillatory differences between the pair of inputs.

8. The monitor method of claim 6, further comprising evaluating to declare an input with which all other inputs paired are inconsistent for a predetermined duration is invalid.

9. The monitor method of claim 6, further comprising storing at least one of an evaluated validity state and an evaluated invalidity state of each input in a memory circuit.

10. The monitor method of claim 6, further comprising receiving, for each of the plurality of inputs, a predetermined acquisition valid state selected from the group consisting of data acquisition valid and data acquisition invalid, and declaring an input for which the corresponding acquisition valid state reflects a data acquisition invalid condition as invalid.

Technical Field

The present disclosure relates generally to voting and monitoring redundant data sources using a scheme that determines optimal values and detects erroneous data sources. More specifically, the present disclosure relates to voting and monitoring, where the data is cyclic in nature-having discrete points where the data transitions between a maximum and a minimum (wrap).

Background

This section provides background information related to the present disclosure that is not necessarily prior art.

Aircraft control systems often rely on multiple redundant data sources. These sources need to be integrity monitored and voted to provide a single composite value for control purposes. A typical monitoring scheme involves determining the error by measuring the absolute difference between the sources. Typical voting schemes include averaging or median selection.

Certain types of data typically found in aircraft applications are cyclic in nature. Cycle data is data like seconds on an analog clock or orientation on an analog compass that has a discontinuity, when crossed, the value jumps abruptly from a maximum value to a minimum value, and vice versa. On an analog clock, the discontinuity is located at the boundary between 60 seconds and 0 seconds; on a simulated compass, the discontinuity is located at the boundary between 360 degrees and 0 degrees. These are of course merely examples. There are other situations where cycle data may be encountered. For example, in a typical aircraft control system, cyclic data may be used to represent inclination angle, heading, longitude, and the like. For this type of data, typical voting and monitoring schemes do not work around discontinuities.

There are an alternative number of systems that can be used to address the discontinuous nature of cycle data. For example, quaternary numbering systems are sometimes used to eliminate cyclic data discontinuities. However, to achieve this advantage, the quaternary numbering system employs an extended set of complex numbers (i, j, and k complex components) and requires that the algebraic rules be changed (e.g., multiplication 2 x 3 using quaternary mathematics does not produce the same answer as multiplication 3 x 2). To handle the extended complex components and algebraic rule changes, more complex (and time-consuming) computer resources are required. Even without the quaternary numbering, conventional solutions still require extensive use of trigonometric functions (sin, cos, etc.) that require significant computational resources. In aircraft control applications, this computational burden, particularly the use of multiple redundant data sources, overwhelms the sensors and control systems. Therefore, better solutions are needed.

Disclosure of Invention

The disclosed monitor circuit and method evaluate validity in each of a plurality of inputs carrying cycle data. The processor is programmed to compare the plurality of inputs two by two (two-by-two) to establish the validity of each input by: grouping the plurality of inputs into pairs, and for each pair, generating a minimum angle difference by selecting a minimum of: (a) an absolute difference between the pair of inputs, and (b) a conjugate of the absolute difference between the pair of inputs. The processor then tests each generated minimum angular difference with a predetermined threshold and declares a pair inconsistent if the minimum angular difference for the pair exceeds the predetermined threshold. The processor then evaluates and declares that inputs with which all other inputs paired with it are inconsistent are invalid.

In one application, the monitor circuit and method may be used to precondition inputs to a voter circuit and method such that inputs found invalid by the monitor circuit are not used as inputs by the voter circuit.

Drawings

The drawings described herein are for illustrative purposes only of selected embodiments and not all possible implementations. Accordingly, the particular choice of drawings is not intended to limit the scope of the present disclosure.

FIGS. 1A and 1B are examples of cycle data useful in understanding the context in which the disclosed voting and monitoring system operates;

FIG. 2 is a block diagram of a three-way voter illustrating cycle data;

FIG. 3 is a block diagram illustrating the selection of an intermediate value by a three-way voter for loop data;

FIG. 4 is a block diagram illustrating the generation of an angular average by a three-way voter for loop data;

FIG. 5 is a block diagram of a three-way monitor cycling data;

FIG. 6 is a block diagram of a three-way monitor performing filtering and comparison of cycle data;

FIG. 7 is a block diagram of three-way monitor execution validation timing and enablement of cycle data;

FIG. 8 is a block diagram of a three-way monitor for loop data implementing a data validity-mismatch algorithm;

FIG. 9 is a flow chart illustrating how a three-way voter for loop data calculates voted data from three sources;

fig. 10 is a flow chart illustrating how the three-way monitor of cycle data operates.

Detailed Description

The following detailed description is merely exemplary in nature and is not intended to limit the invention or the application and uses of the invention. Furthermore, there is no intention to be bound by any theory presented in the preceding background of the invention or the following detailed description.

In handling redundant data, there are two important data handling components: a monitor circuit and a voter circuit. Monitor circuitry evaluates the integrity of each redundant data source, and voter circuitry uses the redundant sources to provide a single composite (voted) value for control purposes. Examples of both monitor circuits and voter circuits are described herein.

Referring to fig. 1A and 1B, two examples of cycle data are presented to illustrate some of the difficulties encountered in implementing a monitoring scheme or a voting scheme. FIG. 1A depicts a situation where the average of two data points at +170 degrees and-170 degrees, respectively, has a physical average midway between the two points, as indicated by reference numeral 10, which corresponds to an angular position of either +180 or-180 degrees. However, the arithmetic mean of +170 and-170 is 0 (zero), which is located on the other side of the circle, at reference numeral 12. This illustrates one problem with performing simple arithmetic on the cycle data.

The angular error between the +170 and-170 data points (reference 14) is 20 degrees. However, mathematically, the absolute difference between these two points yields a much larger angular error:

|+170–(-170)|＝340。

it is clear that the arithmetically calculated 340 degree error is much larger than the actual 20 degree angle error. This illustrates another problem of performing simple arithmetic on the cycle data.

Fig. 1B shows a second example, in which the angular position of the intermediate value is +170 degrees. However, when the three values are sorted in increasing order (-170, 120, 170), the middle value is 120 degrees. Also, it is clear that there is a significant difference between 170 degrees and 120 degrees.

The illustrated embodiment is designed to handle three redundant input sources, and thus the voter circuit and monitor circuit are referred to as a three-way circuit that operates on a three-way (triplex) data source or signal. The techniques described herein may be extended to cover other situations where a different number of redundant input sources are present. Thus, the three-way embodiment described herein is merely an example of a technique that may be applied to other situations where a different number of redundant signals need to be monitored and voted. In a typical aircraft application, the algorithms disclosed herein may be executed by suitably programming a flight control computer onboard the aircraft. Of course, dedicated logic gates or dedicated processors may be used instead, if desired.

Before a detailed disclosure of the voter circuit and the monitor circuit is given, an overview of the corresponding voting and monitoring methods will be given with reference to fig. 9 and 10.

Three-way voter overview of cycle data

Referring to FIG. 9, the three-way voter for loop data calculates voted data from three sources as follows:

a) if three inputs are valid (at 300), then at 302, selection is made by the following algorithm

Median values of three valid inputs (median data):

the minimum angular increment (delta) between each two sources is calculated as shown at 304. The minimum angular increment is calculated as the minimum between the absolute difference between the two sources and their conjugate angle (i.e., to 360 degrees so that the minimum angular increment is always an angle less than 180 degrees). Note that this technique of using conjugate angles is suitably used elsewhere in the process of calculating the minimum angle increment, as will be apparent from the drawings and the description that follows.

Three points on a given circle, of which two points with the largest angular increment are extreme values and the middle value is the third point, as indicated at 306.

For an undefined case where three points are 120 degrees apart, one of the inputs is selected, as shown at 308.

b) If the two inputs are valid (at 300), then the average of the two valid inputs is calculated at 310 as follows:

if the absolute angular difference between the two sources is less than or equal to 180 degrees at 312, as shown at 314, then a conventional average is calculated.

If the absolute angular difference between the two sources is greater than 180 degrees at 312 (as shown at 316), then the average is calculated by adding the maximum input to half the minimum angular increment between the two sources. The result is converted (wrapped) from +180 degrees to-180 degrees (i.e., 360 degrees is subtracted from the result) if it is greater than 180 degrees.

c) If only one input is valid, the valid input is selected, as shown at 318.

d) If none of the inputs are valid, the output is set to zero, as shown at 320.

Three-way monitor overview of cycle data

Referring to fig. 10, the three-way monitor of cycle data has the following inputs 330:

three data sources

-three data source validity

-a comparison enable input for enabling/disabling the monitor

A reset input for clearing a latched fault that is no longer persistent

The three-way monitor of cycle data has the following parameters 332, which are defined in terms of the monitored data:

-comparing threshold values

Comparison of persistence

Minimum number of valid data sources for which voting data need to be marked as valid

-a filtering time for filtering the difference between the sources and detecting oscillation faults.

The three-way monitor of cycle data compares data 334, two by two, to determine the difference between each input pair. A comparison threshold and a comparison duration are defined for each data type.

The angular difference 336 between the two inputs is defined as the minimum between:

-the absolute difference between the two sources;

the conjugate of the absolute difference between the two sources (i.e., 360 degrees minus the absolute difference between the two sources).

The monitor includes the ability to detect oscillation faults by low pass filtering 338 the difference of the two inputs and then comparing the filtered difference to a threshold. A low pass filter cut-off frequency is defined for each data type.

The monitor determines the validity of the voting data relative to a minimum number of valid data sources 340. A minimum number of valid data sources will be defined for each data type.

If its collection is valid and no mismatch is detected with the remaining data sources with valid collections, as shown at 342, and there is a minimum number of valid data sources that need to have their voting status flagged as valid, the monitor considers the data source valid.

Three-way voter for cycle data

Referring to fig. 2, a logic circuit for implementing a three-way voter circuit for loop data is illustrated. The logic circuitry may be implemented by programming a processor to perform the illustrated logic steps. In this regard, fig. 2 describes the logic in a form suitable for expression as a Matlab Simulink model, in which case executable program code may be generated using code generation tools within Matlab Simulink. It should be understood that Matlab Simulink is just one example of a model-based software development environment. Other alternatives exist, such as SCADE. The Matlab Simulink embodiments described herein are exemplary only and are not intended as limitations on the scope of the present disclosure. Alternatively, the logic circuitry may be implemented as an Application Specific Integrated Circuit (ASIC) or using a Field Programmable Gate Array (FPGA).

In some embodiments, redundant (three-way) data may be provided as a signal, input, or data that has been evaluated by a monitor circuit or other means for marking each of the redundant inputs as valid or invalid. By way of example, an invalid signal may indicate that the sensor providing the signal has been turned off or has failed, or that the conductor designated to carry the signal is not reporting data. In the event that the monitor circuit or other validity checking circuit provides a data valid/invalid indication, this information is provided to the data valid input (one for each of the three-way signals), as shown at 40. As shown, these Data Valid states are summed at 42 and the sum is used as an averaging factor, which is then parsed by logic gate 46 to determine if all three inputs are Valid (B _3_ Data _ Valid), or if both inputs are Valid (B _2_ Data _ Valid). In the example shown in FIG. 2, the case where only one input is valid is not tested, as voting is not required with only a single input being valid.

As shown at 48, the three-way cycle data is processed by a saturation function that limits the data to between +180 degrees and-180 degrees, respectively. This is done to ensure that all loop values are expressed with respect to a common loop, as shown in fig. 1A and 1B. After the data values are processed by the saturation function, the data is voted to determine from the redundant three-way signals a data vote value selected by the voter circuit that best represents the collective three-way group.

As shown in fig. 2, the voting is performed by calculating the median of the three-way inputs as shown at 50, and also calculating the average of a subset of the three-way inputs as shown at 52. As shown, when there are only two valid data sources, switch B1 and switch B2 provide two valid data sources at 100. The median selection is detailed in fig. 3 and the angular average calculation is detailed in fig. 4, both discussed below. In these figures, some switches have been shown; these switches generally work as follows: when the control input is TRUE, the top input is used. When the control input is FALSE, the bottom input is used. In the figure, the switches are drawn in a state where the control input is assumed TRUE. The output of the voting circuit, which is based on how the switches 56-64 are set, produces a data voting signal at 54. As shown, switch 56 (switch B3) toggles to provide the intermediate value selected by the intermediate value selection block 50 and the output of switch 58 (switch B4) to the data voting output. The switch switches between these two settings based on the state of the 44-B3 output of logic gate 46. Upon examination of the circuit of fig. 2, it can be seen that each of the remaining switches 58-64 operate in a similar manner. When only one source is active, switches 60, 62 and 64 select the remaining sources that are active. When there is no active source, switch 64 sets the output to zero. The following table summarizes these switch selection switches. When the controlled signal is TRUE, the output of the switch is as shown in the unswitched output column. When the controlled signal is FALSE, the output of the switch is as shown in the switching output column.

Switch label	Switch name	Unswitched output	Is controlled by	Switching output
					56	Switch B3	Median value	B_3_Data_Valid	Switch B4
58	Switch B4	Mean value of	B_2_Data_Valid	Switch B5
					60	Switch B5	Data_1	Data_1_Valid	Switch B6
62	Switch B6	Data_2	Data_2_Valid	Switch B7
					64	Switch B7	Data_3	Data_3_Valid	0

Referring now to fig. 3, the intermediate value selector circuit 50 (fig. 2) is further described. The selector circuit 50 operates on input data provided at 66 (also shown in fig. 2). The selector circuit operates by calculating the difference or delta between the corresponding pairs of input values. As shown, at 68, three incremental outputs, namely (Data _1, Data _2), (Data _1, Data _3), and (Data _2, Data _3), are calculated using the three pairs of Data values, as shown at 70. The same algorithm is used to calculate or process the block for each pair of input values as shown in block diagram form at 72. The algorithm subtracts the two input values at 74, calculates the absolute value of the difference at 76, and then subtracts the resulting absolute value from 360 degrees at 78 to obtain the conjugate angle. The absolute value from 76 is then compared at 80 with the conjugate angle at 78, the minimum of the two being selected. The minimum value is reported at the incremental output at 68.

Next, at 68a, the incremental output is further processed to compute two intermediate selector values, [ Select _3] at 82 and [ Select _2] at 84. As shown, these selector values are calculated using a greater than or equal to comparison at 86, followed by a Boolean AND gate function at 88. These intermediate selector values control switch 90 (switch B) and switch 92 (switch B1) to produce an intermediate value result at 94 (the output of circuit 50 (fig. 2)). Switches 90 and 92 are summarized in the table below.

Switch label	Switch name	Unswitched output	Is controlled by	Switching output
					90	Switch B	Data_3	[Select_3]	Switch B1
92	Switch B1	Data_2	[Select_2]	Data_1

Referring now to fig. 4, the average calculation circuit 52 (fig. 2) is further described. The average value calculation circuit 52 operates on the input Data (Data _ X and Data _ Y) supplied at 100 (also shown in fig. 2). The average calculation circuit generates an average value 104 (also shown in fig. 2) by: the angular average 106 and the regular average 108 are calculated and then one of the two averages is selected based on whether the absolute difference or delta between the input data is greater than 180 degrees. In the circuit of fig. 4, this selection between the two averages is performed by switch 110 (switch B1), where the absolute increment between Data _ X and Data _ Y tested at 112 is greater than 180 degrees.

To perform these calculations, the calculation circuit processes the two input values 100(Data _ X and Data _ Y) to produce two intermediate signals, a minimum increment value (Min _ Delta _ X _ Y) at 102 and an absolute increment value (Abs _ Delta _ X _ Y) at 103. At 114, the minimum delta value 102 is calculated using logic gates and calculation circuitry that functions substantially the same as components 74-80 of FIG. 3, and the absolute delta value is calculated using logic gates and arithmetic circuitry, as shown. As can be seen from fig. 4, these minimum and absolute delta values are used at 102a and 103a to help generate the average at 104.

Specifically, the average is derived from a first component that considers the minimum increment value at 102a and the absolute increment value at 103a, and a second component that is based only on the conventional average of the Data _ X and Data _ Y input values at 100 b. The first component is calculated by: the maximum of the Data _ X and Data _ Y values is selected at 120 and then added to half the minimum increment value derived at 122 in adder 124. The resulting calculations are then processed by circuit 126 to resolve the cycle data problem. Circuit 126 operates by using switch 128 to select the output of adder 124 directly if its value is less than or equal to 180 degrees at 130, or to select the output of the adder minus 360 degrees if its value is greater than 180 degrees.

Meanwhile, the Data _ X and Data _ Y values at 100b are used to calculate a conventional average at 108 by a simple arithmetic calculation of half the sum of the two values.

The average calculation circuit operates through switch 110 to select the angular average 106 as the average at 104 unless the absolute increment 103a is less than or equal to 180 degrees, in which case switch 110 selects the normal arithmetic average 108 as the average at 104. Therefore, the average calculation circuit performs a segment calculation using a conventional arithmetic average in the case where the absolute increment (absolute value) between two input values is less than or equal to 180 degrees; otherwise the calculation uses the larger of the two input values, increasing the difference or half the increment between the two, and if necessary adjusting, subtracting 360 degrees to ensure that the resulting value does not exceed one full rotation period.

Three-way monitor for cycle data

Referring to fig. 5, a logic circuit for implementing a three-way monitor circuit for loop data is illustrated. The logic circuitry may be implemented by programming a processor to perform the illustrated logic steps. In this regard, fig. 5 describes the logic in a form suitable for expression as a Matlab Simulink model, in which case executable program code may be generated using code generation tools within Matlab Simulink. Other development environments may be used instead, as described above. Alternatively, the logic circuit may be implemented as an Application Specific Integrated Circuit (ASIC) or using a Field Programmable Gate Array (FPGA).

As discussed above in connection with the voter circuit, in some cases it may be known a priori that a certain signal or signals are invalid because, for example, the sensor providing the signal has been turned off or has failed, or the conductor designated to carry the signal has no reported data. The monitor circuit may use this information to treat invalid signal conditions from the outset as those in which not all of the acquired data is valid. However, in this more likely case where all the acquired Data is present and appears to be Valid, the monitor circuit uses this condition as a switch or select value (shown at 200 and designated as Data _ i _ Acq _ Valid). This Data _ i _ Acq _ Valid value or condition is used in some circuits described below. As used herein, the vertical bus 202 represents the fact that the output side of the bus at 200 (labeled Data _ i _ Acq _ Valid) carries all of the information provided on the input side of the bus at 204. In this case, there are three input side values passed to the output, since we are processing three ways of data. In this case, a validity condition listing each of three Data values Data _1_ Acq _ Valid, Data _2_ Acq _ Valid, and Data _3_ Actq _ Valid is input.

The monitor circuit of fig. 5 includes three main functional components: a filtering and comparison component 206 (shown in more detail in fig. 6), a validation time and enable component 208 (shown in more detail in fig. 7), and a data validity/mismatch algorithm 210 (shown in more detail in fig. 8). Note that the Data _ i _ Acq _ Valid bus condition is used as one of the inputs to the component 206, as shown at 200 a. Three-way data values are also input to component 206 as indicated at 212. The function of the filter and compare circuit 206 is to determine which pairs of the three-way data input 212 are inconsistent. The validation time and enable circuit, when enabled, evaluates whether the data inconsistency persists for a predetermined time, thereby precluding the case where the data inconsistency persists only for a short time interval. In the event that the data mismatch persists for a sufficient time, the data validity/mismatch algorithm evaluates which of the three paths of data are valid and which are responsible for the data mismatch.

Referring to fig. 6, the filtering and comparing component 206 first processes each of the three inputs (data 1, data 2, data 3) to determine if there is a difference or delta between any two inputs. This function is performed using processing component 214, which is substantially identical in configuration and function to components 74-80 in fig. 3. Component 214 compares pairs of inputs: data 1 and data 2, data 1 and data 3, and data 2 and data 3, as shown.

The results of each comparison are processed by a filter 216, such as a first order low pass filter designed to avoid nuisance tripping of the monitor and allow the monitor to detect oscillation faults. The filter time constant is set to mask out transient differences due to signal glitches. Such glitches may occur, for example, due to random signals and noise picked up by associated signal lines or generated by associated electronic circuitry. The low pass filter circuit is also used to detect oscillation faults that are otherwise undetectable at sufficiently high frequencies, where the miscompares last for a duration shorter than the monitor duration. The filter time constant also determines the magnitude of the oscillation miscompares required to trip the monitor at a given frequency.

Next, at 218, the low pass filtered signals are respectively compared to predetermined thresholds provided as constant signal levels at 220. The comparison basically determines whether the two data values are consistent. However, such a comparison may only make sense if the information on bus 202 (FIG. 5) has not previously considered the two input data values being compared to be invalid. Thus, an AND gate 222 is provided to declare that two data values are inconsistent only if, according to the bus 204, the two data value sources are active AND the two data values differ in value above a predetermined threshold 220, as determined at 218.

The validation time and enable circuit 208 is shown in fig. 7. This circuit is used to ensure that the determination of an inconsistency between any two values is persistent. The duration is established by block 223. For a data pair mismatch to be considered established, the mismatch condition must last at least for a predetermined duration. This circuit also functions as a master enable/disable circuit (also shown in fig. 5) responsive to the enable signal at 224. The output of duration block 223 AND the enable signal are coupled through an AND gate 225 to provide a Data _ Mismatch signal 226.

Referring now to fig. 8, the Data _ Mismatch signal 226 is further processed by latch circuit 250. As shown, three latch circuits 250 are used, one latch circuit generating a signal at 260 indicating that data 1 is mismatched with respect to data 2 and data 3. The other two latch circuits 250 generate signals at 262 and 264, respectively. Signal 262 indicates a data 2 mismatch; signal 264 indicates a data 3 mismatch. The three latch circuits 250 are substantially identical and therefore only one latch circuit will be described in detail herein.

In detail, the latch circuit 250 generating the data 1 mismatch signal 260 includes an OR gate 251 to which the following three inputs are provided. If any one or more of these inputs assumes a logical TRUE state, then the TRUE state is provided to the set terminal S of the set-reset flip-flop 252, and the flip-flop 252 remains in the TRUE state at its output Q until the flip-flop 252 is reset by a signal on the reset terminal R, as shown at 253. When the set signal and the reset signal occur simultaneously, the effect of the set signal takes precedence. Thus, flip-flop 252 can be considered to perform a function equivalent to a computer memory device or a computer memory circuit.

The three inputs to OR gate 251 are provided by three AND gates 254, 256, AND 258, which process the Data mismatch signal 226 AND the Data _ i _ Acq _ Valid signal 201 (FIG. 5) as follows.

AND gate 254 provides a logic TRUE state to OR gate 251 if the following two conditions are met: the mismatch signal 226 exhibits a data 1-2 mismatch condition and a data 1-3 mismatch condition. The source of these mismatch conditions can be seen in fig. 7.

If the Data 1-3 mismatch condition is satisfied AND the Data _1_ Acq _ Valid signal is NOT TRUE, AND gate 256 provides a logical TRUE state to OR gate 251. The NOT TRUE condition is decoded by providing a logic inverter gate 257.

Similarly, if the Data 1-2 mismatch condition is met AND the Data _3_ Acq _ Valid signal is NOT TRUE, AND gate 258 provides a logic TRUE state to OR gate 251. The NOT TRUE condition is decoded by providing a logic inverter gate 259.

Latch circuit 250 also provides data valid output signals 270, 272, and 274, respectively, for each of the three inputs 48 (fig. 2). As shown, the Data Valid output signal is generated by inverting the output Q of the flip-flop 252 at 276 AND combining that logic state with the Data _1-Acq _ Valid state of the associated input in the AND gate 278. These Data Valid states are added to the corresponding outputs of the other two latch circuits (250) at 282 and compared to a minimum Data Valid constraint 286 at 284, as shown at 280 and 280a, reporting that Data voting is Valid if the sum of the three Data Valid states 282 is greater than or equal to the minimum Data value constraint 286.

In one embodiment, the various inputs to the voter circuit described above are preconditioned by the monitor circuit described above to inhibit invalid inputs from being considered by the voter circuit.

While at least one exemplary embodiment has been presented in the foregoing detailed description, it should be appreciated that a vast number of variations exist. It should also be appreciated that the exemplary embodiment or exemplary embodiments are only examples, and are not intended to limit the scope, applicability, or configuration of the invention in any way. Rather, the foregoing detailed description will provide those skilled in the art with a convenient road map for implementing the exemplary embodiment or exemplary embodiments as contemplated herein. It being understood that various changes may be made in the function and arrangement of elements described in an exemplary embodiment without departing from the scope of the invention as set forth in the appended claims.