Synchronized, fail-operational, fail-safe multi-computer control system

Abstract

For each of two computer systems, logic flowcharts describe background program in which highly detailed memory checksum tests of fixed memory and complementary tests of variable memory are performed, the background program being interrupted for utility programs which are for the most part responsive to transducer or other sensor and discrete inputs to calculate control values for operation of control actuators or other responsive devices. The utility programs include specific self test routines. A direct memory access unit is included in each computer for moving data between inputs of either computer and memories of both, and between the memories of both computers. Periodic testing of fault codes registering the health of each computer is done during utility program routines, any variation from normal causing further health-analysis routines to be performed until dispositive action-causing conditions are determined. Neither computer checks the internal health of other, but inputs, results and data link transmissions must compare equally between the two computers, or routines determine whether one computer will recognize itself (or a component thereof) as being faulty, and disable itself. If not, then each computer disables itself after disabling the other. A variety of self tests and other checks and routines are included. Disablement is accomplished in a complex fashion of each computer's output, by itself, and additional disablement if instituted by the other computer.