Multiple redundant computer system combining fault diagnostics and majority voting with dissimilar redundancy technology

Abstract

A multiple redundant computer system includes three primary processor modules (PPM) and three redundant processor modules (RPM) operating synchronously. Primary and redundant processor modules are dissimilar in hardware and software for decreasing the probability of a common cause system failure. Each primary and redundant processor module receives input data from associated primary and redundant input modules respectively, executes control program and transfers output data to an output module. The output module produces a system output as the result of 2-out-of-3 voting among output data generated by PPMs. In response to PPMs hard failures, the output module still produces the system output as the result of 2-out-of-3 voting among output data generated by any combination of the PPM and the RPM. As such, the system is able to operate properly even though five-out-of six processor modules have failed. The output module also compares output data that it has received from each pair of the associated PPM and RPM for detecting a disparity between said output data due to the occurrence of transient faults. Additionally, the output module produces the system output as the result of 2-out-of-2 and 1-out-of-1 voting upon the occurrence of disparity of output data generated by the associated PPM and RPM in one and two pairs of the associated PPM and RPM respectively.