초록 ▼

A backup software program is installed in an isolated portion in the memory of at least one of redundant computers. The backup program performs basically the same functions as the prime program but is dissimilarly programmed to prevent a common software error. Switchover to the backup program occurs

A backup software program is installed in an isolated portion in the memory of at least one of redundant computers. The backup program performs basically the same functions as the prime program but is dissimilarly programmed to prevent a common software error. Switchover to the backup program occurs either automatically in response to monitors, or manually by the operator (i.e. pilot) when he detects an anomaly.

대표청구항 ▼

In a computer system (10) having a plurality of identical processors (12) and controlling a device (24), a method of providing control over the device comprising: installing identical primary software in a portion (18) of memory (16) associated with each processor (12), said primary software directi

In a computer system (10) having a plurality of identical processors (12) and controlling a device (24), a method of providing control over the device comprising: installing identical primary software in a portion (18) of memory (16) associated with each processor (12), said primary software directing the operation of the processors to control the device during normal operation; installing backup software, dissimilar from the primary software, in an isolated portion (20) of memory (16) associated with at least one of the processors (12), said backup software capable of directing the operation of the processor(s) to control the device of in the event of a sensed event; sensing for a fault event occurring in the primary software affecting all processors; sensing for a fault event occurring in the primary software affecting a majority of the processors (12); sensing for an externally initiated event represented by a backup software transfer command signal; providing a nonmaskable interrupt request in response to one of said sensed events; completing whatever instruction is being executed in the primary software when the nonmaskable interrupt request is provided, and then acknowledging the nonmaskable interrupt request; and disabling the primary software and executing the backup software in response to the nonmaskable interrupt request so as to maintain control over the device with the backup software associated with the at least one processor.