Vehicle control with functional redundancy

A method of operating an aircraft system comprising:

• communicating information between one or more peripheral devices of a gas turbine engine and a multi-core processor, the multi-core processor including a plurality of cores, the plurality of cores including first, second, third and fourth cores;
• concurrently executing a first discrete set of software instructions on the first and second cores to generate respective instances of an output based on the information, including executing a predictive model relating to one or more components of the gas turbine engine, wherein the respective instances of the output are based on at least one expected input corresponding to at least one expected condition of the one or more components;
• communicating sensor information from one or more sensors that measure one or more conditions of the gas turbine engine;
• executing software instructions on the third core to generate respective instances of the output based on the sensor information, wherein the at least one expected input differs from the sensor information and differs from an actual condition of the one or more components;
• controlling a condition of the one or more components of the gas turbine engine according to the respective instance from the first core in response to at least one predetermined criterion being met, but controlling the condition of the one or more components of the gas turbine engine according to the respective instance from another one of the cores in response to the at least one predetermined criterion not being met;
• concurrently executing a second discrete set of software instructions on the third and fourth cores to control the gas turbine engine, the first discrete set of software instructions being separate and distinct from the second set of software instructions, and wherein the fourth core generates the respective instances of the output based on the sensor information;
• wherein the step of controlling the gas turbine engine includes communicating a selected output to control the gas turbine engine, the selected output corresponding to at least two matched values from the respective instances of the output and the sensor information;
• wherein a first instance of the at least two matched values includes matched values of the respective instances of the output corresponding to the first core and the second core, but not the third core or the fourth core;
• wherein a second instance of the at least two matched values includes matched values of the respective instances of the output corresponding to the first core and the third core, but not the second core or the fourth core;
• and
• wherein a third instance of the at least two matched values includes matched values of the respective instances of the output corresponding to the third core and the fourth core, but not the first core or the second core.