Reconfiguration procedure for an error-tolerant computer-supported system with at least one set of observers

Reconfiguration method for an error-tolerant system with at least one set of observers that are each formed from various combinations of sensors and a system model whereby the set of observers cause time-dependent operating statuses to fulfill system functions, whereby past deviations of the measured system status of this combination of one of the estimated system statuses of the assigned observers are used to determine the error status of each of these combinations of sensors for each time interval,

• characterized in
• the provision of a first and a second threshold value related to the error status, whereby the attainment of the first threshold value is an indicator for the occurrence of an error in that component, and attainment of the second threshold value results in the determination that the sensor or system model combination is erroneous, whereby, for determination of the error status of each of these combinations, a predetermined number n of past deviations from a measured system status of this combination is determined from the estimated system status of an assigned observer, and an error status is derived for that particular time interval,
• thus based on an initial condition in which a first observer is active and at least one additional redundant sensor or system model combination in inactive condition is available, during attainment of the first threshold value in the first observer via the following steps:
• 1.1. engaging at least one additional observer with a different combination of sensors or of the system model,
• 1.2. input of deviations of the last n−1 time intervals from the observer that reported the error into said at least one additional observer,
• 1.3. input of the current system status from the observer that reported the error into said at least one additional observer,
• 1.4. determination of the error status in the first observer based on the last n deviations measured by it,
• 1.5. determination of the error status in said at least one additional observer based on the last n deviations that said at least one additional observer itself reported, or that it received upon activation,
• 1.6. deactivation of said at least one additional observer as soon as the first observer falls below the first threshold value,
• and by attainment of the second threshold value by means of the following steps:
• 1.7. deactivation of each first observer for the course of this time interval
• 1.8. activation of the observer with the most favorable error status of said at least one additional observer used to verify the system functions,
• 1.9. input of deviation of the last n−1 time intervals from the observer with the most favorable error status into the first observer based on the last n−1 deviations that the most favorable observer itself has reported, or that it received upon activation
• 1.10. input of the current system status from the most favorable observer into the first observer,
• 1.11. determination of error status in the first observer based on the last n deviations that the first observer itself reported, or that it received upon activation,
• 1.12. repetition of steps 1.1 to 1.6, as soon as the first threshold value is reached
• 1.13. repetition of steps 1.7 to 1.11, as soon as the second threshold value is reached.