Method and system for a geographical hot redundancy

A method for a geographical hot redundancy between a first safety computer and a second safety computer, the first and second safety computers being remote from each other to avoid failure common modes, the first and second safety computers being connected to each other by a generic communication network without a synchronisation link allowing a strict synchronisation between the first and the second safety computers, the first safety computer cyclically executing a first replica of an application and the second safety computer, providing a redundancy for the first safety computer, cyclically executing a second replica of the application, the method, in normal operation, while the first safety computer operates as a master computer and the second safety computer operates as a slave computer, comprising the steps consisting in:

• a) a transmission by the first safety computer to the second safety computer of a message comprising first input data items for an nth cycle and all or part of a first execution context for execution of the application for the nth cycle;
• b) an execution, during the nth cycle, of the first replica of the application on the first safety computer and updating of the first execution context of the application at the end of the nth cycle;
• c) a transmission by the first safety computer to the second safety computer of a first output quantity corresponding to all or part of the first execution context at the end of the nth cycle;
• d) a reception by the second safety computer of the message and a recovery of the first input data items for the nth cycle and of all or part of the first execution context for the nth cycle contained in the message as second input data items and a second execution context for the nth cycle on the second safety computer;
• e) an execution, during the nth cycle, of the second replica of the application on the second safety computer in the second execution context for the nth cycle, on the second input data items of the nth cycle, and an update of the second execution context at the end of the nth cycle;
• f) a check and verification of the consistency between the first and second safety computers by comparing a second output quantity corresponding to all or part of the second execution context at the end of the nth cycle on the second safety computer with a first output quantity at the end of the nth cycle received from the first safety computer.