Fail-operational fault tolerant flight critical computer architecture and monitoring method

A flight critical computer system for an aircraft, the aircraft having sensor means for providing sensor signals representative of characteristics concerning the aircraft, said system comprising:

• a first lane having a first primary processor and a first redundant processor and for providing a first command signal, said first primary processor for generating a first output signal and said first redundant processor for providing a first redundant output signal as a function of said sensor signals;
• a second lane having a second primary processor and a second redundant processor and for providing a second command signal, said second primary processor for generating a second output signal and said second redundant processor for generating a second redundant output signal as a function of said sensor signals;
• wherein said first primary processor is dissimilar from said second primary processor and said first and second redundant processors, said second primary processor is dissimilar from said first and second redundant processors, and said first and second redundant processors are substantially similar to each other;
• wherein said first primary processor includes first monitor means for monitoring said second primary processor and second monitor means for monitoring said second redundant processor, said first and second monitor means for generating first and second comparison signals, respectively, representative of disagreement or agreement therebetween;
• wherein said second primary processor includes third monitor means for monitoring said first primary processor and fourth monitor means for monitoring said first redundant processor, said third and fourth monitor means for generating third and fourth comparison signals, respectively, representative of disagreement or agreement therebetween;
• wherein said first redundant processor includes fifth monitor means for monitoring said second primary processor and for generating fifth comparison signals representative of disagreement or agreement therebetween;
• wherein said second redundant processor includes sixth monitor means for monitoring said first primary processor and for generating sixth comparison signals representative of disagreement or agreement therebetween, and;
• selection means for selecting, as a function of said first, second, third, fourth, fifth, and sixth comparison signals, one of said first output signal and said first redundant output signal as said first command signal and one of said second output signal and said second redundant output signal as said second command signal while allowing for at least one of said primary processors and said redundant processors to fail before both said first and second command signals from said first and second lanes, respectively, are disabled.

A monitoring method for fail-operational fault tolerant flight critical computer architecture, said method comprising the steps of:

• providing dual independent lanes having two dissimilar processors in each lane, said first lane including a first primary processor and a first redundant processor and said second lane including a second primary processor and a second redundant processor, said first and second primary processors being dissimilar and said redundant processors being similar to each other, each of said processors producing an output signal in response to signals from one or more sensors representative of characteristics concerning an aircraft;
• monitoring the outputs of said first and second primary processors with respect to each other and generating comparison signals representative thereof;
• monitoring the outputs of said first redundant processor and said second primary processor with respect to each other and generating second comparison signals representative thereof;
• monitoring the outputs of said second redundant processor and said first primary processor with respect to each other and generating third comparison signals representative thereof;
• and
• selecting one of said output signals of said first primary processor and said first redundant processor and selecting one of said output signals of said second primary processor and said second redundant processor as command signals for said aircraft as a function of said first, second, and third comparison signals.