Hybrid multiple redundant computer system

A hybrid multiple redundant computer system comprising:

• a) a first, a second, and a third processing unit operating in parallel, each of which includes a central processor module connected to an input and an output module for receiving an input data from said input module and for using the input data as input to a control program to provide output data by execution of said control program, each central processor module has a data bus for transferring said output data to output modules in a such manner that the central processor module associated with the first processing unit transmits output data to the associated output module and to the output module associated with the second processing unit, the central processor module associated with the second processing unit transmits output data to the associated output module and to the output module associated with the third processing unit, the central processor module associated with the third processing unit transmits output data to the associated output module and to the output module associated with the first processing unit, said output module having no single point of failure;
• b) means in the output module for providing its output as a logical product of output data received from two central processor modules, said output modules connected to each other for generating system output as a logical sum of the outputs produced by said output modules to provide a two-out-of-three vote among output data produced by three central processor modules;
• c) the processing unit further comprising a watchdog controller connected to the associated central processor module for detecting the occurrence of a fault within said central processor module and for activating an alarm signal in the event that said central processor module fails;
• d) the output module in each processing unit further connected to the associated watchdog controller and connected to watchdog controllers in the other processing units for receiving alarm signal from any of said watchdog controllers in the event that the associated central processor module fails;
• e) means in the output module for producing the output of said output module as a logical product of output data received from the associated central processor module and from neighbor central processor module if said alarm signal in each processing unit is not activated, means for disabling said output if alarm signal received from the associated watchdog controller is activated, for generating said output by only using the output data received from the associated central processor module if at least one out of two alarm signals produced by the neighbor watchdog controllers is activated, thereby allowing the system to reconfigure from the triple processing unit configuration with two-out-of-three voting to a two-out-of-two diagnostic dual processing unit configuration in the event that the associated central processor module fails, to a single processing unit configuration in the event that the associated and any neighbor central processor modules concurrently fail, and to the predetermined safe output condition in the event that each central processor module fails;
• f) wherein said means in the output module associated with the first processing unit for producing its output as a logic product of output data received by said output module from central processor modules associated with first and third processing units if said alarm signal in each processing unit is not activated, and generates said output by only using the output data received from the central processor module associated with the first processing unit if at least one out of two alarm signals associated with second and third processing units is activated, and for disabling the output of said output module if the alarm signal associated with the first processing unit is activated;
• g) wherein said means in the output module associated with the second processing unit for producing its output as a logic product of output data received by said output module from central processor modules associated with second and first processing units if said alarm signal in each processing unit is not activated, and generates said output by only using the output data received from the central processor module associated with the second processing unit if at least one out of two alarm signals associated with first and third processing units is activated, and for disabling the output of said output module if the alarm signal associated with the second processing unit is activated;
• h) wherein said means in the output module associated with the third processing unit for producing its output as a logic product of output data received by said output module from central processor modules associated with third and second processing units if said alarm signal in each processing unit is not activated, and generates said output by only using the output data received from the central processor module associated with the third processing unit if at least one out of two alarm signals associated with first and second processing units is activated, and for disabling the output of said output module if the alarm signal associated with the third processing unit is activated;
• i) means in each central processor module for reading status of the associated output module to disable output of said output module if a fault of that module is discovered;
• j) means in each central processor module for reading status of the associated input module and disabling input data received from said input module if a fault of that module is discovered.