A multiple redundant control system comprising:
- a) at least one primary input module including first, second, and third input circuits operating in parallel for receiving process data for each controlled point;
- b) at least one output module including first, second, and third output circuits operating in parallel, outputs of said output circuits are connected together for providing system output for each controlled point;
- c) each of said output circuits including a first and a second interface;
- d) a first, a second, and a third primary processor module operating in parallel;
- e) said first, second, and third primary processor modules respectively connected to said first, second, and third input circuits of the primary input module for receiving input data from the associated input circuit, and for using the input data as input to a control program to generate output data by execution of the control program;
- f) said first, second, and third primary processor modules coupled together for sending a status and input/output data to each other to provide synchronous operation of said primary processor modules;
- g) said first, second, and third primary processor modules are connected to the first interface of said first, second, and third output circuits respectively for delivering an output data to the associated output circuit;
- h) at least one redundant input module including first, second, and third input circuits operating in parallel for receiving process data for each controlled point;
- i) a first, a second, and a third redundant processor module operating in parallel;
- j) said first, second, and third redundant processor modules respectively connected to said first, second, and third input circuits of the redundant input module for receiving input data from the associated input circuit, and for using the input data as input to said control program to generate output data by execution of the control program;
- k) said first, second, and third redundant processor modules coupled together for sending a status and input/output data to each other to provide synchronous operation of said redundant processor modules;
- l) said first, second, and third redundant processor modules are connected to the second interface of said first, second, and third output circuits respectively for delivering output data to the associated output circuit;
- m) said first, second, and third primary processor modules are respectively connected to said first, second, and third redundant processor modules for allowing each said primary processor module to send a command to the associated redundant processor module to begin said control program execution, thereby allowing each said primary processor module and the associated redundant processor module to synchronously execute said control program;
- n) means in the output circuit for detecting the occurrence of a fault in the associated primary processor module, and using output data received from the redundant processor module in the event that the primary processor module fails;
- o) means in the output module for producing a system output as the result of two-out-of-three voting among output data generated by said first, second, and third primary processor module;
- p) means in the output module for producing the system output as the result of two-out-of-three voting among output data generated by said first, second, and third redundant processor modules if said first, second, and third primary processor module concurrently fail;
- q) means in the output module for producing the system output as the result of two-out-of-three voting among output data generated by three processor modules, each of said processor modules comprising said primary processor module or said associated redundant processor module if said primary processor module fails;
- r) means in the output module for producing the system output as the result of two-out-of-two voting among output data generated by two processor modules, each of said processor modules comprising said primary processor module or said associated redundant processor module if said primary processor module fails and all other said processor modules fail;
- s) means in the output module for producing the system output as the result of one-out-of-one voting of output data received from said primary processor module or from said redundant processor module if all other processor modules fail, thereby allowing the system to remain operational even though five processor modules out of six fail;
- and
- t) means in output module for driving the system output to a safe condition in the event that all primary and redundant processor modules concurrently fail.