Methods and systems for vital bus architecture

A safety critical bus system for communicating data in a control system, said bus system comprising:

• a plurality of data communication buses configured in a multiple redundant orientation;
• at least one safety supervisor module communicatively coupled to and associated with at least two of said plurality of data communication buses, said safety supervisor comprising a database including a plurality of logic rules, said logic rules programmed to:
• receive data from the at least two of said plurality of data communication buses;
• determine the validity of the received data from each bus using one or more of the plurality of the logic rules;
• if the received data is determined to be invalid, restore the validity of the data using one or more of the plurality of the logic rules;
• if the data can not be restored transmit an alert to the control system;
• and
• transmit the validated data to an intended destination;
• and wherein
• said safety supervisor module comprises a first safety supervisor module communicatively coupled to a first communication bus, and a second safety supervisor module that is separately coupled to a second communication bus, the first and second safety supervisor modules being communicatively coupled one to the other.

A vehicle including a control system comprising:

• a plurality of low-integrity systems configured to detect operating conditions of the vehicle, the low-integrity systems configured to control operation of the vehicle, the low-integrity systems each comprising redundant vehicle control devices configured to control a function of the operation of the vehicle, each of the redundant vehicle control devices coupled to one of a plurality of separate communication buses;
• the redundant vehicle control devices coupled one to the other for communication therebetween via a cross talk bus, the cross talk communication for verifying the output signals between the redundant vehicle control devices;
• and
• a safety supervisor module communicatively coupled to and associated with at least one of a control device and an input device associated with each low-integrity system via a respective one of the communication buses, said safety supervisor module configured to monitor the state of each of the vehicle control devices using one or more logic rules, said safety supervisor module configured to remove control from a vehicle control device determined to be in an abnormal state;
• wherein independent supervision of the plurality of low-integrity systems by the safety supervisor module permits operation of the control system as a high-integrity system.