Fault tolerant system employing majority voting

Claim 2

A fault tolerant system in which input signals are supplied to a plurality of redundant subsystems and output signals from the subsystems are supplied to an output selecting circuit after a self-diagnosis and a data comparison among each subsystem are executed in each subsystem, respectively, and the output selecting circuit outputs a selected signal by a method of majority voting based on output signals from the subsystems, the method of majority voting being characterized by: selecting at first an output signal having a reliability based on the lowest probability of defective report rate from a subsystem in which abnormality is not detected as a result of the self-diagnosis and whose data comparison with another subsystem results in coincidence; selecting an output signal of a subsystem which has a second-highest output reliability based on the second-lowest probability of defective report rate in accordance with the self-diagnosis and the data comparison in an absence of a subsystem which is most reliable; and selecting an output signal of a subsystem which has a next lower output reliability based on a higher probability of defective report rate in accordance with the self-diagnosis and the data comparison in an absence of a subsystem which has the second-highest output reliability.

Claim 3

A fault tolerant system in which input signals are supplied to a plurality of redundant subsystems and output signals from the subsystems are supplied to an output selecting circuit after a self-diagnosis and a data comparison among each subsystem are executed in each subsystem, respectively, and the output selecting circuit outputs a selected signal by a method of majority voting based on output signals from the subsystems, the method of majority voting being characterized by: selecting at first a most reliable output signal from a subsystem which is decided as normal as a result of the self-diagnosis and whose data comparison with other subsystems coincides with each other as a result of the data comparison; selecting an output signal of a subsystem having a second-highest output reliability in which a comparison with other subsystems coincides with each other in an absence of a subsystem of the highest reliability; and selecting an output signal of a subsystem having a third-highest output reliability which is decided as normal as a result of the self-diagnosis in an absence of a subsystem which has the second-highest output reliability.

Claim 4

A fault tolerant system in which input signals are supplied to a plurality of redundant subsystems and output signals from the subsystems are supplied to an output selecting circuit after a self-diagnosis and a data comparison among each subsystem are executed in each subsystem, respectively, and the output selecting circuit outputs a selected signal by a method of majority voting based on output signals from the subsystems, the method of majority voting being characterized by: selecting at first a most reliable output signal from a subsystem which is decided as normal as a result of the self-diagnosis and whose data comparison with other subsystems coincides with each other as a result of the data comparison; selecting an output signal of a subsystem having a second-highest output reliability in which a comparison with other subsystems coincides with each other in an absence of a subsystem of the highest reliability; and selecting an output signal of a subsystem having a third-highest output reliability which is decided as normal as a result of the self-diagnosis in an absence of a subsystem which has the second-highest output reliability.

Claim 5

A fault tolerant system in which input signals are supplied to a plurality of redundant subsystems and output signals from the subsystems are supplied to an output selecting circuit after a self-diagnosis and a data comparison among each subsystem are executed in each subsystem, respectively, and the output selecting circuit outputs a selected signal by a method of majority voting based on output signals from the subsystems, the method of majority voting being characterized by: selecting at first a most reliable output signal from a subsystem which is decided that a bit error is not involved as a result of the self-diagnosis and whose data comparison with other subsystems coincides with each other as a result of the data comparison; selecting an output signal of a subsystem which has a second-highest output reliability based on judgments that an error of 2 or more bits is not involved as a result of the self-diagnosis and a data comparison with other subsystems coincides with each other as a result of the data comparison in an absence of a subsystem which is most reliable; selecting an output signal of a subsystem which has a third-highest output reliability based on a judgment that a data comparison with other subsystems coincide with each other as a result of the data comparison in an absence of a subsystem which has the second-highest output reliability; selecting an output signal of a subsystem which has a fourth-highest output reliability based on a judgment that a bit error is not involved as a result of the self-diagnosis in an absence of a subsystem which has the third-highest output reliability; and selecting an output signal of a subsystem which has a fifth-highest output reliability based on a judgment that an error of 2 or more bits is not involved as a result of the self-diagnosis in an absence of a subsystem which has the fourth-highest output reliability.

Claim 6

A fault tolerant system in which input signals are supplied to a plurality of redundant subsystems and output signals from the subsystems are supplied to an output selecting circuit after a self-diagnosis and a data comparison among each subsystem are executed in each subsystem, respectively, and the output selecting circuit outputs a selected signal by a method of majority voting based on output signals from the subsystems, the method of majority voting being characterized by: selecting at first a most reliable output signal from a subsystem which is decided that a bit error is not involved as a result of the self-diagnosis and whose data comparison with other subsystems coincides with each other as a result of the data comparison; selecting an output signal of a subsystem which has a second-highest output reliability based on judgments that an error of 2 or more bits is not involved as a result of the self-diagnosis and a data comparison with other subsystems coincides with each other as a result of the data comparison in an absence of a subsystem which is most reliable; selecting an output signal of a subsystem which has a third-highest output reliability based on a judgment that a data comparison with other subsystems coincide with each other as a result of the data comparison in an absence of a subsystem which has the second-highest output reliability; selecting an output signal of a subsystem which has a fourth-highest output reliability based on a judgment that a bit error is not involved as a result of the self-diagnosis in an absence of a subsystem which has the third-highest output reliability; and selecting an output signal of a subsystem which has a fifth-highest output reliability based on a judgment that an error of 2 or more bits is not involved as a result of the self-diagnosis in an absence of a subsystem which has the fourth-highest output reliability.

Claim 7

A fault tolerant system in which input signals are supplied to a plurality of redundant subsystems and output signals from the subsystems are supplied to an output selecting circuit after a self-diagnosis and a data comparison among each subsystem are executed in each subsystem, respectively, and the output selecting circuit outputs a selected signal by a method of majority voting based on output signals from the subsystems, the method of majority voting being characterized by: selecting at first a most reliable output signal from a subsystem in which abnormality is not detected as a result of the self-diagnosis and whose data comparison with other subsystems coincides with each other as a result of the data comparison; selecting an output signal of a subsystem which has a second-highest output reliability based on the self-diagnosis in an absence of a subsystem which is most reliable; and selecting an output signal of a subsystem which has a third-highest output reliability based on a judgment that a data comparison with another subsystems coincides with each other as a result of the data comparison in an absence of a subsystem which has the second-highest output reliability.

Claim 8

A fault tolerant system in which input signals are supplied to a plurality of redundant subsystems and output signals from the subsystems are supplied to an output selecting circuit after a self-diagnosis and a data comparison among each subsystem are executed in each subsystem, respectively, and the output selecting circuit outputs a selected signal by a method of majority voting based on output signals from the subsystems, the method of majority voting being characterized by: selecting at first a most reliable output signal from a subsystem in which abnormality is not detected as a result of the self-diagnosis and whose data comparison with other subsystems coincides with each other as a result of the data comparison; selecting an output signal of a subsystem which has a second-highest output reliability based on the self-diagnosis in an absence of a subsystem which is most reliable; and selecting an output signal of a subsystem which has a third-highest output reliability based on a judgment that a data comparison with another subsystems coincides with each other as a result of the data comparison in an absence of a subsystem which has the second-highest output reliability.

Claim 9

A fault tolerant system in which input signals are supplied to a plurality of redundant subsystems and output signals from the subsystems are supplied to an output selecting circuit after a self-diagnosis and a data comparison among each subsystem are executed in each subsystem, respectively, and the output selecting circuit outputs a selected signal by a method of majority voting based on output signals from the subsystems, the method of majority voting being characterized by: selecting at first an output signal having a reliability based on the lowest probability of defective report rate from a subsystem in which abnormality is not detected as a result of the self-diagnosis and whose data comparison with other subsystems coincides with each other as a result of the data comparison; selecting an output signal of a subsystem which has a second-highest output reliability based on the second-lowest probability of defective report rate and whose reliability is higher than a desired value based on the self-diagnosis and the data comparison in an absence of a subsystem which is most reliable; and selecting an output signal of a subsystem which has a next lower output reliability based on a higher probability of defective report rate and whose probability of defective report rate is lower than a desired value based on the self-diagnosis and the data comparison in an absence of a subsystem which has the second-highest output reliability.

Claim 10

A fault tolerant system in which input signals are supplied to a plurality of redundant subsystems and output signals from the subsystems are supplied to an output selecting circuit after a self-diagnosis and a data comparison among each subsystem are executed in each subsystem, respectively, and the output selecting circuit outputs a selected signal by a method of majority voting based on output signals from the subsystems, the method of majority voting being characterized by: selecting at first an output signal having a reliability based on the lowest probability of defective report rate from a subsystem in which abnormality is not detected as a result of the self-diagnosis and whose data comparison with other subsystems coincides with each other as a result of the data comparison; selecting an output signal of a subsystem which has a second-highest output reliability based on the second-lowest probability of defective report rate and whose reliability is higher than a desired value based on the self-diagnosis and the data comparison in an absence of a subsystem which is most reliable; and selecting an output signal of a subsystem which has a next lower output reliability based on a higher probability of defective report rate and whose probability of defective report rate is lower than a desired value based on the self-diagnosis and the data comparison in an absence of a subsystem which has the second-highest output reliability.

Claim 11

A fault tolerant system in which input signals are supplied to a plurality of redundant subsystems and output signals from the subsystems are supplied to an output selecting circuit after a self-diagnosis and a data comparison among each subsystem are executed in each subsystem, respectively, and the output selecting circuit outputs a selected signal by a method of majority voting based on output signals from the subsystems, the method of majority voting being characterized by: selecting at first a most reliable output signal from a subsystem in which abnormality is not detected as a result of the self-diagnosis and whose data comparison with another subsystem coincides with each other as a result of the data comparison; selecting an output signal of a subsystem which has a second-highest output reliability based on the self-diagnosis and the data comparison in an absence of a subsystem which is most reliable; and selecting an output signal of a subsystem which has a next lower output reliability based on the self-diagnosis and the data comparison in absence of a subsystem which has the second-highest output reliability, wherein data processes at said subsystems are treated by different programs, respectively, using a N-version program.

Claim 12

A fault tolerant system in which input signals are supplied to a plurality of redundant subsystems and output signals from the subsystems are supplied to an output selecting circuit after a self-diagnosis and a data comparison among each subsystem are executed in each subsystem, respectively, and the output selecting circuit outputs a selected signal by a method of majority voting based on output signals from the subsystems, the method of majority voting being characterized by: selecting at first a most reliable output signal from a subsystem in which abnormality is not detected as a result of the self-diagnosis and whose data comparison with another subsystem coincides with each other as a result of the data comparison; selecting an output signal of a subsystem which has a second-highest output reliability based on the self-diagnosis and the data comparison in an absence of a subsystem which is most reliable; and selecting an output signal of a subsystem which has a next lower output reliability based on the self-diagnosis and the data comparison in absence of a subsystem which has the second-highest output reliability, wherein data processes at said subsystems are treated by different programs, respectively, using a N-version program.

Claim 13

A fault tolerant system in which input signals are supplied to a plurality of redundant subsystems and output signals from the subsystems are supplied to an output selecting circuit after a self-diagnosis and a data comparison among each subsystem are executed in each subsystem, respectively, said output selecting circuit including means for outputting a selected signal by majority voting based on the output signals from the subsystems so that an output signal is selected form a subsystem having the highest reliability Rd of the following: (1) Rd=1-P.sub.ε.sup.K ·P.sub.dε.sup.K ·P.sub.aε.sup.K-1 (2) Rd=1-P.sub.68.sup.K ·P.sub.aε.sup.K-1 (3) Rd=1-P.sub.ε.sup.K ·P.sub.dε.sup.K where Pdε is defective report rate, Paε is the probability at which erroneous data items agree, Pε is the probability at which error occurs and K is the number of subsystems determined to be normal.

Claim 14

A fault tolerant system in which input signals are supplied to a plurality of redundant subsystems and output signals from the subsystems are supplied to an output selecting circuit after a self-diagnosis and a data comparison among each subsystem are executed in each subsystem, respectively, said output selecting circuit including means for outputting a selected signal by majority voting based on the output signals from the subsystems so that an output signal is selected form a subsystem having the highest reliability Rd of the following: (1) Rd=1-P.sub.ε.sup.K ·P.sub.dε.sup.K ·P.sub.aε.sup.K-1 (2) Rd=1-P.sub.68.sup.K ·P.sub.aε.sup.K-1 (3) Rd=1-P.sub.ε.sup.K ·P.sub.dε.sup.K where Pdε is defective report rate, Paε is the probability at which erroneous data items agree, Pε is the probability at which error occurs and K is the number of subsystems determined to be normal.