Fault tolerant control system

1. A fault tolerant data processing system for controlling a real time process, said system being tolerant to systematic faults in its software, said system comprising:

a data processor unit with a program memory and a data memory and input and output units where program software residing in the program memory can be executed on the data processor unit

a normal-mode software program residing in said program memory,

a backup-mode software program also residing in said program memory arranged to perform the same or similar function of the normal mode software program but being differently implemented than the normal-mode software program, wherein a trigger signal received by the data processor unit can switch execution control such that the normal-mode software program stops executing and the backup-mode software program starts executing,

a backup activation system comprising a plurality of activation units, wherein the activation units are implemented in the normal-mode software program, wherein the activation units are operative to issue an error signal upon discovery of an error, and

a voter unit connected to the data processor unit, wherein each activation unit is connected to the voter unit, wherein the voter unit is configured to issue the trigger signal to interrupt the real time process when a majority of the activation units issue the error signal.

2. The system according to claim 1 , wherein the backup-mode software program is differently implemented than the normal mode software program by using different algorithms or different control laws.

3. The system according to claim 1 , wherein the backup-mode software program is differently implemented than the normal mode software program by using a different software design, programming language, different compilers, or different linkage editors.

4. The system according to claim 1 , wherein said switch of execution control is implemented by letting the trigger signal trigger a Non-Maskable Interrupt which subsequently transfers execution control to the backup-mode software program.

5. The system according to claim 1 , wherein said switch of execution control is implemented by activating a Reset subroutine and subsequently forcing execution control to the backup-mode software program.

6. The system according to claim 1 , wherein said backup-mode software comprises software instructions for reading and updating process data from the input unit before performing process control via the output unit.

7. The system according to claim 1 , wherein process data is stored in more than one place in the data memory and is protected against undetected corruption by a checksum or an error correcting code.

8. The system according to claim 1 , wherein the system is a control system of a vehicle.

9. A method for activating a backup mode software program in a real time process of a system that is tolerant to systematic faults in the software of the system, the method comprising:

connecting a voter unit to a data processor,

running detection software with a backup activation system comprising a plurality of activation units, wherein the activation units are implemented in a normal-mode software program, wherein each activation unit is connected to the voter unit,

detecting a fault in said system running the normal-mode software program,

issuing an error signal with the activation units upon discovery of an error,

determining with the voter unit if a triggering signal should be sent to interrupt the process,

issuing the trigger signal with the voter unit to interrupt the real time process with the activation units when a majority of the activation units issue the error signal,

triggering an interruption to the running normal-mode software, and

switching execution such that the normal-mode software program stops executing and a backup-mode software program starts executing, wherein the backup-mode software program performs the same or similar function of the normal mode software program but being differently implemented than the normal-mode software program.

10. The method for activating a backup function according to claim 9 , further comprising:

synchronizing the backup mode software program by retrieving parameters and storing the parameters in a safe storage of the control system.

11. The method for activating a backup function according to claim 10 , further comprising after the system has been interrupted:

retrieving the parameters from the safe storage; and

checking by checksums that the parameters are reliable.

12. The method for activation a backup function according to claim 9 , wherein the system is a control system of a vehicle.

13. A fault tolerant real time data processing system, comprising:

a number of dissimilar hardware replicas of data processing units executing the same software, said software being divided into normal mode software program and backup mode software arranged to perform the same or similar function of the normal mode software program but being differently implemented than the normal-mode software program and where switching from executing normal mode software program to executing backup mode software is initiated by a backup activation system comprising a plurality of activation units, wherein the activation units are implemented in the normal-mode software program, wherein the activation units are operative to issue an error signal upon discovery of an error, and a voter unit connected to the data processor units to determine an output from said data processing units, wherein each activation unit is connected to the voter unit, wherein the voter unit is configured to issue a trigger signal to interrupt the real time process when a majority of the activation units issue the error signal.

14. The system according to claim 13 , wherein the output voter is arranged to use a choice of majority in order to determine the output from said data processing units.

15. The system according to claim 13 , wherein said system is a control system of a vehicle.

16. A computer program product, comprising:

a non-transitory computer readable medium; and

computer program instructions recorded on the computer readable medium and executable by a data processor unit for a real time data processing system, said computer program instructions, when executed in said data processor unit, being able to carry out a method comprising

connecting a voter unit to a data processor,

running detection software with a backup activation system comprising a plurality of activation units, wherein the activation units are implemented in a normal-mode software, wherein each activation unit is connected to the voter unit,

detecting a fault in said system running a normal-mode software program,

issuing an error signal with the activation units upon discovery of an error,

determining with the voter unit if a triggering signal should be sent to interrupt the process,

issuing the triggering signal with the voter unit to interrupt the real time process with the activation units when a majority of the activation units issue the error signal,

triggering an interruption to the running normal-mode software, and

switching execution such that the normal-mode software program stops executing and a backup-mode software program starts executing, wherein the backup-mode software program performs the same or similar function of the normal mode software program but being differently implemented than the normal-mode software program.