Reconfiguration stategies for the SIFT fault-tolerant computer

We describe methods for achieving an acceptable level of fault-tolerance in a multiprocessor designed for the execution of critical flight tasks on commercial aircraft. The SIFT (Software Implemented Fault-tolerant) system differs from other reliable computer architectures in the manner of utilization of redundant resources. The SIFT system is designed to cope with hardware faults by detecting discrepancies in the results computed by separately executed versions of critical programs. When such a discrepancy occurs we identify the processor/memory unit, bus unit, or processor/bus interface that has failed. A reconfiguration of task execution among the available resources is carried out to avoid the use of hardware units that have been identified as faulty or unreliable. We explain how the identification of faulty units can be effected, how the system may be reconfigured to avoid use of faulty units, and show that these reconfiguration policies are "safe" with respect to faults that do not occur in separated units during the short interval required to carry out the reconfiguration of tasks.