| 摘要 |
PCT No. PCT/EP91/01020 Sec. 371 Date Apr. 6, 1993 Sec. 102(e) Date Apr. 6, 1993 PCT Filed Jun. 3, 1991 PCT Pub. No. WO92/03785 PCT Pub. Date Mar. 5, 1992.As soon as the computers of a two-out-of-three computer system arrive in their program run at a synchronization point, they interrupt the execution of the program run and transmit synchronization-readiness signals to the partner computers. The program run is continued at the same time in all computers, when synchronization-readiness signals from all three computers are present in these allocated synchronization modules. If a synchronization-readiness signal fails to appear, then this is detected by a time monitoring device of the synchronization module allocated to the computer which has become unsynchronized. After its established time span has expired, this synchronization module stops the computer from accessing the interface system relevant to security and transmits pseudo-synchronization-readiness signals to the other computers, which permanently simulate the synchronization capability of the failed computer there. The computer system then continues to work in the two-out-of-two mode. Should the time monitoring device fail, the time monitoring devices, which are adjusted to longer delay times, become effective in all synchronization modules and disconnect the computer system. |
