Externally, individual systems provides a single candidate control output, the local leader. At the switch box, votes from each computer are resolved to allow one of the local leaders to become the global leader and it is placed in control of the pendulum. This allows upgrade and testing of individual controllers. It also permits protection against software bugs without the necessity of continuous operation of all systems. Output from all running controllers is checked analytically and any controller rated as failing the set of empirically-derived safety rules is placed offline automatically.
Voting is handled by the individual control computers.
In addition to allowing output from the global leader to control the pendulum, the switchbox also returns the output signal to all systems for monitoring. Each system monitors the control output of the global leader and votes on the validity of its output. The global leader's system invalidates its lead controller. Leaders may vote against themselves when self-checking invalidates all running controllers. More frequently, a system votes against itself during initialization or finalization.