Patent ID: 7721149

Claim:
A method for checking a system requiring a high level of operational safety for transportation, comprising at least two computers each with secure outputs configured to adopt one of a restrictive state and a permissive state, the restrictive state being an intrinsically safe state, said computers configured to exchange data with each other, each intrinsically safe computer having the same calculation program to determine output states S A , one computer being a master computer and the other being a slave computer, wherein the two computers are equipped with securitization means to detect their own operating failure, and wherein, if a failure of the master computer is detected, the master computer becomes the slave, said method comprising: a) a redundant operating mode in which each of the computers calculates the outputs states, the redundant operating mode comprising: receiving output states S B determined by the other computer, comparing, for each output, the states determined by the two computers, detecting a state of divergent operation if the two computers have determined two different states for a single secure output, and if a divergence is detected for at least one secure output, determining the state of said divergent output by preventing any transition from a restrictive state to a permissive state, b) a temporary operating mode in a stand-alone mode, wherein: if a state of divergence persists beyond an initial predetermined duration k, operation of the computers switches to the stand-alone mode in which the master computer stops taking into account output states of the slave computer and the slave computer no longer generates any external outputs, for the slave computer, the stand-alone mode is a mode used to ensure consistency with the master computer, wherein, in the stand-alone mode, the slave computer receives input and context data from the master computer, calculates the output states S A using the data from the master computer, compares the output states S A calculated with the output states S B of the master computer and detects whether a state of convergence exists in which all of the output states determined by the slave computer correspond to the output states of the master computer, and in order to return to operation in the redundant mode, the slave computer requests that the master computer switch to the redundant mode, the switch to the redundant mode being possible only if the slave computer requests the switch to the redundant mode once the slave computer has detected that the slave computer is convergent with output states of the master computer.