Actually, I know nothing about the subject; Please don't take my comments as such. Sorry, I should have made that clear. About the first proposal: redundancy u

Actually, I know nothing about the subject; Please don't take my comments as such. Sorry, I should have made that clear. About the first proposal: redundancy using majority of votes is well known. Second, GP said: > There’s a separate watchdog system that monitors the outputs (orders) of both the COM and MON, and if their order values diverge by too much for too long, it shuts down the COM computer and passes control to the MON computer and the spare. What I read from this is: COM differs from MON; watchdog disables COM and uses MON and spare as a new COM/MON. But if previous MON was faulty, it will still differ from spare (except if both are failing in a sufficiently similar way).