Abstract

A fault tolerant modular computing or communications system is disclosed. The system comprises a plurality of primary processing modules and at least one spare module. These modules are preferably interconnected with a data network to switch and process network traffic. A control processing module controls overall operation of primary and spare modules. Upon failure of a primary processing module the control module senses the failure and determines if it is a recoverable fault, by preferably resetting the failed module. If fault is not recoverable, as manifested by an unsuccessful reset in a first sparing interval, data at the failed module is switched to a spare module. If the fault is recoverable and the reset is successful, data is not switched. If a subsequent failure of that module occurs in a second stability interval, data is immediately switched to the spare module. The system is particularly well suited for distinguishing software faults from non-recoverable hardware faults.