a dual - processing unit with single clock source cpus safety i / o module having a safety timer crosscheck diagnostic to enable each cpu to verify the accuracy of the clock source of the other cpu . the diagnostic works by having the first cpu act as a controlling cpu and the second cpu act as a monitoring cpu . both cpus are synchronized to begin one cycle of their respective safety functions at the same time . as part of the diagnostic , the controlling cpu is set to be interrupted after a pre - determined time period while the monitoring cpu is set to be interrupted slightly after that . when the controlling cpu is interrupted after the pre - determined time has passed as determined by that cpu &# 39 ; s clock source , it sends a signal to the monitoring cpu which then verifies that the perceived time is within an expected range . to verify that the clock source of the monitoring cpu is accurate , the first cpu swaps roles to become the monitoring cpu while the second cpu becomes the controlling cpu . the cpus are loaded again and execute one cycle of their respective safety functions . the first , now monitoring , cpu then ensures the accuracy of the clock source of the second , now controlling , cpu .