Time-triggered communication control unit and communication method

Claim 3

The method of claim 1 including the step of: marking, with a receiving communication control unit, a fault-tolerant unit (FTU 1 , FTU 2 , FTU 3 , FTU 4 ) as faulty by setting the corresponding bit in its membership field to FALSE, if none of the expected messages with a correct CRC field (CRC) has been received in the timeslots that have been assigned to this sending unit.

Claim 4

The method of claim 1 including the step of: providing, in the control field (310), as a first bit, an initialization bit (311) for specifying whether the message is an initialization message or a normal message.

Claim 5

The method of claim 1 including the step of: providing, in the control field (310), a number of acknowledgment bits (313), by the means of which the correct receipt of one or more of the preceding messages is acknowledged, in order that each receiving communication control unit can determine by checking the control field of an incoming message, whether all its communication ports have been operational and whether it is a member of the majority of the set of operating communication control units by comparing the number of correctly received messages with the number of messages that were discarded because of failed CRC checks during the last time division multiple access cycle.

Claim 6

The method according to claim 3 including the step of: providing, in the control field (310), a number of mode change bits (312).

Claim 7

The method according to claim 1 including the step of: providing a mode field in the local internal state, which is included in the calculation of the CRC field of normal messages, and which is checked by the receiver.

Claim 8

The method according to claim 1 including the step of: deriving the message name from the prior determined point in time of sending and receiving the message, thus eliminating the need to carry a message-name field in the message.

Claim 9

The method according to claim 1 including the step of: establishing a global timebase in a distributed manner in each communication control unit; and determining the differences between the states of the clocks in the fault-tolerant units (FTU 1 , FTU 2 , FTU 3 , FTU 4 ) on the basis of the a priori known points in time of sending a message and the locally measured points in time of receiving a message.

Claim 10

The method according to claim 1 including the step of: providing, for every logical message to be sent, a plurality of replicated physical message transmissions systematically interleaved with other replicated physical message transmissions of a predetermined number of other logical messages on the replicated communication channels in such a prior determined pattern that a correlated transmission error of known length that effects both channels can only mutilate such a subset of the replicated physical message transmissions that the communication between the FTUs is not disrupted.

Claim 11

A communication control unit for the transmission of messages within a distributed real-time computer architecture with a global time base, comprising a plurality of fault-tolerant units (FTU 1 , FTU 2 , FTU 3 , FTU 4 ), each fault-tolerant unit (FTU) containing at least one fail-silent computer (A,B,C) and each computer having a communication control unit with at least one communication port, whereby each fault-tolerant unit (FTU 1 , FTU 2 , FTU 3 , FTU 4 ) is connected to a communication bus (101,102) with every other fault-tolerant unit (FTU 1 , FTU 2 , FTU 3 , FTU 4 ), the access to the communication bus (101,102) being determined by a cyclic time division multiple access scheme which is derived from a global time base, the communication control unit being realized as single chip control unit or as part of a single chip microcomputer, the communication control unit including means to construct the messages to be transmitted from a control field (310), a data field (320) and a CRC (Cyclic Redundancy Check) field (331,332), the contents of the CRC field of normal messages, identified by a specified bit (311) of the control field (310), being calculated over the concatenation of the control field (310), the data field (320) and the local internal state of a sending communication control unit and the communication control unit comprising means for maintaining a local internal state of the communication control unit that is composed of the concatenation of the current global time with a membership field, in which each fault-tolerant unit (FTU 1 , FTU 2 , FTU 3 , FTU 4 ) is represented by a specified bit, in which the value TRUE means that said fault-tolerant unit is operating and the value FALSE means that said fault-tolerant unit is faulty, and a receiving communication control including means to perform a CRC-check on the incoming messages in order to detect a mutilated message as well as a deviation of the internal state of the receiving from the internal state of the sending communication control unit.

Claim 12

A communication control unit for the transmission of messages within a distributed real-time computer architecture with a global time base, comprising a plurality of fault-tolerant units (FTU 1 , FTU 2 , FTU 3 , FTU 4 ), each fault-tolerant unit (FTU) containing at least one fail-silent computer (A,B,C) and each computer having a communication control unit with at least one communication port, whereby each fault-tolerant unit (FTU 1 , FTU 2 , FTU 3 , FTU 4 ) is connected to a communication bus (101,102) with every other fault-tolerant unit (FTU 1 , FTU 2 , FTU 3 , FTU 4 ), the access to the communication bus (101,102) being determined by a cyclic time division multiple access scheme which is derived from a global time base, the communication control unit being realized as single chip control unit or as part of a single chip microcomputer, the communication control unit including means to construct the messages to be transmitted from a control field (310), a data field (320) and a CRC (Cyclic Redundancy Check) field (331,332), the contents of the CRC field of normal messages, identified by a specified bit (311) of the control field (310), being calculated over the concatenation of the control field (310), the data field (320) and the local internal state of a sending communication control unit and the communication control unit comprising means for maintaining a local internal state of the communication control unit that is composed of the concatenation of the current global time with a membership field, in which each fault-tolerant unit (FTU 1 , FTU 2 , FTU 3 , FTU 4 ) is represented by a specified bit, in which the value TRUE means that said fault-tolerant unit is operating and the value FALSE means that said fault-tolerant unit is faulty, and a receiving communication control including means to perform a CRC-check on the incoming messages in order to detect a mutilated message as well as a deviation of the internal state of the receiving from the internal state of the sending communication control unit.

Claim 13

The communication control unit of claim 10 comprising two counters, one for counting the received messages with a correct CRC field and another one for counting the received messages with an erroneous CRC field.

Claim 14

The communication control unit of claim 10 comprising means to perform a mode change as soon as a message from another fault-tolerant unit (FTU 1 , FTU 2 , FTU 3 , FTU 4 ) is received in which a respective bit in the mode field is set.

Claim 15

The communication control unit of claim 10 comprising means to measure the difference between the prior known point in time of expected arrival of a message and the actual point in time of receiving this message.

Claim 18

A communication control unit for the transmission of messages within a distributed real-time computer architecture having a global time base, said architecture comprising a plurality of fault-tolerant units, each fault-tolerant unit containing at least one fail-silent computer and each micro-computer having a communication control unit with at least one communication port, a communication bus, each fault-tolerant unit being connected to said communication bus, the access to the communication bus being determined by a cyclic time division multiple access scheme which is derived from the global time base, the communication control unit being realized as single chip control unit or as part of a single chip microcomputer, the communication control unit including means to construct the messages to be transmitted from a control field, a data field and a CRC (Cyclic Redundancy Check) field, the contents of the CRC field of normal messages, identified by a specified bit of the control field, being calculated over the concatenation of the control field, the data field and the local internal state of a sending communication control unit, the communication control unit further comprising means for maintaining a local internal state of the communication control unit that is composed of the concatenation of the current global time with a membership field, in which each fault-tolerant unit is represented by a specified bit, the TRUE value of which means that said fault-tolerant unit is operating and the FALSE value of which means that said fault-tolerant unit is faulty, and a receiving communication control unit including means to perform a CRC-check on the incoming messages by using its internal state in order to detect a mutilated message as well as a deviation of the internal state of the receiving communication control unit from the internal state of the sending communication control unit.

Claim 19

A communication control unit for the transmission of messages within a distributed real-time computer architecture having a global time base, said architecture comprising a plurality of fault-tolerant units, each fault-tolerant unit containing at least one fail-silent computer and each micro-computer having a communication control unit with at least one communication port, a communication bus, each fault-tolerant unit being connected to said communication bus, the access to the communication bus being determined by a cyclic time division multiple access scheme which is derived from the global time base, the communication control unit being realized as single chip control unit or as part of a single chip microcomputer, the communication control unit including means to construct the messages to be transmitted from a control field, a data field and a CRC (Cyclic Redundancy Check) field, the contents of the CRC field of normal messages, identified by a specified bit of the control field, being calculated over the concatenation of the control field, the data field and the local internal state of a sending communication control unit, the communication control unit further comprising means for maintaining a local internal state of the communication control unit that is composed of the concatenation of the current global time with a membership field, in which each fault-tolerant unit is represented by a specified bit, the TRUE value of which means that said fault-tolerant unit is operating and the FALSE value of which means that said fault-tolerant unit is faulty, and a receiving communication control unit including means to perform a CRC-check on the incoming messages by using its internal state in order to detect a mutilated message as well as a deviation of the internal state of the receiving communication control unit from the internal state of the sending communication control unit.