Handling errors in an error-tolerant distributed computer system

• US 20040030949A1
• Filed: 08/13/2003
• Published: 02/12/2004
• Est. Priority Date: 10/10/2000
• Status: Active Grant

• Current Assignee: TTTech Computertechnik AG
• Original Assignee: FTS Computertechnik GmbH
• Inventors: Bauer, Gunther, Kopetz, Hermann
• Granted Patent: US 7,124,316 B2
• Time in Patent Office: Days
• US Class Current: 714/4
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/16 Error detection or correction of the data by redundancy in hardware
• CPC Class Codes: G06F 2201/805 Real-time

Abstract

Method of dealing with faults in a fault-tolerant distributed computer system, as well as such a system, with a plurality of node computers (K1 . . . K4) which are connected by means of communication channels (c11 . . . c42) and access to the channels takes place according to a cyclic time slicing method. Messages leaving node computers (K1 . . . K4) are checked by independently formed guardians (GUA) which convert a message burdened with an SOS (“slightly off specification”) fault either into a correct message or into a message which can be recognised by all node computers as clearly incorrect.

Claims

1. Method of dealing with faults in a fault-tolerant distributed computer system with a plurality of node computers (K1 . . . K4) which are connected by means of communication channels (c11 . . . c42) and each node computer has an autonomous communication control unit (CON) wherein access to the communication channels takes place according to a cyclic time slicing method and the correctness of messages leaving the node computers is checked by guardians (GUA) and characterised in that the independently formed guardians (GUA) convert a message burdened with an SOS (“

slightly off specifications”

) fault either into a correct message or into a message which can be recognised by all receiving node computers (K1 . . . K4) as clearly incorrect.

2. Method according to claim 1 characterised in that each independent guardian (GUA) with the support of its independent time basis checks whether the start of a message sent by the communication control unit (CON) of a node computer (K1 . . . K4) falls within the start time window (T_GUA) of the message known a prior to the guardian (GUA) and which immediately closes the corresponding communication channel (c11 . . . c42) if the message lies outside of this time window in order that an incomplete message which can be recognised by all receiving node computers as incorrect is formed.

3. Method according to claim 1 or 2 characterised in that a guardian (GUA) regenerates the incoming physical signal of each message in the time domain and value domain taking into consideration the relevant coding regulations and using its local time basis and its local power supply.

4. Method according to one of the claims 1 to 3 characterised in that a guardian (GUA) not receiving any messages does not generate any messages with correct CRC and correct length.

5. Method according to one of the claims 2 to 4 characterised in that the start time window (T_GUA) of a guardian (GUA) starts by more than the precision (P) of the system after the start time window (T_CON) of a cost computer (K1 . . . K4) and the start time window of a guardian ends by more than the precision before the start time window of a node computer.

8. Computer system according to claim 5 or 6 characterised in that a guardian (GUA) is adapted to regenerate the incoming physical signal of each message in the time domain and value domain taking into consideration the relevant coding regulations and using its local time basis and its local power supply.

6. Fault-tolerant distributed computer system with a plurality of node computers (K1 . . . K4) which are connected to each other by at least one distributor unit (V1, V2) and communication channels (c11 . . . c42), each node computer has an autonomous communication control unit (CON), access to the communication channels takes place according to a cyclic time slicing method and guardians (GUA) are provided for the purpose of checking the messages leaving the node computers characterised in that the independently formed guardians (GUA) are adapted to convert a message burdened with an SOS (“

slightly off specifications”

) fault either into a correct message or into a message which can be recognised by all receiving node computers (K1 . . . K4) as clearly incorrect.

7. Computer system according to claim 6 characterised in that a guardian (GUA) has an independent time basis and is adapted to check whether the start of a message sent by the communication control unit (CON) of a node computer (K1 . . . K4) falls within the start time window (T_GUA)of the message known a priori to the guardian (GUA) as well as to immediately close the corresponding communication channel (c11 . . . c42) if the message lies outside of this time window in order that an incomplete message is formed which can be recognised by all receiving node computers as incorrect.

9. Computer system according to one of the claims 6 to 8 characterised in that a guardian (GUA) is adapted, in the event of its not receiving a message, to not generate any messages with correct CRC and correct length either.

10. Computer system according to one of the claims 6 to 9 characterised in that the beginning of the start time window (T_CON) of a node computer (K1 . . . K4) lies by more than the precision (P) of the system before the beginning of the start time window (T_GUA) of a guardian and the end of the start time window of a guardian lies by more than the precision before the end of the start time window of a cost computer.

11. Computer system according to one of the claims 6 to 10 characterised in that the guardians (GUA) are integrated into the distributor unit (V1, V2), of which there is at least one, and the distributor unit has an independent power supply and independent fault-tolerant distributed chock synchronisation.