Abstract: The invention relates to a method for providing a fault-tolerant global time via a time server in a distributed real-time computer system, wherein the time server comprises four components which are connected to one another via a bi-directional communication channel. At a priori defined periodic, internal synchronization times, each of the four components transmits an internal synchronization message, which is simultaneously transmitted to the other three components, from which each internal computer of a component determines a correction term for the tick counter contained in its component and corrects the reading of the local tick counter by this correction term.

Abstract: The invention relates to a method for providing a fault-tolerant global time and for the fault-tolerant transport of time-controlled messages in a distributed real-time computer system which comprises external computers and a fault-tolerant message distribution unit, FTMDU. The FTMDU comprises at least four components which supply the global time to the external computers by means of periodic external synchronization messages, wherein the external computers each set their local clock to the received global time, wherein each external sender of a time-controlled message transmits two message copies of the message to be sent via two different communication channels to two different components of the FTMDU at periodic sending times defined a priori in timetables, wherein these two message copies are delivered within the FTMDU via two independent communication paths to those two components of the FTMDU which are connected to an external receiver of the message via communication channels.

Abstract: A distributed maintainable real-time computer system is provided, wherein the real-time computer system includes at least two central computers and one, two or a plurality of peripheral computers.

Abstract: A communication node (NODE) for connecting a fault-tolerant computer (FTC) to a real-time network (NET), wherein the node receives critical application data (HCAD1, HCAD2) from computation hosts (HOST) of the fault-tolerant computer, and the node is configured to forward the critical application data as node critical application data (NCAD) to the NET. The node includes at least a first end system (ES1), a second end system (ES2) and a switch (SW), and the switch includes at least a commander part (COM), a monitor part (MON) and a comperator part (COMP). The MON and the COMP may be integrated into an integrated part (MONC). The ES1 connects to the computation hosts or a subset thereof, and the ES2 connects to the computation hosts or a subset thereof. The ES1 connects to the COM, and the ES2 connects to the MON.

Abstract: A method to configure nodes in a real-time network, which nodes are connected with links to each other directly or indirectly via other nodes and communicate with each other using said links by exchanging frames, wherein: (i) at least one node (a) associates at least one queue with at least one link, (b) is connected to said at least one queue, and (c) places frames in said at least one queue for transmission on the associated link, (ii) said at least one queue is associated with a gate which can be in an open or closed state, (iii) said at least one node selects frames that are placed in said at least one queue on the at least one link associated with said queue for transmission if the gate associated therewith is in the open state and does not select frames for transmission when said gate is in the closed state, (iv) said gate changes the state with the progress of time from open to closed and vice versa to form windows as indicated by configuration data, (v) said configuration data is produced by a tool ca

Abstract: A method for data integrity check in a network device of a computer network. The network device includes a communication module and a monitoring module. The monitoring module receives (a) the same data being received by a communication module from an input port of the network device, and (b) the same data the communication module transmits towards output port/s of the network device.

Abstract: Methods and computer systems for establishing an interactive consistency property between receivers of messages. Messages are transmitted to receivers by a sender over a communication network including disjoint communication paths for connecting receivers and sender. Switches include local clocks. Local clocks of non-faulty switches are synchronized to each other with a maximum error (precision), and receivers detect switch failures. Redundant copies of a message are forwarded by sender to each receiver across different disjoint communication paths. A switch of each disjoint path is configured such that redundant copies are forwarded to each receiver with a temporal distance between disjoint paths. That distance is selected such that all non-faulty receivers receive redundant copies in the same receive order, when the switches and communication links of the disjoint paths exhibit no failure.

Abstract: A self-checking network device (201) for communication in a real-time network, wherein the self-checking network device (201) includes at least four modules (S-COM, P-COM, P-MON, S-MON), wherein the network device (201) and/or each of the four modules is configured such that a first module (S-COM) of the at least four modules receives both regular data and protocol data from said communication links (110) on a first input (COM-IN), and said first module (S-COM) forwards protocol data on a second input (P-COM-IN) to a second module (P-COM) of the at least four modules, wherein said second module (P-COM) executes a first function (C-PU) as part of the one or the more of the network protocols using protocol data received on said second input (P-COM-IN) and produces protocol data as output on a first output (P-COM-OUT).

Abstract: A method for a determination of the optimal duration of a time slot for computational actions in a time-triggered controller. The controller includes a sensor subsystem, a computational subsystem, an actuator subsystem, and a time-triggered communication system. The time-triggered communication system is placed between the sensor subsystem, the computational subsystem, the actuator subsystem, and a monitor subsystem. An anytime algorithms is executed in the computational subsystem. A plurality of execution slot durations of the anytime algorithms is probed during the development phase, starting from the minimum execution slot duration, increasing this slot duration by the execution slot granularity until the maximum execution slot duration is reached. In each of the execution slot durations, a multitude of frames is executed in a destined application environment.

Abstract: A method for transmitting control commands in a computer system, which includes components at least in the form of nodes, actuators and communication systems, wherein the control commands are communicated over the communication systems from the nodes to the actuators, and wherein one or more of the components may fail to operate according their specification. For consistently accepting control commands at the actuators, the nodes and their control commands are assigned priorities, wherein a node and its control commands have the same priority, wherein at least two priorities are used, wherein a high priority node produces high priority control commands and a low priority node produces low priority control commands, and wherein a high priority node is configured to communicate its control commands over at least two communication systems to the actuators and a low priority node is configured to communicate its low priority control commands over at least one communication system to the actuators.

Abstract: A method for transmitting real-time messages in a computer network (100), in particular real-time computer network, wherein said network comprises two or more computing nodes (21, 22, 23, 24, 25, 26) and one or more star couplers (1, 2, 3, 4), wherein said nodes are interconnected via at least one star coupler, wherein each node is connected to at least one star coupler via at least one of the communication links (50), and wherein the nodes exchange messages (M1, M2) with one another and with the at least one star coupler, and wherein star couplers, which are synchronized to a global time base (C), transmit a first non-empty set (SSET) of real-time messages according to a synchronized communication paradigm, and/or wherein computing nodes, which are synchronized to the global time base, transmit said first non-empty set of real-time messages according to the synchronized communication paradigm, wherein a star coupler, which is not synchronized to a global time base, and/or a computing node, which is not synch

Abstract: The invention relates to a method, in particular a time controlled error-tolerant method, for periodically transporting real-time data in a computer system, in particular in a distributed computer system, said computer system comprising node computers (111-116), in particular a plurality of node computers (111-116), and distributor units (131, 132, 133, 151), in particular a plurality of distributor units (131, 132, 133, 151). The node computers and the distributor units have access to a global time, and real-time data is transported by means of messages, preferably by means of time-controlled real-time messages. The topology of the computer system corresponds to an intree, and node computers (111-116), are arranged on the leaves of the intree.

Abstract: The invention relates to a method for periodic transmission of real time data in a computer system, particularly a distributed computer system, which computer system is comprised of node computers (201-208), particularly an appreciable number of node computers (201-208), and distributor units (211-215), particularly an appreciable number of distributor units (211-215), wherein the node computers (201-208) and the distributor units (211-215) have access to a global time, and wherein real time data are transmitted by means of time-triggered real time messages, wherein selected distributor units (212, 213, 214, 215) form a central structure of distributor units; and wherein during a periodic communication round (PCR), in the error-free case, at least two copies of each real time message to be sent are transmitted via at least two independent routes through the central structure, by executing a satisfying or an optimal time plan, from a start distributor unit in the central structure to a target distributor unit

Abstract: A network device for a computer network (1), the network device (2) including communication channels (3), a PHY chip (4) configured for transmitting data in a raw data stream on the communication channels, and a MAC chip (5) configured for encapsulating data to be transmitted into frames, and for calculating a checksum for each frame. The PHY chip is configured for receiving frames of the MAC chip and transmitting transmission data contained in the frames via at least one of its communication channels. The PHY chip is configured to calculate, after receiving a frame and before sending the data of the frame in a raw data stream, a checksum of the data contained in the frame, and to this checksum with the CRC contained in the frame. The data contained in the frame are transmitted if the comparison of the checksums delivers identical values. If the comparison delivers non-identical values, then a specifiable or specified action is executed.

Abstract: The invention relates to a fault-tolerant, maintainable automation system comprising two central computers, a process periphery and gateway computers, wherein the central computers and the gateway computers are fail-silent FCUs and represent autonomous exchange units, and the central computers and gateway computers exchange timed status messages via communications channels, and wherein each gateway computer establishes the link to the process periphery associated with the gateway computer and saves the current status of the process periphery associated with the gateway computer, and wherein a central computer assumes the role of an active central computer and another central computer assumes the role of a passive central computer, and wherein the active central computer exerts control over the gateway computers, and wherein the active central computer transmits a sign-of-life message to the passive central computer, preferably periodically, and wherein the passive central computer acknowledges the receipt of

Abstract: The invention relates to a time-controlled distribution unit (30, 31) for the distribution of messages in a distributed computer system for safety-critical applications. Said distribution unit is designed as a self-testing functional unit and comprises input channels (201 . . . 222) for receiving time-controlled periodic input messages from node computers (20, 21, 22) upstream in the data flow, and output channels (301 . . . 333) for transmitting time-controlled periodic output messages to the node computers (50, 51, 52) downstream in the data flow, a computer (40) being provided in the distribution unit and being designed to analyze, by means of a “simple” software, useful information contained in the input messages, and to decide whether output messages are output and, if so, which useful information is contained in the output messages.

Abstract: A method is provided for the periodic detecting of measured values in a distributed real-time computer system, which comprises a plurality of intelligent sensors, node computers, and distribution units, wherein the intelligent sensors, the node computers, and the distribution units have access to a global time, wherein real-time data is transported in the real-time computer system by time-triggered real-time messages, wherein periodically recurring global observation instants are established or will be established in the real-time computer system at the beginning of a frame, wherein each node computer controlling a physical sensor outputs a trigger signal to the the physical sensor at a sensor-specific trigger instant of the sensor controlled by the node computer, which specific trigger instant is calculated from the difference between the global observation instant and a sensor-specific startup interval.

Abstract: A method is provided to detect and handle failures in the communication in a network, including a sender (201, 203) and a receiver (202, 501, 502, 503), where communication between the sender and the receiver is message-oriented. The method includes: (a) the sender sending a message (M101, M101-C, M102-C) to the receiver; (b) the sender monitoring the transmission process of the message inside the sender and/or monitoring the message; (c) the sender executing a correctness check of (i) the message, e.g., its contents, and/or (ii) the transmission process of the message inside the sender; and (d) after the correctness check(s) has/have been completed, the sender informs the receiver of the result of the correctness check(s), wherein (e) the receiver of the message marks the message as being faulty and/or discards the message if the result of a correctness check indicates that the message and/or transmission process is faulty.

Abstract: The invention relates to a method for deterministic wireless transfer of time-triggered real-time messages in a distributed real-time system, which real-time system comprises a plurality of node computers and one or more base stations, which are arranged in an arena, wherein all node computers and base stations have a global time, wherein one or more real-time message sequences are periodically transferred in the arena, wherein a real-time message sequence consists of a time-triggered header message with variable length and a sequence of one or more time-triggered real-time messages with a priori known length, and wherein, at an a priori determined transmission time, the software of a T-node issues, to a communication controller thereof, the command to send the header message, and wherein the communication controller of the T-node starts to send the header message as soon as no activity is determined in the arena during an IFS, and wherein the sending of the header message is aborted at an a priori determined

Abstract: The invention relates to a method for the periodic transport of real-time data in a distributed computer system, which computer system comprises node machines (100, 101, 102, 103), in particular a plurality of node machines (100, 101, 102, 103), and distributor units (121, 122), in particular a plurality of distributor units (121, 122), wherein the node machines (100, 101, 102, 103) and the distributor units (121, 122) have access to a global time, and wherein real-time data is transported by means of time-triggered real-time messages.