KR100433649B1 - Method for imposing the fail-silent characteristic in a distributed computer system and distribution unit in such a system - Google Patents

Abstract

Fault Tolerance A method for implementing a fault-stop attribute in the time domain of a telecommunications computer 111,... 114 of a distributed computer system is provided in which a plurality of telecommunications computers are configured to operate the distributor unit 101, 102. Connected through, each remote computer has an independent communication controller corresponding to the connection to its communication channel 121, and access to the communication channel is done according to a periodic time division multiple access method. At least one distributor unit ensures that the remote computer can only transmit to another remote computer within a statically allocated time slice by the correct transmission operation of the remote computer whose priorities (execution priorities) are known.

Description

METHODS FOR IMPOSING THE FAIL-SILENT CHARACTERISTIC IN A DISTRIBUTED COMPUTER SYSTEM AND DISTRIBUTION UNIT IN SUCH A SYSTEM}

Safety-critical technical applications, especially those where failure can lead to disaster, tend to be increasingly managed by distributed embedded real-time computer systems.

In a built-in real-time computer system consisting of multiple telecommunication computers and a real time communication system, failure of the remote computer must be allowed. At the heart of this computer architecture is a built-in, real-time communication system for exchanging messages quickly and safely, as expected.

One communication protocol that meets this need is described in EP 0 658 275 A (WO 94/06080). This protocol is known in the art under the name “TTP / Time-Triggered Protocol / C (TTP / C) Protocol”, which is a well-known technique having time-slices built up prior to it. It is based on the periodic time division multiple access method. The TTP / C protocol uses the intrinsic resolution time synchronization method disclosed in US Pat. No. 4,866,606.

The TTP / C protocol allows the communication system to support a logical broadcast topology, and from the point of view the telecommunications computers “fail-silence” (kopetz, p.121) the disturbance operation, ie the range of values by the remote computer. B indicates correct operation in the time domain or idle state. This is described in Kopetz, H. (1997), "Real-Time Systems, Design Principles for Distributed Embedded Applications"; ISBN: 0-7923-9894-7, Boston, Kluwer Academic Publishers. Obstacles in the time domain, so-called "babbling idiot" disorders (Kopetz, p. 130, and also Annual Int. Symposium on Fault-Tolerant Computing, 23 June 1998, pages 218-277, IEEE computer Soc , Los Alamitos, CA, US; Temple C∴ prevention of "Avoiding the Babbling-idiot Failure in a Time-Triggered Communications system" in the TTP / C protocol by an independent fault acknowledgment unit, a so-called "guardian". This acknowledgment unit has an independent time base and continuously checks the time operation of the remote computer. To achieve fault tolerance, several fault-tolerant remote computers are assembled in a fault-tolerant unit (FTU) to respond to the communication system. As long as the response of one FTU remote computer and one communication system operates, the services of the FTU are appropriately provided within the time domain and range of values.

The logical broadcast topology of the communication can be physically established by a distributed bus system (distributed ring system) or a distributor unit such as a star coupler having a combination of these topologies or a point-to-point connection to remote computers. Once a distribution bus system or distribution ring system is established, each remote computer must have its own protector. On the other hand, if a distributor unit is employed, all protectors can be integrated into this distributor unit, which can effectively execute the correct transmission operation in the time domain by comprehensive observation of all remote computer behavior. The invention also relates to the protector integration by such a distributor unit.

The present invention relates to a method in which a plurality of telecommunication computers are connected through at least one distributor unit, each remote computer having an independent communication controller corresponding to a connection to the communication channel, and access to the communication channel being periodically time-division multiplexed. And a method for implementing fault-to-failure attributes in the time domain of a telecommunications computer of a fault-tolerant distributed computer system. In addition, the present invention provides a built-in in which a plurality of remote computers are interconnected, each remote computer has an independent communication controller corresponding to a connection to the communication channel, and access to the communication channel is performed by a cyclic time division multiple access method. A dispensing unit of a decentralized distributed computer system.

1 illustrates the structure of a distributed computer system having four remote computers coupled via two response distributor units of the present invention;

2 is a diagram showing the structure of a remote computer comprising a communication controller and a host computer on which communication is performed by a communication network interface (CNI);

3 shows the structure of a distributor unit with an integrated protector,

4 shows a data structure of information in which the distributor unit includes precedence;

5 is a diagram illustrating a structure of an initialization message;

6 is a view showing an internal state of the distributor unit.

An object of the present invention is to increase the built-in resolution of a distributed time control computer system and to reduce the cost.

This object is achieved by a method of the kind mentioned at the beginning, wherein at least one distributor unit according to the invention is statically assigned by the remote computer by the correct transfer operation of the remote computer of known precedence (execution priority). It ensures that only transmissions to other remote computers can be made within a given time slice.

By combining the "protector" with the intelligent distributor unit, it becomes possible to prevent the "babbling idiot" of the remote computer, i.e. sending the message at the wrong time. If the distributor unit is employed according to the invention, All protectors can be integrated within this distributor unit, which can effectively enhance the correct transmission operation in the time domain by comprehensive observation of the operation of all remote computers. Such a distributor unit with an integrated protector has the following advantages: (I) The built-in area of damage for comprehensive critical disturbances is reduced by the point-to-point connection of the remote computer to the distributor unit, ie these point-to-point by electromagnetic immission (EMI). Obstacles introduced into a connection can be explicitly assigned to a single remote computer and have no comprehensive effect. Ii) The responded generic critical distributor unit can be installed as a spatial separation in the protected area, and has a physically compact structure, which significantly reduces the likelihood that the fault causing element will collapse all comprehensive critical distributor units. The protector of the distributor unit is replaced by a distributed protector in the remote computer, which saves the hardware for the remote computer, such as the protector oscillator. (Iii) The physical point-to-point connection is well suited for the introduction of optical fibers and for twisted cables It brings advantages in impedance matching.

It is also an object of the present invention to achieve a distributor unit of the kind described above, wherein at least one distributor unit according to the present invention is a time slice in which the remote computer is statically assigned by an accurate transfer operation of the remote computer of which priorities are known. It is designed to ensure that only transmissions to other remote computers in the network can be made.

The function of the distributor unit is based on the evaluation of a combination of static precedence information for transmission time delegation of each remote computer and dynamic synchronization of the distributor unit by messages of the time control communication system.

The advantages according to the invention are explained in more detail with reference to the drawings in the embodiments described below.

Next, one embodiment of the present invention shows, by way of example, four remote computers connected via two response distributor units. Components in the figures are numbered in such a way that the first digit of the three digit reference number represents the corresponding figure.

As shown in FIG. 1, four telecommunication computer systems 111, 112, 113, 114 are shown, each remote computer consisting of interchangeable units, and two response distributor units 101, 102. Is connected via a point-to-point connection. The unidirectional communication channel 151 from the first distributor unit 101 is directed to another second distributor unit 102. On the other hand, the unidirectional communication channel 152 from the second distributor unit 102 is sent to the first distributor unit 101. Through these unidirectional communication channels, the first distributor unit 101 can also observe the amount of communication to the second distributor unit 102 and vice versa, if there is no message exchange in its own connection 121, The distributor unit 101 performs a cold start or time synchronization. The connections 141, 142 indicated are dedicated communication channels, which can establish parameterization of the distributor unit and are connected with a maintenance computer (not shown) which can continuously monitor the proper functioning of the distributor unit.

2 shows an internal configuration of a telecommunications computer 111. The telecommunications computer 111 is a communication controller 210 connected with two subsystems, namely, the response communication channels 201 and 202 (corresponding to 121 in FIG. 1), and a host computer on which a remote computer application program is executed. It consists of 220. These two subsystems are interconnected via a communication network interface (CNI) 241 and a signal line 242. The interface 241 includes memory (dual port RAM = DPRAM) that both subsystems can access. In addition, the two subsystems exchange communication data with each other via the common memory and the interface 241. The signal line 242 transmits a signal for time synchronization. The signal line is clearly described in US Pat. No. 4,866,606A. Meanwhile, the automatically driven communication controller 210 includes a communication control unit 211 and a data structure 212 for indicating a time point at which data is transmitted and received. This data structure 212 is designed by a message descriptor list (MEDL).

3 shows the structure of a distributor unit with an integrated protector. The distributor unit is composed of an input port 311, an output port 312, a data distributor 330 and a control computer 340. The data connection 301 of the remote computer (corresponding to 121 in FIG. 1) is connected to the input port 311 and the output port 312 of the distributor unit, and the other data connections 302, 303, 304 are also made the same. . In addition, in the case of a unidirectional communication line, the two ports 311 and 312 may be individually connected to corresponding ports of a remote computer having a data connection 301. In addition, a switch that can be switched by the control computer 340 of the distributor unit via a signal line 314 in each input port 311 adjacent to custom filters and potential separation, if necessary. 313 is configured, and the switch 313 tells the control computer 340 when to receive from that port. Data arriving at the input port 311 is relayed to the output port 312 through the data distributor 330, and relayed to the control computer 340 through the data line 331, through the channel 351 Relayed to other distributor units. The control computer 340 also has a serial input / output channel 341 that periodically sends diagnostic report data to the maintenance computer for the state of the control computer 340, the structure of the fixed data being shown in FIG. . If necessary, the data on the output port 312 may be amplified at the output front end. Conventional amplifiers are not shown in FIG.

4 is a diagram showing a data structure that can use the precedence (before the relay time) for the control computer 340. The data structure includes specific data records 411, 412, 413, 414 for each port or remote computer 111, 112, 113, 114 of the distributor unit. The first field 401 of the data record 411 includes a port number to which the data record belongs. The second field 402 includes transmission time length information of a node associated with a port included in the MEDL 212 list. The third field 403 contains length information of the time interval for the end point of the latest transmission of the node associated with that port and the start point of the next transmission. The fourth field 404 includes the next port number to be followed. The fifth field 405 includes the length information of the time interval between the start point and the end point of the latest transmission of the node at the next port to be followed. The sixth field 406 includes length information of an initialization message received at a recent port. The items of the data structure shown in FIG. 4 are established by a development tool equivalent to the message descriptor list 212 and loaded into the control computer 340 before the relay time via the channel 341.

5 is a diagram illustrating an initialization message structure. The initialization message must include a specific bit 510 in the header 501 that can be recognized as an initialization message. The data field 502 of the initialization message represents additional information that is of little importance to the function of one distributor unit. The last of the initialization message is the CRC field 503. The high performance distributor unit may evaluate the information contained in the data field 502 of the initialization message to further increase the likelihood of fault recognition. For example, such a high performance distributor unit may evaluate the time field of the TTP / C initialization message to compare the sender's clock state against the clock they contain.

FIG. 6 shows the two most important internal states of the control computer 340 that are configured in the distributor unit 101, and are roughly divided into "synchronized" 601 and "synchronized" 602. . When the power is turned on, the fraud control computer 340 is in an asynchronous 602 state. In that state, all the input ports 311 are connected to the data distributor 330. When the correct message is received from the control computer 340 through the data line 331 or the channel 352 at its input port, the control computer 340 constructed by the signal line 314 port used for reception is stored in memory. Store the receiving point in time and check the length of the message by comparing the length stored in the field 406. If the confirmation result of the message length is affirmative, it is in a synchronization 602 state, and a synchronization event is generated when a memory initialization message is received. In the synchronization 602 state, the control computer 340 is connected in correspondence with the input port only for the time interposed in the time information 403. If an individual message arrives at the correct time, it is encoded by the encoding rules of the encoding system. The control computer resynchronizes the time used for a reliable embedded resolution algorithm (see, eg, Kopetz 1997, p. 61), using the observed time difference of the message and the time difference detected during the expected time of arrival. If the correct message does not arrive during the set time interval d _fault-1 over any one of the multiple channels 301-304 or 352, the distributor unit or its control computer 340 is in an unsynchronized state (601). Switching. If this switching is capable of executing at least the following evaluation operation, the message in the synchronization 602 state is correct. The message has the correct CRC field 503 so it arrives at the input port at approximately the expected time and has the correct length by the field 406.

The control computer 340 manages the parameters set in the control computer 340 through input / output lines 341 (same as the input / output lines 141 and 142 shown in FIG. 1), and maintains the monitoring of the control computer during its operation. Communicate with the maintenance computer.

One error in the remote computer (eg, 111) clock can result in insufficient encoding error of the physical signal on each channel 201, 202 of the remote computer 111. In order to prevent this error from increasing on the receiving side of the message via the two distributor units, the distributor unit receives the physical signal to be subsequently executed within each distributor unit and then uses the digital signal used as the local clock of the distributor unit. Convert Then, just before transmission, it is converted back into a physical form distributor unit (a signal recombined by the distributor unit). In this way, insufficient encoding errors can be consistently represented with the correct or incorrect encoding. Assuming that only one error source occurs in the TDMA environment, inconsistencies will occur in the system, thus preventing a single error in the time domain or range of values from interfering with the encoding on each channel. can do.

The control computer 340 merely controls the opening and closing of the switch 313, and does not convert the contents of the transmission message or insert a new message. Therefore, the error form of the distributor unit remains a fault-fault error of the communication channel. In addition, a second independent communication channel can always be used in a built-in solution.

Finally, the present invention is not limited to the embodiment presented in the present invention, that is, the embodiment having four remote computers and two distributor units, and can be expanded in a broader sense. In addition, the present invention may use other time control protocols without using the TTP / C protocol.

Claims (17)

delete delete delete delete delete delete delete delete An autonomous communication control unit having a plurality of network node-computers 111 ... 114 connected by at least one distributor unit 101,102, each network-node computer having a connection corresponding to the communication channel 201,202. An error-tolerant distributed computer system having 211 and wherein the communication channels are accessed according to a cycle time slice process, At least one distributor unit (101, 102) is a network-node computer that differs from the network-node computer within a statistically allocated time slice because of the regular transmission behavior of the network-node computer (111 ... 114). Fault-tolerant distributed computer system comprising a control computer (340-313) that knows the priorities that cause them. delete The method of claim 9, The control computers 340-131 of the at least one distributor unit 101, 102 receive this correct port and then, from the " unsynchronized " state which can be received through all of the input ports 311. A fault-tolerant distributed computer system for translating into a "synchronized" state receivable through one input port during a time slice statistically assigned to. The method of claim 11, The control computers 340-131 of the at least one distributor unit 101, 102 have not received any correct messages since the last initialization message via one of its input ports 311 within a predetermined time interval. And when transitioning from a "synchronized" state to a "unsynchronized" state. The method of claim 9, The content of the incoming message is assessed in the sense of further error recognition by the control computer (340-131) of the at least one distributor unit (101, 102). The method of claim 9, The control computer (340-131) of the at least one distributor unit, after power-up, assumes an asynchronous state. The method of claim 9, At least one distributor unit (101, 102) converts the physical signals arriving using the local clock of the distributor unit into digital signals and returns them in physical form prior to transmission. . The method of claim 9, The distributor units (101, 102) are connected to each other via communication channels (201, 202) in order to enable starter and clock synchronization of the distributor unit even when there are no incoming messages for its own connection. Fault-tolerant distributed computer system. The method of claim 9, The distributor units 101, 102 are connected to at least one maintenance computer via dedicated communication channels 141, 142 to perform parametrisation of the distributor unit during operation and to monitor the correct operation of the distributor unit. Fault-tolerant distributed computer system.