Fault-tolerant distribution unit and method for providing fault-tolerant global time

A method, comprising:

• providing a fault-tolerant global time and for the fault-tolerant transport of time-controlled messages in a distributed real-time computer system which comprises external computers (210, 220, 230, 240, 250, 260) and a fault-tolerant message distribution unit (100), FTMDU, wherein each external computer can be an external sender and/or an external receiver of messages comprising time-controlled messages,
• wherein the FTMDU comprises at least four components (110, 120, 130, 140) comprising a first component (110), a second component (120), a third component (130), and a fourth component (140),
• wherein each of the four components (110, 120, 130, 140) is connected to the other three components of the FTMDU via two or at least two independent communication paths,
• wherein these four components (110, 120, 130, 140), after a power-up of the FTMDU, establish a fault-tolerant global time by means of internal synchronization messages (191) and maintain this global time while the FTMDU is operating,
• wherein the four components (110, 120, 130, 140) supply the global time to the external computers (210, 220, 230, 240, 250, 260) by means of periodic external synchronization messages (192),
• wherein the external computers each set their local clock to the received global time,
• wherein each external sender of a time-controlled message transmits two message copies of the message to be sent via two different communication channels to two different components of the FTMDU at periodic sending times defined a priori in timetables, expressed in global time,
• wherein these two message copies are delivered within the FTMDU via two independent communication paths to those two components of the FTMDU which are connected to an external receiver of the message via communication channels,
• wherein the external receiver verifies the validity of the incoming message copy and accepts the valid message copy that arrived first and discards the second, subsequently arriving message copy.