Time-triggered communication control unit and communication method

A communication control unit for the transmission of messages within a distributed real-time computer architecture with a global time base, comprising a plurality of fault-tolerant units (FTU.sub.1, FTU.sub.2, FTU.sub.3, FTU.sub.4), each fault-tolerant unit (FTU) containing at least one fail-silent computer (A,B,C) and each computer having a communication control unit with at least one communication port, whereby each fault-tolerant unit (FTU.sub.1, FTU.sub.2, FTU.sub.3, FTU.sub.4) is connected to a communication bus (101,102) with every other fault-tolerant unit (FTU.sub.1, FTU.sub.2, FTU.sub.3, FTU.sub.4), the access to the communication bus (101,102) being determined by a cyclic time division multiple access scheme which is derived from a global time base, the communication control unit being realized as single chip control unit or as part of a single chip microcomputer, the communication control unit including means to construct the messages to be transmitted from a control field (310), a data field (320) and a CRC (Cyclic Redundancy Check) field (331,332), the contents of the CRC field of normal messages, identified by a specified bit (311) of the control field (310), being calculated over the concatenation of the control field (310), the data field (320) and the local internal state of a sending communication control unit and the communication control unit comprising means for maintaining a local internal state of the communication control unit that is composed of the concatenation of the current global time with a membership field, in which each fault-tolerant unit (FTU.sub.1, FTU.sub.2, FTU.sub.3, FTU.sub.4) is represented by a specified bit, in which the value TRUE means that said fault-tolerant unit is operating and the value FALSE means that said fault-tolerant unit is faulty, and a receiving communication control including means to perform a CRC-check on the incoming messages in order to detect a mutilated message as well as a deviation of the internal state of the receiving from the internal state of the sending communication control unit.

A method for the transmission of messages within a distributed real-time computer architecture having a global time base, comprising the steps of:

• providing a plurality of fault-tolerant units;
• providing each fault-tolerant unit with at least one fail-silent computer and providing each computer with a communication control unit having at least one communication port;
• connecting each fault-tolerant unit to every other fault-tolerant unit by at least one communication bus;
• determining the access to the communication buses by a cyclic time division multiple access scheme derived from the global time base;
• providing each message to be sent with a control field, a data field and a CRC (Cyclic Redundancy Check) field;
• calculating the contents of the CRC field of normal messages, which are identified by a specified bit of the control field, over the concatenation of the control field, the data field and the local internal state of a sending communication control unit;
• providing the local internal state of such a sending communication control unit by concatenating the current global time with a membership field;
• representing each fault-tolerant unit by a specified bit in the membership field, the value TRUE of which means that said fault-tolerant unit is operating and the value FALSE of which means that said fault-tolerant unit is faulty;
• and, performing, in a receiving communication control unit, a CRC-check on the incoming messages using its internal state, for detecting a mutilated message as well as a deviation of the internal state of the receiving communication control unit from the internal state of the sending communication control unit.

A communication control unit for the transmission of messages within a distributed real-time computer architecture having a global time base, said architecture comprising a plurality of fault-tolerant units, each fault-tolerant unit containing at least one fail-silent computer and each micro-computer having a communication control unit with at least one communication port, a communication bus, each fault-tolerant unit being connected to said communication bus, the access to the communication bus being determined by a cyclic time division multiple access scheme which is derived from the global time base, the communication control unit being realized as single chip control unit or as part of a single chip microcomputer, the communication control unit including means to construct the messages to be transmitted from a control field, a data field and a CRC (Cyclic Redundancy Check) field, the contents of the CRC field of normal messages, identified by a specified bit of the control field, being calculated over the concatenation of the control field, the data field and the local internal state of a sending communication control unit, the communication control unit further comprising means for maintaining a local internal state of the communication control unit that is composed of the concatenation of the current global time with a membership field, in which each fault-tolerant unit is represented by a specified bit, the TRUE value of which means that said fault-tolerant unit is operating and the FALSE value of which means that said fault-tolerant unit is faulty, and a receiving communication control unit including means to perform a CRC-check on the incoming messages by using its internal state in order to detect a mutilated message as well as a deviation of the internal state of the receiving communication control unit from the internal state of the sending communication control unit.