Distributed real-time computer system and method for forcing fail-silent behavior of a distributed real-time computer system

1. A method for forcing fail-silent behavior of a periodically functioning distributed real-time computer system, which can be connected with one or more sensor(s) ( 101 , 102 , 103 ), the real-time computer system comprises at least two redundant NSCFCUs (non-self-checking fault-containment units), the method comprising:

making available a global time by the distributed real-time computer system, which global time establishes a beginning of a frame;

supplying the at least two redundant NSCFCUs ( 110 , 111 ) with the same input data by the sensor(s) at the beginning of the frame;

calculating by each of the at least two redundant NSCFCUs a result by a deterministic algorithm from the input data by the sensor(s);

packing the result into a CSDP (closed signed data packet) with an end-to-end signature;

transmitting the CSDPs of the at least two redundant NSCFCUs ( 110 , 111 ) to an SCFCU (self-checking fault-containment unit) ( 130 ) at a tick of the global time that has been established a priori; and

checking by the SCFCU ( 130 ) whether bit patterns of the received CSDPs are identical, and, if a disparity of the bit patterns is found, preventing further transmission of the CSDPs in which the disparity was found.

2. The method of claim 1 , wherein the SCFCU ( 130 ) prevents further transmission of the other CSDP in the event that a CSDP is not received by one of the at least two redundant NSCFCUs ( 110 , 111 ).

3. The method of claim 1 , wherein the SCFCU ( 130 ) transmits a release signal to a transceiver ( 140 ) in the failure-free case by way of a control line ( 170 ), and, in the event of failure, shuts off or does not transmit the release signal, so that further transmission of the CSDPs to subsequent components by way of a communication channel ( 165 ) is prevented.

4. The method of claim 1 , wherein in the event of failure of the SCFCU ( 130 ), further transmission of the CSDPs to the subsequent components is prevented.

5. The method of claim 3 , wherein in the event of failure of the SCFCU ( 130 ) and thereby of the release signal on the control line ( 170 ), the transceiver ( 140 ) prevents further transmission of the CSDPs to the subsequent components by way of the communication channel ( 165 ) and transmission of the CSDPs to the subsequent components is prevented.

6. The method of claim 3 , wherein a time-controlled message relay unit ( 120 ) delays output of the CSDPs to the transceiver ( 140 ) until the SCFCU ( 130 ) has completed the comparison of the redundant CSDPs.

7. The method of claim 1 , wherein the SCFCU ( 130 ) transmits failure messages to a monitor component by way of a communication channel ( 167 ).

8. A periodically functioning distributed real-time computer system, which can be connected with one or more sensor(s) ( 101 , 102 , 103 ), the system comprising:

a global time is made available by the distributed real-time computer system, which global time establishes the beginning of a frame, wherein in order to force fail-silent behavior, the real-time computer system comprises at least two redundant NSCFCUs ( 110 , 111 ) and an SCFCU ( 130 ), wherein each sensor ( 101 , 102 , 103 ) is connected with each of the at least two redundant NSCFCUs ( 110 , 111 ) by way of at least one communication channel ( 150 ) in each instance, wherein the at least two redundant NSCFCUs ( 110 , 111 ), which are supplied with the same input data by the sensor(s) at the beginning of the frame, are set up for calculating a result, in each instance, by a deterministic algorithm, packing the result into a CSDP (closed signed data packet) with an end-to-end signature, wherein the SCFCU ( 130 ) is set up for receiving the CSDPs of the at least two redundant NSCFCUs ( 110 , 111 ) based on the same input data, and for checking whether the bit patterns of the received CSDPs are identical, and the SCFCU ( 130 ) is furthermore set up for preventing further transmission of the CSDPs if a disparity of the bit patterns was found of those CSDPs in which the disparity was found.

9. The real-time computer system of claim 8 , further comprising a distributor unit ( 120 ), wherein at least one of the of the at least two redundant NSCFCUs ( 110 ) is connected with the distributor unit ( 120 ) by way of a communication channel ( 160 ), and at least one of the at least two redundant NSCFCUs ( 111 ) is connected with the distributor unit ( 120 ) by way of a further communication channel ( 162 ).

10. The real-time computer system of claim 9 , further comprising a transceiver ( 140 ), wherein the distributor unit ( 120 ) is connected with the transceiver ( 140 ) by way of a communication channel ( 163 ), and with the SCFCU ( 130 ) by way of a communication channel ( 161 ), and wherein a control line ( 170 ) leads from the SCFCU ( 130 ) to the transceiver ( 140 ).

11. The real-time computer system of claim 9 , wherein a protocol converter ( 119 ) is disposed in a communication channel ( 160 ), which connects the at least one of the at least two redundant NSCFCUs ( 110 ) with the distributor unit ( 120 ).

12. The real-time computer system of claim 10 , wherein a protocol converter ( 119 ) is disposed in the communication channel ( 163 ), which connects the distributor unit ( 120 ) with the transceiver ( 140 ).

13. The real-time computer system of claim 8 , wherein the at least two redundant NSCFCUs ( 110 , 111 ) are combined in a physical unit ( 115 ).

14. The real-time computer system of claim 8 , wherein the distributor unit ( 120 ), the SCFCU ( 130 ), and the protocol converter ( 119 ) are combined in a physical unit ( 135 ).