Method and computer system to consistently control a set of actuators
A method for transmitting control commands in a computer system, which includes components at least in the form of nodes, actuators and communication systems, wherein the control commands are communicated over the communication systems from the nodes to the actuators, and wherein one or more of the components may fail to operate according their specification. For consistently accepting control commands at the actuators, the nodes and their control commands are assigned priorities, wherein a node and its control commands have the same priority, wherein at least two priorities are used, wherein a high priority node produces high priority control commands and a low priority node produces low priority control commands, and wherein a high priority node is configured to communicate its control commands over at least two communication systems to the actuators and a low priority node is configured to communicate its low priority control commands over at least one communication system to the actuators. An actuator accepts the high priority control commands from the high priority node as long as it receives said high priority control commands on any one of the communication systems, and in this first case, it discards the low priority control commands, and stops to accept said high priority control commands in case said actuator does not receive said high priority control commands from any of the communication systems for a configurable duration, and in the second case, the actuator starts to accept low priority control commands.
1. A method for transmitting control commands (F-A 100 , F-A 200 ) in a computer system, wherein said computer system comprises components comprising nodes (A 100 , A 200 ), actuators (ACT 1 , ACT 2 , ACT 3 ) and communication systems (COM 1 , COM 2 ), wherein said control commands (F-A 100 , F-A 200 ) are communicated over said communication systems (COM 1 , COM 2 ) from said nodes (A 100 , A 200 ) to said actuators (ACT 1 , ACT 2 , ACT 3 ), and wherein one, two, or more components (A 100 , A 200 , IF 100 , IF 200 , COM 1 , COM 2 , IF 11 , IF 12 , IF 13 , IF 21 , IF 22 , IF 23 , ACT 1 , ACT 2 , AT 3 ) of the computer system can fail to operate according their specification, the method comprising:
consistently accepting control commands (F-A 100 , F-A 200 ) at said actuators (ACT 1 , ACT 2 , ACT 3 ) by:
assigning priorities to nodes (A 100 , A 200 ) and their control commands (F-A 100 , F-A 200 ), wherein a node and its control commands have the same priority, wherein at least two priorities (HIGH, LOW) are used, wherein a high priority node (A 100 ) produces high priority control commands (F-A 100 ) and a low priority node (A 200 ) produces low priority control commands (F-A 200 ),
wherein the high priority node (A 100 ) is configured to communicate its control commands (F-A 100 ) over at least two communication systems (COM 1 , COM 2 ) to the actuators (ACT 1 , ACT 2 , ACT 3 ) and the low priority node (A 200 ) is configured to communicate its low priority control commands (F-A 200 ) over at least one communication system (COM 2 ) to the actuators (ACT 1 , ACT 2 , ACT 3 ),
wherein the actuator (ACT 1 , ACT 2 , ACT 3 ) (a) accepts the high priority control commands (F-A 100 ) from the high priority node (A 100 ) as long as the actuator receives said high priority control commands (F-A 100 ) on any one of the at least two communication systems (COM 1 , COM 2 ) and in this first case discards the low priority control commands (F-A 200 ) and (b) stops accepting said high priority control commands (F-A 100 ) in case said actuator (ACT 1 , ACT 2 , ACT 3 ) does not receive said high priority control commands (F-A 100 ) from any communication system (COM 1 , COM 2 ) of the at least two communication systems (COM 1 , COM 2 ) for a configurable duration, and in which second case the actuator (ACT 1 , ACT 2 , ACT 3 ), starts to accept low priority control commands (F-A 200 ),
wherein a fail-over device (S 300 ) is provided which decides whether or not control commands (F-A 200 ) from a low priority node (A 200 ) are forwarded on a communication system (COM 2 ),
wherein a decision of the fail-over device, whether or not control commands (F-A 200 ) from a low priority node (A 200 ) are forwarded on a communication system (COM 2 ), depends on the fail-over device (S 300 ) receiving control commands (F-A 100 ) from the high priority node (A 100 ),
wherein the fail-over device (S 300 ) starts forwarding control commands (F-A 200 ) from the low priority node (A 200 ) on the communication system (COM 2 ) when any one or any combination of the following conditions is/are met:
(i) the fail-over device (S 300 ) does not receive control commands (F-A 100 ) from the high priority node (A 100 ) for the configurable duration,
(ii) the fail-over device (S 300 ) receives more control commands (F-A 100 ) from the high priority node (A 100 ) than it is configured to receive, and
(iii) the fail-over device (S 300 ) receives faulty control commands (F-A 100 ) from the high priority node (A 100 ), and
wherein said configurable duration is longer than the maximum duration in between the production of two succeeding control commands (F-A 100 ).
2. The method according to claim 1 , wherein the computer system comprises exactly two nodes (A 100 , A 200 ) which produce control commands (F-A 100 , F-A 200 ), wherein the high priority node (A 100 ) of said two nodes communicates on exactly two communication systems (COM 1 , COM 2 ), and wherein the low priority node (A 200 ) of said two nodes communicates on exactly one communication system (COM 2 ).
3. The method according to claim 1 , wherein said fail-over device (S 300 ) only forwards a configurable number of control commands (F-A 100 ) per configurable time-duration it receives from the high-priority node (A 100 ) on the communication system (COM 2 ) when it starts forwarding control commands (F-A 200 ) from the low-priority node (A 200 ) to said communication system (COM 2 ), and wherein said configurable number comprises 0, 1, 2, or any integer number.
4. The method according to claim 1 ,
wherein the fail-over device (S 300 ) maintains two states (ACTIVE, BACKUP), where in one of the states (ACTIVE) the fail-over device (S 300 ) is configured not to forward control commands (F-A 200 ) from said low priority node (A 200 ) to said communication system (COM 2 ), and wherein said fail-over device (S 300 ) in the second state (BACKUP) is configured to forward control commands (F-A 200 ) from said low priority node (A 200 ) to said communication system.
5. The method according to claim 4 , wherein the fail-said device is configured to change from said first state (ACTIVE) to said second state (BACKUP) when any one or any combination of the following conditions is/are met:
(i) the fail-over device (S 300 ) does not receive control commands (F-A 100 ) from the high priority node (A 100 ) for the configurable duration,
(ii) the fail-over device (S 300 ) receives more control commands (F-A 100 ) from the high priority node (A 100 ) than it is configured to receive, and
(iii) the fail-over device (S 300 ) receives faulty control commands (F-A 100 ) from the high priority node (A 100 ).
6. The method according to claim 4 , wherein said fail-over device (S 300 ) only forwards a configurable number per configurable time-duration of control commands (F-A 100 ) it receives from the high-priority node (A 100 ) on the communication system (COM 2 ) when it starts forwarding control commands (F-A 200 ) from the low-priority node (A 200 ) to said communication system (COM 2 ), and wherein said configurable number comprise 0, 1, 2, or any integer number.
7. The method according to claim 4 , wherein said fail-over device (S 300 ) is part of the low priority node (A 200 ).
8. The method according to claim 4 , wherein said fail-over device (S 300 ) is part of the communication system (COM 2 ) which at least is connected to the low priority node (A 200 ).
9. A method for transmitting control commands (F-A 100 , F-A 200 ) in a computer system, wherein said computer system comprises components comprising nodes (A 100 , A 200 ), actuators (ACT 1 , ACT 2 , ACT 3 ) and communication systems (COM 1 , COM 2 ), wherein said control commands (F-A 100 , F-A 200 ) are communicated over said communication systems (COM 1 , COM 2 ) from said nodes (A 100 , A 200 ) to said actuators (ACT 1 , ACT 2 , ACT 3 ), and wherein one, two, or more components (A 100 , A 200 , IF 100 , IF 200 , COM 1 , COM 2 , IF 11 , IF 12 , IF 13 , IF 21 , IF 22 , IF 23 , ACT 1 , ACT 2 , AT 3 ) of the computer system can fail to operate according their specification, the method comprising:
consistently accepting control commands (F-A 100 , F-A 200 ) at said actuators (ACT 1 , ACT 2 , ACT 3 ) by:
assigning priorities to nodes (A 100 , A 200 ) and their control commands (F-A 100 , F-A 200 ), wherein a node and its control commands have the same priority, wherein at least two priorities (HIGH, LOW) are used, wherein a high priority node (A 100 ) produces high priority control commands (F-A 100 ) and a low priority node (A 200 ) produces low priority control commands (F-A 200 ),
wherein the high priority node (A 100 ) is configured to communicate its control commands (F-A 100 ) over at least two communication systems (COM 1 , COM 2 ) to the actuators (ACT 1 , ACT 2 , ACT 3 ) and the low priority node (A 200 ) is configured to communicate its low priority control commands (F-A 200 ) over at least one communication system (COM 2 ) to the actuators (ACT 1 , ACT 2 , ACT 3 ),
wherein the actuator (ACT 1 , ACT 2 , ACT 3 ) (i) accepts the high priority control commands (F-A 100 ) from the high priority node (A 100 ) as long as the actuator receives said high priority control commands (F-A 100 ) on any one of the at least two communication systems (COM 1 , COM 2 ) and in this first case discards the low priority control commands (F-A 200 ) and (ii) stops accepting said high priority control commands (F-A 100 ) in case said actuator (ACT 1 , ACT 2 , ACT 3 ) does not receive said high priority control commands (F-A 100 ) from any communication system (COM 1 , COM 2 ) of the at least two communication systems (COM 1 , COM 2 ) for a configurable duration, and in which second case the actuator (ACT 1 , ACT 2 , ACT 3 ), starts to accept low priority control commands (F-A 200 ),
wherein a fail-over device (S 300 ) is provided which decides whether or not control commands (F-A 200 ) from a low priority node (A 200 ) are forwarded on a communication system (COM 2 ), and
wherein said fail-over device (S 300 ) only forwards a configurable number of control commands (F-A 100 ) per configurable time-duration it receives from the high-priority node (A 100 ) on the communication system (COM 2 ) when it starts forwarding control commands (F-A 200 ) from the low-priority node (A 200 ) to said communication system (COM 2 ), and wherein said configurable number comprises 0, 1, 2, or any integer number.