Fail-Silent Distributed Real-Time Computer System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In safety-critical real-time computer systems, such as those used in motor vehicle control, transient or permanent hardware errors can occur due to advanced SoC manufacturing, posing a risk to system safety, and existing technologies struggle to maintain application safety under economically viable conditions.
Innovation Solution
A distributed real-time computer system with redundant NSCFCUs and a SCFCU enforces fail-silent behavior by providing a global time frame, using deterministic algorithms to calculate results from input data, packing them into closed signed data packets, and transmitting these to a SCFCU for comparison, preventing further transmission if bit patterns differ, ensuring only identical packets are forwarded.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If advanced SoC manufacturing technology is used to achieve high performance and low cost, then processing power and economic viability are improved, but the occurrence of transient hardware errors increases
Solution Approach 1:
The system divides the computation into multiple independent NSCFCU segments that process the same input data through deterministic algorithms. Each segment operates independently and produces separate output data packets, allowing individual segments to be isolated and prevented from affecting the overall system if errors occur.
Solution Approach 2:
The system creates redundant copies of the computational process by having multiple NSCFCUs perform the same deterministic algorithm on the same input data. The SCFCU then compares these copies to detect any deviations caused by transient errors, ensuring that faulty results are identified and blocked.
2Reliability
If redundant NSCFCUs are implemented to detect hardware errors, then system safety is improved, but device complexity increases
Solution Approach 1:
The NSCFCUs are designed as universal processing units that can handle various computational tasks through deterministic algorithms. The same hardware architecture serves multiple purposes: normal computation, error detection through redundancy, and participation in the comparison mechanism, reducing the need for specialized error-detection hardware.
Solution Approach 2:
The system uses its own computational resources (the NSCFCUs) to perform error detection rather than requiring separate dedicated error-detection hardware. The redundant units serve dual purposes: performing the primary computational function while simultaneously providing the data needed for error detection and comparison by the SCFCU.
3Reliability
If deterministic algorithms are used in redundant NSCFCUs to calculate results from input data, then error detection capability is improved, but processing time increases
Solution Approach 1:
The system organizes computation into periodic frames with fixed tick intervals. Input data is supplied to NSCFCUs at regular intervals, and results are compared by the SCFCU at predetermined comparison points within each frame. This periodic structure allows error detection to occur at predictable moments without continuously interrupting the computational flow.
Solution Approach 2:
The system performs error detection and comparison actions in advance at predetermined ticks within each frame before faulty results can propagate to the output. By comparing results from redundant NSCFCUs at these predetermined points, the system prevents erroneous data from being transmitted further, maintaining real-time performance guarantees.
4Reliability
If CSDPs are transmitted to SCFCU for comparison at fixed ticks, then fail-silent behavior is enforced, but transmission overhead increases
Solution Approach 1:
The system combines multiple pieces of information into single CSDP structures that are transmitted to the SCFCU. Each CSDP contains output data from an NSCFCU along with end-to-end signatures and frame identifiers, allowing the SCFCU to perform comprehensive verification (integrity checking, source identification, and error detection) in a single comparison operation rather than requiring separate transmission and verification steps.
Data Source
Figure 1~2
AI summary
The invention relates to a method for enforcing fail-silent behavior in a periodically operating, distributed real-time computer system, which comprises at least two redundant NSCFCUs. At the beginning of a frame, the at least two redundant NSCFCUs (110, 111) are supplied with the same input data, wherein each of the redundant NSCFCUs, preferably using a deterministic algorithm, calculates a result, in particular from the input data, and wherein this result is packaged with an end-to-end signature in a CSDP, and wherein the CSDPs of the NSCFCU (110, 111) are transmitted to an SCFCU (130), and wherein the SCFCU (130) checks whether the bit patterns of the received CSDPs are identical and, if a discrepancy in the bit patterns is detected, prevents the further transmission of the CSDPs, in particular those CSDPs in which a discrepancy was detected.Furthermore, the invention relates to a periodically operating, distributed real-time computer system.