Fault-Tolerant TTVM Architecture for Real-Time Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing distributed real-time computer systems for controlling physical systems, such as motor vehicles, face challenges in rapid reconfiguration and integration of new functions or requirements during operation, especially in the event of errors or changes in system conditions.
Innovation Solution
The system employs a Time-Triggered Virtual Machine (TTVM) architecture with active and passive allocation plans, where the monitor component manages the reconfiguration of real-time software components to new TTVMs, ensuring seamless operation by specifying start and end times, memory areas, and communication schedules, and implementing active redundancy through multiple virtual machines to maintain system integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the system uses a traditional distributed real-time computer architecture, then the system structure is relatively simple and easy to implement, but the system cannot be quickly reconfigured when errors occur or new functions need to be integrated
Solution Approach 1:
The system is segmented into multiple independent node computers, each running its own real-time operating system and application software components. This modular architecture allows individual nodes to be reconfigured or replaced without affecting the entire system, enabling quick adaptation when errors occur or new functions are needed.
Solution Approach 2:
The distribution units are designed with universal communication interfaces and protocols that allow them to work with different types of sensors and actuators. This multi-functionality enables the system to integrate new components and reconfigure communication paths without requiring specialized hardware for each function.
2Reliability
If the system implements fault tolerance mechanisms, then the system reliability is improved, but the system complexity and resource consumption increase
Solution Approach 1:
The system pre-configures backup nodes and redundant communication paths before faults occur. When a failure is detected, the system can immediately switch to pre-prepared backup configurations without requiring complex real-time decision-making or resource allocation, thus improving reliability while keeping the fault tolerance mechanisms relatively simple.
Solution Approach 2:
The system creates copies of critical software components and data across multiple nodes. This redundancy allows the system to maintain operation even if one node fails, as identical or near-identical copies can take over immediately, providing fault tolerance through simple replication rather than complex error correction mechanisms.
3Loss of time
If the system uses periodic time-triggered communication, then the system achieves deterministic timing and real-time performance, but the communication overhead and data transmission volume increase
Solution Approach 1:
The system implements time-triggered communication with different periodicities for different types of data and different communication channels. Critical safety-related communications use shorter periods with higher priority, while non-critical data uses longer periods. This localized optimization of communication parameters reduces overall overhead while maintaining deterministic timing for critical functions.
Solution Approach 2:
The system sends time-triggered messages at predetermined intervals regardless of whether data changes have occurred. This excessive action ensures that timing requirements are always met, but the system includes mechanisms to minimize the actual data payload by only transmitting changed values or using efficient encoding, thus reducing communication overhead while maintaining real-time performance.
Data Source
Figure 1~2
Figure 3
AI summary
The invention relates to a fault-tolerant distributed real-time computer system for controlling a physical system, in particular a machine or a motor vehicle, wherein the components of the computer system have access to a global time of known precision, and wherein the node computers, intelligent sensors, and intelligent actuators exchange periodic time-controlled messages and event-driven messages via the distribution units, and wherein the functions of the application software are contained in real-time software components (EZWSK), and the periodic time-controlled data transfer between the EZWSK is defined by a time-controlled data flow diagram, and wherein the assignment of the EZWSK to a TTVM of a node computer and certain parameters of the TTVM are defined in active local allocation plans for each EZWSK.and wherein active local allocation plans for each distribution unit contain the schedules for time-controlled communication in that distribution unit, and wherein a global allocation plan consists of the sum of the coordinated local allocation plans of all EZSWK and all distribution units of the application software, and wherein a monitor component periodically receives a copy of messages from the node computers to determine the current operating state of the node computers, and wherein, after the permanent failure of one or more EZSWK, the monitor component activates a passive global allocation plan that specifies the allocation of the EZSWK and their data supply on newly installed TTVMs to the still functioning node computer, and wherein the EZSWK are executed on the newly configured TTVMs at the scheduled periodic restart time according to the selected passive global allocation plan.