Source: http://www.google.com.tw/patents/US7372859
Timestamp: 2013-05-24 03:29:37
Document Index: 137269781

Matched Legal Cases: ['Application No. 60', 'Application No. 60', 'Application No. 60', 'Application No. 60', 'Application No. 60', 'Application No. 60', 'Application No. 60', 'Application No. 60', 'Application No. 60', 'Application No. 60']

�M�Q US7372859 - Self-checking pair on a braided ring network - Google �M�Q�j�M �Ϥ� �a�� Play YouTube �s�D Gmail ���ݵw�� ��h »�i���M�Q�j�M | �������� | �n�J�i���M�Q�j�M�M�QIn one embodiment, one or more self checking pairs are implemented at the application layer in a network that supports the qualified propagation of data at the transport layer (for example, in a network having a braided ring topology)....http://www.google.com.tw/patents/US7372859?utm_source=gb-gplus-share�M�Q US7372859 - Self-checking pair on a braided ring network���}��US7372859 B2�X���������v�ӽЮѽs��11/010,249�o�G���2008�~5��13���ӽФ��2004�~12��10�� �u���v���2003�~11��19����L���}�M�Q��EP1820103A1US20050152379WO2006063237A1�o��HKevin R. DriscollBrendan HallMichael Paulitsch��M�Q�v�HHoneywell International Inc. ���M�Q������370/400370/407455/453709/225370/447370/258��ڱM�Q������H04L12/28H04Q7/20G06F15/16 �X�@����H04L12/437G06F11/2007 �ڬw������H04L12/437�ѦҤ��m�M�Q�ޥ� (46)�D�M�Q�ޥ� (46)�Q�H�U�M�Q�ޥ� (12)�~���s�����M�Q�ӼЧ� ���M�Q�ӼЧ��M�Q����T�� �ڬw�M�Q��Self-checking pair on a braided ring networkUS 7372859 B2�K�n In one embodiment, one or more self checking pairs are implemented at the application layer in a network that supports the qualified propagation of data at the transport layer (for example, in a network having a braided ring topology).
CROSS REFERENCE TO RELATED APPLICATIONS This application is a continuation-in-part of the following (all of which are hereby incorporated herein by reference):
U.S. patent application Ser. No. 10/993,931, filed Nov. 19, 2004, entitled ��UNSYNCHRONOUS MODE BROTHER'S KEEPER BUS GUARDIAN FOR A RING NETWORKS�� (which is also referred to here as the ��10/993,931 Application��), which claims the benefit of U.S. Provisional Application No. 60/523,892, filed on Nov. 19, 2003, and U.S. Provisional Application No. 60/523,865, filed on Nov. 19, 2003 (both of which are incorporated herein by reference);
U.S. patent application Ser. No. 10/994,209, filed Nov. 19, 2004, entitled ��CLIQUE AGGREGATION IN TDMA NETWORKS,�� which claims the benefit of U.S. Provisional Application No. 60/523,892, filed on Nov. 19, 2003, and U.S. Provisional Application No. 60/523,865, filed on Nov. 19, 2003;
U.S. patent application Ser. No. 10/993,936, filed Nov. 19, 2004, entitled ��SYNCHRONOUS MODE BROTHER'S KEEPER BUS GUARDIAN FOR A TDMA BASED NETWORK,�� which claims the benefit of U.S. Provisional Application No. 60/523,892, filed on Nov. 19, 2003, and U.S. Provisional Application No. 60/523,865, filed on Nov. 19, 2003;
U.S. patent application Ser. No. 10/993,933, filed Nov. 19, 2004, entitled ��HIGH INTEGRITY DATA PROPAGATION IN A BRAIDED RING,�� which claims the benefit of U.S. Provisional Application No. 60/523,892, filed on Nov. 19, 2003, and U.S. Provisional Application No. 60/523,865, filed on Nov. 19, 2003; and
U.S. patent application Ser. No. 10/993,932, filed Nov. 19, 2004, entitled ��DIRECTIONAL INTEGRITY ENFORCEMENT IN A BIDIRECTIONAL BRAIDED RING NETWORK,�� which claims the benefit of U.S. Provisional Application No. 60/523,892, filed on Nov. 19, 2003, and U.S. Provisional Application No. 60/523,865, filed on Nov. 19, 2003.
This application is related to U.S. patent application Ser. No. 10/993,162 , filed Nov. 19, 2004, entitled ��MESSAGE ERROR VERIFICATION USING CHECKING WITH HIDDEN DATA,�� which is also referred to here as the ��10/993,162 Application�� and is incorporated herein by reference.
BACKGROUND Distributed, fault-tolerant communication systems are used, for example, in applications where a failure could possibly result in injury or death to one or more persons. Such applications are referred to here as ��safety-critical applications.�� One example of a safety-critical application is in a system that is used to monitor and manage sensors and actuators included in an airplane or other aerospace vehicle.
SUMMARY In one embodiment, a network comprises a plurality of nodes that are communicatively coupled to one another over first and second channels that form first and second rings, respectively. The network further comprises at least one self checking pair comprising at least two of the plurality of nodes. Each node is communicatively coupled via the first channel to a first neighbor node in a first direction and to a second neighbor node in a second direction. Each node is communicatively coupled via the second channel to the first neighbor node in the first direction and to the second neighbor node in the second direction. The two nodes of the self checking pair are neighbor nodes of one another. When each node relays a first relayed unit of data along the first channel in the first direction, that node relays information indicative of the integrity of the first relayed unit of data along with the first relayed unit of data. When each node relays a second relayed unit of data along the second channel in the second direction, that node relays information indicative of the integrity of the second relayed unit of data along with the second relayed unit of data. Each of the two nodes of the self checking pair, for a particular unit of data communicated on the first channel in the first direction and on the second channel in the second direction: sends, to the other of the two nodes included in the self checking pair, information about first and second instances of the particular unit of data received by that node from the first and second channels, respectively; receives, from the other of the two nodes included in the self checking pair, information about first and second instances of the particular unit of data received by that other node from the first and second channels, respectively; and selects, for use in processing performed by that node for the self checking pair, at least one of the first and second instances of the particular unit of data received by that node based on at least one of: information about the first and second instances received by that node from the first and second channels, respectively, and information about the first and second instances received by the other of the two nodes of the self checking pair from the first and second channels, respectively.
DETAILED DESCRIPTION FIG. 1 is a block diagram of one embodiment of a communication network 100. Communication network 100 includes multiple nodes 102. Each node 102 of the network 100 is communicatively coupled to at least one channel 106. For a given direction in which data flows in the channel 106, the channel 106 directly (that is, with only one hop) communicatively couples each node 102 to at least two other nodes 102 from which that node 102 receives data (also referred to here as ��receive-from nodes��) and to at least two other nodes 102 to which that node 102 transmits data (also referred to here as the ��transmit-to nodes��). In one embodiment, one of the received-from nodes 102 is designated as a ��primary�� receive-from node 102 and the other receive-from nodes 102 are designated as ��secondary�� receive-from nodes 102. When a node 102 ��relays�� data on a channel 106 in a given direction, that node 102 receives data from the primary receive-from node 102 for that channel 106 and that direction and forwards the received data along the same channel to each of the transmit-to nodes designated for that node 102 for that channel 106 and that direction. Data received by a node from the secondary receive-from nodes 102 is used for the various comparison operations described below and/or is relayed in the event that suitable data is not received from the primary receive-from node. When a given node 102 ��transmits�� data (that is, when the given node 102 is the source of data communicated on the network 100) along a channel 106 in a given direction, that node 102 transmits the data to each of the transmit-to nodes 102 designated for that node 102 for that channel 102 and direction.
In the particular embodiment shown in FIG. 1, the nodes 102 are arranged in a ring 104 having a ��braided ring�� topology in which the nodes 102 communicate with one another over multiple communication channels 106. In the particular embodiment shown in FIG. 1, eight nodes 102 communicate with one another over two replicated communication channels 106. In other embodiments, a different number and/or type of nodes 102 and/or channels 106 and/or different network topologies are used.
The eight nodes 102 shown in FIG. 1 are also individually labeled in FIG. 1 with the letters A through H and are referred to here individually as ��node A,�� ��node B,�� and so forth. As used herein, a ��neighbor node�� (or just ��neighbor��) is a node that is immediately next to a given node 102 in the ring 104. Each node 102 has two ��neighbor nodes 102, one in the clockwise direction (also referred to here as the ��clockwise neighbor node�� or ��clockwise neighbor��) and one in the counter-clockwise direction (also referred to here as the ��counter-clockwise neighbor node�� or ��counter-clockwise neighbor��). For example, the neighbor nodes 102 for node A are node H in the clockwise direction and node B in the counter-clockwise direction.
In addition, as used herein, a ��neighbor's neighbor node�� (or just ��neighbor's neighbor��) for a given node 102 is the neighbor node 102 of the neighbor node 102 of the given node 102. Each node 102 has two neighbor's neighbor nodes 102, one in the clockwise direction (also referred to here as the ��clockwise neighbor's neighbor node�� or ��clockwise neighbor's neighbor��) and one in the counter-clockwise direction (also referred to here as the ��counter-clockwise neighbor's neighbor node�� or ��counter-clockwise neighbor's neighbor��). For example, the two neighbor's neighbor nodes for node A are node G in the clockwise direction and node C in the counter-clockwise direction.
The two communication channels 106 are individually labeled in FIG. 1 (and are also referred to here) as ��channel 0�� and ��channel 1�� respectively. In the embodiment shown in FIG. 1, each of the channels 106 is formed using multiple point-to-point, unidirectional serial links 108. Channel 0 interconnects the node 102 in the clockwise direction around the ring 104 and channel 1 interconnects the nodes 102 in the counter-clockwise direction around the ring 104. In other embodiments, other types of links are used. For example, in one such other embodiment, bidirectional links are used and the devices, systems, and techniques described here are performed for each direction in which communications occur.
As used here, when a link 108 is described as being connected ��from�� a first node 102 ��to�� a second node 102, the link 108 provides a communication path for the first node 102 to send data to the second node 102 over the link 108. That is, the direction of that unidirectional link 108 is from the first node 102 to the second node 102.
The links 108 that connect a given node 102 to that node's respective clockwise and counter-clockwise neighbor nodes are also referred to here as ��direct�� links 108. The links 108 that connect a given node 102 to that node's respective clockwise and counter-clockwise neighbor's neighbors are referred to here as ��skip�� links 108.
In the embodiments described here, the transport-layer processing comprises two at least two modes�Xan unsynchronized mode and a synchronized mode. When operating in a synchronized mode, the nodes 102 of network 100 are synchronized to a global time base and transmit in accordance with a TDMA media access scheme. With such a TDMA media access scheme, a schedule is used to determine when the nodes 102 in the network 100 transmit during a given schedule period or round. During a given schedule period, various nodes 102 in the network 100 are assigned a respective time slot in which to transmit. In other words, for any given time slot, the node 102 assigned to that time slot is allowed to transmit during that time slot (also referred to here as the ��scheduled node�� 102). In this embodiment, the scheduled node performs the processing described below in connection with FIG. 2. The other nodes 102 in the network 100 perform at least some of the relay processing described below in connection with FIGS. 3A-3B and 4A-4B.
FIG. 2 is flow diagram of one embodiment of a method 200 of transmitting data in the network 100 of FIG. 1. The embodiment of method 200 shown in FIG. 2 is described here as being implemented in the embodiment described here in connection with FIGS. 1-5. Method 200 is performed by a node 102 that is operating in a synchronized mode in accordance with a TDMA schedule. Each node 102, in such an embodiment, performs the processing of method 200 when that node 102 is the scheduled node 102 (that is, when the current time slot is assigned to that node 102 by the TDMA schedule). In the context of FIG. 2, the node 102 that is performing the processing of method 200 is referred to here as the ��current�� node 102. In one embodiment, at least a portion of the functionality described here as being performed by the current node 102 is implemented in a controller included in the node 102. Other embodiments of method 200 are implemented in other ways.
FIG. 3A is flow diagram of one embodiment of a method 300 of relaying data in the network 100 of FIG. 1. When a node ��relays�� data, the node 102 receives data from one or more receive-from nodes and forwards the received data onto the one or more transmit-to nodes. That is, when a node 102 is relaying data, the node 102 is not the source of the data that the node 102 is forwarding onto other nodes. The embodiment of method 300 shown in FIG. 3A is described here as being implemented in the braided-ring embodiment described here in connection with FIGS. 1-5. In other embodiments, method 300 is implemented using other network topologies. One example of an alternative network topology in which method 300 can be implemented is a network topology that comprises two ��simplex�� ring channels. In one implementation of such a simplex ring network, the network uses a topology similar to the one shown in FIG. 1 except that there are no skip links that communicatively couple each node to its clockwise and counter-clockwise neighbor's neighbors.
Method 300 is performed by a node 102 that is operating in a synchronized mode in accordance with a TDMA schedule. Each node 102, in such an embodiment, performs the processing of method 300 when one of that node's neighbors is the scheduled node 102 for the current time slot. In the context of FIG. 3A, the node 102 performing the processing of method 300 is referred to here as the ��current�� node 102. In one embodiment, at least a portion of the functionality described here as being performed by the current node 102 is implemented in a controller included in the node 102. Other embodiments of method 300 are implemented in other ways.
The current node 102 performs the processing of method 300 when the current node 102 determines that one of the neighbors of the current node 102 is scheduled to transmit during the current time slot (checked in block 302). Such a neighbor is also referred to here in the context of FIG. 3A as the ��scheduled neighbor.�� In the embodiment of FIGS. 1-5, the current node 102 makes this determination based on information including the TDMA schedule and the global time base to which the nodes 102 are synchronized.
FIG. 3B is flow diagram of another embodiment of a method 350 of relaying data in the network 100 of FIG. 1. The embodiment of method 350 shown in FIG. 3B is described here as being implemented in the braided-ring embodiment described here in connection with FIGS. 1-5. In other embodiments, method 350 is implemented using other network topologies. One example of an alternative network topology in which method 350 can be implemented is a network topology that comprises two ��simplex�� ring channels. In one implementation of such a simplex ring network, the network uses a topology similar to the one shown in FIG. 1 except that there are no skip links that communicatively couple each node to its clockwise and counter-clockwise neighbor's neighbors.
Method 350 is performed by a node 102 that is operating in a synchronized mode in accordance with a TDMA schedule. Each node 102, in such an embodiment, performs the processing of method 350 when one of that node's neighbors is the scheduled node 102 for the current time slot. In the context of FIG. 3B, the node 102 performing the processing of method 350 is referred to here as the ��current�� node 102. In one embodiment, at least a portion of the functionality described here as being performed by the current node 102 is implemented in a controller included in the node 102. Other embodiments of method 350 are implemented in other ways.
The current node 102 performs the processing of method 350 when the current node 102 determines that one of the neighbors of the current node 102 is scheduled to transmit during the current time slot (checked in block 352). Such a neighbor is also referred to here in the context of FIG. 3B as the ��scheduled neighbor.�� In the embodiment of FIGS. 1-5, the current node 102 makes this determination based on information including the TDMA schedule and the global time base to which the nodes 102 are synchronized.
In method 350 (as in method 300 of FIG. 3A), when the current node 102 determines that one of its neighbors is the scheduled node for the current time slot, the current node 102 only relays frames sourced from the scheduled neighbor that are received by the current node 102 from the scheduled neighbor via the direct link 108 that couples the scheduled neighbor to the current node 102. That is, if the current node 102 receives a frame that is sourced from a node 102 other than the scheduled neighbor, the current node 102 does not relay that frame. However, unlink in method 300 of FIG. 3A, in method 350 of FIG. 3B, the current node 102 does not perform the ��bus guardian�� processing associated with blocks 308-310.
FIGS. 4A-4B are flow diagrams of one embodiment of a method 400 of relaying data in the network 100 of FIG. 1. The embodiment of method 400 shown in FIGS. 4A-4B is described here as being implemented in the embodiment described here in connection with FIGS. 1-5. Method 400 is performed by a node 102 that is operating in a synchronized mode in accordance with a TDMA schedule. Each node 102, in such an embodiment, performs the processing of method 400 when that node 102 is not scheduled to transmit during the current time slot and neither of that node's neighbors are scheduled to transmit during the current time slot. In the context of FIGS. 4A-4B, the node 102 performing the processing of method 400 is referred to here as the ��current�� node 102. In one embodiment, at least a portion of the functionality described here as being performed by the current node 102 is implemented in a controller included in the node 102. Other embodiments of method 400 are implemented in other ways.
When the current node 102 determines that the current node 102 is not scheduled to transmit during the current time slot and neither of the current node's neighbors are scheduled to transmit during the current time slot and the current node 102 starts to receive a frame from the current node's counter-clockwise neighbor on channel 0 (checked in block 404), the current node 102 compares the frame being received from the current node's counter-clockwise neighbor on channel 0 to any frame that is being received from the current node's counter-clockwise neighbor's neighbor on channel 0 (block 406). In the embodiment shown in FIG. 4, a bit-by-bit comparison is performed. Moreover, as described below in connection FIG. 5, because the frames will likely be received at the current node 102 at slightly different times, de-skew functionality is used to de-skew the received frames. The current node 102 relays the frame that is being received from the current node's counter-clockwise neighbor on channel 0 to the current node's clockwise neighbor and clockwise neighbor's neighbor along the channel 0 (block 408). After the current frame has been relayed and the comparison is complete, the current node 102 relays information indicative of the results of the comparison in or after the frame received from the current node's counter-clockwise neighbor (block 410). The current node 102 relays the information indicative of the results of the comparison to the current node's clockwise neighbor and clockwise neighbor's neighbor along the channel 0. In one embodiment, the information indicative of the results of the comparison comprises a one-bit, appended integrity field that the current node 102 appends to the frame received from the current node's counter-clockwise neighbor. In another embodiment, a shared integrity field is included at the end of each frame. In such an embodiment, the current node 102 sets the shared integrity field to a ��negative�� value (for example, a value of ��0��) if the comparison indicates that the two frames are not identical and, otherwise, does not alter the shared integrity field if the comparison indicates that the two frames are identical.
If the current node 102 does not receive a frame from the current node's counter-clockwise neighbor on channel 0 (for example, after a predetermined time-out period has elapsed) but starts to receive a frame from the current node's counter-clockwise neighbor's neighbor on channel 0 (checked in block 412), the current node 102 relays the frame that is being received from the current node's counter-clockwise neighbor's neighbor on to the current node's clockwise neighbor and clockwise neighbor's neighbor along the channel 0 (block 414). After that frame has been relayed, the current node 102 relays in or after that frame information indicating that there was a ��mismatch�� at the current node 102 for channel 0 (block 416). The current node 102 relays this information to the current node's clockwise neighbor and clockwise neighbor's neighbor along the channel 0. Because no frame was received from the counter-clockwise neighbor of the current node 102, it is not the case that a frame received from the counter-clockwise neighbor is identical to the frame received from the counter-clockwise neighbor's neighbor of the current node 102.
If the current node 102 does not receive a frame from the current node's clockwise neighbor on channel 1 (for example, after a predetermined time-out period has elapsed) but starts to receive a frame from the current node's clockwise neighbor's neighbor on channel 1 (checked in block 428), the current node 102 relays the frame that is being received from the current node's clockwise neighbor's neighbor on to the current node's counter-clockwise neighbor and counter-clockwise neighbor's neighbor along the channel 1 (block 430). After that frame has been relayed, the current node 102 relays in or after that frame information indicating that there was a ��mismatch�� at the current node 102 for channel 1 (block 432). The current node 102 relays this information to the current node's counter-clockwise neighbor and counter-clockwise neighbor's neighbor along the channel 1. Because no frame was received from the clockwise neighbor of the current node 102, it is not the case that a frame received from the clockwise neighbor is identical to the frame received from the clockwise neighbor's neighbor of the current node 102.
In the example shown in FIG. 5, the current node 102 includes a de-skew and compare module 514 that ��de-skews�� and compares the frames received from the current node's counter-clockwise neighbor and counter-clockwise neighbor's neighbor. In the particular example shown in FIG. 5, the current node 102 includes a single transmitter 516 that is used to transmit data to both the current node's clockwise neighbor and the current node's clockwise neighbor's neighbor. The output of the transmitter 516 is coupled to both the second direct link interface 510 and the second skip link interface 512 in order to transmit to the current node's clockwise neighbor and the current node's clockwise neighbor's neighbor, respectively.
For given transmission during a given time slot, the current node 102 will typically receive start receiving respective frames on the first direct link interface 502 and the first skip link interface 504 at different times. For example, where the comparison and relaying processing is performed in connection with blocks 406-410 and 414-418 of FIG. 4, the current node 102, for a given transmission, will typically start receiving a frame on the first skip link interface 504 before the current node 102 starts receiving a corresponding frame on the first direct link interface 502. This is because, in such an example, the frame received at the first skip link interface 504 travels through one less hop than the frame received on the first direct link interface 502 (that is, the frame received on the first skip link interface 504 ��skips�� the current node's counter-clockwise neighbor).
If a frame is being received on both the first direct link interface 502 and the first skip link interface 504, when both FIFO buffers 506 and 508 are half full, the de-skew and compare module 514 starts receiving bits from the respective outputs ends of the first and second FIFO buffers 506 and 508 and the transmitter 516 start receiving bits from the output end of the FIFO buffer 506. The de-skew and compare module 514, as it receives bits from the first and second FIFO buffers 506 and 508, performs the bit-by-bit comparison of the two received frames. The transmitter 516, as it receives bits from the first FIFO buffer 506, relays the received bits along channel 0 to the counter-clockwise neighbor and counter-clockwise neighbor's neighbor. When the de-skew and compare module 514 has compared the end of both frames, the de-skew and compare module 514 outputs, to the transmitter 516, a bit that indicates whether the two frames were or were not identical. The transmitter 516 receives the bit output by the de-skew and compare module 514 and ��appends�� the bit to the end of the relayed frame by transmitting the bit after the relayed frame.
If a frame is being received on the first direct link interface 502 but not on the first skip link interface 504, when the first FIFO buffer 506 is half full, the de-skew and compare module 514 and the transmitter 516 start receiving bits from the output end of the first FIFO buffer 506. The de-skew and compare module 514 outputs, to the transmitter 516, a bit that indicates that a mismatch has occurred for channel 0 at the current node 102. The transmitter 516, as it receives bits from the first FIFO buffer 506, relays the received bits along channel 0 to the counter-clockwise neighbor and counter-clockwise neighbor's neighbor. The transmitter 516 receives the bit output by the de-skew and compare module 514 and ��appends�� the bit to the end of the relayed frame by transmitting the bit after the relayed frame.
In the case of processing performed for method 400 of FIG. 4, if a frame is being received on the first skip link interface 504 but not on the first direct link interface 502, when the second FIFO buffer 508 is half full, the de-skew and compare module 514 and the transmitter 516 start receiving bits from the output end of the second FIFO buffer 508. The de-skew and compare module 514 outputs, to the transmitter 516, a bit that indicates that a mismatch has occurred for channel 0 at the current node 102. The transmitter 516, as it receives bits from the second FIFO buffer 508, relays the received bits along channel 0 to the counter-clockwise neighbor and counter-clockwise neighbor's neighbor. The transmitter 516 receives the bit output by the de-skew and compare module 514 and ��appends�� the bit to the end of the relayed frame by transmitting the bit after the relayed frame.
FIG. 12 is a flow diagram of one embodiment of a method of detecting directional integrity in the network 100 of FIG. 1. Although the embodiment of method 1200 shown in FIG. 12 is described here as being implemented using the network 100 shown in FIG. 1, other embodiments are implemented in other networks and in other ways. In the context of FIG. 12, the node 102 that is performing the processing of method 1200 is referred to here as the ��current�� node 102. In one embodiment, at least a portion of the functionality described here as being performed by the current node 102 is implemented in a controller included in the node 102. Other embodiments of method 1200 are implemented in other ways.
When a given node 102 (referred to here in the context of FIG. 12 as the ��transmitting�� node 102) transmits data, each of the neighbor nodes of the transmitting node 102 perform method 1200 in order to determine if the transmitting node 102 is transmitting the same data on both channels 0 and 1 of the network 100 (that is, whether there the transmitting node 102 is transmitting with directional integrity). Method 1200 can be performed, for example, when the nodes 102 in the network 100 are operating in a synchronized mode in which the nodes transmit in accordance with a TDMA schedule. In such an embodiment, method 1200 can be performed by the neighbor nodes in addition to the processing described above in connection with FIG. 3A or FIG. 3B. Method 1200 can also be performed, for example, when the nodes 102 in the network 100 are operating in an unsynchronized mode (for example, during system startup). In such an embodiment, method 1200 can be performed in addition to the processing described in the 10/993,931 Application.
When the transmitting node 102 transmits, both neighbors of the transmitting node exchange the respective frames they receive from the transmitting node over the skip links 108 that communicatively couple the neighbors to one another. As shown in FIG. 12, when the current node 102 receives a frame sourced from one of its neighbors (checked in block 1202), the current node 102 forwards the frame it is receiving from that neighbor (that is, from the transmitting node) to the other neighbor of the transmitting node (block 1204). The current node 102 receives the frame from the transmitting node 102 from the direct link 108 that communicatively couples the current node 102 to the transmitting node. In the context of claim 12, the channel on which the current node 102 receives the frame from the transmitting node 102 is referred to here as the ��current channel.�� The current node 102 forwards the frame it receives from the transmitting node to the other neighbor of the transmitting node 102 over the skip link 108 that communicatively couples the current node 102 to the other neighbor in channel other than the current channel.
The other neighbor of the transmitting node forwards the frame it receives from the transmitting node to the current node 102 over the other skip link 108 that communicatively couples the other neighbor to the current node 102 in the current channel. In the context of FIG. 12, the frame forwarded to the current node 102 by the other neighbor of the transmitting node is also referred to here as the ��other frame.�� The current node 102 receives the other frame (block 1206). The current node 102 compares the frame it is receiving from the transmitting node to the other frame it is receiving from the other neighbor (block 1208). In one embodiment, this comparison is a bit-for-bit comparison.
In one embodiment, higher-layer functionality implemented on top of the transport-layer functionality described above in connection with FIGS. 2-6 and 12 takes advantage of various features of such transport-layer functionality. In the exemplary embodiments described in connection with FIGS. 7-10, such high-layer functionality is implemented so as to use one or more of the features provided by the transport-functionality described above in connection with FIGS. 2-6 and 12 to mitigate value-domain frame errors occurring within the application layer. FIG. 7 is a block diagram of one embodiment of the network 100 of FIG. 1 that is configured, at the application layer, to implement self-checking pairs. Each of the individual nodes 102 implements at least a portion of the transport-layer functionality described above in connection with FIGS. 2-6 and 12. At the application layer, one or more self-checking pairs 700 are established in the network 100. For example, in the embodiment shown in FIG. 7, a self-checking pair 700 is established for nodes A and B (also referred to here individually as ��pair A/B��) and another self-checking pair 700 is established for nodes E and F (also referred to here individually as ��pair E/F��).
In each self-checking pair 700, the two nodes 102 of each pair are required to act, at the application layer, in a replica-deterministic fashion such that the output of each node 102 is bit-for-bit identical. This enables straightforward bit-for-bit voting. In one embodiment, where pure computation-based replication is implemented, replica-determinism requires that the nodes 102 in the pair have both an identical internal state vector (that is, identical history state) and have agreed upon an input-data vector that is used for the next frame of computation. Typically, nodes of a self checking pair perform one or more comparison operations (in an operation commonly referred to as a ��voting�� or ��selection�� operation) in order to determine which of multiple instances of received data should be used in the processing performed by the self checking pair. In the embodiment shown in FIG. 7, the comparisons performed in the transport-layer processing described above in connection FIGS. 1-6 and 12 are leveraged to implement such voting or selection operations performed by such self checking pairs 700.
FIG. 8 is a flow diagram of one embodiment of a method 800 that implements at least a portion of the higher-layer processing performed by a member of self checking pair 700. In the embodiment shown in FIG. 8, each of the nodes 102 in the network 100 implements, at the transport layer, at least a portion of the processing described above in connection with FIGS. 2-6 in order to transmit, relay, and receive frames on the network 100. In the context of FIG. 8, the node 102 that is performing the processing of method 800 is referred to here as the ��current�� node 102. The self checking pair 700 of which the current node 102 is a member is also referred to here as the ��current�� pair 700. In one embodiment, at least a portion of the functionality described here as being performed by the current node 102 is implemented in a controller included in the node 102. Other embodiments of method 800 are implemented in other ways.
Method 800 is performed by the current node 102 for each transmitted frame that is causal to a replica-determinate computation performed by the current pair 700. When a frame is transmitted in network 100, transport-layer functionality implemented at the current node 102 supplies to the application-layer functionality implemented on the current node 102 up to two instances of the transmitted frame�Xone instance ��received�� from channel 0 (block 802) and one instance ��received�� from channel 1 (block 804). In the particular embodiment shown in FIG. 8, for a given channel, the instance of the transmitted frame that the transport-layer functionality provides to the application-layer functionality is the instance of the transmitted frame that the transport-layer functionality relays along that channel (for example, as described above in connection with FIGS. 3A-3B and 4A-4B). Such an instance will include one or more comparison status indicators appended to or included in the instance of the transmitted frame. If the comparison status indicators for such an instance indicate that a mismatch did not occur at the current node 102 or at any previous node 102 along the channel from which the instance was received, the instance is referred to here as having been received ��with integrity.�� If the comparison status indicators for such an instance indicate that a mismatch did occur at the current node 102 or at any previous node 102 along the channel from which the instance was received, the instance is referred to here as having been received ��without integrity.��
In the embodiment shown in FIG. 8, for each transmitted frame that is causal to a replica-determinate computation performed by the pair 700, the member nodes 102 of the pair 700 exchange a 3-bit vector (also referred to here as a ��syndrome��). Each member node 102 of the current pair 700 generates a syndrome based on the instance of the transmitted frame received from channel 0 and the instance of the transmitted frame received from channel 1. Each syndrome includes one bit that indicates whether the node 102 that generated the syndrome received an instance of the transmitted frame from channel 0 with integrity (also referred to here as the ��channel-0 bit��), one bit that indicates whether that node 102 received an instance of the transmitted frame from channel 1 with integrity (also referred to here as the ��channel-1 bit��), and one bit that indicates whether the instance received from channel 0 matches the instance received from channel 1. The member nodes 102 of the self-checking pair 700 exchange syndromes, which are used by each member node 102 to select which instance of the transmitted frame to use for the next replica-determinate computation performed by that pair 700.
In one embodiment, the syndrome exchange occurs during a predetermined time slot. One example of a TDMA schedule 900 for the network 100 of FIG. 7 is illustrated in FIG. 9. The schedule 900 includes a time slot 902 that is assigned to each of the self checking pairs 700 of FIG. 7 to exchange syndromes. In the example shown in FIG. 8, pair A/B and pair E/F exchange syndromes during time slot 902. In one embodiment, the same transport-layer functionality used for ��regular�� time slots is used for the syndrome exchange transmissions. In such an embodiment, when pairs A/B and E/F exchange syndromes during time slot 902, the other nodes 102 in the network 100 are configured to ignore any frames they receive during that time slot 902.
FIG. 10 is a flow diagram of one embodiment of a method 1000 of selecting an instance of a transmitted frame for use in a replica-deterministic computation performed by a self checking pair 700 of FIG. 7. Embodiments of method 1000 are implemented in each member node 102 of a self-checking pair 700. In the context of FIG. 10, the node 102 that is performing the processing of method 1000 is referred to here as the ��current�� node 102. The self checking pair 700 of which the current node 102 is a member is also referred to here as the ��current�� pair 700. In one embodiment, at least a portion of the functionality described here as being performed by the current node 102 is implemented in a controller included in the node 102. Other embodiments of method 1000 are implemented in other ways.
In the embodiment shown in FIG. 10, the current node 102 first checks if the source of the transmitted frame is a self checking pair (or other high-integrity source) (block 1002). In such an embodiment, the selection of which instance of a transmitted frame to use is dependent on the nature of the source of the transmitted the frame. In the embodiment shown in FIG. 10, there are two types of sources�Xself checking pair nodes 700 and ��simplex�� sources. When acting as a simplex source, a single node 102 transmits other than as a member of self checking pair 700. In the network 100 shown in FIG. 7, nodes A and B are a part of pair A/B, nodes E and F are a part of pair E/F.
In the embodiment of method 1000 shown in FIG. 10, if the source of the transmitted frame is not a self checking pair, the current node 102 checks if both the current node 102 and the other member node 102 of the current pair 700 received an instance of the transmitted frame from the same channel with integrity (checked in block 1014). If that is the case, the current node 102 selects such an instance of the transmitted frame for use in performing the replica-deterministic computation (block 1016). In the embodiment shown in FIG. 10, when the source of the transmitted frame is a not a self checking pair (and the directional integrity functionality described above in connection with FIG. 12 is not used) and the current node 102 receives an instance with integrity from both channels, it may nevertheless be the case that the two received instances are not identical. Therefore, in such an embodiment, the member nodes 102 of the current pair 700 have a bias in favor of one of the channels (also referred to here as the ��primary channel��) such that, in the event that both member nodes 102 of the current pair 700 receive an instance with integrity from both of the channels, both member nodes 102 select the instance received from the primary channel.
Where the precision of a globally agreed fault-tolerant time base is a large number of bit cells (on the order of 1 microsecond to 5 microseconds), a local rendezvous between the two members of the pair is used to achieve the required level of synchronization. In one implementation, a ��halt-release�� protocol using the direct links 108 is used. In such an implementation, when a self checking pair 700 transmits, the ��faster�� member node 102 of the pair 700 initially transmits an IDLE preamble at the beginning of the assigned time slot. The faster node 102 continues to send such an IDLE preamble until the faster node 102 detects that the ��slower�� member node 102 has started its transmission. The slower node, detecting the presence of the faster node 102, sends a minimal preamble, which is only long enough for the faster node to detect and align the start of the faster node's real transmission. The precise time, in one implementation, is configured a priori using a suitable parameter in the global TDMA schedule table. Using this approach (or similar approaches), the time difference between the two member nodes 102 of a transmitting self checking pair 700 can be closely aligned to within the expected nominal propagation delay of the network 100 (for example, around one to three bit cells). By performing such a rendezvous function to closely align the transmissions of the member nodes 102 of a self-checking pair 700, the de-skew and comparison functionality implemented at the other nodes 102 of the network 100 can be utilized without requiring an increase in the FIFO buffer sizes.
In other embodiments, in addition to or instead of a pure computation self checking pair configuration, the direct links 108 between two neighbor nodes 102 are used as ��private�� channels between those two neighbor nodes 102 in order to exchange and/or agree on other types of data such as local sensor data. In such an embodiment, the entire raw data is exchanged between the two neighbor nodes 102. As with the exchange of the syndromes in time slot 902 of FIG. 9, multiple, different pairs of neighbor nodes 102 in the network 100 can exchange sensor data during the same time slot.
Also, in other embodiments, other hybrid self-checking pair schemes are implemented in which only a subset of the nodes 102, tasks and/or transmissions operate in a replica-determinate fashion. For example, as noted above in connection with FIG. 9, in the embodiment described above in connection with FIGS. 7-10, nodes B and F transmit as members of pairs A/B and E/F in time slots 904 and 906, respectively, and as simplex sources in time slots 916 and 918, respectively. Since each ��critical�� transmission is characterized in the global time schedule table (for example, by identifying whether the source is self checking pair or a simplex source), the behavior of neighboring nodes is varied from ��bus guardian�� to member node 102 of a self checking pair 700 from round-to-round and/or from slot-to-slot. For example, node A transmits as a member of pair A/B during time slot 904 and acts as a bus guardian node for node B during time slot 916.
The TTP/C controller 1112 includes a communication network interface (CNI) 1116 that serves as an interface between the host 1110 and the other components of the TTP/C controller 1112. In the embodiment shown in FIG. 11, the CNI 1116 is implemented using a dual-ported memory 1118 (also referred to here as the ��CNI memory 1118). The CNI memory 1118 is accessed by the host 1110 and by a TTP/C controller unit 1120 included in the TTP/C controller 1112. In one implementation of such an embodiment, the CNI memory 1118 is implemented using a static random access memory (SRAM). A bus interface 1122 couples the CNI memory 1118 to buses 1124 (for example, data, address, and/or control buses) over which the host 1110 reads and writes data from and to the CNI memory 1118. In other embodiments, the CNI memory 1118 is accessed in other ways (for example, using a serial interface).
The systems, devices, methods, and techniques described here may be implemented in networks having network topologies other than the particular braided-ring topology illustrated in FIG. 1. For example, at least some of the systems, devices, methods, and techniques described here may be implemented in networks in which additional inter-node connections are provided between the various nodes of the network. One example of such a network is a ��mesh�� network. In one example of such a mesh embodiment, each node is communicatively coupled to all the other nodes in the network 100 (in the case of a ��full�� mesh network topology) or a subset of the other nodes in the network (in the case of a ��partial�� mesh network topology). For each such node, and for a given flow of data within a given channel defined in such a mesh network, at least a subset of the nodes to which that node is coupled are designated as receive-from nodes for that node and at least a subset of the nodes to which that node is coupled are designated as transmit-to nodes.
Moreover, at least some of the systems, devices, methods, and techniques described here may be implemented in networks in which fewer inter-node connections are provided between the various nodes of the network. One example of such a network is a network that comprises two ��simplex�� ring channels. One such embodiment is implemented in a manner to that shown in FIG. 1 except that there are no skip links that communicatively couple each node to its clockwise and counter-clockwise neighbor's neighbors). For example, an embodiment of method 300 is suitable for use in such a simplex ring network.
�M�Q�ޥ� �ޥΪ��M�Q�ӽФ���o�G��� �ӽЪ��M�Q�W��US44173341981�~4��16��1983�~11��22��Ncr CorporationData processing system having dual-channel system busUS44280461980�~5��5��1984�~1��24��Ncr CorporationData processing system having a star coupler with contention circuitryUS46302541984�~10��26��1986�~12��16��Trw Inc.Controlled star networkUS46317181985�~1��7��1986�~12��23��Fuji Xerox Co., Ltd.Method and device for synchronization of system timingUS47409581986�~10��15��1988�~4��26��International Computers LimitedData transmission systemUS48560231986�~7��23��1989�~8��8��Ncr CorporationSystem for maintaining low bit error rate in a starcoupled network of direct coupled stationsUS48666061987�~6��24��1989�~9��12��Austria Miktosystem International GmbhLoosely coupled distributed computer system with node synchronization for precision in real time applicationsUS51611531990�~10��5��1992�~11��3��Stc PlcSynchronous networkUS52572661991�~2��27��1993�~10��26��General Dynamics Corporation, Space Systems DivisionComputer and communications systems employing universal direct spherics processing architecturesUS53074091992�~12��22��1994�~4��26��Honeywell IncApparatus and method for fault detection on redundant signal lines via encryptionUS53412321989�~2��20��1994�~8��23��Licentia Patent-Verwaltung-GmbhStar-shaped network for data communication between stationsUS53864241993�~3��31��1995�~1��31��Honeywell, Inc.Apparatus and method for transmitting information between dual redundant components utilizing four signal pathsUS55577781994�~11��7��1996�~9��17��Network Devices, Inc.Star hub connection device for an information display systemUS58965081995�~2��23��1999�~4��20��Advanced Micro Devices, Inc.Hub-network adapter device for a file server personal computerUS59035651995�~8��15��1999�~5��11��Wabco GmbhSerial bus system using bitwise arbitration for independently communicating with and controlling individual bus systemsUS60527531998�~1��20��2000�~4��18��Alliedsignal Inc.Fault tolerant data busUS62266761998�~10��7��2001�~5��1��Nortel Networks CorporationConnection establishment and termination in a mixed protocol networkUS63740782000�~5��31��2002�~4��16��Direct Wireless CorporationWireless communication system with multiple external communication linksUS65130922000�~4��18��2003�~1��28��Nec Eluminant Technologies, Inc.1:N protection switching architecture for common processing unitsUS65948022000�~11��20��2003�~7��15��Intellitech CorporationMethod and apparatus for providing optimized access to circuits for debug, programming, and testUS66183591998�~10��7��2003�~9��9��Nortel Networks LimitedError recovery in a mixed protocol networksUS67079132000�~4��11��2004�~3��16��Verizon Laboratories Inc.Network interfaceUS67607682001�~8��7��2004�~7��6��Micron Technology, Inc.Method and system for establishing a security perimeter in computer networksUS68426172002�~4��8��2005�~1��11��Wahoo Communications CorporationWireless communication device with multiple external communication linksUS69254972000�~9��26��2005�~8��2��Microsoft CorporationSystems and methods for controlling the number of clients that access a serverUS69564612001�~8��30��2005�~10��18��Lg Electronics Inc.Apparatus and method for remotely controlling household appliancesUS70503952001�~11��30��2006�~5��23��Redback Networks Inc.Method and apparatus for disabling an interface between network element data processing unitsUS70855602004�~9��23��2006�~8��1��Wahoo Communications CorporationWireless communications device with artificial intelligence-based distributive call routingUS70889211999�~6��11��2006�~8��8��Lucent Technologies Inc.System for operating an Ethernet data network over a passive optical network access systemUS200200278772001�~8��3��2002�~3��7��Agency For Defense DevelopmentPacket processing method using multiple fault tolerant network structureUS200200877632001�~11��13��2002�~7��4��Wendorff Wilhard VonCommunication sytem with a communication busUS200501321052004�~11��19��2005�~6��16��Honeywell International, Inc.Mobius time-triggered communicationAT407582B �W�٤���DE3238692A1 �W�٤���DE19633744A1 �W�٤���DE20220280U1 �W�٤���EP0405706A11990�~2��7��1991�~1��2��Gpt LimitedProcessor unit networksEP1280024A12001�~7��26��2003�~1��29��Motorola Inc.Clock synchronization in a distributed systemEP1280312A22002�~6��26��2003�~1��29��Hitachi, Ltd.Methods, systems and computer program products for checking the validity of dataEP1365543A22003�~2��27��2003�~11��26��Robert Bosch GmbhMethod and apparatus for transmitting information and detection of failures in a ring networkEP1398710A22003�~2��5��2004�~3��17��Hitachi, Ltd.Network systemEP1469627A12003�~4��14��2004�~10��20��Alcatel Alsthom Compagnie Generale D'ElectriciteMethod for secure data transferGB1581803A �W�٤���GB2028062A �W�٤���GB2175775A �W�٤���WO2000064122A11999�~4��15��2000�~10��26��Feitelberg, RafaelMonitoring integrity of transmitted data�D�M�Q�ޥ��ѦҤ��m1"Backplane Data Bus ARINC Specification 659", Dec. 1993, pp. 1-132, Publisher: ARINC.2"Flexray Communication System: Protocol Specification Version 2.1 Revision A", "www.flexray-group.com", Mar. 2006, pp. 1-8, Publisher: Flexray Consortium.3"Internet Content Adaptation", "Network Appliance", Jul. 2001, pp. 1-13.4"Preliminary Central Bus Guardian Specification Version 2.0.9", Dec. 2005, pp. 1-38, Publisher: Flexray Consortium.5"Preliminary Node-Local Bus Guardian Specification Version 2.0.9", Dec. 2005, pp. 1-75, Publisher: Flexray Consortium.6"Software Considerations in Airborne Systems and Equipment Certification", "http://www.rtca.org", Dec. 1992, pp. 1-112, Publisher: RTCA.DO-178b.7"Time-Triggered Protocol TTP/C", Publisher: TTTECH Computertechnik GmbH, Published in: Austria.8Al-Rousan et al., "The Two-Processor Reliability of Hierarchical Larg-Scale Ring-Based Networks", "Proceedings of the 29th Hawaii International Conference on System Sciences", 1996, pp. 63-71.9Avizienis,"A Fault Tolerance Infrastructure for Dependable Computing With High-Performance Cots Components", "Conference Proceedings on: Dependable Systems and Networks", Jun. 25, 2000, pp. 492-500, Publisher: IEEE, Published in: New York, NY.10Bauer et al., "Assumption Coverage Under Different Failure Modes in the Time-Triggered Architecture", "8th IEEE International Conference on Emerging Technologies and Factory Automation", Oct. 2001, pp. 333-341, Publisher: IEEE.11Bauer et al., "The Central Guardian Approach to Enforce Fault Isolation in a Time-Triggered System", "Proceedings of Symposium on Autonomous Decentralized Systems", Apr. 2003, pp. 37-44, Publisher: IEEE.12Bauer et al., "Transparent Redundancy in the Time-Triggered Architecture", "Proceedings of the Conference on Dependable Systems and Networks", 2000, pp. 5-13, Publisher: IEEE.13Bosch, "Can Specification Version 2.0", "SAE Handbook-Parts and Components", 1998, pp. 1-72, vol. 2, Publisher: Society of Automotive Engineers.14Brinkmeyer, "Flexray International Workshop Slides", "www.flexray-group.com", Apr. 2002, pp. 1-356, Publisher: Flexray.15D'Luna, "A Single-Chip Universal Cable Set-Top Box/Modern Transceiver", "Journal of Sold-State Circuits", Nov. 1998, pp. 1647-1660, vol. 34, No. 11, Publisher: IEEE.16Driscoll et al., "The Real Byzantine Generals", "Proceedings of Digital Avionics System Conference", Oct. 2004, pp. 6.D.4-1-6.D.4-11, Publisher: IEEE.17Grnarov et al., "A Highly Reliable Distributed Loop Network Architecture", "Proceedings of Fault-Tolerant Computing Symposium", Jun. 1980, pp. 319-324, Publisher: IEEE.18Gruenbacher, "Fault Injection for TTA", 1999, Publisher: Information Society Technologies.19Hall et al., "Ringing Out Fault Tolerance a New Ring Network for Superior Low-Dost Dependability", "International Conference on Dependable Systems and Networks (DSN'05)", 2005, pp. 298-307.20Hammett et al., "Achieving 10-9 Dependability With Drive-By-Wire Systems", "SAE World Congress", 2003, pp. 534-547, vol. 112, No. 7, Publisher: Society of Automotive Engineers.21Hopper et al., "Design and Use of an Integrated Cambridge Ring", "Journal on Selected Areas in Communications", Nov. 2003, pp. 775-784, vol. 1, No. 5, Publisher: IEEE.22Hoyme et al., "Safebus", "IEEE Aerospce and Electronics Systems Magazine", Mar. 1993, pp. 34-39, vol. 8, No. 3, Publisher: IEEE.23Hoyme et al., "SAFEbus", "Proceedings of the Digital Avionics Systems Conference", Oct. 1992, pp. 68-73, Publisher: IEEE.24Huber et al., "SILK: An Implementation of a Buffer Insertion Ring", "Journal on Selected Areas in Communications", Nov. 1983, pp. 766-774, vol. 1, No. 5, Publisher: IEEE.25Hwang et al., "Survival Reliability of Some Double-Loop Networks and Chordal Rings", "Transactions on Computers", 1995, pp. 1468-1471, vol. 44, No. 12, Publisher: IEEE.26IEEE Computer Society, "1149.6 IEEE Standard for Boundary-Scan Testing of Advanced Digital Networks", Apr. 17, 2003, pp. 1-139, Publisher: IEEE, Published in: New York, NY.27Johansson et al., "On Communication Requirements for Control-by-Wire Applications", "Proceedings of System Safety Conference", Aug. 2003, pp. 1123-1132.28Kanoun et al., "Dependability Evalucation of Bus and Ring Communication Topologies for the Delta-4 Distr Fault-Tolerant Architecture", "Proceedings of the Symposium on Reliable Distributed Systems", 1991, pp. 130-141, Publisher: IEEE.29Kieckhafer et al., "The Maft Architecture for Distributed Fault Tolerance", "Transactions on Computers", 1988, pp. 398-405, vol. 37, No. 4, Publisher: IEEE.30Kopetz et al., "TTP-A Protocol for Fault-Tolerant Real-Time Systems", "Computer", January 1194, pp. 14-23, vol. 27, No. 1, Publisher: IEEE Computer Society, Published in: Long Beach, CA.31Liu et al., "The Distributed Double-Loop Computer Network (DDLCN)", "ACM '80 Proceedings of the ACM 1980 Annual Conference", 1980, pp. 164-178, Publisher: ACM.32Lonn, "Initialsynchronization of TDMA Communication in Distributed Real-Time Systems", "Conference on Distributed Computing Systems", 1999, pp. 370-379, Publisher: IEEE.33Nayak et al., "Ring Reconfiguration in Presence of Close Fault Cuts", "Proceedings of Hawaii International Conference on System Science", 1996, pp. 422-428, Publisher: IEEE.34Paulitsch et al., "Cverage and the Use of Cyclic Redundancy Codes in Ultra-Dependable Systems", "2005 International Conference on Dependable Systems and Networks (DSN'05)", 2005, pp. 346-355.35Poledna et al., "Replica Determinism and Flexible Scheduling in Hard Real-Time Dependable Systms", "IEEE Transactions on Computers", Feb. 2000, pp. 100-111, vol. 49, No. 2, Publisher: IEEE.36Poledna, "Replica Determinism in Distributed Real-Time Systems: A Brief Survey", "Real-Time Systems", 1994, pp. 289-316, vol. 6.37Rushby, "Bus Architectures for Safety-Critical Embedded Systems, Embedded Software", "Proceedings of 1st International Workshop on Embedded Software, Notes in Computer Science", Oct. 2001, pp. 306-323, vol. 2211, Publisher: Springer-Verlag, Published in: Germany.38Saltzer et al., "Why a Ring", "Proceedings of Symposium on Data Communications", 1981, pp. 211-217, Publisher: IEEE.39Sivencrona et al., "Protocol Membership Agreement in Distributed Communicaiton System-A Question of Brittleness", "SAE World Congress, Paper No. 2003-01-0108", 2003, pp. 1-6, Publisher: Society of Automotive Engineers Inc.40Steiner et al., "The Startup Problem in Fault-Tolerant Time-Triggered Communication", "International Conference on Dependable Systems and Networks (DSN'06)", 2006, pp. 35-44.41Steiner et al., "The Transition From Asynchronous to Synchronous System Operation: An Approach From Distributed Fault-Tolerant Systems", "Proceedings of Conference on Distributed Computing Systems", Jul. 2002, pp. 329-336, Publisher: IEEE.42Sundaram et al., "Controller Integrity in Automotive Failsafe System Architectures", "2006 SAE World Congress", 2006, pp. 1-10, Publisher: SAE International.43Tomlinson et al., "Extensible Proxy Services Framework", Jul. 2000, pp. 1-13, Publisher: Internet Society.44Wensley et al., "The Design, Analysis, and Verification of the Sift Fault Tolerant System", "Proceedings of Conference on Software Engineering", 1976, pp. 458-469, Publisher: IEEE Computer Society Press.45Yeh, "Design Condiserations in Boeing 777 Fly-By-Wire Computers","High-Asssurance Systems Engineering Symposium", Nov. 1998, pp. 64-72, Publishers: IEEE.46Yeh, "Triple-Triple Redundant 777 Primary Flight Computer", "Proceedings of the Aerospace Applications Conference", 1996, pp. 293-307, vol. 1, Publisher: IEEE, Published in: New York, NY.�Q�H�U�M�Q�ޥ� �ޥΥ��M�Q�ӽФ���o�G��� �ӽЪ��M�Q�W��US76568812006�~12��13��2010�~2��2��Honeywell International Inc.Methods for expedited start-up and clique aggregation using self-checking node pairs on a ring networkUS76680842006�~9��29��2010�~2��23��Honeywell International Inc.Systems and methods for fault-tolerant high integrity data propagation using a half-duplex braided ring networkUS77781592007�~9��27��2010�~8��17��Honeywell International Inc.High-integrity self-test in a network having a braided-ring topologyUS78896832006�~11��3��2011�~2��15��Honeywell International Inc.Non-destructive media access resolution for asynchronous traffic in a half-duplex braided-ringUS79120942006�~12��13��2011�~3��22��Honeywell International Inc.Self-checking pair-based master/follower clock synchronizationUS81307732009�~3��19��2012�~3��6��Honeywell International Inc.Hybrid topology ethernet architectureUS81563712009�~6��16��2012�~4��10��Honeywell International Inc.Clock and reset synchronization of high-integrity lockstep self-checking pairsUS81797872009�~1��27��2012�~5��15��Smsc Holding S.A.R.L.Fault tolerant network utilizing bi-directional point-to-point communications links between nodesUS82137062008�~4��22��2012�~7��3��Honeywell International Inc.Method and system for real-time visual odometryUS200903237042009�~3��19��2009�~12��31��Honeywell International Inc.Hybrid topology ethernet architectureUS201002054982009�~11��12��2010�~8��12��Taiwan Semiconductor Manufacturing Company, Ltd.Method for Detecting Errors and Recovering Video DataWO2010098811A22010�~1��26��2010�~9��2��Firefly Green Technologies Inc.Fault tolerant network utilizing bi-directional point-to-point communications links between nodes������l�Ϥ�Google ���� - Sitemap - USPTO �j�q�U�� - ���p�v�F�� - �A�ȱ�� - ���� Google �M�Q - �N���^�X��ƬO�Ѭ��ӷ~�M�Q��Ʈw (IFI CLAIMS Patent Services) ����©2012 Google