公开(公告)号：US10571920B2

公开(公告)日：2020-02-25

申请号：US15678181

申请日：2017-08-16

Applicant: FTS Computertechnik GmbH

Inventor： Stefan Poledna ,  Georg Niedrist ,  Eric Schmidt ,  Christopher Helpa ,  Hermann Kopetz

IPC: G05D1/02 ,  G05D1/00 ,  G06F11/14 ,  G06F11/18 ,  H04L29/08

Abstract: A method is provided by which a complex electronic system for controlling a safety-critical technical process, for example driving an autonomous vehicle, can be implemented. A distinction is made between simple and complex software, wherein the simple software is executed on error-tolerant hardware and wherein a plurality of diverse versions of the complex software are implemented simultaneously on independent fault containment units (FCU). A consolidated environmental model is developed from a number of different environmental models and represents the basis for trajectory planning.

公开(公告)号：US10359772B2

公开(公告)日：2019-07-23

申请号：US15677878

申请日：2017-08-15

Applicant: FTS Computertechnik GmbH

Inventor： Stefan Poledna ,  Georg Niedrist ,  Eric Schmidt ,  Christopher Helpa ,  Hermann Kopetz

IPC: G05B23/02 ,  G06F11/20 ,  G06F11/36 ,  G06F9/448

Abstract: An innovative method is provided by which a complex electronic system for controlling a safety-critical technical process, for example driving an autonomous vehicle, can be implemented. A decision is made between simple and complex software, wherein the simple software is implemented on error-tolerant hardware and wherein a plurality of different versions of the complex software are simultaneously implemented in independent fault containment units (FCU) and wherein a result that is to be transmitted to the actuators is selected by a decider from the results of the complex software that is implemented using the simple software.

公开(公告)号：US10241858B2

公开(公告)日：2019-03-26

申请号：US15508924

申请日：2015-09-03

Applicant: FTS COMPUTERTECHNIK GMBH

Inventor： Hermann Kopetz

IPC: G06F11/07 ,  G06F11/16

Abstract: The invention relates to a computer system for carrying out safety-critical applications, said computer system comprising a plurality of node computers and a communications system. Sensor data are supplied in parallel to one or more node computers, the node computers calculating an optimized result, preferably using an optimization algorithm, in order to solve a given problem, and transmitting said optimized result, preferably for checking the safety, to a node computer which is designed as an SCFCU, said SCFCU being directly connected to the actuator controller, and the SCFCU furthermore calculating from the sensor data a simple result, which preferably meets all safety requirements, and an envelope of the simple result, and the SCFCU checking whether the resulting values, particularly those relevant to safety, of the optimized result lie within the envelope of the simple result, and, if this is the case, directly forwarding the optimized result to the actuator controller, and, if this is not the case, forwarding the simple result calculated by the SCFCU directly to the actuator control.

公开(公告)号：US09898924B2

公开(公告)日：2018-02-20

申请号：US15445224

申请日：2017-02-28

Applicant: FTS COMPUTERTECHNIK GMBH

Inventor： Hermann Kopetz

IPC: G08B29/00 ,  G08B29/18 ,  H04L12/24 ,  H04L29/08 ,  G06F11/26

CPC classification number: G08B29/185 ,  G06F11/261 ,  H04L12/417 ,  H04L41/0681 ,  H04L41/069 ,  H04L67/10 ,  H04L67/12

Abstract: The invention relates to a method for the reliable transport of alarm messages in a distributed computer system, said computer system comprising components, in particular a plurality of components, the components being node computers, distributor units, sensors—preferably intelligent sensors—and actuators—preferably intelligent actuators—and all components having access to a global time of known precision, and the node computers, intelligent sensors and intelligent actuators exchanging messages via the distributor units. It is provided that the computer system includes intelligent alarm sensors or intelligent alarm sensors are assigned to the computer system, and an intelligent alarm sensor transmits two types of time-triggered messages, alarm messages having an alarm transport period prescribed a priori, and error detection messages having an error detection period prescribed a priori, and the time stamps for the occurrence of alarm events are included in an alarm monitoring interval, the alarm monitoring interval ending directly before the transmission of the alarm message and being at least twice as long as the alarm transport period, and an alarm message only being transmitted if at least one time stamp of an alarm event is included in the alarm message, and the current states of all alarms that are active immediately before the transmission of the error detection message are included in the periodic error detection messages.

公开(公告)号：US09697096B2

公开(公告)日：2017-07-04

申请号：US14776210

申请日：2014-03-13

Applicant: FTS COMPUTERTECHNIK GMBH

Inventor： Hermann Kopetz

IPC: G06F11/20 ,  G05B9/03 ,  B60T8/88

CPC classification number: G06F11/2028 ,  B60T8/885 ,  B60T2270/402 ,  B60T2270/406 ,  B60T2270/413 ,  G05B9/03 ,  G05B2219/2637 ,  G06F2201/86

Abstract: The invention relates to a method and a device for limiting the risk of faults in a control system, in particular a safety-relevant control system, wherein a preferably intelligent actuator controller (AST), by means of the application of a weighted mean value algorithm, calculates a new control value from the two control values determined by means of diverse redundancy by two independent fault-containment units (FCUs), which new control value, in spite of the occurrence of a fault in one of the two FCUs, causes an object to be controlled by the control system to be guided into a safe state, preferably quickly.

公开(公告)号：US10394671B2

公开(公告)日：2019-08-27

申请号：US15327141

申请日：2015-07-17

Applicant: FTS COMPUTERTECHNIK GMBH

Inventor： Hermann Kopetz

IPC: G06F11/00 ,  G06F11/20 ,  G05B19/042 ,  G05B23/02

Abstract: The invention relates to a fault-tolerant, maintainable automation system comprising two central computers, a process periphery and gateway computers, wherein the central computers and the gateway computers are fail-silent FCUs and represent autonomous exchange units, and the central computers and gateway computers exchange timed status messages via communications channels, and wherein each gateway computer establishes the link to the process periphery associated with the gateway computer and saves the current status of the process periphery associated with the gateway computer, and wherein a central computer assumes the role of an active central computer and another central computer assumes the role of a passive central computer, and wherein the active central computer exerts control over the gateway computers, and wherein the active central computer transmits a sign-of-life message to the passive central computer, preferably periodically, and wherein the passive central computer acknowledges the receipt of a sign-of-life message from the active central computer in a periodic sign-of-life message and monitors it through a time-out, and wherein the passive central computer assumes the role of the active central computer if the sign-of-life messages fail to appear after the time-out, and wherein the faulty, previously active central computer autonomously attempts to restart and, following a successful restart, monitors the communications traffic within a cluster, the cluster containing the central computer, in order to ascertain the current status of the cluster, and wherein the computer assumes the role of the passive central computer and informs the now-active central computer by means of preferably periodic sign-of-life messages that it is performing the role of the passive central computer, and wherein, if the restart is unsuccessful, the faulty central computer indicates the permanent error by means of a display means.

公开(公告)号：US10346242B2

公开(公告)日：2019-07-09

申请号：US15514578

申请日：2015-09-28

Applicant: FTS COMPUTERTECHNIK GMBH

Inventor： Stefan Poledna ,  Hermann Kopetz

IPC: G06F11/00 ,  G06F11/07 ,  G06F11/18 ,  G06F11/16

Abstract: The invention relates to a time-controlled distribution unit (30, 31) for the distribution of messages in a distributed computer system for safety-critical applications. Said distribution unit is designed as a self-testing functional unit and comprises input channels (201 . . . 222) for receiving time-controlled periodic input messages from node computers (20, 21, 22) upstream in the data flow, and output channels (301 . . . 333) for transmitting time-controlled periodic output messages to the node computers (50, 51, 52) downstream in the data flow, a computer (40) being provided in the distribution unit and being designed to analyze, by means of a “simple” software, useful information contained in the input messages, and to decide whether output messages are output and, if so, which useful information is contained in the output messages.

公开(公告)号：US10324797B2

公开(公告)日：2019-06-18

申请号：US15440449

申请日：2017-02-23

Applicant: FTS COMPUTERTECHNIK GMBH

Inventor： Hermann Kopetz

IPC: G06F11/00 ,  G06F11/14 ,  H04L12/24 ,  H04L29/08 ,  G05B19/04 ,  G06F11/20 ,  G06F11/16 ,  G06F11/18

Abstract: A fault-tolerant distributed real-time computer system for controlling a physical system, in particular a machine or a motor vehicle, wherein the components of the computer system have access to a global time of known precision, and wherein the node computers and intelligent sensors and the intelligent actuators exchange time-triggered messages and event-triggered messages periodically via the distributor units, and wherein the functions of the user software are contained in real-time software components—RTSC—and the periodic time-triggered data transfer between the RTSC is specified by a time-triggered data flow diagram, and wherein the assignment of the RTSC to a TTVM of a node computer and specific parameters of the TTVM are contained in active local allocation plans for each RTSC, and wherein the time plans for the time-triggered communication in this distributor unit are contained in active local allocation plans for each distributor unit, and wherein a global allocation plan consists of the totality of the local allocation plans, which are adapted to one another, of all RTSC and all distributor units of the user software, and wherein a monitor component periodically receives a copy of messages of the node computers to define the present operating state of the node computers, and wherein after the permanent failure of one or more RTSC, the monitor component activates a passive global allocation plan which specifies the allocation of the RTSC and the data supply thereof on newly installed TTVMs to the still functional node computers, and wherein the RTSC arrive at the newly configured TTVMs for execution at the provided periodic restart point in time in accordance with the selected passive global allocation plan.

公开(公告)号：US10306015B2

公开(公告)日：2019-05-28

申请号：US15377585

申请日：2016-12-13

Applicant: FTS COMPUTERTECHNIK GMBH

Inventor： Hermann Kopetz

IPC: H04L29/08 ,  H04J3/06 ,  H04L12/26 ,  H04L12/417 ,  H04L12/44

Abstract: A method is provided for the periodic detecting of measured values in a distributed real-time computer system, which comprises a plurality of intelligent sensors, node computers, and distribution units, wherein the intelligent sensors, the node computers, and the distribution units have access to a global time, wherein real-time data is transported in the real-time computer system by time-triggered real-time messages, wherein periodically recurring global observation instants are established or will be established in the real-time computer system at the beginning of a frame, wherein each node computer controlling a physical sensor outputs a trigger signal to the the physical sensor at a sensor-specific trigger instant of the sensor controlled by the node computer, which specific trigger instant is calculated from the difference between the global observation instant and a sensor-specific startup interval.

公开(公告)号：US10146735B2

公开(公告)日：2018-12-04

申请号：US15019234

申请日：2016-02-09

Applicant: FTS Computertechnik GmbH

Inventor： Stefan Poledna ,  Hermann Kopetz ,  Martin Schwarz

IPC: G06F15/173 ,  H04L29/08 ,  G06F12/1081 ,  G06F12/0831 ,  H04L12/931 ,  H04L12/933

Abstract: The invention relates to a method for processing real-time data in a distribution unit of a distributed computer system, the computer system comprising a plurality of node computers and distribution units, the distribution unit containing, in addition to a switching engine (SE) and a switching memory (SM), one or more application computers each with one or more application central processing units and each with one or more application memories (AM), wherein the switching engine of the distribution unit, when it receives, at one of its ports, a message intended for an application computer, forwards this message to the addressed application computer through a direct memory access (DMA) unit that is arranged between the switching memory and the application memory of the addressed application computer and that is under the control of the switching engine. The invention also relates to an expanded distribution unit and a computer system with such expanded distribution units.