Many safety-relevant real-time systems require fault-tolerant clock synchronization. For the class of bridge-connected networks with a very small amount of redundant point-topoint links, particularly ring topologies, a new clock synchronization protocol is proposed: “single initiator forward and answer”, SFA for short. This solution tolerates (almost) arbitrary behavior of a single faulty bridge, although it requires only two disjoint paths between any pair of bridges.

Summary form only given. Detailed state transition models of fault-tolerant systems tend to induce extremely large state spaces, mainly caused by the nondeterministic nature of faults. One of the well-known countermeasures is partial ordering technique. Yet the remaining state space can be by far too large. We deal with a special partial ordering criteria to limit fault effects: After the model components have been grouped to single fault regions the concurrency between these regions is reduced by firing rules of the respective transitions. The rules are either based on a priority scheme or, preferably, on a model of time consumption. It is shown how the approach can be realized in standard SDL without an extension to the language. The problems of the underlying SDL time model and the relationship to single fault regions are discussed deeply. An experimental evaluation with a large model shows the usefulness of the approach.

For the comparison-based self-diagnosis of multiprocessor systems, an extended model that considers both processor and comparator faults is presented. It is shown that in this model the system diagnosability is t>