TTEthernet is a novel communication infrastructures that allows using a single physical communication infrastructure for distributed applications with mixed-criticality requirements, e.g. the command and control systems and audio/video systems. This is achieved via a fault-tolerant self-stabilizing synchronization strategy, which establishes temporal partitioning and, hence, ensures isolation of the critical dataflows from the non-critical dataflows. The focus in this paper is on the dataflow in TTEthernet. For this we take the synchronization as a given and discuss from a TTEthernet user perspective which communication options TTEthernet provides and how they are aligned and realized. While this paper uses TTEthernet as reference communication infrastructure, the methods and strategies presented are valid for any message-based network.

Arbitrary faults of a single node In a time-triggered architecture (TTA) bus topology system may cause error propagation to correct nodes and may lead to inconsistent system states. This has been observed in validation work using software implemented fault injection (SWIFI) and heavy-ion fault injection techniques in a TTA cluster. In a TTA system, the membership and the clique avoidance algorithms detect state inconsistencies and force the nodes that do not have the same state with the state of majority of nodes, to restart. Changing the interconnection structure of the cluster to a star topology allows the use of star couplers that will isolate faults of a node, thus guaranteeing consistency, even in the presence of arbitrary node failures. The same SWIFI and heavy-ion fault injection experiments that caused error propagation in bus-based TTA clusters, were performed in the star configuration. No error propagation was observed in a TTA system with the star topology during the execution of SWIFI and heavy-ion experiments.

This paper discusses measures to make a distributed system based on the time-triggered architecture resistant to arbitrary node failures. The presented approach introduces a central guardian as part of the interconnection network. This guardian acts as a supervising unit to node computers by checking for compliance to the fault hypothesis at the network interface of the node. By implementing appropriate algorithms the guardian is able to transform failure modes (of nodes) that cannot be tolerated by the fault hypothesis of the TTP/C protocol. This transformation ensures that at the interface to correct nodes, even an arbitrarily faulty node will be compliant to the fault hypothesis of the TTP/C communication protocol.

The time-triggered architecture (TTA) provides a computing infrastructure for the design and implementation of dependable distributed embedded systems. A large real-time application is decomposed into nearly autonomous clusters and nodes, and a fault-tolerant global time base of known precision is generated at every node. In the TTA, this global time is used to precisely specify the interfaces among the nodes, to simplify the communication and agreement protocols, to perform prompt error detection, and to guarantee the timeliness of real-time applications. The TTA supports a two-phased design methodology, architecture design, and component design. During the architecture design phase, the interactions among the distributed components and the interfaces of the components are fully specified in the value domain and in the temporal domain. In the succeeding component implementation phase, the components are built, taking these interface specifications as constraints. This two-phased design methodology is a prerequisite for the composability of applications implemented in the TTA and for the reuse of prevalidated components within the TTA. This paper presents the architecture model of the TTA, explains the design rationale, discusses the time-triggered communication protocols TTP/C and TTP/A, and illustrates how transparent fault tolerance can be implemented in the TTA.

The Time-Triggered Architecture (TTA) is a distributed computer architecture for highly dependable real-time systems. The core building block of the TTA is the communications protocol TTP/C. This protocol has been designed to provide non-faulty nodes with consistent data in the presence of faulty nodes. To achieve this consistency the protocol assumes that a fault is either a reception fault or a consistent send fault of some node. Although the communications protocol of the TTA uses this rather optimistic failure mode assumption, the TTA can isolate and tolerate a broader class of faults. This is possible by making intensive use of the static knowledge present in a TTA distributed computer system. This off-line available knowledge allows to build interconnection networks which transform failure modes of nodes into failure modes the communications protocol can deal with. This paper will discuss three alternative implementations of interconnection networks for the TTA which have been designed to meet different failure mode assumptions.

The time-triggered architecture is an architecture for distributed embedded real-time systems in high dependability applications. The core element of the architecture is the time-triggered communications protocol TTP/C. This paper shows how TTP/C can be extended by a fault-tolerance layer that performs those functions that are necessary for the implementation of application redundancy. The hardware/software interface of the host computer where the application software is executing, is not changed, neither in the value domain, nor in the temporal domain, by this implementation of fault-tolerance in the communications system. Provided the application software has been properly organized it is thus possible to implement application redundancy transparently, i.e., without any modification of the function and timing of the application system. The paper also discusses the experiences gained from a prototype implementation of the fault-tolerance layer in the microprogram of a TTP/C controller chip.

Avoiding the partitioning of a cluster into cliques that are not able to communicate with each other is an important issue in the time-triggered communication protocol TTP/C. This is achieved by a mechanism called clique avoidance. The clique avoidance algorithm always selects one partition (clique) to win and causes all nodes of other partitions to shut down. In this paper, we investigate the properties of this algorithm by analyzing its performance, elaborating the properties and showing how the clique avoidance algorithm interacts with the implicit acknowledgement algorithm of TTP/C.