There has been an increasing interest in using star topologies in field-bus communications, e.g., in Time Triggered Protocol for SAE classC applications (TTP/C), FlexRay, or controller area network (CAN), due to increased fault resilience and potential error-containment advantages. In this context, an innovative CAN-compliant star topology, CANcentrate, has been developed, whose hub includes enhanced fault-treatment mechanisms. However, despite this interest toward stars, it is still necessary to quantify their real dependability benefits. For this purpose and for the particular case of CAN, this paper presents models for the dependability features of CAN and CANcentrate using Stochastic Activity Networks (SANs). It quantitatively compares their reliability and error-containment capabilities under permanent hardware faults. These models rely on assumptions that ensure that results are not biased toward CANcentrate, which, in some cases, is too detrimental for it. Thus, despite not reflecting the full CANcentrate potential, results quantitatively confirm the improvement of error-containment it achieves over CAN. Additionally, the way in which the nodes' ability to contain their own errors affects the relevance of using a star topology has been quantified. Although this paper refers to the case of CAN, conclusions regarding the justification of using a star topology depending on this ability can be extrapolated to other field-bus technologies.

The controller area network (CAN) is facing a great opportunity. The maturity of this technology makes many researchers believe that CAN may be adopted in more critical systems. However, the suitability of CAN for these challenging applications strongly depends on our capacity to integrate all the solutions already available into a single, comprehensive architecture. We claim that clock synchronization plays a fundamental role in such architecture. Therefore, the means to achieve a solution fulfilling the expected requirements on reliability, cost, and precision must be deeply investigated. This paper discusses the relevance of clock synchronization in the future of CAN systems and describes a novel solution to supply this service. This solution exhibits several advantages: it provides very high precision, causes very low communication and computation overhead, and includes mechanisms to provide fault tolerance. Moreover, and in contrast to previous proposals, it is designed to be orthogonal to the rest of the system. Thus, it can be directly incorporated to any CAN system, without having to replace any of the components, which reduces the cost increment caused by the new service.

The application of model checking for the formal verification of distributed embedded systems requires the adoption of techniques for realistically modeling the temporal behavior of such systems. This paper discusses how to model with timed automata the different types of relationships that may be found among the computer clocks of a distributed system, namely, ideal clocks, drifting clocks, and synchronized clocks. For each kind of relationship, a suitable modeling pattern is thoroughly described and formally verified.

Many industrial systems have specific requirements derived from the applications they execute. Specifically, the interaction of a distributed embedded control system (DECS) with the real-world imposes strict real-time (RT) and reliability requirements. For a system to be RT, it has to produce a proper result in a bounded time. On top of that, for a system to be reliable, it has to operate continuously during its mission time, and in cases in which very high reliability is needed, fault tolerance (FT) techniques are used. Moreover, these systems are often deployed in dynamic environments where the operational conditions may change in an unpredictable manner. Therefore, there is an increasing interest in creating DECSs that are capable of modifying their behavior autonomously and dynamically in response to unexpectedly changing requirements or conditions. In recent years, there is a growing trend toward using Ethernet as the network technology for DECSs. Unfortunately, the original specification of this technology lacks appropriate services to fulfill the most demanding requirements of industrial systems. In this regard, many Ethernet-based protocols and standards have been proposed along the past years to deal with these limitations. In this paper, we survey solutions that have been proposed to achieve FT in Ethernet-based DECSs, considering faults both in their nodes and communication subsystem. In addition, we discuss adaptive FT techniques that can be used to increase the flexibility of adaptive DECS. Finally, we identify future trends and open challenges to build highly reliable DECS in the future.

Time-Sensitive Networking (TSN) is a set of technical standards that is being developed to provide Ethernet with hard real-time, reliability and flexibility services. In the last years, there has been a growing interest in increasing the connectivity of all kind of devices. This trend has reached industrial environments, where the demanding timing and reliability constraints imposed the use of specialised networks with specific features to support these requirements. Moreover, the industry has shown interest in using Ethernet as the network technology in industrial environments, due to its low cost, high bandwidth and extensive use. The ability of TSN to support both, data-oriented and traditional control traffic over the same network makes it an appealing technology to implement the next generation of industrial networks with high connectivity. Nevertheless, TSN does not cover some reliability aspects important for its deployment in critical systems. In this work we propose the implementation of time redundancy of frames in order to tolerate temporary faults in the channel and, therefore, increase the reliability of the network.

Distributed embedded systems that require real-time performance need a network capable of deterministic m- cess delay. CAN is one such network that became widespread in recent years due to its electrical robustness, low price, and priority-based uccess control. Howevez its use in safety-critical applications has been controver- sial due to dependability limitations that arise from its bus topology and non-guarunteed atomic broadcast. In this pa- per: we propose an active star topology that allows solv- ing many of the limitations related to the first aspect by means of strong error confinement. Nodes are intercon- nected through an active hub that is fully compatible with existing CANcontrollers. The paper compares bus andstar topologies, analyzes related work and discusses the hub im- plementation and dependability properties.