Fault-tolerant data processing system

0001The invention relates to a fault-tolerant data processing system consisting of a plurality of computer units and a plurality of logical decision-making devices (voters) which derive the correctness of a message from the majority of the messages given in relation to the total number of computer units.

0002Fault-tolerant data processing systems can be found, for example, in US Pat. No. 4,375,683. In this known design, a so-called triple-modular redundancy is used, three computers each being connected to a common logical decision unit. Such circuit arrangements primarily serve to achieve higher system reliability in the event of unforeseeable hardware failures. In this known device, the logical decision unit works on the basis of a majority vote and the system can still be operated sensibly even if a computer unit of the three units combined to form a node emits an incorrect signal. In the case of two identical signals which differ from a third signal, the logical decision unit forms a majority decision in favor of the identical signals and this majority result is further processed in the data processing.

0003There are major problems with the synchronization of the individual units of the data processing system, in particular for the process in complex data processing systems, in which non-periodic and indeterministic events are to be processed and an event-controlled system is to be created. To establish a global time base in all data processing units would require considerable synchronization and communication effort, which would use up to half of the available computing power. In the known device according to US Pat. No. 4,375,683, connectivity to more complex data processing systems is not readily possible, and the applicability of the basic principles of triple-modular redundancy set out in US Pat. No. 4,375,683 is limited to relatively simple cyclical and easily synchronized events . Applications, the nature of which is cyclical, are used, for example, when controlling the fuel supply to an engine depending on performance parameters. A high degree of decentralized data processing is also provided for process controls that naturally record decentralized events, such as for railway safety systems. In such applications in particular, it is particularly advantageous to provide the fault-tolerant data processing system with which the effort for communication between the individual computer units or nodes is substantially reduced and, at the same time, a high degree of system reliability is maintained. The invention further aims to ensure a high degree of reliability and fault tolerance even in the case of non-periodic and indeterministic events.

0004To achieve this object, the invention essentially consists in that each computer unit is assigned an input / output voter, which votes on the input or output messages of the input channels or output channels of all computer units of a voting node, each voting node consisting of several computer units (SRUs) there is that each input / output voter determines the content of the input via the input channels or Passes on the message received via the output channels by sending a voting message by means of voting links to all other input / output voters located in the same voting node, then each input / output voter via its own and all those from the other input / output voters of the same voting node receives received voting messages that each computer unit is assigned a sequence voter for the decision on the correlated order of the messages to be processed, to which the message recognized as correct during the input / output voting is fed that each sequence voter forwards the content of the message received by him by sending a sequence voting message by means of voting links to all other sequence voters located in the same voting node, then carries out a voting on all received sequence voting messages, including the own message, and passes the uniform message sequence recognized as correct on to its own application process.

0005Due to the selected networking, process processing can be carried out according to a simple priority-controlled process. A system-wide time base for the synchronization of the process processing can be omitted and there is also no need for a time grid for the execution of processes. The connection of the individual computer units supplying or processing data signals to one another can be formed as a network by means of serial point-to-point connections.

0006The necessary and unavoidable temporal uncertainty in the transmission of messages via these connections can be mastered by suitable decision logic. In an advantageous manner, the design is such that each computer unit which processes or processes data signals has at least one voter for the decision on the error-free nature of input and / or output signals, the main result of which is in the case of non-cyclic working methods and in the absence of a global time base Problems with the order of the individual messages can be mastered effectively, that each computer unit supplying or processing data signals contains a sequence voter for deciding on the correct sequence of the signals to be processed.

0007The main advantage of the networking according to the invention is that the transmission of messages can take place serially, which naturally significantly reduces the line effort. The possibility of serial transmission is primarily due to the existence of the sequence voter, which in turn corrects any change in the sequence of the individual signals or messages that may have occurred in the case of non-periodic, deterministic events. The connections or links between the individual computer units are bidirectional, so that a complete meshing and a complete exchange about the processes in the individual nodes of the fault-tolerant data processing system take place with one another.

0008In order to ensure complete communication about the absence of errors, both in terms of the completeness and correctness of the input or output signals and in terms of the correct order of the signals, the networking is carried out so that the signals of the voters for input signals can be forwarded to the sequence voters . The sequence voter decides on the sequence of the input signals and these input signals are then transferred in this sequence to the process processing and the result is then made available to the output voter. The internal logic of the decision-making units or Voters for the input or output signals are designed in such a way that the input and / or output voters pass on the signals with a majority given in relation to the total number of channels. For a clear decision, an odd number of data signal supplying or processing units of each group is required, whereby the decision logic can make a two-out-of-three decision in the case of triple-modular redundancy. If a larger number of data processing or processing units per group are linked, a correspondingly stricter condition for the correctness of the signal processing can be established, whereby the fault tolerance decreases, but the reliability increases.

0009A further development of the invention provides that each voter forwards the voting message received from him from another voter of the same voting node to all other voters of the same voting node. This measure results in a virtual doubling of each voting link and introduces an additional mechanism which ensures that voting messages reach the destination SRU in two different ways. The failure of a voting link is certainly recognized, but does not lead to an error event.

0010The following example describes the principle of a highly reliable, fault-tolerant real-time system that was designed for use in failsafe controls, such as in railway signal boxes. This system is called VOTRICS (VOting TRiple modular Computing System) in the following.

00111 shows a general representation of a VOTRICS system, FIG. 2 shows the cascading of VOTRICS nodes, FIG. 3 shows the convergence of VOTRICS nodes, FIG. 4 shows a divergence of VOTRICS nodes, FIG. 5 shows the temporal Uncertainty in the transmission of a message triad between two cascaded VOTRICS systems, FIG. 6 shows the interaction of the voting functions in one computing unit, FIG. 7 voting links between neighboring VOTRICS computing units and FIG. 8th a virtual duplication of the voting links by using redundancy in the time domain.

0012A VOTRICS network consists of any network of one or more VOTRICS nodes, each of which forms an autonomous fault-tolerant subsystem. In the minimum configuration, a VOTRICS node consists of three independent computer units of the same configuration - so-called Smallest Replaceable Units (SRU) - which are completely meshed together loosely using serial bidirectional voting links VL. Each SRU is connected to the environment through one or more serial input and output channels IC, OC. Fig. 1 shows the most general arrangement of such a system consisting of SRU (al) ... SRU (an), which work together in active redundancy and SRU (pl) ... SRU (pn) in passive redundancy (standby).

0013Due to the required timing behavior, the use of active redundancy is required for real-time systems for failsafe controls.

0014A prerequisite for the successful application of active redundancy is an efficient voting mechanism, which allows the results and the behavior of the computers working in active redundancy to be compared continuously and under real-time conditions. In the event of a mismatch between the results or of the behavior continue to work properly, i.e. to be able to tolerate the error (error masking), at least 2N + 1 independently determined results are necessary. When using parallel, active redundancy (simultaneous determination of the results, once per computer), at least three computers are necessary to be able to tolerate an error.

0015The common term in the literature for this form of redundancy is "Triple Modular Redundancy (TMR)". For the sake of simplicity, when describing VOTRICS in more detail, only a TMR configuration with active redundancy will be discussed. Special voting hardware is used in many of the fault-tolerant systems mentioned in the literature. If this voting hardware is carried out simply, it worsens the mean time between failures (MTBF) of the TMR system. The failure of the voting hardware results in a total failure. Solutions with redundant voting hardware are also known (see for example: AL Hopkins Jr., FTMP - A Highly Reliable Fault-Tolerant Multi- processor for Aircraft, Proc. Of the IEEE, Vol 66 No. 1o. Pp 1221 - 1239, Oct 1978 ). Although these provide a comparatively better reliability, they require a considerable amount of additional hardware.

0016In this VOTRICS, the voting function is therefore divided between the individual computer units (SRUs) of the system. This can advantageously be done by software voters in each individual computer unit. The architecture described below allows any combination of SRU's in active and / or passive redundancy, so it can be flexibly adapted to the required reliability or availability.

0017VOTRICS differs in a number of fundamental ways from other fault-tolerant computer systems with a comparable objective:<ul id="ul0001" list-style="none"><li>1) no global time base (no close synchronization of the clocks of all SRU's)</li><li>2) Indeterministic first in - first out (FIFO) scheduling</li><li>3) no 'broadcast' communication between the SRU's.</li></ul>

0018Establishing a global (absolute) time base with the required granularity in the millisecond range in all SRUs of a distributed system requires additional synchronization and communication effort. The interactive convergence algorithm used in a known system, depending on the number of SRUs used and the clock drift, causes an additional outlay which consumes 100% of the available computing power in the case of approximately 12-15 SRUs. (See for example: C. Krishna &amp; K. Shin, Synchronization and Fault-Masking in Redundant Real-Time Systems, Dig. of Pap. 14th Int. Symp. On Fault-Tolerant Computing, pp. 152-157, 1984 and L. Lamport &amp; PM Melliar-Smith, Synchronizing Clocks in the Presence of Faults, Journal of the ACM, Vol 32 No 1, pp. 52-78, Jan 1985). In VOTRICS, time measurements are only carried out using a relative time base - only time differences are measured, ie the inevitable drift of the hardware timers cannot have any effect.

0019In VOTRICS, process scheduling is not carried out in a fixed, periodic time schedule, but according to a simple, priority-controlled FIFO procedure. All actions take place on the basis of (stochastic) external and internal events. By eliminating the coupling of scheduling to a system-wide time base, it is necessary to use suitable synchronization measures to coordinate the scheduling activities among the SRUs working in active redundancy.

0020Both VOTRICS nodes and the computer units SRU within a node are networked with one another by serial point-to-point connections. An alternative to this would be computer couplings via redundant "broadcast buses". However, the point-to-point connections provide a simple method to limit the spread of errors, since only two units of SRU can be affected by a link error.

0021Only through these assumptions is a high degree of generality and transparency of the fault tolerance mechanisms towards the application achieved. For example, the synchronization methods used in the well-known SIFT and August 300 systems are based (see: CB Weinstock, "SIFT: System Design and Implementation", Dig. Of Pap. 10th Int. Symposium on Fault Tolerant Computing, Kyoto, Japan, pp 75 - 77, Oct 1-3, 1980 and J. Wensley, "Industrial Control System does Things in three for Safety", Electronics, Jan 1983) on a simple, periodic scheduling procedure linked to a global time base. The advantage of the relative simplicity of such a synchronization algorithm can only be fully effective where applications are of a cyclical nature (such as controlling the fuel supply to an engine depending on the performance parameters). The use of periodic systems is unsuitable for process controls that are inherently stochastic (railway safety systems belong to this group), since non-periodic processes are difficult to map to the cyclical operating mode of the operating system.

00222, 3 and 4 show networking options for VOTRICS nodes.

0023Each VOTRICS node forms a fault-tolerant subsystem. An essential goal of this concept is the possibility of being able to build up a distributed computer network from several such subsystems. For this it is necessary to connect VOTRICS nodes with each other. The coupling of two VOTRICS nodes is carried out by three point-to-point connections (paired connection of two neighboring SRUs). In this way, any network topology can be created by cascading and branching.

0024As shown in Fig. 2, the node TMR (n, x) (node ​​x of level n) and the node TMR (n + 1, y) (node ​​y of level n + 1) are via channels K1, K2 and K3 cascaded. The three computer units SRU (1,2,3) are completely meshed with each other within each node.

00253 shows the convergence in a VOTRICS arrangement. The outputs of the node TMR (n, x) - thus node X of level n - with the respective inputs of the nodes TMR (n + 1, y) or TMR (n + 1, z) - these are the nodes y or z of level n + 1 - connected.

0026As can be seen from FIG. 4, divergence is also possible in a similar manner. In the example shown, the outputs of the nodes TMR (n, x) and TMR (n, y) are connected to the inputs of the node TMR (n + 1, z).

0027All communication and synchronization in a VOTRICS network takes place exclusively with the help of "CHILL messages" (see: CCITT Recommendation z.200, "CCITT High Level Language CHILL", Yellow Book, Vol. VI, Fasc. VI.8. Geneva 1981). This applies both to inter-process communication within an SRU and in general to 'inter-SRU communication'.

0028This type of message synchronization corresponds to the principle of event control, according to which all actions of application processes can only be triggered by messages. In principle, there are only two sources that can intervene in the course of an application process from outside: events that are received from a neighboring SRU on an input channel (IC) and the expiry of time monitoring by the operating system in timeout -News will be implemented.

0029The CHILL application process is not interrupt-controlled; Interrupts are handled by the operating system and are only used to handle serial communication between SRUs.

0030FIG. 5 shows the uncertainty in time during the transmission of a message triad between two cascaded VOTRICS systems. Communication between neighboring VOTRICS nodes takes place via 'message triads': three identical messages are exchanged between the three SRU pairs of two neighboring VOTRICS nodes via the three connecting lines. Due to the different processing times in the SRUs of the sending and receiving VOTRICS node and also due to possible differences in the transmission times (serial transmission method), the messages of a triad arrive with a time uncertainty in the receiver processes.

0031In this example, the three computer units SRU (n, x, 1) present in the node TMR (n, x) (from FIG. 2) send SRU (n, x, 2) and SRU (n, x, 3) on the channels K1, K2, K3 the output messages OM (n, x, 1), OM (n, x, 2) and OM (n, x, 3). The max. Output blur Uamax (n, x) is given in this case by the time interval between the output messages OM (n, x, 1) and OM (n, x, 2). Due to different transmission times TUe1, TUe2, TUe3, the transmission sharpness Utue (n, x - n + 1, y) is TUe2 minus TUe1 in the present example. The maximum temporal input blur with which a message triad arrives at the destination node results from<maths id="math0001"><math display="inline"><mrow><mtext>Uemax (n + 1, y) = Uamax (n, x) + Utue (n, x n + 1, y).</mtext></mrow></math><img file="EP0246218B1_D0001.tif" /></maths>

0032Despite the lack of clarity, the receiver receives the same sequence of messages on every single input channel of a triad (no transmission errors). If several input channels are connected to each SRU (convergence, see FIG. 4), this no longer applies to the sum of the messages received from these channels. Due to the uncertainties in time during the transmission of the message triads on different channels, overhaul processes occur, which means that the message sequences received by each SRU of a VOTRICS system are unequal. If such a resulting message sequence were forwarded unchanged to the application processes, this would cause the application processes of the individual SRUs to behave differently, and the TMR system would no longer be synchronized.

0033The synchronization algorithm used in VOTRICS to solve this problem is based on the principle of a distributed 'sequence voting' on the sequence of input messages passed on from the individual SRUs of a TMR system to the application processes, which will be described in a later section.

0034The time behavior of the application processes is controlled by timeout messages. Since the clocks are not synchronized and the application processes run with considerable time blurring in the three computer units, the sequence of the timeout messages is not necessarily identical in all three units. However, the timeout messages generated by the operating system can be regarded as an additional input channel, and therefore identical timeout messages are sent to the application processes to all computer units.

0035The interaction of the voting functions in a computer unit SRU will now be described with reference to FIG. 6.

0036In distributed voting, three independent voters (one voter per SRU) vote together on an object (e.g. a message, a data record, etc.). In the course of the voting process, everyone sends the current object wrapped in a voting message to his two neighbors. Each voter compares his own object with the other two and then makes an independent 2-of-3 decision. This result is normally passed on, in the event of an error the output is suppressed and the error is reported to a central error processing process.

0037The voters can be used for a wide variety of tasks, the following basic functions are carried out by each voter: error detection, error masking and synchronization.

0038Depending on the role of the voter, these functions have different weights.

0039Depending on whether one or more logical message sources are to be voted on at the same time, a distinction is made between sequence voting and input / output voting. In each computer unit SRU there is an input / output voter IOV which forms a voting triad with its neighboring voters by means of voting links VL. This voter now has to vote on all incoming or outgoing message triads of a VOTRICS node. The source for incoming message triads are the input channels IC1 ... ICn and the timeout handler TOH of the operating system. The outgoing messages that are processed by the AP application processor leave the VOTRICS node via the output channels OC1 ... OCm after they have been recognized as correct by the input-output voter triad.

0040Due to the transmission blur in the input channels and the unsynchronized system clock, the input message sequences generated by the input / output voters are different in each SRU, although the amount of messages in each sequence is the same. All input message triads that were accepted as correct during the input voting are therefore redirected to the sequence voter SV, where a uniform sequence of the messages is produced and then passed on to the application process.

0041Voters have the task of recognizing error situations and masking them if possible, but cannot carry out system-wide measures such as stopping their own SRU, recovery etc. For this purpose, an 'Error Monitoring Process' (EMP) is introduced, which receives all errors recognized by the voters (including the masked ones).

0042The connections between VOTRICS nodes (triads of serial data channels) are most exposed to environmental interference due to the possible long distances. There is therefore one input / output voter triad per input channel triad (IC), which votes on the signals received on this IC. Both the correctness of the sequence as well as the content and correctness of the time of the signals are voted. The resulting signal sequence of this voting is forwarded to the sequence voter, which will be explained later. It is the task of the input / output voter to recognize and mask errors in the input signal triad.

0043In VOTRICS, each application process can start one or more independent time monitoring. After such a timeout has expired, the process receives a message from the operating system that it specified when the timeout was started.

0044It will also usually happen that a timeout expires in one SRU and not in the other two (or vice versa). Although this is not an error situation, it is not desirable to deal with such situations in the sequence voter (the sequence voter would be a lot more complex if the timeout message were handled specially). The timeout signals are therefore forwarded to the input / output voter, who then ensures that only complete timeout message triads are forwarded to the sequence voter triad.

0045The input / output voting triad also votes on all signals that leave the VOTRICS node. The purpose of the output voting is to identify errors in the neighboring units, to mask errors and to provide the output triad with a uniform identifier. The sequence of signals leaves the Votrics node in the same sequence as it was created by the application process.

0046Although each concrete input / output vote is only carried out via three redundant objects (in most cases signal triads), the input / output voters must process the sequences of such triads correctly. This results in a few boundary conditions:<ul id="ul0002" list-style="dash"><li>The triads of a logical channel (for example, an input channel) must be output in the same order in which they arrived. Since a triplicated channel generates three identical signal sequences, a uniform sequence is defined in the signal triads.</li><li>The sequence in which signals are transmitted from different logical channels is arbitrary.</li><li>A faulty triad must not affect the processing of other triads in the same voter.</li></ul>

0047Triads from different logical channels should therefore be processed and transmitted in parallel, while successive triads on a single logical channel must be transmitted sequentially.

0048Due to the boundary conditions under which signal triads arrive at a VOTRICS node, the triads can influence one another in different ways, namely through<ul id="ul0003" list-style="dash"><li>Triad overlap on a single logical channel: If the time interval between the arrival of triads is smaller than the time blur within the three signals of the triad, then it can happen, for example, that the signal arrives later on the "own" input channel of the voter than one or both voting signals a subsequent triad (the inept signals which the neighboring voters receive and pass on). In the case of a "defective" triad, ie a triad with a faulty or non-existent signal, even more complex situations can arise.</li><li>Channel overlap: The input / output voter must process triads from several logical input channels (at least from a physical input channel and a timeout handler). The signals of such triads can arrive in any order.</li></ul>

0049The input / output voter must therefore be able to process any combination of triad and channel overlap.

0050The voting algorithm on which all of the voter types are based is described below.

0051The basic principle of the distributed voting used here is that each voter passes on the content of an input message received by him to his partners by sending 'voting messages'. An output of the voting result (e.g. in the case of IOV transfer to the sequence voter) takes place exclusively on the basis of a 2 out of 3 majority decision (commitment).

0052Due to the inevitable lack of clarity in the arrival of the input messages, it will usually happen that a voter receives one or both voting messages before the own input message. After the first message of a new commitment has arrived, the voter waits time-monitored (vote time constant) for the remaining messages belonging to the commitment. After receiving the first of the two missing messages, he compares them in terms of content and uses the following rules:<ul id="ul0004" list-style="none"><li>Case 1) If messages are identical, then commitment and output of the voting result.</li><li>Case 2) If messages are not identical, then start the second timeout TOʹ (TO = TOʹ). Time-monitored waiting for third input message.</li><li>Case 2a) If the third message arrives in time within the timeout TO, if message 3 is identical to message 1 and message 2 is wrong, then 2 of 3 majority decision and output as above.</li><li>Case 2b) If the third message arrives on time within the second timeout TOʹ, if message 3 is identical to message 2 and message 1 is wrong, then 2of3 majority decision and output as above.</li><li>Case 2c) If the same message pairs do not arrive within the timeout TO or TOʹ, then the majority decision and no output of a voting result.</li></ul>

0053This voting algorithm refers to a news triad. A voter can vote across multiple triads simultaneously to search for triad or channel overlap, however the sequence of commitments across each logical channel must match the input sequence of that logical channel.

0054The sequence voting is now described below. The task of the sequence voter triad is the coordinated forwarding of a uniform input message sequence to the application processes of each SRU. Each sequence voter receives the message sequences generated by the IOV and, in coordination with its neighbors, combines them into a resulting message sequence accepted by all three sequence voters. The correctly ordered signals, which are identical in each computer unit (SRU), are then passed on to the application processes in order to synchronize their processes.

0055Like other voters, the sequence voter performs error masking. However, if a sequence voter detects an error, this always means a critical situation. It is very likely that the voter who sent the message is defective. If this is an error in your own SRU, this is subsequently stopped by the 'Error Monitoring Process'.

0056Communication via the voting links is a problem in itself. Via these channels the related voters each communicate in a triad. The messages to be processed by a voter are 'packed' in voting messages and sent to the two neighbors of the same triad of voters. Both physically and logically, the voting links form the only connections between the SRUs of a VOTRICS system. In order to achieve maximum independence of the individual error behavior of the SRUs of a VOTRICS system, it must be prevented that neighboring SRUs can export or import errors via the voting links.

0057The example of the 'lying clock' brought up by Leslie Lamport (see above article in Journal of the ACM, Vol 32 No 1, pp. 52 - 78, Jan. 1985) can be directly applied to the problem of voting. By falsifying communication with the two neighboring voters, in the absence of suitable measures, an SRU could deceive its two neighbors and gain two votes in the voting. As a result, the synchronicity of the TMR system could be lost or in the worst case, different output by the output vote leave the system, which means a violation of the failsafe principle.

0058Another error event that primarily damages the efficiency of a VOTRICS system (here above all the timing) is the failure of a voting link. If no countermeasures are taken here, the timing of the overall system will deteriorate in this case and the input blur of the input message triad will be fully influenced by the commitment blur.

0059The method described below solves both problems by using redundancy in the time domain for the transmission on the voting links. An additional mechanism is introduced at the communication level which ensures that voting messages reach the destination SRU in two different ways (FIG. 7). This measure results in a virtual doubling of each voting link (FIG. 8).

0060From a message triad previously required by SRUk for a complete voting process, namely input message IMk, voting messages VMik and VMjk, now, as shown in FIG. 7, a quintuple, namely input message IMk, voting messages VMik and VMjk, and additionally to the respective other computer unit SRUj and SRUi sent virtual voting messages VMikʹ and VMjkʹ. The following applies in the case of errors<maths id="math0002"><math display="inline"><mrow><mtext>VMik = VMikʹ = VMjk = VMjkʹ.</mtext></mrow></math><img file="EP0246218B1_D0002.tif" /></maths>

0061<maths id="math0003"><img file="EP0246218B1_D0003.tif" /></maths>The resulting arrangement of the voting links for the computer unit SRUk can be seen from FIG. The voter of this unit accordingly receives the above-mentioned voting messages from the input channel ICk and the voting links VLjk from the computer unit SRUj and VLik from the computer unit SRUi and from the additional virtual voting links VLjkʹ from the computer unit SRUj via SRUi and Vlik from the computer unit SRUi via SRUj.

0062For example, if SRUi lies, then VMij = VMik. VMij is forwarded from SRUj to SRUk (VMik '), VMik from SRUk to SRUj (VMijʹ); Both SRUj and SRUk can independently determine by checking the conditions (VMij = VMij ') or (VMik = VMikʹ) that SRUi is lying. In both cases, the condition is not met.

0063However, the algorithm as has been described so far has the defect that a voting message could be falsified by the neighboring SRU when it is duplicated. To prevent an SRU from lying undetected when duplicating and forwarding a voting message, another protection mechanism is introduced.

0064Each SRU protects the voting messages it produces with an individual, unique signature. The coding function ENCODEn (VMnx) is different for all n = i, j, k. In addition, each SRU only knows its own coding algorithm. For example, ENCODEi (VMix) is only known to SRUi. The decoding functions DECODEn (VMnx) for n = i, j, k are known to all three SRUs.

0065Each voting message is provided with its individual signature by the source SRU. When duplicating by the neighboring SRU, a signature is no longer applied. The destination SRU can use the decoding algorithm known to it and thus check whether the message has been damaged on the way through the neighboring SRU.

0066Example: SRUi produces VMij and VMik. Before sending to SRU j or SRUk, the signature is applied, namely for VMij: "ENCODEi (VMij)" and for VMik: "ENCODEi (VMik)". SRUj duplicates VMij and sends VMij to SRUk (without providing its own signature), but at the same time SRUj also performs the decoding functions for its own message (DECODEi (VMij)). SRUk receives VMik and VMikʹ and executes the decoding functions DECODEi (VMik) and DECODEi (VMikʹ); SRUk also produces a VMij (but without its own signature) and sends it to SRUj where it is received, decrypted with DECODE (VMijʹ) and compared with the decrypted VMi'j.

0067The timing of the system in the event of a failed voting link is also improved in such a way that in this situation the input blur no longer enters into the commitment blur during voting. However, you have to accept twice the number of voting messages (4 instead of 2 per SRU and commitment) and the overhead of signature coding and decoding.