Synchronization and time stamping

Both computers are synchronized in an extremely precise manner seconds). This synchronization is not guaranteed. As far as safety is concerned, a synchronization control is performed, which is significantly less accurate, but is largely sufficient for the applications of interest to us (of the magnitude of a few milliseconds). This synchronization control causes the transition to the isolated mode in case of failure. 

Furthermore, the clocks pacing the cycles of the two computers are safety clocks ensuring a relative drift below a given threshold. 

This ensures a fairly good synchronization between the beginning of the cycles of the two units. To this, we add a counter on each unit called Safe Logic Clock (SLC). At initialization, the passive unit synchronizes its SLC with that of the active unit. This SLC is then used to time stamp and check the freshness of all messages exchanged inter unit. 

---