Method and support device for supporting robustability optimization of data processing system and corresponding CI system

Abstract

The invention relates to a method and a support device for supporting robustness optimization of a data processing system. The invention also relates to a corresponding CI system (5). In the method, different message sequences (1) are generated and sent to a receiving device (11). Subsequently, an error message (15) generated by the receiving device (11) is detected for each message sequence (1). According to the number of error messages (15) generated in each case, one of the message sequences (1) is classified as the most problematic message sequence (1, 16) and output as a basis for the respective error elimination.

Description

Technical Field

[0001] The invention relates to a method and a supporting device for supporting robustness optimization of a data processing system. The invention also relates to a corresponding CI system (CI: Continuous Integration). Background Art

[0002] Today, software and data processing systems are used in a variety of ways. Such systems can have considerable complexity, which makes it difficult and expensive to ensure robust and error-free operation. Due to the variety of possible error types and error sources, a wide variety of solutions already exist. However, improvements and simplifications are still desirable.

[0003] As a method, DE 10 2012 101 747 B4 describes a data transmission system which is intended to achieve reliable data transmission with a reduced bit error rate. In this system, a transmitter and a receiver determine a checksum based on a plurality of transmitted data frames. The checksum is then compared by a checksum comparison unit which, if necessary, signals a transmission error or can trigger a safety function if the compared checksums are not identical.

[0004] An important application today is vehicles that increasingly have computer-based and thus data-processing functions. For this purpose, EP 2 891 264 B1 describes, for example, a method for executing a safety function for a vehicle, wherein the required data are transmitted to a control unit of the vehicle by means of a communication system. The control unit generates control signals based on the data and transmits them to a functional unit of the vehicle, which executes the safety function based on this. In this case, diagnostic tests are performed at multiple time intervals, with which it is checked whether there are errors or faults in the electronic and / or programmable systems used for the method that could impair the execution of the safety function. It should therefore be possible to execute the safety function of the vehicle as reliably and safely as possible.

[0005] As another example, EP 2 434 695 B1 describes a method for transmitting data between participants of a serially connected annular communication module. In it, a data packet is transmitted from a master device to a slave device and further transmitted from a slave device to a slave device. Here, the address information of the data packet is changed by each slave device. Here, the structure of the address value is checked by each slave device, and it is recognized whether the content of the data packet is set for the corresponding slave device. Then, an overflow of the address value is generated for the slave device for which the data packet is determined. Summary of the invention

[0006] The object of the present invention is to enable an improvement in the robustness of a data processing system to be achieved particularly effectively.

[0007] This object is achieved by the subject matter of the independent claims. Further possible embodiments of the invention are disclosed in the dependent claims, the description and the drawings. The features, advantages and possible embodiments listed within the scope of the description of one of the subjects of the independent claims should be regarded at least similarly as the features, advantages and possible embodiments of the corresponding subject matter of the other independent claims and any possible combination of the subject matter of the independent claims, if necessary in combination with the features, advantages and possible embodiments of one or more dependent claims.

[0008] The method according to the invention is used to support the robustness optimization of a conventional bus-based data processing system. Such a data processing system may include one or more software components and one or more hardware components. The corresponding hardware components may (at least in conventional use or operation) be connected to each other via a data bus, i.e. a bus connection, for data transmission. In particular, a plurality of components of the data processing system may be connected to each other in series along such a data bus or such a bus connection. These components may be, for example, control units, controllers, embedded systems, sensors, etc.

[0009] Robustness optimization in this sense can be used to enable or ensure the most robust and error-free operation of the data processing system in the final normal or productive operation or use. Robust operation can, for example, mean that the data processing system performs or realizes its functions normally, i.e. correctly, under different conditions or different situations.

[0010] In the method according to the invention, a plurality of different message sequences are generated. Such a message sequence can be a sequence of a plurality of single messages in a specific order. Such a single message can be or include a data packet or a data block, etc. Likewise, the message sequence or its single message can include other components, such as headers, time stamps, etc. The exact structure of the message sequence can depend on the respective application, i.e. on the respective data processing system, whose robustness should be optimized. The message sequence can be generated automatically or semi-automatically, for example, by a support device designed to carry out the method according to the invention.

[0011] Different message sequences can be identical and correct in particular with respect to at least one predefined formal standard. Thus, the message sequence can correspond to the corresponding predefined requirements of the data processing system for a message sequence to be processed or processable according to the formal standard. Thus, the message sequence or its individual messages can, for example, have a predefined data format that can be processed by the corresponding data processing system.

[0012] However, the generated message sequences may differ with respect to one or more predefined secondary criteria or test criteria or secondary features or test features. Thus, the message sequences can be generated variably with respect to at least one predefined test criterion or test feature, with respect to which the robustness of the data processing system is to be checked or optimized. The message sequences can be generated, for example, manually or semi-automatically or fully automatically, for example by means of corresponding predefined algorithms.

[0013] In addition, in the method according to the invention, the generated message sequence is also sent to the receiving device in sequence, for example, via the support device. The receiving device can be, in particular, a part or component of a corresponding data processing system or corresponds to such a component. The receiving device can be, for example, a control unit or an embedded system (English: embeddedsystem) or a controller, etc. for a motor vehicle. Since the message sequence is sent to the receiving device, i.e., it is transmitted to the receiving device or input to the receiving device, the receiving device can also be referred to as a target unit or a target control unit. Here, the message sequence can be delivered to the receiving device directly or in a controlled manner, in particular directly via the corresponding interface of the receiving device or via a controlled data connection, such as an Ethernet connection, etc. In this case, unlike the final application or use purpose of the receiving device or the corresponding component in the data processing system, this cannot be a bus connection between one or more components or nodes connected to the transmitter of the message sequence and the receiving device. Therefore, in this stage of the method according to the invention, changes or unknown or uncontrolled influences of such a bus connection including multiple components or sections can be avoided. Ultimately, this can more effectively lead to or contribute to more accurate results.

[0014] The receiving device is designed to receive and process the corresponding message sequence. Therefore, the message sequence can be generated in principle in terms of its type, its properties, its structure, its content, etc., depending on the message sequence that the receiving device or the corresponding component in the corresponding data processing system is to receive and process in its final normal productive use or operation.

[0015] For each message sequence, when processing the message sequence, the error messages generated by the receiving device are also detected by the support device, for example. These error messages can also be received by the support device, which is designed to carry out the method according to the invention.

[0016] Depending on how many error messages the receiving device generates in each case for the processed message sequences, one of the message sequences generated and processed by the receiving device is classified as the most problematic message sequence and output as a basis for corresponding error correction, for example also via a support device.

[0017] Of all message sequences sent to a receiving device and processed by the receiving device, at least one message sequence or a plurality of message sequences, the processing of which by the receiving device generates the most error messages, can be output, for example, as the most problematic message sequence. The most problematic message sequence can therefore be a message sequence that particularly reliably or effectively leads to error messages of the receiving device. Thus, errors or vulnerabilities of the receiving device can be particularly effectively revealed and corresponding error messages can be reproduced.

[0018] The actual identification and elimination of errors or bugs can be significantly facilitated and accelerated using the most problematic message sequences determined by the method according to the invention.

[0019] The corresponding error or vulnerability may, for example, relate to the robustness of the receiving device or a computer program or operating program or corresponding program code executed therein or by it for processing the message sequence, etc. In this case, this may in particular be an error or vulnerability in such a computer program or operating program or corresponding program code, i.e., the corresponding software of the receiving device.

[0020] Through the support provided by the present invention, it is particularly possible to identify and understand and, if necessary, eliminate errors or loopholes that only occur relatively rarely or have no obvious pattern from the beginning, that is, errors or loopholes that are particularly difficult to reproduce, especially effectively, specifically and quickly. This can represent a clear advantage of effectively improving the robustness of the corresponding functions or systems of the data processing system arrangement including the bus-based transmission of data or messages to at least the corresponding receiving device. This can be seen, for example, in comparison with previous methods, in which, for example, error messages that occur randomly when using the receiving device or the corresponding data processing system are collected and analyzed, or attempts are made to identify potential errors or potential loopholes based on these randomly occurring error messages. This is because, especially in the case of relatively few error messages or problems, their situation or occurrence and thus their ultimate cause are usually unclear or difficult to identify. In addition, in the case of error messages that cannot be reproduced or cannot be reliably reproduced, there may be only too little data or error messages in particular, so that the pattern and thus the ultimate cause can actually be determined.

[0021] The effective improvement in the robustness of a data processing system that can thus be achieved by the present invention can, depending on the application, lead to or contribute to, for example, higher safety, lower costs, faster task completion, etc.

[0022] In a possible design of the present invention, a plurality of or all message sequences in the generated message sequence contain the same single message. This may correspond to the formal standard mentioned elsewhere, for example. However, in the design of the present invention proposed here, the generated message sequence changes in the time intervals between these single messages. These different time intervals between the single messages may correspond to the search or test criteria or features mentioned elsewhere. Here, different message sequences may therefore include the same content, but have different timings of these contents. Depending on the application, the single messages may be arranged in the same order in all generated message sequences. Thus, errors or loopholes that are attributable to timing changes or are susceptible to the influence of timing changes, i.e., differences or deviations in the time intervals between single messages in a message sequence, can be particularly specifically or specifically identified.

[0023] Additionally or alternatively, the message sequence or the second group of message sequences can be generated with a varying, i.e. different, sequence of the individual messages. For such a message sequence with a varying sequence of the individual messages, a uniform timing, i.e. the same time intervals or interval patterns or interval sequences between the individual messages can be used. Thus, errors or loopholes that are attributable to or susceptible to deviations in the sequence of the individual messages can be particularly specifically or specifically identified.

[0024] A message sequence or a group of message sequences can also be generated with a variable timing and with a variable order of the individual messages. Thus, different or complex errors or vulnerabilities can be identified, for example, which only occur or are relevant in a combination of a specific timing and order of the individual messages, by causing or triggering corresponding error messages through the corresponding message sequence.

[0025] The proposed changes in timing within a message sequence can be particularly advantageous for triggering unpredictable, randomly occurring and / or relatively rare and usually difficult to reproduce error messages. In practical applications, timing changes can occur, for example, due to an unpredictable combination of factors that may lie outside the direct task or operating area of ​​the receiving device. This can depend, for example, on the relative scanning or calculation frequencies or corresponding phase positions in different components of the data processing system and / or on different loads and / or on different filling levels of buffers or temporary memories, etc. Such influences can lead in practice to individual messages of a message sequence being detected, processed and / or forwarded to the receiving device via the data bus, for example, at different speeds.

[0026] In another possible design of the present invention, each message sequence is sent to the receiving device multiple times. Then all the error messages that occur here are considered to determine the most problematic message sequence. In other words, multiple instances of each message sequence can be sent to the receiving device and processed by it. Then, for example, the error messages generated or accumulated for all instances of the message sequence can be counted, that is, added or accumulated. Then, the corresponding accumulated error messages or their number of all instances of a specific message sequence can be assigned to the corresponding message sequence. Then, the accumulated number of error messages of all message sequences can be compared with each other. However, the average value or median value of the error messages generated or accumulated when processing multiple instances of the message sequence can also be formed and used as a corresponding comparison value. Therefore, the message sequence for which the maximum corresponding average value is determined for the message sequence can be output as the most problematic message sequence or as the message sequence whose processing generates the most error messages through the receiving device.

[0027] By the multiple transmission and processing of the message sequence proposed here, effects or influences that affect robustness or corresponding errors or vulnerabilities can be particularly reliably identified. Thus, the occurrence of an error message may depend, for example, on the corresponding reception time point of the message sequence or a single message, for example relative to a point or phase in the clock cycle of the receiving device, and / or on the filling level of an input buffer or temporary memory of the receiving device, which is only completely filled through multiple message sequences, etc. When the message sequence is transmitted multiple times, the corresponding individual instances of the message sequence can, for example, be sent to the receiving device at least partially directly in succession or at different time intervals from each other. As a result, errors or vulnerabilities based on this or susceptible to being affected can be particularly reliably disclosed, or correspondingly simply and reliably identified. This can ultimately lead to or contribute to further improvements in the robustness of the receiving device or the corresponding data processing system.

[0028] In another possible design of the present invention, different message sequences are generated by means of a preset genetic algorithm. Within the scope of this genetic algorithm, pairing and mutation can be applied in several generations in particular to generate different message sequences. This genetic algorithm can generate message sequences particularly simply and at low cost for the corresponding user and particularly reliably here, which generate particularly many error messages or particularly reliably cause the generation of at least one error message. The characteristics of the message sequence that ultimately causes the error message can, for example, be automatically amplified or maintained by the genetic algorithm, or finally accumulate or concentrate in the most problematic message sequence. This can be especially independent of whether the characteristics of the error message of the specific responsible receiving device or the corresponding value of the specific characteristic are known to the corresponding user or user in advance. Compared with, for example, generating different message sequences by pure random or generating and processing all possible different message sequences almost impractically, the application of the genetic algorithm proposed here can generate or find problematic message sequences that particularly frequently or reliably cause error messages more reliably and / or faster or with less total cost if necessary.

[0029] In a possible extension of the present invention, in or from a genetic algorithm, a corresponding sequence of time intervals between single messages contained in a corresponding message sequence is used as a corresponding gene sequence of a message sequence. In other words, the timing mentioned elsewhere can be used to change the message sequence. The time interval between two consecutive single messages of a specific message sequence can form the gene of these message sequences. Here, for all message sequences, the single messages or their order can be the same in particular. Here, the gene sequence of a message sequence can be represented, for example, as a simple sequence of numbers, wherein each number can indicate the time interval between two consecutive single messages. Therefore, the gene sequence can be manipulated or processed particularly low-cost, because, for example, in order to describe a message sequence by its gene sequence, it is not necessary to indicate or process the actual data content of the corresponding message sequence.

[0030] In a possible extension of the invention, in or from the genetic algorithm, the number and / or severity and / or type of error messages generated when the message sequence is processed by the receiving device is used as a degree of suitability of the message sequence. Here, a greater number and / or a higher severity of error messages and / or a hierarchically higher classified, i.e., a correspondingly prioritized or to be prioritized error message type according to a preset hierarchy or ranking or order of error message types corresponds to a greater suitability. For the severity of the error messages, a corresponding hierarchy, ranking or order can also be preset, in which different types or characteristics or effects of the error messages can be described in a classified manner in a preset manner. It can be provided here that as a feature or criterion for further use of the message sequence in the corresponding next generation, i.e., for the survival of the message sequence within the scope of the genetic algorithm, a greater number or severity of error messages or a hierarchically higher classification in the hierarchy or ranking of the error message types is decisive.

[0031] These features or criteria can be used individually or in combination with one another. If two different message sequences, for example, generate the same number of error messages, but one of the message sequences results in a more severe or hierarchically higher-classified error message, then this error message may have a greater suitability and is accordingly preferably used further, i.e., is adopted or incorporated into the next generation of message sequences, for example.

[0032] By means of the design proposed herein of the present invention, it is ultimately possible to particularly reliably determine the message sequence that leads to particularly important or relevant errors. This can optimize the robustness of the corresponding data processing system by giving priority to or taking into account particularly serious and / or relevant errors or vulnerabilities. Less serious errors may, for example, lead to unexpected delays without hindering or preventing the basic operation of the receiving device or the data processing system. On the contrary, serious errors or more serious vulnerabilities may, for example, lead to safety-related erroneous functions or to a sudden termination or interruption of a function or program flow, etc. Therefore, by means of the design proposed herein of the present invention, a corresponding priority optimization can be achieved by correspondingly prioritizing the error messages, and thus, a particularly efficient and effectively improved safety and / or reliability of the data processing system can ultimately be achieved.

[0033] In a possible extension of the present invention, a new generation, i.e. a new and varied message sequence, is generated by a genetic algorithm until a preset convergence criterion and / or a preset interruption criterion regarding error messages and / or regarding the most suitable message sequence is met. Thus, when the convergence criterion and / or the interruption criterion are met, the generation of the genetic algorithm or a new generation or a new individual, i.e. a new message sequence, is automatically stopped, for example, depending on the situation that occurs first. During the convergence criterion, for example, the convergence of the message sequence or the characteristics of the message sequence can be checked to determine a particularly problematic message sequence or a corresponding characteristic or a corresponding group of characteristics or at least one cluster of problematic message sequences with the same or similar characteristics. For example, it can be determined here whether the message sequence that is prevalent in the genetic algorithm, i.e. the most suitable message sequence according to a preset degree of suitability, remains at least substantially the same over several generations.

[0034] In the corresponding abstract vector or feature space, for example, corresponding clusters, i.e., groupings of message sequences and / or characteristics of message sequences, can appear or be identified. Cluster analysis can be used for this. If the most suitable message sequence or one or more of its characteristics are or remain in the corresponding cluster within a preset number of generations, then, for example, a convergence criterion can be met. If necessary, multiple clusters formed within several generations can also be identified. Multiple parallel clusters can indicate different errors or loopholes. Then, if necessary, these errors or loopholes can be identified individually and eliminated if necessary.

[0035] A preset minimum size or a preset minimum number of error messages and / or message sequences in a cluster can be used or considered as a convergence criterion or a correlation criterion for the cluster, for example. The cluster can only be identified as such or relevant when it reaches a preset minimum size, i.e., for example, contains or includes or represents at least a preset minimum number of message sequences and / or error messages within a preset maximum distance between each other. The corresponding distance can be determined, for example, by an abstract distance criterion, i.e., for example, as a Mahalanobis distance, etc. The design scheme proposed herein of the present invention can limit or preset the cost required to execute the method according to the present invention. Therefore, the method according to the present invention can be applied accordingly effectively and efficiently. Multiple different errors or vulnerabilities can also be identified simultaneously through the proposed cluster analysis. This also contributes to the improvement of the efficiency of robustness optimization.

[0036] In another possible design of the present invention, for example, in addition to the corresponding number of error messages, the type and / or severity of the error message or the error on which the error message is based is also detected. Then, the corresponding type and / or severity of the error message is combined with the corresponding number of error messages to be considered for determining the most problematic message sequence. For this purpose, the error message can be weighted according to its type and / or severity or accordingly. The level, ranking or order mentioned elsewhere of the error message or error type can be used for this or as a basis, respectively. Therefore, at least mathematically, the error message that is more serious or is classified higher in level according to its type or is to be prioritized can be regarded as more than one error message, and in other ways has a greater impact on determining the most problematic message sequence than the error message that is less serious or is not classified too high according to its type or is not prioritized. This represents a simple and practical possibility, that is, to realize the personalized prioritization of errors or vulnerabilities according to the corresponding requirements.

[0037] The present invention also relates to a support device for supporting the robustness optimization of a data processing system, in particular a conventional bus-based system. The support device according to the present invention has a processing device, such as a microchip, a microprocessor or a microcontroller, and a computer-readable data memory coupled thereto. In addition, the support device according to the present invention has at least one interface for sending a message sequence to a receiving device and for receiving an error message generated by the receiving device. Here, the support device according to the present invention is designed to perform the method according to the present invention, in particular automatically or semi-automatically. For this purpose, the corresponding operation or computer program encoding or implementing the method steps, procedures or measures mentioned in conjunction with the method according to the present invention can be stored in a data memory, for example. The operation or computer program can be executed by means of a processing device in order to realize the execution of the corresponding method. The support device according to the present invention can in particular be the support device mentioned in conjunction with the method according to the present invention or corresponding thereto.

[0038] The invention also relates to a CI system for continuous software integration. The CI system according to the invention comprises a support device according to the invention. Therefore, the CI system according to the invention is designed to automatically check incoming or detected software components, such as corresponding program codes, etc., with the aid of the support device, i.e. using the method according to the invention, to determine errors or error susceptibility or robustness. For this purpose, different message sequences can be automatically generated by the support device and sent as input to the corresponding incoming or detected software components or corresponding program codes for processing. The CI system can also be designed to update a preset test version of a more comprehensive software, such as stored in a data memory of the CI system, and / or a receiving device or data processing system provided for such test purposes or connected to the CI system in normal use, using the corresponding incoming or detected software components or corresponding program codes, and send the generated message sequences to the software and / or the receiving device. The generated error messages can then be automatically detected by the support device.

[0039] Furthermore, the CI system according to the invention is designed to release, for example deliver, the corresponding software component for integration and / or automatically integrate it into the corresponding production system if no error messages occur or are detected during the check.

[0040] Furthermore, the CI system according to the invention is designed to reject the corresponding software component and automatically create a corresponding report if at least one error message occurs or is detected during the check. In this case, such a report can also include in particular the correspondingly determined most problematic message sequences, for example together with the corresponding error messages. For example, the corresponding report can be stored in a data memory of the CI system and / or output via a corresponding interface and / or sent as an e-mail, etc. Thus, continuous software integration can be implemented or realized in a particularly safe and reliable manner by means of the CI system according to the invention.

[0041] The CI system according to the invention can also be designed to store the corresponding determined most problematic message sequences of the rejected software components, which are for example provided with corresponding assignments or identifications. When, for example, a new version or a new revision of the corresponding software component is introduced or detected, the message sequence can be used to check the software component. For example, the corresponding most problematic message sequence determined in advance can be used as the first message sequence for checking the new software component or the corresponding updated software. If necessary, the corresponding message sequence can be used as a starting point for generating another message sequence and / or as at least a part of the first generation of the genetic algorithm explained in conjunction with the method according to the invention. Therefore, the CI system can be designed to automatically generate new or future release tests when rejecting software components, especially according to the corresponding most problematic message sequence or the message sequence characteristics and / or the pattern found together of the error message. Therefore, the corresponding release or release test can be at least partially automated, and thus the continuous software integration can not only be implemented or realized in a particularly safe and robust manner, but also in a particularly effective manner.

[0042] The CI system according to the invention can also be a CD system (CD: continuous conveyance) or part of a CD system. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Further features of the invention can be derived from the claims, the drawings and the description of the drawings. The features and feature combinations mentioned previously in the description and the features and feature combinations shown individually in the description of the drawings and / or in the drawings can be used not only in the respectively specified combination but also in other combinations or alone without departing from the scope of the invention.

[0044] in,

[0045] Figure 1 An exemplary schematic diagram showing a message sequence for a data processing system is shown;

[0046] Figure 2 A schematic diagram is shown for illustrating the generation of different message sequences by means of a genetic algorithm; and

[0047] Figure 3 An exemplary schematic overview diagram for illustrating a CI system with integrated robustness optimization is shown.

[0048] In the figures, identical and functionally identical elements are provided with the same reference numerals. For the sake of clarity, only a representative selection of identical or similar elements that are present multiple times is explicitly indicated in some parts. DETAILED DESCRIPTION

[0049] An example of a software or data processing application, in which errors should also be avoided as far as possible for safety reasons, is the determination and output of a locally permissible maximum speed by a corresponding assistance system of a motor vehicle. Such an assistance system can, for example, receive and process map data in a corresponding control unit in order to determine the permissible maximum speed. For example, such map data can be sent by a navigation device via a data bus, i.e. as a bus message, to the control unit. The ADAS protocol can, for example, be used for this. However, this protocol may be susceptible to or sensitive to errors or unexpected deviations or changes in the timing of the corresponding messages (i.e. corresponding data packets etc.) and to the sequence of the messages or data packets. As soon as such errors or deviations occur, the control unit may not be able to process one or more corresponding messages correctly and, in particular, outputs an error message 15 accordingly via the data bus (see Figure 3 ).

[0050] However, potential errors or holes that are ultimately responsible for this, for example in the corresponding source code of the control unit, may be difficult and complex to identify. To facilitate this, in particular at least semi-automatic support can be applied, for example based on a predefined genetic algorithm.

[0051] Such a genetic algorithm can generate different messages which can then be sent to the control unit in order to check whether an error message 15 can occur as a result. Figure 1 An exemplary schematic diagram of a corresponding message sequence 1 is shown. The message sequence 1 comprises a plurality of individual messages 2 and the time intervals 3 respectively located between them. The individual messages 2 can be, for example, signals or data blocks of different functions and / or devices, which should routinely be sent in a predefined sequence and at specific time intervals 3 relative to one another via a data bus. However, in a corresponding control unit environment comprising a plurality of control units or other devices, such as sensors, etc., which are connected to one another via a data bus and communicate with error-sensitive bus messages, it can be problematic to identify errors and loopholes in the processing of bus messages. This can be caused by the fact that timing problems can often occur, which can be difficult to identify and reproduce, such as, for example, different time intervals 3 between the individual messages 2.

[0052] Thus, the time intervals 3 of the message sequences 1 can be different or varied here, and a plurality of such message sequences 1 can ultimately be generated by a genetic algorithm, which have different and varying time intervals 3 between the individual messages 2. The message sequence 1 can be described here by a corresponding genetic sequence, which can be determined or defined by a corresponding sequence of the time intervals 3 of the corresponding message sequences 1.

[0053] To further illustrate, Figure 2An exemplary schematic diagram of a plurality of corresponding individuals 4 to which a genetic algorithm can be applied is shown. The individuals 4 are defined here by their gene sequences, i.e. the corresponding sequences of intervals 3. Different individuals 4 may have commonalities and / or differences. For example, the commonality between two individuals 4 may be that the same time intervals 3 are at the same position in the corresponding gene sequence. However, all message sequences 1 corresponding to the individuals 4 may be identical and correct with respect to at least one predefined formal criterion, i.e., have, for example, all the single messages 2 expected in the corresponding application case in a predefined correct order. Thus, for example, the individuals 4 may all have the same number of genes, i.e., the individual intervals 3.

[0054] Within the scope of the genetic algorithm, different individuals 4 can be combined with one another and, for example, random mutations, i.e. changes in one or more intervals 3 of the individuals 4, can be generated. In order to distinguish between weak individuals and fit individuals 4, a corresponding degree of fitness or a corresponding fitness can be determined for each individual 4. For this purpose, for example, a corresponding message sequence 1 can be generated using the gene sequence of each individual 4 and sent, in particular multiple times in sequence, to a control unit. Then, the error messages 15 generated for each message sequence 1, i.e. generated by the control unit when processing the corresponding message sequence 1, can be detected. Based on these error messages 15, in particular their number or their type and / or severity, the degree of fitness or fitness of the corresponding message sequence 1 and thus the corresponding individual 4 can be determined for the genetic algorithm.

[0055] In gene pairing, based on the corresponding fitness, suitable or more suitable individuals 4 or their genes relative to other individuals 4 can be preferred relative to weak, i.e. less suitable individuals 4. Through this pairing and possible mutations, i.e. changes in the individual intervals 3, a new generation of individuals 4 can be generated with the help of a genetic algorithm. The message sequence 1 corresponding to the corresponding new generation of individuals 4 can also be sent to the control unit in order to detect the generated error messages 15 and determine the corresponding fitness of the new generation of individuals 4 based on this. As a basis, for example, 100 different individuals 4 can be generated first, which can then be sent to the control unit 10 times respectively. However, other values ​​can also be used here depending on the application. Then, for example, a genetic algorithm can be applied based on this until convergence to a specific individual 4 or a cluster of individuals 4 is generated, so that, for example, particularly many and / or severe error messages 15 can be generated or caused particularly reliably.

[0056] To further illustrate the application of this genetic algorithm for robust optimization of data processing systems, Figure 3An exemplary schematic overview of a CI system 5 is shown. The CI system 5 is schematically shown here with one or more interfaces 6, a processor 7 and a data memory 8. For example, a corresponding test program 9 can be stored in the data memory 8, which test program includes or implements a genetic algorithm. Of course, further data, software components, computer programs, etc. can be stored in the data memory 8.

[0057] The CI system 5 can detect a software component candidate 10, for example, via the interface 6. The software component candidate 10 can be, for example, a new or updated program code, which should be supplied to the software maintained by the CI system 5 or a corresponding data processing system. However, instead of directly performing this, the software component candidate 10 can first be tested in the described manner. For this purpose, the software component candidate 10 can, for example, first be loaded onto a preset test device 11. For this purpose, the test device 11 can, for example, have a test device interface 12, a test device processor 13 and a test device data memory 14. The test device 11 can, for example, correspond to the control unit described above.

[0058] The test device 11 can be connected to the CI system 5, for example, via an Ethernet connection. In addition, the CI system 5 can send different message sequences 1 generated by means of a genetic algorithm, for example, via a SomelP protocol or the like, to the test device 11 for processing. Possibly generated error messages 15 can be detected by the CI system 5 and taken into account by the test program 9 as described. In this case, the test program 9 can, for example, adapt the timing, i.e. the intervals 3 of the message sequence 1, based on the detected error messages 15. This can continue until the final most problematic individual 4 or the corresponding message sequence 1 or the final error pattern is found.

[0059] Depending on the results of the test program 9, i.e. the application of the genetic algorithm, the CI system 5 can output a corresponding output 16. If no error message 15 is detected, the output 16 can be, for example, a software component candidate 10 which can therefore, for example, be released or supplied. If, on the other hand, an error message 15 is detected, a corresponding report can be output as output 16, for example. Thus, for example, the software component candidate 10, the most problematic message sequence 1 determined by the test program 9 and the error message 15 generated by the test device 11 when processing this message sequence 1 can be described or output. Such an output 16 can support the analysis of potential errors or vulnerabilities of the test device 11, for example in which the corresponding problem can thus be reproduced in a targeted manner, for example in a computer-supported debugging environment or the like.

[0060] Overall, the described example shows how a method for identifying errors or vulnerabilities, such as timing problems, can be implemented in a system that provides feedback (e.g. in the form of error messages 15) by processing messages in order to facilitate the analysis of the corresponding source code and thus ultimately eliminate corresponding erroneous behaviors, such as in embedded systems or control units, to improve robustness. In this case, timing-based errors in sequence-dependent bus-based data processing systems can be discovered, for example, with the aid of a genetic algorithm.

[0061] Reference numerals list

[0062] 1 Message Sequence

[0063] 2 Single Message

[0064] 3 Interval

[0065] 4 individuals

[0066] 5 CI system

[0067] 6 Interface

[0068] 7 Processor

[0069] 8 Data storage

[0070] 9 Testing Procedure

[0071] 10 Software Component Candidates

[0072] 11 Test Equipment

[0073] 12 Test device interface

[0074] 13 Test device processor

[0075] 14 Test device data storage

[0076] 15 Error Messages

[0077] 16 Output

Claims

1. A method for supporting robustness optimization of a conventional bus-based data processing system, wherein: - generate different message sequences (1), - sending the message sequences (1) one after the other to a receiving device (11) designed to process the message sequences (1), - for each message sequence (1), detecting an error message (15) generated by the receiving device (11), and - depending on the number of respectively generated error messages (15), one of the message sequences (1) is classified as the most problematic message sequence (1, 16) and is output as a basis for corresponding error correction.

2. The method according to claim 1, characterized in that The generated message sequence (1) contains identical individual messages (2), but with variations in the time intervals (3) between the individual messages (2).

3. The method according to any one of the preceding claims, characterized in that Each message sequence (1) is sent multiple times to the receiving device (11), and all error messages (15) occurring therein are taken into account in order to determine the most problematic message sequence (1, 16).

4. The method according to any one of the preceding claims, characterized in that The different message sequences (1) are generated with the aid of a predetermined genetic algorithm (9), in particular by using pairing and mutation over several generations.

5. The method according to claim 4, characterized in that In the genetic algorithm (9), a corresponding sequence of time intervals (3) between the individual messages (2) contained in the corresponding message sequence (1) is used as a corresponding gene sequence of the message sequence (1).

6. The method according to claim 4 or 5, characterized in that: In the genetic algorithm (9), the number and / or severity and / or type of error messages (15) generated when processing the message sequence are used as a degree of suitability of the message sequence (1), wherein a greater number of error messages (15) and / or a higher severity and / or a type of error messages (15) that is hierarchically classified higher according to a preset hierarchy of error message types corresponds to a greater suitability.

7. The method according to any one of claims 4 to 6, characterized in that New message sequences (1) are generated by the genetic algorithm (9) until a predetermined convergence criterion and / or a predetermined termination criterion with respect to the error message (15) and / or with respect to the most suitable message sequence (1) is met.

8. The method according to any one of the preceding claims, characterized in that The type and / or severity of the error messages (15) are also detected and taken into account in combination with the number of error messages (15) for determining the most problematic message sequence (1, 16).

9. A support device for supporting robustness optimization of a data processing system, the support device comprising a processing device (7) and a computer-readable data memory (8) coupled to the processing device, and at least one interface (6) for sending a message sequence (1) to a receiving device (11) and for receiving error messages (15) from the receiving device (11), wherein: The supporting device is designed to carry out the method according to one of the preceding claims.

10. A CI system (5) for continuous software integration, comprising a support device according to claim 9 and being designed to: - automatically checking the incoming software component (10) with the aid of the support device to determine its susceptibility to error, - if no error message (15) is detected during said check, then the corresponding software component (10) is released for integration, If at least one error message (15) is detected during the check, the corresponding software component (10) is rejected and a corresponding report (16) is automatically created and output, which also includes the determined most problematic message sequence (1, 16).

Images