Method for carrying out technical process in normal operation and repair operation

Abstract

The invention relates to a method for executing a technical process, in which applications (AP1... AP5) are executed redundantly in N computing instances, and on the basis of a MooN system, in which M is at least 2 and N is at least 3, a comparison of N results of the redundantly executed applications (AP1... AP5) is carried out during voting (VTG). In the case that a minority of results are different from a majority of results with the same content, the minority of results are not considered during execution of the technical process, and are repaired and recombined into the process through a state copy of one of the undamaged calculation instances according to the invention. The invention also comprises a computer program product and a providing apparatus.

Description

Technical Field

[0001] The invention comprises the following subject matter: A method for carrying out a technical process. The invention comprises the following subject matter: A computer program product with program instructions. The invention comprises the following subject matter: A device for providing a computer program product according to the preceding claim. Background Art

[0002] Railway automation systems, i.e. communication networks or control systems used in the field of railway automation, must meet high requirements for the correct and reliable functioning of components and the transmission of messages, for example in the form of control information, within their operating scope. The reason for this is that the corresponding processes (computation, data storage, message transmission) have a direct impact on operational safety, also called "Safety". A corresponding railway automation system usually consists of at least one control unit, which controls a plurality of terminals or requests information from these terminals and uses a corresponding communication network for this purpose. A characteristic of railway automation systems is that they usually include a large number of devices or units and are usually geographically extended, so that a distributed system with components at different locations results.

[0003] For example, EP 3676991 A1 describes that at least during the operation of a railway automation system, the transmission of messages can be carried out according to a publish-subscribe method in order to provide an operationally reliable transmission technology which ensures greater flexibility with regard to configuration and scalability.

[0004] Furthermore, in order to ensure a safety-related computing environment, it is known that only the components for processing the relevant application are reliably installed in multiple computing instances of the computer. If the application is then run in parallel in multiple computing instances, it can be determined in a manner known per se by voting whether an error has occurred in the computing, thereby also discovering storage errors.

[0005] According to patent document WO 2014 / 00924382, a method and a computer are described, which have a checking algorithm for processing applications in a computing environment formed by a computer. Redundantly executed applications are installed on the computer, so that the checking algorithm can find errors by comparing calculation results (also called voting as mentioned above).

[0006] However, this method involves a lot of hardware costs and, in some cases, does not allow reliable error detection. When an error is detected, the components of the railway automation system that were involved in the error must be isolated for reasons of operational safety. If there are no longer enough functional components available, the railway automation system must be reinitialized, which is associated with an interruption of railway operation. This often results in train delays, for example. Summary of the invention

[0007] The technical problem to be solved by the present invention is to eliminate the problems described in the prior art. In particular, the object of the present invention is to provide a method for executing a technical process with voting, which can continue to operate as long as possible even when an error is detected.

[0008] According to a first aspect of the invention, a method for performing a technical process is described.

[0009] a) the application is executed redundantly in N (N is a natural number) independent computing instances (in which, for the execution of the application, messages are received, processed and sent in a manner known per se, wherein messages are sent if the results of the execution of the application are to be transmitted to other computing instances or other hardware components participating in the technical process), and

[0010] b) performing a comparison of N results of redundant execution of the application program at the time of voting based on a MooN system, where M (M is a natural number) is at least 2 and N is at least 3, wherein

[0011] c) In the case where a minority result differs from a majority of results with identical content, said minority result remains disregarded when performing the technical process.

[0012] In order to avoid misunderstandings, it should be noted here that the individual claim features are numbered consecutively with lowercase Latin letters, regardless of the claim number. This means that each letter appears only once in the entire claim, which enables unambiguous location of the claim feature in question without reference to the claim number. The order of the letters is therefore not important.

[0013] In order to make the execution of the application program redundant, the computing instances work independently of each other. This means that the processes for redundantly executing the operation of related application programs in the computing instances do not influence each other. Preferably, the computing instances respectively access reserved storage areas of one or more storage units. Preferably, the computing instances that execute the application program redundantly do not exchange messages for the execution of the related application program.

[0014] Comparators, also known as voters, are devices for determining the functionality of redundant systems. Majority decision systems, MooN systems for short, belong to active redundancy (majority redundancy). They are used as a means to increase the fault tolerance of systems for which a high degree of operational safety is required to prevent faults or errors. MooN systems have different architectures. Practical applications within the scope of the present invention can be found, for example, in three-way (2oo3) and four-way (3oo4) architectures. The results of the MooN system are compared by a majority decision maker (Voter) to forward the majority results. If at least M of the N systems are working (e.g. for hardware components and machines), or M of the N results are consistent when compared (e.g. for data and measured values), the results are forwarded. Otherwise, the overall system is considered to be faulty, and an error can be output and / or protective measures can be started (e.g. stopping the technical process).

[0015] The voting device thus makes a majority decision after the comparison. The following situation occurs here.

[0016] 1. All results are identical (even in the case of identical results, multiple results are referred to in the context of the description of the present invention, since they are calculated by different computing instances. In other words, the mathematical understanding that an identical result is just one result is not important here). This is considered as proof that the technical process runs without errors in all computing instances. The corresponding results can be used in the computing instances involved in their generation to further execute the technical process or to generate messages to other computing instances.

[0017] 2. Most of the results are the same. This is considered to prove that most of these results are correct. The corresponding (same as other results) results can be used in the computing instances involved in its generation to further execute the technical process or generate messages to other computing instances, while the computing instances that calculated different results are excluded from the execution of the technical process.

[0018] 3. Identical results do not predominate. This means that either all results differ from one another or the number of identical results is not a majority compared to the number of results that differ from it. This is considered evidence that the risk of error is too great. Protective measures for the execution of the technical process must be taken. This can include, for example, outputting a warning or aborting the execution of the technical process.

[0019] The centralized exclusion of redundant computing instances from participating in (in short, contributing to) a technical process, whether a single computing instance or an entire team of computing instances (a team refers to the totality of computing instances that redundantly execute the relevant process steps), can be accomplished by message communication, also with the computing instances themselves. If a computing instance is identified as faulty by the voter, the computing instance is shut down (or, in the case of interference with the shutdown function, it is shut down externally), and according to the invention it can subsequently be started again without fault (this is discussed in detail below).

[0020] The voting device can be implemented by software technology or hardware technology, wherein in the scope of the present invention, the voting device using software technology is preferably used. The voting device implemented by software technology is composed of a program module for comparison, also called voting, which processes the above results as input and generates errors or permissions as output. In hardware technology, the voting device can also be designed as an analog computer, which performs voting through the logical association of the structural blocks of the analog computer. In particular, the program module can also run on a processor, and the processor itself preferably does not participate in the generation of the results. This leads to the hardware technical separation of the task of generating the result on the one hand and the task of evaluating the result by comparison on the other hand. It has the advantage that the method steps of generating the result and comparing the result can have a small influence on each other, so the operational reliability of the comparison process can be additionally increased.

[0021] According to the present invention:

[0022] d) in the case of c) (see above), at least one instance of calculation involving the production of a small number of results is excluded from the performance of the technical process,

[0023] e) for the case according to c) (see above), a computation instance not involved in the new initialization (i.e., a computation instance involved in producing the majority of results) creates a state replica from the state to be newly initialized, and stores all messages (in the form of data items) sent to the computation instance since the creation of the state replica and their order, and

[0024] f) At the time of the new initialization, the state of the involved computing instances is established based on the state replicas, and all stored messages are processed by the involved computing instances in the order in which they were stored, until the involved computing instances are once again running synchronously with the computing instances not involved in the new initialization,

[0025] g) Thereafter, at least one of the computational instances involved (previously involved in the generation of a small number of results) is reincorporated into the technical process.

[0026] If at least one of the involved computation instances is re-merged into the technical process, this means that it is again working in sync with the computation instances that were previously left in the technical process. In other words, the re-merged computation instance produces the required results close in time to the other computation instances, so that after being merged into the process all results can again be compared by the voter as described above.

[0027] One advantage of the invention is that a computing instance that was excluded from a technical process due to voting, in other words a computing instance that was isolated, can be "repaired" within the scope of the method according to the invention and can be incorporated into the technical process again after synchronization. This advantageously means that the technical process can continue to run permanently even in the event of repeated errors. The only prerequisite is that the majority of redundantly running computing instances still run without errors, because this still provides operational safety for the technical process.

[0028] The majority of redundantly working computing instances can also be used to make the state copy. It is ensured that the state copy is error-free, which is guaranteed by the matching results of the majority of computing instances with a sufficiently high probability. After the state copy is transmitted to the computing instance in isolation, the computing instance can make up for the "missed" computing steps with the stored messages until it runs synchronously again and is then reintegrated into the technical process. Now there are enough redundant computing instances available again, so that the computing instance with calculation errors can be excluded from the process in the next error situation. In other cases, more and more computing instances fail one after another until the technical process stagnates. Therefore, the present invention helps to improve the stability of the technical process without weakening safety.

[0029] According to a further aspect of the invention, a computer program product with program instructions for executing the above method is specified.

[0030] According to the present invention, a computer program with program commands, which includes program modules, is therefore specified, wherein the method according to the present invention and / or its embodiments can be executed by means of the computer program and the advantages described are achieved through this execution.

[0031] According to a further aspect of the invention, a provision device for a computer program product according to the preceding claim is specified, wherein the provision device stores and / or provides the computer program product.

[0032] Furthermore, a provision device in the form of a computer-readable storage medium for storing and / or providing a computer program is described. The provision device is, for example, a storage unit that stores and / or provides the computer program. Alternatively or additionally, the provision device is, for example, a network service, a computer system, a server system, in particular a distributed, for example cloud-based, computer system and / or a virtual computer system, which stores the computer program on a computer-readable storage medium and preferably provides it in the form of a data stream.

[0033] The provision is implemented in the form of a program data item of the computer program as a file, in particular a download file, or as a data stream, in particular a download data stream. For example, the computer program is transferred to a computing environment using a provision device so that the method according to the invention can be executed in a computing instance of the computing environment.

[0034] An apparatus is computer-assisted or computer-implemented when it has at least one computer or processor, or a method is computer-assisted or computer-implemented when at least one computer or processor performs at least one method step of a method.

[0035] A computing environment is an IT infrastructure consisting of components such as processors, storage units, programs and data to be processed by the programs, wherein the data is used to execute at least one application that must perform a task. An IT infrastructure can also consist of a network of the above components.

[0036] The cloud (also called computer cloud or data cloud) is a computing environment for so-called cloud computing. It refers to an IT facility that is implemented via a network interface, such as the Internet. It usually includes storage space, computing power or software as a service that does not have to be installed on the computing instance using the cloud. The services provided in the scope of cloud computing include the entire field of information technology and also include IT infrastructure, platforms, software and computing power, wherein the cloud provider allocates the provided resources to cloud users according to demand in order to achieve optimal utilization of resources.

[0037] Due to the high safety standards that apply in railway technology with regard to the functionality (operational safety) and vulnerability (transmission security) of computer-implemented solutions, the functionality of clouds used in railway technology is often limited in terms of their shared availability. Restrictions are therefore necessary, especially when it comes to access to a potentially unlimited circle of cloud users. However, when it comes to sharing computing resources via different computing instances, access must also be limited with regard to the required redundancy. Technologies that take these restrictions into account for railway technology are also referred to in the context of the present invention as private clouds, even if private clouds only meet the technical features associated with cloud technology to a limited extent.

[0038] In any case, the task achieved by the features proposed according to the invention is to safely design the distributed processing of applications on distributed computing instances of commercial origin (so-called COTS components, COTS standing for Commercial off-the-shelf). Thus, the dependence on local conditions and proprietary computer systems is advantageously reduced or even eliminated. Process stability can advantageously be ensured independently of the system.

[0039] A computing instance (or simply instance) constitutes a functional unit within a computing environment, which can be assigned to an application (e.g., composed of multiple program modules) and can execute the application. When executing the application, these functional units form a physically (e.g., computer, processor) and / or virtually (e.g., program module) independent system.

[0040] A computer is an electronic device with data processing capabilities. A computer may be, for example, a client, a server, a handheld computer, a communication device, or other electronic device for data processing, which may have a processor and a storage unit and may also be connected to a network via an interface.

[0041] The processor can be, for example, a converter, a sensor for generating a measurement signal or an electronic circuit. The processor can be a central processing unit (CPU), a microprocessor, a microcontroller or a digital signal processor, which can be combined with a storage unit for storing program instructions and data. The processor can also be understood as a virtualized processor or Soft-CPU.

[0042] The storage unit can be designed as a computer-readable memory in the form of a working memory (Random Access Memory) or in the form of a data storage device (hard disk or data carrier).

[0043] A program module is a single software functional unit that implements a program sequence of method steps according to the present invention. The software functional unit can be implemented in a single computer program or in multiple computer programs that communicate with each other. The interface implemented here can be implemented in a single processor by software technology or by hardware technology when multiple processors are used.

[0044] The interface can be realized by hardware technology, for example a wired or wireless connection, or by software technology, for example as interaction between individual program modules of one or more computer programs.

[0045] Unless otherwise indicated below, the terms "create", "determine", "calculate", "generate", "configure", "edit" etc. preferably relate to the process of generating and / or changing data and / or converting data into other data. The data are present in particular as physical quantities, for example as electrical impulses or as analog electrical quantities. The necessary instructions are combined into software in a computer program. In addition, the terms "send", "receive", "read in", "read out", "transmit" etc. refer to the coordination of individual hardware components, in particular processors and / or software components, in particular program modules via interfaces.

[0046] General embodiments of the present invention:

[0047] The following explanations describe improved variants of the invention without restricting the basic idea of ​​the invention.

[0048] According to a variant, the above-mentioned aspects of the invention are determined by:

[0049] h) If a majority of identical results cannot be determined during voting, the N results shall remain unconsidered during the technical procedure,

[0050] i) for the case according to h), N computing instances are excluded from the execution of the technical process,

[0051] j) Initialize N new computing instances, where the redundant execution of the application is restarted.

[0052] This variant of the invention describes the situation in which, within a team, all computing instances, or at least the majority of them, provide different results. In this case, it is not possible to create a state copy in which it can be safely assumed to be error-free. Instead, all computing instances of the team are newly initialized. Synchronization is therefore not possible, since no computing instance can continue to run during the new initialization and form a reference for synchronization. Instead, the new initialization excludes the presence of errors in the application or the processed data items with the necessary safety, after which the computing instance is provided to the technical process for processing new tasks in the form of executing the application.

[0053] This variant of the invention has the advantage that the process can continue even if an entire team of computing instances fails. This presupposes, of course, that there are multiple teams of computing instances, which can ensure the process "by proxy", so to speak, by processing the required applications during the new initialization of the teams involved. During this time, at most a slowdown in processing will occur, but the process will not come to a complete standstill. It is also advantageous that sufficient computing power can be provided by the team so that if one team fails, the technical process does not slow down, and the computing instances do not run at full load when all teams are available. As a result, the performance of the process is advantageously improved in terms of operational stability and availability.

[0054] According to a variant, the above-mentioned aspects of the invention are determined by:

[0055] Once the situation according to c) occurs, a state copy is created by the computing instance that does not involve new initialization.

[0056] The computing instances not involved in the new initialization are the computing instances that are part of the majority of computing instances that provide the same result. In contrast, the computing instances involved are always those computing instances (represented as a minority) that are excluded from participating in the technical process due to producing different results.

[0057] The advantage of using state copies that are created using computing instances that do not involve new initialization is that they can be created as needed. This need only arises when a computing instance is excluded from the execution of the technical process due to different results. If a majority of computing instances provide the same result, it is assumed that error-free state copies can be created from these computing instances. Since this only occurs when necessary and subsequent messages and their sequence must be stored only then, the required computing power is advantageously reduced to a minimum. As a result, the performance in terms of computing power when executing the technical process is thus improved.

[0058] Alternatively, a state copy can be created cyclically by each computing instance. Each time a new state copy is created, the previous copy including the subsequently stored messages is deleted. If a computing instance fails, there is already a state copy accessible. The advantage of this variant is that the computing instances are prevented from influencing each other by accepting the state copy of another computing instance. In addition, when a computing instance fails, a new initialization can be started immediately without having to wait for the creation of a state copy. As a result, the performance in terms of the speed of new initialization when executing the technical process is improved.

[0059] According to a variant, the above-mentioned aspects of the invention are determined by:

[0060] The contents of a majority of the results of calculation instances of at least one previous comparison step, preferably at least 10 previous comparison steps, are stored, and when processing a message according to step f) of claim 1, the calculated result is compared with at least one of the stored results for synchronization in at least one comparison step downstream of the processing.

[0061] The comparison step for synchronization is preferably performed by the same voter as the comparison of the results of step b) of the method according to the invention. Storing the results of the prior comparison step advantageously makes it easier to synchronize the calculation instances during normal operation in step b) and when remerging the calculation instances affected by errors in step f). If the results to be compared differ in time within the range of the stored results, a successful comparison can also be performed by the voter. In this regard, a synchronization window is mentioned below, in which the synchronization is successful even in the case of a certain time offset in the generation of the results to be compared. In the case of a remerging of the calculation instances involved, this can thus advantageously be performed earlier, since it is not necessary, as it were, to completely catch up with the calculation instances not involved in order to be remerged.

[0062] The advantage of this variant is that the process runs more stably, because the synchronization of the results generated by the application only needs to be within the synchronization action window defined by the stored results. The re-merging of the involved calculation instances thus takes place after a shorter synchronization time.

[0063] According to one variant, the above-mentioned aspect of the invention is determined by the fact that if in at least one downstream comparison step, preferably in at least three subsequent comparison steps performed in the order of the stored results, it is determined that the corresponding stored result is consistent with the result of the relevant calculation, then at least one calculation instance involved (the generation of a few results) is reincorporated into the technical process.

[0064] In the context of the present invention, downstream comparison steps are those required for the re-merging of the involved computing instances according to step f). They do not differ in content from the comparison steps performed within the scope of step b) of the method according to the present invention. These comparison steps are downstream only if a time offset is caused by the new initialization of the involved computing instances. They can then be compensated by the subsequent processing of the working steps of the application installed on the involved computing instance, which working steps have previously been processed by the non-involved computing instance. For this purpose, starting from the state copy in the involved computing instance, the stored messages are processed in the stored order until the involved computing instance reaches the synchronization window again with respect to the results to be compared.

[0065] In order to determine that the synchronization was successful, i.e. that the involved computing instances did not make errors when subsequently processing the message, at least the stored results must match. Advantageously, however, it is also possible to wait for the re-merging until three consecutive results match, which increases the security of the statement that the involved computing instances worked synchronously without errors. This advantageously increases the performance of the system in terms of safety.

[0066] According to a variant, the above-mentioned aspect of the invention is determined by determining the order of the messages by taking into account the points in time at which the messages were sent, wherein the order corresponds to the temporal sequence of the sending.

[0067] The order of the messages in this case indicates a kind of determinism which enables mutually dependent work steps, i.e. dependent work steps, to be processed with the same result (as with calculation instances not involved). This is necessary so that in dependent work steps intermediate results from preceding work steps can be sent as messages to subsequent work steps or messages required for processing the work steps can be received.

[0068] This variant of the invention therefore has the advantage that step F of the method according to the invention can be used to supplement not only parallel working steps that run independently of one another on a computing instance, but also serial working steps that must be executed in a specific time sequence.

[0069] According to a variant, the above-mentioned aspects of the invention are determined by:

[0070] The time at which the message was sent is stored as a digital timestamp.

[0071] If a digital time stamp is available for the point in time when a message is sent, the sequence of the messages can be reliably determined at any time by analyzing the digital time stamp. It is particularly advantageous if the digital time stamp forms part of the message so that it can be unambiguously assigned to the relevant message. Furthermore, by reading the messages in this way, the point in time of sending can be determined at any time, so that a plurality of messages can be sorted according to their chronological sequence.

[0072] According to a variant, the above-mentioned aspects of the invention are determined by:

[0073] State replicas and messages are sent and received via a message broker.

[0074] The message broker advantageously takes over the organization of the sending and receiving of messages relating to the relevant technical processes and the above-mentioned process of reintegrating the excluded computing instances.

[0075] According to a variant, the above-mentioned aspects of the invention are determined by:

[0076] Message brokers work through publish-subscribe method. Hence, a publish-subscribe system is used.

[0077] Here, the publish-subscribe system includes a device configured to publish at least one sender end of a message, a message agent configured to publish at least one sender end, a message agent configured to receive at least one receiver end, and an application configured to receive at least one receiver end of a message.

[0078] Corresponding publish-subscribe systems are known per se from other fields of application and usually achieve a decoupling of information providers from information receivers. In this context, the application on the sending end (i.e. the application running on the computing instance) is often also referred to as a "publisher" or "Publisher", while the application on the receiving end is referred to as a "subscriber", "Subscriber" or "Subscriber".

[0079] The implementation or use of the publish-subscribe system results in that the sender and receiver applications do not have to know each other. This results in, in particular, that if another receiver application wishes to receive messages or data from the sender application, the sender application does not have to be changed in order to additionally transmit the message to the other receiver application.

[0080] For the method according to the invention, this means that a calculation instance that was excluded from the technical process can be easily replaced by another calculation instance until it can be reintegrated into the method. In this case, the transformation of the tasks of the calculation instance is ensured by appropriate subscriptions to the required messages. Likewise, the reintegrated calculation instance can update its subscriptions to obtain the current messages again. In addition, for the synchronization process before the reintegration, the relevant old messages can be retrieved in the required order.

[0081] According to a variant, the above-mentioned aspects of the invention are determined by:

[0082] k) the message is contained in an application data item having a data segment,

[0083] l) voting on redundant data segments with multiple identical changes as a result (of redundant execution of the application),

[0084] m) In the case of c) according to claim 1, application data items containing data segments which lead to erroneous identification (ie which form a minority result which differs from the majority result) are kept out of consideration when performing the technical process.

[0085] The messages are advantageously stored in a single data segment of the application data item. This makes it possible, for example, to address the results of the redundant application of the application program in a targeted manner so that they are compared in the voter in the manner described above. However, other data segments in the application data item can also be compared advantageously, since these data segments also provide inferences about the reliable operation of the technical process (this will be described in detail below).

[0086] According to a variant, the above aspects of the present invention are determined by the fact that the storage unit of the computing instance operates as follows:

[0087] n) application data items are stored in storage units and encoded before storage,

[0088] o) retrieve the application data item from the storage unit and decode it after retrieval (German: Abrufen),

[0089] In this case, the storage unit is monitored for errors by carrying out a time sequence of computer-assisted check runs for the storage unit, and in this case, a new initialization of the computing instance involved according to step f) is only started when at least one, preferably two consecutive check runs indicate that no errors are present.

[0090] A check run is a minimum requirement for each application data item to be checked at least once before starting to reinitialize the computing instances involved. It is safer to wait for two consecutive check runs, because it must be considered that a check run was in progress at the time of the computing instance failure. Since it is error-prone to determine at this stage which application data items have already been checked and therefore must be checked in the next check run before it can be determined that all application data items are error-free, it is easier to wait for a positive result of the check run and perform another complete check run. If it also produces a positive result, it is determined that each application data item has been checked at least once (partially twice), without having to check in detail which application data items have not been checked in the previous check run at the time of the computing instance failure.

[0091] In general, by means of a method for operating a storage unit and executing an application, by checking a data segment containing data for the application and a check data segment containing further criteria that facilitate the checking, it is possible to determine which data items are actually or at least potentially damaged and thus threaten the operational safety of the application, in particular the execution of a user program. The affected data items are marked by an output error and are preferably excluded from data processing in further processing.

[0092] In this variant, in other words, the operational safety is coupled, so to speak, to the data items themselves. For this purpose, according to the invention, suitable check data segments are provided for them. This advantageously enables a plurality of data items to be stored on the same storage unit, even if processes are run in parallel (redundantly) for reasons of operational safety. In particular, commercially available software and hardware components, so-called COTS components, can thus be used for storing data items and processing applications, without jeopardizing the requirements for operational safety. Such components can therefore also be used, for example, for applications in railway technology and replace specialized systems. COTS components are advantageously purchased at low cost and can be more easily replaced and integrated into cloud solutions when necessary.

[0093] According to a variant, the above-mentioned aspects of the invention are determined by:

[0094] In the event that an error is detected in one of the check runs, the method is executed starting with step e) (independently of the occurrence of case c).

[0095] Advantageously, errors in application data items are corrected when they manifest. This could potentially also lead to errors in the processing of application data items (especially application data items of an application program), which is a security risk for the operation of the technical process. However, the newly initialized process also acts on stored application data items that were copied from an undamaged (uninvolved) computing instance when creating a state copy from the computing instance.

[0096] According to a variant, the above-mentioned aspects of the invention are determined by:

[0097] For the first coding of data (COD)

[0098] p) generating or selecting at least one application data item (ADS) comprising a data segment with application data for at least one application program and a check data segment (PA),

[0099] q) for each application data item (ADS), the inspection data segment (PA) is provided with count data (ZD) characterizing the inspection run being performed,

[0100] r) Each application data item (ADS) is encoded and stored,

[0101] and in order to check the data in the check run being executed after calling and decoding (DEC) the application data item (ADS), respectively apply

[0102] s) if the count data (ZD) do not represent either the check run being performed or the most recently completed check run, an error is determined for the application data item (ADS),

[0103] t) if no error is determined, the check data segment (PA) of the application data segment concerned is provided with count data (ZD) which characterize the check run being performed,

[0104] u) If no error is determined, the application data item (ADS) involved is encoded and saved again.

[0105] A check data segment is assigned to each data segment during the initial encoding (if the check data segment does not yet exist, it is generated in advance; or if a check data segment is already available for the data segment in question, the check data segment is selected), so that count data can be stored in the data item in question, which contains information about the check run being performed. By subsequently encoding the data item in question, access to the count data and other data of the data segment in question before decoding is protected. That is, the data cannot be accidentally (for example due to a malfunction) or intentionally (for example due to an external attack) changed in the encoded state without being recognized as an error when the data is decoded. At least it is very unlikely that the change is not considered an error when the data item is decoded. Although there is no protection against the change itself, only against undetected changes. By cyclically checking whether the memory content is correctly encoded (using the count data), so-called passive errors can also be detected. This refers to errors that may occur during data storage, for example due to physical changes of the storage medium (bit flips, etc.). According to this variant, the low probability of undetected errors can comply with higher safety levels (SEL-1...SIL-4).

[0106] Preferably, all data required by the application program are protected in the data item, ie data constituting the program itself and data representing the information to be processed.

[0107] For example, it is possible that the count data change due to a storage error, i.e. an error occurring during the storage of data in a storage unit (e.g. a so-called bit flip) or due to a processing error, i.e. an error occurring during the processing of a data item. However, if the count data do not characterize either the test run being performed or the most recently completed test run, such a change is determined during the next test run. In this case, an error is determined. Even though its cause may not be clearly determined and may be harmless to the data processing, for reasons of the safety level to be achieved, for example, after the error is determined, the error is output and / or measures are taken to prevent further processing of the erroneous data.

[0108] These errors also become apparent during voting, so that the involved calculation instances are excluded according to the above method. Afterwards, a reinitialization process is carried out, wherein, in the variant described, one check run or even two consecutive check runs are waited for before the initialization begins. Thus, storage errors that occur can be corrected even reliably. For this purpose, redundantly stored data items of other calculation instances can be used.

[0109] Whenever no errors are detected in a test run, the count data in the test data segment are assigned the count data of the test run being performed, the data item is encoded and saved again. The data item in question is thereby simultaneously characterized as being checked in the test run in question.

[0110] The characteristic that the count data must have is that they form a series in which the leading and trailing positions of each element of the set of count data are respectively known. Basically all mathematical series can be used here. Particularly preferably, a set of natural numbers can be selected.

[0111] In order to perform the check run, an application program (service program) that performs the check run is preferably used. For this purpose, the application program involved, which can also be called the check program, accesses the storage unit and decodes, checks and encodes the data items one by one until the check run is completely executed. In the case of errors being determined, these can be output by the check program. In this case, the check program can also include functions, which include reactions to determined errors, such as interrupting the execution of the application program (user program) on the computing instance involved, which uses the faulty data segment (also called application data segment) of the application and can therefore cause potential safety-related errors. This advantageously makes additional error sources identifiable, even if they are not directly related to the redundant processing of the data itself.

[0112] For example, the execution of the test run can be controlled by addressing a single data item. If the addresses of all data items are known at the beginning of the test run, these data items can be called in sequence until the end of the test run (this will be described in detail below).

[0113] If the check run as a whole is performed incorrectly, i.e. it does not check all data items of the check run, this will be apparent in the next check run at the latest, at least if the unchecked data items are checked again in a subsequent check run. That is, it still has the count data of the penultimate check run, which will be apparent during the next check run. Errors are thus detected and output. The count data thus also enable monitoring of the correct execution of the check run itself. This makes it possible to identify further sources of error. Data that are classified as outdated and therefore potentially erroneous (because they are not regularly checked in the check run) are not reliable enough in terms of their integrity, and are therefore considered to be erroneous.

[0114] This provides an additional safety mechanism that increases the operation of the storage unit and the execution of the application program (here a service program or a user program, which will be described in detail below). In particular, safety-related applications benefit advantageously from this increase, such as railway applications, which must meet the safety level (also called safety level, SIL-1...SIL-4 or Safety Integrity Level) determined as an approval condition. The term "safety" is to be understood as operational safety in the context of the present invention as described above. In particular, the encoding is mainly carried out based on the aspect of operational safety rather than on the aspect of transmission safety. Therefore, in this variant of the invention, a coding method is preferably provided, which achieves high performance during encoding and decoding (with the effect of short encoding and decoding times) and does not guarantee a high difficulty in decoding the coding without authorization.

[0115] According to another aspect of the present invention, a computer program comprising program modules with program instructions for executing the method according to the invention and / or its exemplary embodiments is further specified, wherein the method according to the invention and / or its exemplary embodiments can be respectively executed by the computer program.

[0116] According to another aspect of the present invention, a providing device for storing and / or providing a computer program is also described. The providing device is, for example, a storage unit that stores and / or provides a computer program. Alternatively or additionally, the providing device is, for example, a network service, a computer system, a server system, in particular a distributed, for example cloud-based, computer system and / or a virtual computer system, which preferably stores and / or provides the computer program in the form of a data stream.

[0117] The provision is carried out in the form of program data items of the computer program as a file, in particular a download file, or as a data stream, in particular a download data stream. Such provision can also be carried out, for example, as a partial download consisting of a plurality of parts. For example, such a computer program is transferred to a computing environment using a provision device so that the method according to the invention can be executed in a computing instance. BRIEF DESCRIPTION OF THE DRAWINGS

[0118] Further details of the invention are described below with reference to the drawings. Identical or corresponding elements in the individual figures are each provided with the same reference numerals and are only described repeatedly to explain the differences between the individual figures.

[0119] The embodiments described below are preferred embodiments of the present invention. In these embodiments, the components of the embodiments are respectively separate, mutually independent variants of the present invention, which also improve the present invention independently of each other and thus also constitute components of the present invention individually or in a different manner than the combination shown. In addition, the components can also be combined with the already described variants of the present invention.

[0120] Figure 1 A railway application is schematically shown with a computing environment and its interactions, wherein an embodiment of the method according to the invention can be executed with the computing environment,

[0121] Figure 2 (spread over two pages Figure 2A and 2B The structure is shown as a block diagram according to Figure 1 Embodiment of the method according to the invention in a computing environment with two hosts in a railway application, wherein the individual functional units contain program modules which form application programs and can each be executed in one or more processors and the interfaces can be designed accordingly using software technology or hardware technology,

[0122] Figure 3 and Figure 4 An exemplary embodiment of the method according to the invention is shown as a flow chart, wherein the individual method steps can be implemented individually or in groups by program modules, and wherein the functional units and interfaces according to FIG. 2 are shown by way of example.

[0123] Figure 5 An exemplary embodiment of the method according to the invention is shown as a flow chart, wherein the method steps shown can be implemented individually or in groups by program modules, and wherein the calculation examples and interfaces according to FIG. 2 are shown by way of example. DETAILED DESCRIPTION

[0124] Figure 1 A railway application controlled by a computing environment RU is schematically shown. The railway application has a track GL, on which various components of the interlocking technology STW are shown by way of example. This is a switch drive WA, which can adjust the switch WH. In addition, a transponder BL is mounted on one of the tracks GL, by means of which information can be exchanged with a train passing by the transponder. Finally, a light signaling device LS is shown, which is controlled by a controller CL.

[0125] The computer environment RU can have different hosts, namely a first host HR1, a second host HR2, and a third host HR3, and the applications for controlling railway applications are distributed on the hosts in the form of application programs AP1...AP5 (further described below). The first host HR1 is provided by a computing center RZ and is connected to a first storage unit SE1 via a first interface S1. The computing center RZ can be operated, for example, by a service provider of a railway operator or by the railway operator itself. The first host HR1 is connected to a private cloud CLD via a second interface S2, so that the first host is not locally bound to the railway application. The cloud CLD can be a private cloud CLD, which is understood to be a cloud CLD that is limited to authorized users.

[0126] The control center LZ of the railway operator comprises a second host HR2, which is also connected to the cloud CLD via a third interface S3. In addition, the second host HR2 is connected to the second storage unit SE2 via a fourth interface S4.

[0127] Furthermore, the computer environment RU has, for example, an interlocking device STW, which includes a third host HR3, which is connected to the third storage unit SE3 via a sixth interface S6. In addition, the third host HR3 has a fifth interface S5 for the second host HR2. Not shown, the third host HR3 is also connected to the cloud CLD. The third host HR3 also has a seventh interface S7 for the switch drive WA, an eighth interface S8 for the controller CL and a ninth interface S9 for the transponder BL.

[0128] according to Figure 1 , all interfaces S1 ... S9 are basically wired or even implemented by wireless transmission technology such as radio. The layout of the hosts HR1 ... HR3 is only exemplary and can be expanded as desired in more complex railway facilities. The computing environment is defined in this way, that is, the participating hosts HR1 ... HR3 can communicate with each other and thus the applications can be processed in a distributed manner on the hosts HR1 ... HR3 taking into account the available computing power. For this purpose, a computing instance is formed, which is not shown in detail and is described in detail below (see Figure 2, in which the computing instance RP1 ... RPn is shown).

[0129] FIG. 2 exemplarily shows Figure 1 The configuration of the first host HR1 and the second host HR2. The access of other hosts can be realized similarly. The hosts are organized in such a way that the task complex determined for solving the problem is organized on the host in the form of a program complex PK1 ... PK4, which is composed of individual application programs AP1 ... AP5. The first application program AP1, the second application program AP2, the third application program AP3 and the fourth application program AP4 are provided for processing railway applications, such as Figure 1 As shown, therefore is the procedure for use.

[0130] A program complex PK1 ... PK4 generally combines a plurality of application programs AP1 ... AP5, the common processing of which can be combined in terms of the overall application program. In particular, it can be provided that all application programs AP1 ... AP5 contained in a data item are combined into a program complex. This takes into account the fact that the data item leads to the combination of data segments DA in terms of the data to be used, and in parallel, the program complex brings together the corresponding application programs AP1 ... AP5, to which the data segments DA are assigned.

[0131] Configuration data KD1 ... KD13 are to be understood as data which configure the application programs AP1 ... AP5 for the individual requirements of the current application case. The configuration defines the interaction of the different application programs AP1 ... AP5 with one another and the functions of the application programs AP1 ... AP5 on the installed hardware components. Furthermore, the configuration also contains the adaptation to the current application case for which the relevant application program is envisaged (e.g. parameters which may be different in different application cases).

[0132] Furthermore, it is shown according to the fifth application AP5 that it can be implemented by a single subprogram TG, VT, GW, MB. The subprograms TG, VT, GW, MB of the fifth application AP5 are the gateway GW, the voter VT, the clock generator TG and the message broker MB, Message Broker (this will be further explained below). However, this can only serve as an example to understand how to implement the voter VT used according to the present invention by software technology and integrate it into the functional environment. Alternatively, for example, the clock generator TG can be run in another (non-safe) application, while the remaining subprograms TG, VT, GW, MB are run in the (safe) fifth application AP5 as described above.

[0133] In the context of the present invention, subprograms TG, VT, GW, MB are generally understood to be smaller units, such as program modules, which together form an application. It is therefore advantageous to be able to construct the application programs AP1 ... AP5 in a modular manner, i.e., to define program modules that are used in a plurality of application programs AP1 ... AP5, for example. In this case, these subprograms TG, VT, GW, MB can have different configuration data KD1 ... KD13 depending on their usage configuration. The subprograms TG, VT, GW, MB thus make it easier to create the application programs AP1 ... AP5 and thereby make it easier to adapt the computing environment to the application case.

[0134] In the creation of program complexes PK1 ... PK4, application programs AP1 ... AP5 and subprograms TG, VT, GW, MB, it should be noted that the configuration data KD1 ... KD13 can be respectively assigned to the program complexes PK1 ... PK4, application programs AP1 ... AP5 and subprograms TG, VT, GW, MB. In this case, certain data of the same content are stored multiple times, wherein they each form data segments DA, which in turn can be assigned univocally to the program complex, application program AP1 ... AP5 or subprogram TG, VT, GW, MB. The feasibility of the univocally assigned data segment DA is important in this case, so as to have univocally addressable data segments DA for implementing, in particular, the checking function of the storage unit (for this purpose, see the diverse characteristic data DD1 ... DD4 described below).

[0135] The fifth application program AP5 is organized in the same way in all program complexes PK1 ... PK4. It can exchange messages with the private cloud CLD via the gateway GW. Therefore, the gateway GW is based on Figure 1 A second interface S2 and a third interface S3 are formed. The messages are distributed within the program complex via the message broker MB, preferably according to the publish-subscribe method. For example, the gateway GW uses the fifteenth interface S15 to provide the received messages to the redundant computing instances RP1 ... RPn via the message broker MB. They are then called by the redundant computing instances RP1 ... RPn. This is represented by the node KN, which is represented in the fifteenth interface S15 (also in the other interfaces S10 ... S14 described below).

[0136] In FIG. 2 , for the sake of clarity, the program complexes PK1 ... PK4 are respectively implemented completely in the hosts HR1 ... HR2. In reality, the program complexes PK1 ... PK4 with the application programs AP1 ... AP5 and their subprograms TG, VT, GW, MB can also be run in a distributed manner on multiple hosts (not shown). This advantageously allows the capabilities of multiple hosts to be utilized if the capabilities of the host do not provide sufficient capacity for the configuration of the entire program complex, in such a way that the capabilities of multiple hosts are used jointly for the relevant program complexes.

[0137] The program complex PK1...PK4 can, for example, be specified for a specific task complex. The program complex can, for example, be used to control specific railway components (light signals LS, interlocking STW, turnouts WH, axle counters, etc.). In order to control these railway components, multiple application programs AP1...AP5 are generally required. In particular, the fifth application program AP5 explained above is also required to ensure the safe execution of the application and communication with other program complexes PK1...PK4 or the host. This is called a service program, which is used to protect the functions of the host and thereby execute applications related to the host (in contrast to the application programs AP1...AP5 that process usage data for railway components, which are therefore called usage programs). The fifth application program AP5 also runs in at least one computing instance RP9...RP12 of each host, but preferably not redundantly.

[0138] In the context of the present invention, multiple redundant computing instances are understood to be software executions on hosts HR1 ... HR3, which allow for parallel processing, or in other words, simultaneous processing of applications AP1 ... AP5, preferably within the corresponding program complex. FIG. 2 shows program complexes PK1 ... PK4, each of which has three redundant computing instances (e.g., RP1, RP2, and RP3) to form a redundant 2oo3 system, but more redundant computing instances RP1 ... RPn are also conceivable, as shown in the example for the first program complex PK1. In the following, the method for processing applications AP1 ... AP5 is explained according to the first program complex in the program complexes PK1 ... PK4 for the first redundant computing instance RP1, the second redundant computing instance RP2 ... and the third redundant computing instance RP3 for processing the first application AP1. However, the processing for the program complexes PK1 ... PK4 runs accordingly, so it is not necessary to explain it separately.

[0139] In the first redundant computing instance RP1 to the third redundant computing instance RP3, the first application program AP1 is processed redundantly, ie, simultaneously and in parallel. It is an application program which is processed according to Figure 1 In addition, first configuration data KD1 are provided from the first redundant computing instance RP1 to the third redundant computing instance RP2, which are necessary for executing the first application program AP1 to handle the unique tasks of the railway application. For example, the first application program AP1 can generally be used to control the light signal device LS, wherein the first configuration data KD1 ensures that the first application program AP1 is applied to the railway application according to Figure 1 In this case, it must be ensured that the Figure 1 Communication with the controller CL.

[0140] The configuration data KD1 ... KD13 can also be used for all other program complexes PK1 ... PK4, application programs AP1 ... AP5 and subprograms TG, VT, GW, MB. Accordingly, the configuration data KD1 ... KD13 contain the data required for the program complexes PK1 ... PK4, application programs AP1 ... AP5 and subprograms TG, VT, GW, MB, respectively, so that they can assume the tasks assigned to them in the relevant application case. In this case, the configuration data KD1 ... KD13 are respectively unchangeable and can therefore be stored in a data segment DA with a known start and a known end. Likewise, all program complexes PK1 ... PK4, application programs AP1 ... AP5 and subprograms TG, VT, GW, MB are stored as data segments DA with a known start and a known end. For this purpose, for example, a configuration data segment according to Figure 1The first storage unit SE1, the second storage unit SE2 and the third storage unit SE3 are stored in one of the storage units. However, the data stored in one of the storage units or kept stored in one of the storage units for a certain period of time are regularly subjected to a check run, by which storage errors in the stored data can be detected (described in detail below). Storage errors are understood to be errors that occur or are generated in the data when the data is stored in the storage unit, when the data is saved or retrieved.

[0141] The data that are changed during the processing of the program are exchanged as messages between the participating parts. For this purpose, an information broker MB is provided, as described above. In addition, the individual hosts HR1, HR2 communicate with each other via external interfaces S2, S3, for example via a private cloud CLD, so that data can also be exchanged between different program complexes PK1...PK4 of different hosts. After the data are changed, the data are stored again in the first storage unit SE1, the second storage unit SE2 or the third storage unit SE3. In the processing of data, errors may also occur in the data, which are more accurately referred to as processing errors in the scope of the present invention.

[0142] according to Figure 1 , the process in the railway application is safety-related for the operational safety of the railway application. This is why the first application AP1 is processed in parallel in time, i.e. redundantly, in the first redundant computing instance RP1 up to the third redundant computing instance RP3. The first redundant computing instance RP1, the second redundant computing instance RP2 and the third computing instance RP3 send the results of processing the first application AP1 to the message broker MB, i.e. the first redundant computing instance RP1 sends via the eleventh interface S11, the second redundant computing instance sends via the twelfth interface S12, and the third redundant computing instance sends via the thirteenth interface S13. These results are retrieved by the voter VT that executes the vote VTG via the interface. Only when the majority of results match (i.e., at least two results for three redundant computing instances in a 2oo3 system, at least three results for four redundant computing instances, ... at least n / 2+1 for an even number n and at least n / 2+0.5 for an odd number n in the case of n redundant computing instances), the result is provided to the message broker MB via the fourteenth interface S14 and can be retrieved from the gateway GW via the fourteenth interface S14 for transmission to other units via the second interface S2.

[0143] In order to simultaneously provide the calculation results to the voting VTG through the voting device VT, the processes in the first redundant computing instance RP1, the second redundant computing instance RP2 and the third redundant computing instance RP3 are clocked by the clock generator TG. The clock generator provides a clock signal via the tenth interface S10, which can also be called by the first redundant computing instance RP1 and the second redundant computing instance RP2 via the message broker MB.

[0144] The described manner of processing tasks by the first application program AP1 is ensured by the fifth application program AP5. The fifth application program AP5 is an internal application program which assists the operation of the hosts HR1 ... HR3 and is therefore a service program. This clearly shows that the applications AP1 ... AP5 (utilization programs) must not only be based on Figure 1 The application provider for railway applications must also provide (service program) for the host HR1...HR3 for application processing.

[0145] The combination of the applications AP1 ... AP5 into program complexes PK1 ... PK4 and the division of the applications AP1 ... AP5 into subprograms TG, VT, GW, MB facilitates the assembly of the applications AP1 ... AP5 and the checking of the processing of tasks for errors. For this purpose, the data are combined into data segments DA that can be clearly identified and addressed (by defining the start of a data segment DA and the end of a data segment DA). As described above, the subprograms TG, VT, GW, MB, the applications AP1 ... AP5, the program complexes PK1 ... PK4 and the respectively associated configuration data KD1 ... KD13 are stored in the data segment DA (wherein these are usually composed of a plurality of data segments DA).

[0146] Advantageously, in addition to the redundancy in processing already described, redundancy in data storage can also be provided. In this case, the required data are preferably stored multiple times using so-called diversity characteristic data DD1 ... DD4 for identifying the respectively redundant storage, so that the data segments DA and the configuration data can be assigned uniquely in each case. In other words, it does not happen in this case that if different applications AP1 ... AP5 use the same configuration data KD1 ... KD13, they access the same storage location for the data, but always access the data segments DA respectively assigned to them, in which the data are provided. As mentioned above, the data are also preferably stored in an encoded manner.

[0147] Figure 3 Schematically, the method steps for the initial encoding of data when carrying out a technical process are shown. In the technical process, new data (work results) are repeatedly generated, which data should each be encoded before storage. This is shown for a computing environment, for example, consisting of a first host HR1, a first storage unit SE1 and a second storage unit SE2. In principle, the data stored in the first storage unit SE1 and the second storage unit SE2 can be accessed by the first host HR1. Reading (RE) and writing (WT) are possible here, which are indicated by the corresponding arrows.

[0148] For example, in order to execute the application programs AP1 ... AP5, application data AD for the application programs AP1 ... AP5 (see FIG. 2 ) can be stored in the storage units SE1, SE2. Furthermore, count data ZD and a reserve VR of diversity characteristic data DD1 ... DD4 (i.e. first diversity characteristic data DD1, second diversity characteristic data DD2, third diversity characteristic data DD3 and fourth diversity characteristic data DD4) can be stored. In order to use the application data AD for an application in the sense of the invention, i.e. to execute the method for computer-aided execution of application programs in order to execute a technical process in the manner according to the invention, the application data AD must be stored in the form of application data items ADS, which are stored by means of a storage device according to the invention. Figure 3 The method is created and saved in a coded manner after the encoding process COD.

[0149] Figure 3 It is only shown by way of example how the application data AD, the count data ZD and the diversity characteristic data DD1 ... DD4 occupy the individual storage areas of the first storage unit SE1 and the second storage unit SE2. In principle, the location where the corresponding data is stored is arbitrary, it is found by appropriate addressing, and there is no restriction on which application data item ADS is stored where in the storage unit SE1, SE2.

[0150] Furthermore, the diversity of the diversity characteristic data DD1 ... DD4 is indicated by shading, which should clearly indicate that the application data item ADS can be identified by the diversity characteristic data DD1 ... DD4 from the reserve VR. As shown on the reserve VR, a longitudinal shading line, a transverse shading line and two oblique shading lines at 90° to each other are provided. Figure 3 The application data item ADS shown in detail in FIG. 4 has, for example, shading indicating the first diversity characteristic data DD1.

[0151] As shown in the enlarged view of the application data item ADS, it consists of a data segment DA for the application data AD and a check data segment PA having first diversity characteristic data DD1, counting elements in the count data ZD and redundant data RD. The first diversity characteristic data DD1, the count data ZD, the redundant data RD filled with start values ​​and the application data AD are combined into the application data item ADS in the first host HR1, for example in a writing process WT in a working memory not shown, and are stored as such. Subsequently, the application data item ADS is encoded in an encoding process COD and sent to the first storage unit SE1, wherein the diversity based on the first diversity characteristic data DD1 is also indicated in the first storage unit SE1 by the shading. Here, the application data item ADS is available for further retrieval (see Figure 4 ).

[0152] Figure 4 The schematic diagram shows the Figure 3DD1 ... DD4. The count data ZD and the redundant data RD can also be different from each other.

[0153] The application data item ADS is executed in three calculation instances RP1, RP2, RP3. For this purpose, the application data item ADS is read into each calculation instance in a read process RE. In this case, the calculation instances RP1, RP2, RP3 are each assigned a certain diversity, which is correspondingly indicated by hatching. The hatching corresponds to the hatching of the diversity characteristic data DD1 ... DD4 of the reserve VR.

[0154] It can also be seen that the computing instance RPn can also process two diversity data, here application data items ADS identified by the third diversity characteristic data DD3 and the fourth diversity characteristic data DD4. This can achieve optimal use of the computing power provided by the computing instance RPN.

[0155] The computing instances RP1, RP2, and RP3 read the correct diversity of application data items ADS. This is achieved by a service program running in the background, so that the computing instances RP1, RP2, and RP3 automatically address the correct application data items ADS. This is for Figure 3 The application data item ADS having the first diversity characteristic data DD1 is shown in more detail and is described in detail below.

[0156] If the application data item ADS is called up, it is first decoded in a decoding process DEC in order to be subsequently read (RE). By decoding, the first diversity characteristic data DD, the current count data ZD and the redundant data RD as well as the application data AD can be read and a service program can be applied, which identifies possible storage errors. It can be checked whether the first diversity characteristic data DD1 come from the reserve VR and / or are consistent with the diversity of the first computing instance RP1. The correct execution of the check run can be checked based on the count data ZD, since it must identify a check run that is being executed or a previously performed check run. Only when the check shows that the data have no storage errors are the data allowed to be read (RE) and processed by the first computing instance RP1. This applies to both Figure 4The shown parallel processing of application data items ADS by applications AP1…AP5 in computing instances RP1, RP2, RP3 (normal operation of a 3oo2 system) also applies to new initialization (repair operation) of computing instance RPn executed in parallel with normal operation (described in detail below).

[0157] After processing the application data item ADS, the first computing instance RP1 writes it back to the first storage unit SE1. A check of the check data segment PA, the first diversity characteristic data DD1, the count data ZD and the redundant data RD may also be performed here in order to identify possible processing errors when processing the application data item ADS (wherein the detected errors lead to the exclusion of the involved computing instance and its new initialization, and the remaining computing instances form a 2oo2 system). Furthermore, the count data ZD are equivalent to the count elements characterizing the currently running check run. Subsequently, the application data item ADS is encoded (COD) and written (WT) to the first storage unit SE1.

[0158] Even if not shown in detail, the method is also executed for other application data items ADS in computing instances RP2, RP3 (normal operation), and is also executed by computing instance RPn in the order of storage in the subsequent processing of messages stored in the form of application data items ADS (repair operation). After successfully processing the application data item ADS, the voting VTG is additionally executed on the application data item ADS to determine that the application data item ADS has been identically changed by the processing by computing instances RP1, RP2, RP3. If this is not the case, this indicates a processing error in normal operation. In the case of three (or four) computing instances, most of the same application data AD can be used for further processing, while application data AD different from them can be blocked for further processing. If only two computing instances are available for voting VTG in normal operation as a 2oo2 system, normal operation must be set when another error occurs in one of the two computing instances. Then all computing instances RP1, RP2, RP3, RP4 must be initialized. However, no state copies are created and no messages are stored because all computing instances are excluded from executing technical processes in normal operation.

[0159] As described above, the processing of messages stored as application data items ADS in the repair operation is carried out in parallel with the processing of the application data items ADS of the computing instances RP1, RP2, RP3. Therefore, the currently changed application data items ADS of the computing instance RPn can also be taken into account in the voting VTG. Once the consistency of the changed application data items ADS of all computing instances RP1, RP2, RP3, RPn has been determined within the synchronization window described above, the computing instance RPn can be merged into the regular operation again to perform the technical process so that it works in parallel with the computing instances RP1, RP2, RP3 (these then together form a 3oo4 system).

[0160] according to Figure 5 A possible method flow of a method for computer-assisted operation of a storage unit and for computer-assisted parallel execution of an application with subsequent voting VTG shall be explained. Before starting the method, an initialization step (step 1, referred to as INI for short) is performed, wherein this step allows regular storage access to a storage unit (not shown). After the start of the method (step 2), a method for performing a check operation of the storage unit in the upper right and upper center, executing the application AP1 ... AP5 in normal operation on the left, and a repair operation in the lower right are performed. These subareas can be executed individually one after the other or preferably in parallel and are therefore shown in a common flow chart.

[0161] First, the method for executing the check run is explained. In a determination step for count data ZD (step 3, referred to as DTM_ZD), a start value for count data ZD is determined. In an output step for count data ZD (step 4, referred to as ZD_OT), the count data ZD are provided to the method for executing the application (left side) via an input step for count data ZD (step 35, referred to as ZD_IN) if necessary.

[0162] The actual test run consists of a repeated process that tests all application data items ADS stored in the storage unit (e.g. Figure 5 For each application data item ADS of the current count element having count data ZD, the following steps are performed:

[0163] In a decoding step for the application data item ADS (step 6, DEC_ADS for short), the application data item ADS is decoded. In a checking step for the count data ZD (step 7, TST_ZD for short), it is checked whether the count element corresponds to the currently checked check run or to the previous check run. In a checking run for the diversity characteristic data DD1 ... DD4 (step 8, TST_DD for short), it is checked whether the application data item ADS has diversity characteristic data DD1 ... DD4 of the available reserve VR corresponding to the diversity characteristic data DD1 ... DD4 (see Figure 3 and Figure 4 In the checking step for the redundant data RD (step 9, referred to as TST_RD), it is checked whether the redundant data RD has an expected value, in particular a preset value (optional).

[0164] If all check steps have been carried out, it is checked in a query step for deviations (step 10, DVG? for short) whether one of the check steps described above has resulted in a deviation from the expected result. If this is the case, an error is output in an output step for errors (step 11, ER_OT for short) (described in detail below). If this is not the case, the checked application data item ADS is encoded again in an encoding step for the application data item ADS (step 12, COD_ADS for short), wherein it is always encoded in count data ZD with the count elements of the current check run. If a check run was carried out for all application data items ADS, these therefore have the current count elements in the count data ZD, and the count data ZD can be updated in an update step for the count data ZD for the running service program (step 13, UPD_ZD for short) so that it now contains the count elements of the check run that is started subsequently.

[0165] In a method for computer-assisted execution of an application program ( Figure 5 In the left side of the figure, after the input step 5 for the count data ZD mentioned above, the decoding step for the application data item ADS involved is repeatedly performed for all required application data items ADS of the application executed by the application program (step 14, referred to as DEC_ADS). Subsequently, as already described for the check operation, a check step for the count data ZD (step 15, referred to as TST_ZD), a check step for the diversity characteristic data DD1 ... DD4 (step 16, referred to as TSD_DD) and a check step for the redundant data RD (step 17, referred to as TSD_RD, optional) are performed.

[0166] In particular, the application is executed on three computing instances RP1, RP2, RP3 (not shown) each having different multiplicities (see the computing instances in the first program complex PK1 in FIG. 2), so that the diversity characteristic data DD1 ... DD4 checked in the step of checking the diversity characteristic data DD1 ... DD4 (step 18, TSD_DT for short) must exactly correspond to the respective multiplicities of the computing instances involved on which the application is to be executed. Therefore, for the sake of greater clarity, the subsequent steps that are identical and preferably executed in parallel in time in the three computing instances RP1, RP2, RP3 (the lagging execution is described in detail below) are shown overlapping.

[0167] Furthermore, when executing the application, for each required application data item ADS, in a checking step 18 for deviations, DVG?, it is checked in each of the three computing instances RP1, RP2, RP3 whether the checking step TST ... has identified a deviation from the expected content of the application data item ADS. If this is the case, an error is output in an output step 11 for errors, ERR_OT, as described above. Otherwise, the application data items ADS are checked continuously until all application data items ADS required by the application are checked. Only under this premise, in the execution step for the application (step 19, referred to as RUN_APP), in the three computing instances RP1, RP2, RP3, the application is respectively executed in parallel with the other two (error-free) computing instances.

[0168] The checking of the application data item ADS can preferably be performed step by step for the application program for each message generated as a result (which is also contained in a new or changed application data item ADS). Figure 5 not shown in detail).

[0169] That is, the processing of the application is divided into processing steps. In this context, all application data items ADS required by the application and generated by the application must be checked, which are required for the next step to be executed by the application. Then, in the execution step 19, RUN_APP, the steps involved in the application are executed respectively. For each application, in Figure 5 In the encoding step for the application data item ADS described in detail below (step 20, in Figure 5 The left side of the counting data ZD is referred to as COD_ADS) and then leads to the input step of the counting data ZD again.

[0170] The execution step is concluded by the voting VTG (step 28), wherein in the execution step the messages generated in parallel in time by the three computing instances are compared, said messages having to be identical at least with respect to the application data AD in the data segment DA. If the voting VTG is positive, i.e. if the majority of the messages are identical, then the majority (i.e. Figure 5 Are two or three of the three results for the 2oo3 system shown allowed for the next step NW_ADS? (see below).

[0171] After the execution step RUN_APP for the application, it is checked whether the application data item ADS present after the execution of the application is a new application data item ADS. This check (query step 21 for the new application data item ADS, NW_ADS for short?) is necessary in order to assign check data to the new application data item ADS in the determination step for the check data segment PA (step 22, DTM_PA for short), which check data enable a subsequent check TST ... of the new application data item ADS in the further steps of the proposed method. In each case, the new application data item ADS or even the old and changed application data item ADS is recoded in the coding step 20, COD_ADS for the application data item ADS and stored in the storage unit. Subsequently, a further application can be executed or, as described above, further steps of the running application can be executed (repetition of ZD_IN, input step for count data ZD and subsequent steps).

[0172] For the execution step 19 of the application, RUN_APP can also obtain a result, which should be output as a message (preferably via the message broker MB, see Figure 2). Before this happens, it is also possible to optionally Figure 5 The test process is shown in the middle. Here, the steps already described are performed, namely the checking step for the count data ZD (step 23, abbreviated as TSD_ZD), the checking step for the diversity characteristic data DD1...DD4 (step 24, abbreviated as TSD_DD) and (optionally) the checking step for the redundant data RD (step 25, abbreviated as TSD_RD). In the subsequent query step for the deviation (step 26, abbreviated as DVG?), it is checked again whether the deviation can be determined in the checking step. If this is the case, as described above, an error signal is generated in the output step 11 for the error, ERR_OT. Otherwise, the result is output in the output step for the result (step 27, abbreviated as OT_RS) and / or the result is further processed in another step (for example in another program complex according to Figure 2).

[0173] In the case where an error is output in the error output step 11, ERR_OT, according to Figure 5In the embodiment of the present invention, a repair operation is started for the computing instance involved.

[0174] This shall be elaborated below.

[0175] If in the voting VTG (step 28) not all messages are evaluated as identical, but the majority of messages are identical (in a 2oo3 system, that is, two out of three messages), the repair run is started only with messages that differ from the two identical messages. If the majority of identical messages cannot be determined (in a 2oo3 system, that is, there are three different messages), a repair run is started for all messages. In any case, an output step ERR_OT for errors is performed. In the subsequent query step (step 29, ALL_RP? for short), it is checked whether all messages are set for the repair run. If this is the case, the method for processing the application is stopped (step 30, STOP for short) and a new initialization of all participating computing instances is performed before restarting all participating computing instances.

[0176] For the case where most messages are the same, continue with the above method for processing applications ( Figure 5 left), and in parallel, the repair run is started ( Figure 5 lower right).

[0177] Therefore, according to Figure 5 In the example of FIG. 5 , processing of applications AP1 . . . AP5 continues as two computing instances are in regular operation, while a repair operation is initiated for one computing instance.

[0178] For the accompanying repair operation, first, in the copying step (step 31, referred to as GEN_CPY), a state copy of the application data items ADS that exist at the current time point and participate in the normal operation is generated. Since the computing instance involved has been excluded from the normal operation, the state copy must be generated by the application data items ADS of one of the computing instances that continue to run. In the subsequent recording step (step 32, referred to as REC_STP), the application data items ADS that are subsequently generated and changed by the selected computing instance that continues to run are continuously copied and stored. Once the state copy is written to the computing instance involved, it starts the subsequent processing of the application program (step 33, referred to as RUN_APP). Here, if necessary, the computing instance also uses the stored application data items AD. After executing the steps 33 of making up for each other, the voting VTG is performed in the described manner (step 34). Here, the messages created in the repair operation are compared with the messages generated in the normal operation, and the messages can be located, for example, within a synchronization window containing the last ten messages generated.

[0179] If the consistency of the compared messages can be determined during the voting VTG, the computing instance involved is reintegrated into the normal operation, because it is proven that the computing instance has made up for the time loss associated with the operation of the state copy in the repair operation. In order to increase the safety during the reintegration, it can also be provided that this is only done when three consecutive messages can be identified as consistent during the voting VTG.

[0180] Reference numerals list

[0181] AD Application Data

[0182] ADS application data items

[0183] AP1 First Application

[0184] AP2 Second Application

[0185] AP3 Third Application

[0186] AP4 Fourth Application

[0187] AP5 Fifth Application

[0188] BL transponder

[0189] CL Controller

[0190] CLD Cloud

[0191] COD Coding Process

[0192] DA data segment

[0193] DD1 first diversity characteristic data

[0194] DD2 Second diversity characteristic data

[0195] DD3 Third Diversity Characteristic Data

[0196] DD4 Fourth Diversity Characteristic Data

[0197] DEC decoding process

[0198] GL Track

[0199] GR group

[0200] GW Gateway

[0201] HR1 first host

[0202] HR2 Second Host

[0203] HR3 Third Host

[0204] KD1...KD13 Configuration Data

[0205] KD1 first configuration data

[0206] KN Node

[0207] LS optical signal device

[0208] LZ Control Center

[0209] MB Message Broker

[0210] PA Check Data Segment

[0211] PK1…PK4 program complex

[0212] PK1 first program complex

[0213] RD redundant data

[0214] RE reading process

[0215] RU computing environment

[0216] RZ Computing Center

[0217] S1 first interface

[0218] S2 Second Interface

[0219] S3 third interface

[0220] S4 fourth interface

[0221] S5 fifth interface

[0222] S6 sixth interface

[0223] S7 seventh interface

[0224] S8 eighth interface

[0225] S9 ninth interface

[0226] S10 tenth interface

[0227] S11 11th interface

[0228] S12 12th interface

[0229] S13 13th interface

[0230] S14 Interface 14

[0231] S15 interface

[0232] SE1 first storage unit

[0233] SE2 second storage unit

[0234] SE3 third storage unit

[0235] STW interlocking equipment

[0236] TG Clock Generator

[0237] TG, VT, GW, MB subroutines

[0238] VR Reserve

[0239] VT Voting Machine

[0240] VTG vote

[0241] WA turnout drive

[0242] WH Turnout

[0243] WT writing process

[0244] ZD Count Data

Claims

1. A method for carrying out a technical process, a) where the applications (AP1…AP5) are executed redundantly in N computing instances, and b) performing a comparison of N results of redundant execution of the application program (AP1 . . . AP5) at the time of voting (VTG) based on a MooN system, wherein M is at least 2 and N is at least 3, wherein c) in the case where the minority results differ from the majority of results with the same content, the minority results remain disregarded when performing the technical process, It is characterized in that d) in the case according to c), at least one computation instance involved in producing said small number of results is excluded from the execution of the technical process, e) for the case according to c), the computing instance involved in generating the majority result creates a state copy from the state to be newly initialized, and stores all messages sent to the computing instance since the creation of the state copy and their order, and f) At the time of the new initialization, the state of the involved computing instances is established based on the state replicas, and all stored messages are processed by the involved computing instances in the order in which they were stored, until the involved computing instances are once again running synchronously with the computing instances not involved in the new initialization, g) subsequently reintegrating at least one of the computing instances involved into the execution of the technical process.

2. The method according to claim 1, wherein h) if no majority of identical results can be determined during the voting (VTG), the N results remain disregarded when carrying out the technical procedure, It is characterized in that i) for the case according to h), N computing instances are excluded from the execution of the technical process, j) Newly initialize N computing instances, where redundant execution of the application (AP1 ... AP5) is restarted.

3. The method according to claim 1 or 2, characterized in that Once the situation according to claim 1 c) occurs, a state copy is created by the computing instance that does not involve new initialization.

4. The method according to any one of the preceding claims, characterized in that The contents of a majority of the results of calculation instances of at least one previous comparison step, preferably at least 10 previous comparison steps, are stored, and when processing a message according to step f) of claim 1, the calculated result is compared with at least one of the stored results for synchronization in at least one comparison step downstream of the processing.

5. The method according to claim 4, characterized in that If in at least one downstream comparison step, preferably in at least three subsequent comparison steps carried out in the order of the stored results, it is determined that the corresponding stored result is consistent with the result of the relevant calculation, then at least one calculation instance involved is reintegrated into the technical process.

6. The method according to any one of the preceding claims, characterized in that The order of the messages is determined by taking into account the points in time at which the messages were sent, wherein the order corresponds to the temporal sequence of the sending.

7. The method according to claim 6, characterized in that The time at which the message was sent is stored as a digital timestamp.

8. The method according to any one of the preceding claims, characterized in that State replicas and messages are sent and received via a message broker.

9. The method according to claim 8, characterized in that Message brokers work via a publish-subscribe approach.

10. The method according to any one of the preceding claims, characterized in that k) The message is contained in an application data item (ADS) having a data segment (DA), l) The redundant data segments (DA) with multiple identical changes are voted on as a result (VTG), m) In the case according to c) of claim 1, application data items (ADS) containing data segments (DA) that lead to erroneous identification remain disregarded when performing the technical process.

11. The method according to claim 10, characterized in that The storage unit of the compute instance operates like this: n) Application Data Items (ADS) are stored in storage units and encoded before storage, o) fetching an application data item (ADS) from a storage unit and decoding it after fetching, In this case, the memory unit is monitored for errors by carrying out a time sequence of computer-assisted check runs for the memory unit, and in this case, a new initialization of the computing instance involved according to step f) of claim 1 is only started when at least one, preferably two consecutive check runs indicate that no errors are present.

12. The method according to claim 11, characterized in that In the event that an error is detected in one of the check runs, the method is carried out starting with step e) of claim 1 .

13. The method according to claim 11 or 12, characterized in that For the first coding of data (COD) p) generating or selecting at least one application data item (ADS) comprising a data segment (DA) with application data (AD) for at least one application program (AP1 . . . AP5) and a check data segment (PA), q) for each application data item (ADS), the inspection data segment (PA) is provided with count data (ZD) characterizing the inspection run being performed, r) Each application data item (ADS) is encoded and stored, and in order to check the data in the check run being executed after calling and decoding (DEC) the application data item (ADS), respectively apply s) if the count data (ZD) represent neither the check run being performed nor the most recently completed check run, an error is determined for the application data item (ADS), t) if no error is determined, the check data segment (PA) of the application data segment concerned is provided with count data (ZD) which characterize the check run being performed, u) If no error is determined, the application data item (ADS) involved is encoded and saved again.

14. A computer program product, characterized in that The computer program product carries program instructions for executing the method according to one of claims 1 to 11 .

15. A device for providing a computer program product according to the preceding claim, characterized in that The providing device stores and / or provides the computer program product.

Images