Method for computer-aided implementation of technical process in processing unit

Abstract

The invention relates to a method for carrying out a technical process in a computer-aided manner, which method is carried out in an application in a redundancy group (GR) comprising N redundant calculation instances (RP) and in which N redundant results are calculated, and b) a comparison of N messages containing the results is subsequently carried out at the time of voting, where a majority of messages contain the same result, the majority of messages are used to continue performing the technical process. N processing units (VE1,..., VE3) are provided, a plurality of different calculation instances (RP) are aggregated in each processing unit (VE1,..., VE3), and no processing unit (VE1,..., VE3) contains a plurality of calculation instances (RP) from the same redundancy group (GR). The N separately generated redundant messages are compared in the vote when the N separately generated redundant messages should be sent as external messages to the calculation instances (RP) that do not belong to the processing units (VE1... VE3) that have already been message generated.

Description

Technical Field

[0001] The present invention includes the following technical solutions: a method for implementing a technical process. In addition, the present invention also includes the following technical solutions: a computing environment with multiple computing instances. In addition, the present invention also includes the following technical solutions: a computer program including program instructions. In addition, the present invention also includes the following technical solutions: a storage medium readable by a computer. Background Art

[0002] For functional safety applications in the railway environment in accordance with EN50128, EN501291 with SIL>2, various measures need to be taken to ensure functional safety, more precisely through fault-freeness. The requirements for certification of safety-related applications, such as in railway technology, are very high. According to the standard EN 50129, four safety integrity levels or Englisch Safety Integrity Levels (SIL) or safety requirement levels for the required functional safety (Safety) are distinguished for safety functions. Here, Safety Integrity Level 4 is the highest Safety Integrity Level and Safety Integrity Level 1 is the lowest Safety Integrity Level. The individual Safety Integrity Levels influence the confidence interval of the measured values, so that the higher the Safety Integrity Level that should be met on the part of the relevant equipment, the smaller the confidence interval. The functional safety dimensions of the different Safety Integrity Levels can be clearly described using the expected failure frequency MTBF (mean time between failures) of the safety-related system, where this is expressed in years (a). In SIL-1 it is a range of 10...100a, in SIL-2 it is a range of 100...1000a, in SIL-3 it is a range of 1000...10000a, and in SIL-4 it is a range of 10000...100000a.

[0003] The core measure here is processing in multiple independent computing instances, which are either sufficiently independent of each other and / or sufficiently error-free to ensure the required security level. In order to merge the independent processing of a group of computing instances, a comparator (also called a voter) is required, which checks the consistency of the processing results and releases the checked results for further processing by the same or other computing instances in case of equality or at least a successful majority decision.

[0004] Comparators (also called voters) are devices for determining the functionality of redundant systems. Majority decision systems (MooN systems for short) belong to active redundancy (majority redundancy). They are used as a means to increase the fault tolerance of systems for which a high degree of functional safety is required to prevent faults or errors. There are different architectures of MooN systems. Practical applications can be found in single-pass (1oo2), two-pass (2oo2), three-pass (2oo3) and four-pass (3oo4) architectures. The results of the MooN system are compared by a majority decider (Voter) in order to forward the majority result. If at least M of the N systems are working (e.g. for hardware components and machines) or M of the N results agree when compared (e.g. for data and measured values), the result is forwarded. Otherwise, the overall system is considered to be faulty and an error can be output.

[0005] The voter can be implemented by software technology or hardware technology. The voter implemented by software technology is composed of a program module for comparison, also called voting, which processes the above results as input and generates errors or permissions as output. In hardware technology, the voter can also be designed as an analog computer, which performs voting through the logical association of the structural blocks of the analog computer. In particular, the program module can also run on a processor, and the processor itself does not participate in the generation of the results. This leads to the hardware technical separation of the task of generating the result on the one hand and the task of evaluating the result by comparison on the other hand. It has the advantage that the method steps of generating the result and comparing the results can have a small influence on each other, so the operational reliability of the comparison process can be increased.

[0006] Voting is obviously expensive and also requires strict synchronization between independent computing instances so that parallel generation and thus identical results are simultaneously available to the votes implemented in the voter. This cost is closely related to the underlying solution (solved in hardware and / or software) and is even stronger when solved in software. However, in the ideal case of using COTS hardware (commercial-off-the-shelf hardware) instead of very special proprietary hardware solutions, the safety of the process must be ensured by suitable software, on the one hand in terms of process safety of the running process and on the other hand in terms of process synchronization, that is, waiting for all results to appear in the form of redundant information to be compared as a prerequisite for reliable voting. This becomes a core issue.

[0007] According to the prior art, such independent processing units are introduced into a processor (CPU or computing core of a CPU) to achieve functional safety, for which there are several known and extensive methods for deterministic processing (e.g. task priorities). The comparison of the results thus makes it possible to determine with high reliability that multiple independent processing results are identical. This approach is described, for example, by S. Steffens et al. in "Entwicklung einer neuen Safety-Plattform DS3–vomForschungsprojekt bis zur Inbetriebnahme", SIGNAL+DRAHT (113) 6 / 2021.

[0008] In the method, when multiple functionally safe applications are processed in parallel, which work together by continuously exchanging messages in the network, each application is synchronized and compared individually before the messages that are checked in this way and are therefore safe (in terms of functional safety or safety) are exchanged between the cooperating applications. As a result, the above-mentioned sharply increased effort for the control task increases with the number of applications involved, so that the overall response time of processing in such a network increases significantly, even to an unacceptable level. Summary of the invention

[0009] The technical problem to be solved by the present invention is to overcome the problems in the prior art. In particular, the technical problem is to provide a method for executing a technical process, a computing environment with a plurality of computing instances for executing the technical process, a computer program including program instructions, and a storage medium readable by a computer, wherein the amount of computing associated with the functionally safe execution of the method is kept as low as possible.

[0010] According to a first aspect of the invention, a method for computer-assisted execution of a technical process is described.

[0011] a) the application is executed redundantly in a redundant group (comprising a number N of computing instances) and N redundant results are calculated therein (messages are received, processed and sent in a manner known per se for the execution of the application, and messages are sent if the results of the execution of the application are to be transmitted to other computing instances or other hardware components involved in the technical process), and

[0012] b) A comparison of the N messages containing the results is then performed during voting, where:

[0013] c) In case a majority of messages contain the same result, said majority of messages are used to continue the technical process.

[0014] To avoid misunderstandings, it should be noted here that the individual claim features are numbered consecutively with lowercase Latin letters, regardless of the claim number. This means that each letter only appears once in the entire claim, which enables unambiguous location of the claim feature in question without reference to the claim number. The order of the letters is therefore not important.

[0015] If a large number of redundant results is mentioned, it is technically understood that there are multiple results represented by different data sets in different messages, which are understood as the results of parallel calculations. In the context of the present invention, it is also called multiple results that the results are the same and can also be regarded as one result in terms of information content. The results are sent and received by the participating computing instances in the form of messages. The majority of N messages or results can also be equivalent to N messages or results (unanimous majority).

[0016] The useful content of the information is the result of the task to be accomplished by the technical process. At the same time, the message also contains content that is intended to control the process running in the computing instance, which is preferably carried out by a service program (this will be described in detail below). The content does not necessarily have to be identical for the comparison to be conclusive: the results of a large number of compared messages must be identical and should still be referred to as control content.

[0017] An apparatus is computer-assisted or computer-implemented when it has at least one computer or processor, or a method is computer-assisted or computer-implemented when at least one computer or processor performs at least one method step of a method.

[0018] A computing environment is an IT infrastructure consisting of components such as processors, storage units, programs and data to be processed by the programs for executing at least one application that has to perform a task. An IT infrastructure can also consist of a network of the above components.

[0019] The cloud (also called computer cloud or data cloud) is a computing environment used for so-called cloud computing. This means an IT infrastructure provided via a network interface (such as the Internet). It usually includes storage space, computing power or software as a service that does not have to be installed on the computing instance using the cloud. The services provided in the context of cloud computing include the entire field of information technology and also include IT infrastructure, platforms, software and computing power, wherein the cloud provider allocates the provided resources to cloud users according to demand in order to achieve optimal utilization of the resources.

[0020] Due to the high safety standards that apply in railway technology with regard to the functionality (operational safety) and vulnerability (transmission security) of computer-implemented solutions, the functionality of clouds used in railway technology is often limited in terms of their shared availability. Restrictions are therefore necessary, especially when it comes to access to a potentially unlimited circle of cloud users. However, when it comes to sharing computing resources via different computing instances, access must also be limited with regard to the required redundancy. Technologies that take these restrictions into account for railway technology are also referred to in the context of the present invention as private clouds, even if private clouds only meet the technical features associated with cloud technology to a limited extent.

[0021] A computing instance (or simply instance) constitutes a functional unit within a computing environment, which can be assigned to an application (e.g., composed of multiple program modules) and can execute the application. When executing the application, these functional units form a physically (e.g., computer, processor) and / or virtually (e.g., program module) independent system.

[0022] A computer is an electronic device with data processing capabilities. A computer may be, for example, a client, a server, a handheld computer, a communication device, or other electronic device for data processing, which may have a processor and a storage unit and may also be connected to a network via an interface.

[0023] The processor can be, for example, a converter, a sensor for generating a measurement signal or an electronic circuit. The processor can be a main processor (CPU), a microprocessor, a microcontroller or a digital signal processor, possibly combined with a memory unit for storing program instructions and data. The processor can also be understood as a virtualized processor or a software CPU.

[0024] The storage unit can be designed as a computer-readable memory in the form of a working memory (Random Access Memory, RAM) or in the form of a data storage device (hard disk or data carrier).

[0025] A program module is a single software functional unit of a program flow according to the invention that implements the method steps. These software functional units can be implemented in a single computer program or in multiple computer programs that communicate with each other. The interface implemented here can be implemented by software technology in a single processor, or in hardware if multiple processors are used.

[0026] An “interface” can be implemented in hardware technology, for example by wire or as a radio connection, or in software technology, for example as an interaction between individual program modules of one or more computer programs.

[0027] According to the present invention, N processing units are provided, wherein:

[0028] d) aggregating a plurality of computing instances in each processing unit, wherein each computing instance in the same redundancy group corresponds to another processing unit,

[0029] e) when the correspondingly generated N redundant messages are sent as external messages to a computing instance outside the processing unit to which the computing instance generating the message to be compared belongs, the correspondingly generated N redundant messages are compared during voting,

[0030] f) Voting is not performed on messages exchanged as internal messages between computing instances within a processing unit.

[0031] External messages can thus also be referred to as final results of a specific section of the technical process, while internal messages are intermediate results. According to the invention, therefore, only redundant results originating from different processing units (that is, N such processing units, which form the redundancy group for voting) are checked. The properties of these messages with regard to useful content are absolutely essential for the functional safety of the process, so that when these messages are transmitted externally to other computing instances (preferably also integrated into the processing units), errors can be excluded while taking into account the required safety level.

[0032] According to the invention, internal messages that are sent and received only by computing instances within a processing unit are not compared. This is not necessary, either, because the processes running within the processing unit are protected from access outside the processing unit, and redundant processing of other messages from a large number of messages is performed in other processing units, which excludes interference in parallel running processes. In other words, the parallelization process is raised from the level of computing instances to the higher level of processing units, so that the processes within the processing unit do not run redundantly and therefore advantageously no synchronization is required, or at least the frequency of synchronization is reduced (described in detail below).

[0033] The problem of undesirable task accumulation and the associated excessive delays can be advantageously solved by the paradigm shift underlying the present invention, which consists in using multiple computing instances that cooperate with each other, continuously and asynchronously exchanging internal messages in any order, working together as an integrated independent processing unit (also called a "bubble"), and guaranteeing functional safety when the processing results (represented by external messages) of N such processing units are subsequently compared at one time.

[0034] In order to achieve the functional safety of multiple integrated independent processing units (bubbles), for each message transmitted by a processing unit to an external (i.e., outside the bubble) subsystem or adjacent system (hereinafter referred to as external message), only a one-time safety comparison is required by a sufficiently large set of (N) messages with the same useful content (stored in the data part of the relevant data set reserved for this purpose), which represent the results of the tasks to be completed by the computing instance. According to the invention, the messages have previously been generated by the processing units working in parallel. The prerequisite is that all computing instances in the redundant group have been developed and configured in accordance with the necessary requirements of the functional safety target SIL. Due to this feature, voting can be advantageously omitted for intermediate information (sent and received by the computing instances) between the individual computing instances within the processing unit (hereinafter referred to as internal information).

[0035] The effect of this is that the number of messages that need to be compared in the voter (i.e. only external messages are compared and not internal messages) is reduced overall, which in turn improves performance when processing tasks. In addition to not having to compare all messages, the performance improvement is that the computing instances within the processing unit can work in a performance-oriented manner and thus asynchronously with other computing instances in the redundant group, which means that the regulation of cycle times in the processing unit and the associated idle times can be avoided.

[0036] According to another aspect of the invention, a computing environment having a plurality of computing instances is described, wherein N computing instances are respectively combined into one of a plurality of redundancy groups and in each redundancy group all computing instances are designed for redundant execution of application programs.

[0037] According to the present invention, the above aspects of the present invention are thus determined,

[0038] That is, the computing environment is divided into the N processing units, where:

[0039] n) Aggregate multiple computation instances in each processing unit,

[0040] o) No processing unit includes multiple computing instances from the same redundancy group, and the computing environment has computing instances designed to

[0041] p) when N redundant messages generated by the computing instance leave the processing unit as external messages, comparing the N redundant messages generated by the computing instance as a voting device, and

[0042] q) In case the message is exchanged as an internal message between computing instances inside a processing unit, the message is not compared.

[0043] The advantages associated with the described structure of the computing environment have already been explained in conjunction with the method according to the invention and also apply in the same way to the computing environment when it is used to carry out the method according to the invention.

[0044] Another aspect of the invention describes a computer program comprising program instructions which, when a computer executes the program, cause the computer to carry out the method according to the invention.

[0045] According to the invention, a computer program with program instructions is thus described, which includes program modules, wherein the method according to the invention and / or its embodiments can be respectively executed by means of the computer program and the advantages can be achieved by means of this execution.

[0046] According to a further aspect of the invention, a storage medium is described, which is readable by a computer and on which a computer program product according to the preceding claim is stored.

[0047] In addition, according to another aspect of the present invention, a providing device is described, which is used to store and / or provide a computer program in the form of a computer-readable storage medium. The providing device is, for example, a memory unit, which stores and / or provides the computer program. As an alternative or supplement, the providing device is a network service, a computer system, a server system, in particular a distributed, for example, cloud-based computer system or virtual computer system, which stores and preferably provides the computer program in the form of a data stream on a computer-readable storage medium.

[0048] The computer program is provided in the form of a program data set as a file, in particular as a download file, or as a data stream, in particular as a download data stream. For example, the computer program is transferred to a computing environment using a providing device, so that the method according to the invention can be executed in a computing instance of the computing environment.

[0049] General Embodiments of the Invention

[0050] Variants describing further developments of the invention are explained below without restricting the basic concept of the invention.

[0051] According to a variant, the above aspect of the invention is determined in that the N processing units operate in a working cycle, wherein:

[0052] g) at the beginning of each work cycle, the messages required for the work cycle and directed to the relevant processing unit's computing instance are delivered to the processing unit,

[0053] h) Subsequently, all messages required for executing the application are processed in the same order by the computing instance in the N processing units, wherein new redundant messages are generated,

[0054] i) Subsequently, the new redundant messages are compared with one another in steps b), c), d) and e) (see above).

[0055] Here, the design method according to the present invention solves other problems. According to the three computing instances A, B, and C of the processing unit ( Figure 2 and Figure 4 The example of a first processing unit (also referred to as AC1, AC2 and AC3) in the redundancy group is used to illustrate the comparison with other processing units in the same redundancy group. For example, in the event of a time offset (so-called jitter), the order in which computing instance B receives messages from computing instances A and C in the first processing unit is different from that in the second or third (fourth...) processing unit of the relevant redundancy group, which may lead to different processing results in different computing units in the redundancy group. Here, "different" not only means that different contents of the individual processing results may appear, but also means that even if the contents are the same, the order itself may be different. However, even if the actual calculated results (useful data) are essentially the same, different results may result in an "error" output during voting.

[0056] The advantage of this design of the present invention is that the occurrence of jitter will no longer affect the results of subsequent calculations. In other words, even if jitter occurs, an overall result that is evaluated as the same during voting can be formed (of course, the prerequisite is that the useful content generated is the same, because otherwise the vote should definitely output "error"). The implementation method is to ensure that the messages are always processed in the same order. The same order is ensured by a suitable sorting algorithm. This type of sorting algorithm is known per se. The sorting criterion can be freely selected, and it only needs to be the same for all processing units of the redundancy group, thereby establishing the same order of messages in the entire redundancy group. For example, all messages can be sorted according to a certain hash value size.

[0057] According to a variant, the above aspect of the invention is determined in that step h) (see above) is performed as a sub-cycle, wherein

[0058] j) Each computing instance in the N processing units receives the message sent to it,

[0059] k) subsequently processing the message, wherein newly generated internal messages during the processing are stored in at least one intermediate buffer of the processing unit,

[0060] l) subsequently, in step k), the messages stored in the intermediate buffer are sorted taking into account a sorting rule which is the same for all N processing units involved,

[0061] m) Repeating steps j) and k) and l), wherein the computing instance receives and processes the message newly created in the previous step k) sent to it, until no unprocessed internal messages sent to the computing instance exist in the intermediate cache.

[0062] This measure of storing the messages in an intermediate buffer can be advantageously used to sort the messages repeatedly stored in step k) in a summary step and then input the messages into the vote (send the messages to the voter). This advantageously achieves further performance gains because the sorting workload is reduced here. Here, during the processing by the mentioned computing instances, the messages can be processed without synchronizing them, that is, in an indeterminate order. Here, all computing instances will run at least one recursive loop, but usually multiple recursive loops, which ultimately lead to all information to be processed being taken into account. If the remaining messages that are no longer processed are to be sorted, the overall results can be compared by the voter, because under the premise that "for each computing instance all or at least most of the individual messages have messages containing the same useful content", this generates a positive result of the vote (that is, the execution process can continue).

[0063] According to a variant, the aforementioned aspect of the invention is determined in that the voting is performed in an external computing instance which does not belong to the N redundancy groups.

[0064] In the case of the present invention referring to an external computing instance, it is to be understood that the computing instance does not belong to a plurality of processing units, which contain computing instances that compute independently of one another in order to redundantly process messages of, for example, redundantly executed applications. This does not mean that the external computing instance must be constructed on another computer or processor or computing core (i.e., it is not necessarily separated in hardware), it is sufficient to separate it in software by the definition of redundancy groups and the associated message management (e.g., using a publish-subscribe program). Moreover, the computing instance can also be included in other redundant groups of computing instances, in which no computing instance participates in the calculation of the N calculation results that should be input to the vote.

[0065] If the voting is performed in a computation instance outside the relevant processing unit, then the messages related to the overall results that need to be compared are external messages. In contrast, the messages required for the redundant processing of the tasks and transmitted to the redundancy group for this purpose or generated during the processing of the redundancy group are described as internal messages, because they do not have to be transmitted to the (external) voting and therefore do not have to be sent from the processing units that make up the redundancy group.

[0066] According to a variant, the aforementioned aspect of the invention is determined in that the application program is constituted by a useful program intended to execute a technical process and a service program supporting the functionality of the computing environment.

[0067] In other words, a useful program is an application (e.g. a railway application) which supports the technical process to be performed by the method according to the invention. In other words, it generates the messages required for processing the technical process. These messages are usually further processed by other applications of the technical process. For example, the technical process can be a method for operating a railway infrastructure. The railway infrastructure has a track system with control elements and sensors on the one hand and vehicles with control elements and sensors on the other hand.

[0068] Service programs are those application programs that do not directly participate in the execution of technical processes, but only ensure the functionality of the computing environment itself. This includes, for example, voters, which only ensure the functional reliability of the computing environment but do not provide results that can be used as useful data in technical processes.

[0069] According to a variant, the above-described aspect of the invention ensures that all processing units of a computing instance comprising a redundant group are respectively executed on another processor or at least respectively on another computing core, preferably another computing core of the same processor.

[0070] If the computing instances in the redundant group and the processing units in which the relevant computing instances are arranged are respectively arranged on different computing cores of the same processor, the external information that needs to be voted can preferably be sent to a voter, which is implemented on the same processor, but preferably implemented on a computing core other than the computing core occupied by the processing unit or computing instance. This advantageously leads to the physical separation of processes executed in parallel by different processing units, thereby reducing hardware-related errors. In addition, the processing process related to voting is thus performed in the same processor, which also advantageously brings performance improvement.

[0071] According to a variant, the aforementioned aspect of the invention is ensured by the fact that in at least one processing unit, preferably in all processing units of at least one redundant group, a plurality of computing cores of a processor are combined.

[0072] Furthermore, within the relevant processing unit (preferably all processing units of the redundant group), according to another embodiment, only one of the computing instances of the processing unit is assigned to each computing core. As a result, all processing processes running in the relevant computing instance are performed in the same processing core, thereby increasing functional reliability and further increasing performance in an advantageous manner.

[0073] The performance gains associated with parallel but temporally independent processing of messages in different processing units will be even greater if the computational instances of such a processing unit are distributed over multiple CPUs or multiple (virtual) cores, respectively, for parallel and therefore more efficient processing (which is also a core motivation for using multi-core applications).

[0074] In this advantageous configuration, all computing instances of a bubble are located on the same CPU core. As a result, the transmission paths within a bubble are very fast, and the independence of multiple bubbles can be fully exploited by distributing the relevant bubbles across multiple servers. The overall effectiveness of these measures can therefore also be quantitatively fully extended to bubbles with relatively many subunits ("large" bubbles).

[0075] In an advantageous embodiment, for a specific technical process (such as Figure 1 The individual units of the system (railway application shown) are optimally distributed on multiple computing instances according to the required functional processing in terms of their quantity structure to be processed, such as the size of the perimeter of the dispatching mechanism (number of switches, number of tracks, number of signals), so that the work in the bubble is evenly distributed, and especially when the workload increases beyond all sub-units, that is, more and more scenarios need to be processed in parallel almost at the same time. Specifically, this means that no single sub-step in a sub-unit is overloaded, so that a whole bubble working cycle is required to be fully processed, or even another bubble working cycle is required. In this way, when the increase in workload exceeds all processing units and despite the increase in workload exceeding all processing units, the total response time of multiple scenarios to be processed in parallel can still remain stable respectively, so that effective expansion is achieved.

[0076] In a further advantageous embodiment, the proposed method can be extended not only to an extension via a distribution in terms of the quantity structure, but also to an extension via a distribution in terms of the functions themselves, or both aspects can be combined and implemented in almost any way. This also includes the subdivision of the originally monolithic work units. Specifically, this means that for the first time, parallelization and efficient and deterministic multi-core utilization of the originally monolithic work units are possible, which was not possible in conventional systems before.

[0077] According to a variant, the aforementioned aspect of the invention is determined in that the computing instance configured as a voter as an external computing instance does not belong to the redundancy group from which it is configured to receive messages for voting.

[0078] The configuration of the voter as an external computing instance advantageously means that all messages provided for voting by redundant computing instances must be sent from the redundancy group as external messages. This allows the process of generating the messages to be compared to be separated from the subsequent voting, thereby making it possible to perform the method according to the invention with greater fail-safety.

[0079] According to a variant, the above aspect of the invention is defined in that it has a plurality of voters.

[0080] The use of multiple voters advantageously results in performance gains when executing the method according to the invention. The reason for this is that if multiple redundant groups send out results for voting in quick succession, then if there is only one voter, these results must be processed serially. However, in the case of multiple voters, the voting process can be parallelized. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] The invention will be described in further detail below with reference to the drawings. Identical or corresponding elements in the various figures are provided with the same reference numerals, and only the differences between the various figures are explained again.

[0082] The embodiments described below are preferred embodiments of the present invention. In these embodiments, the described components of the embodiments are respectively individual, mutually independently viewable variations of the present invention, which also form separately and independently the expanded designs of the present invention and can therefore also be considered as components of the present invention individually or in combinations different from the combinations shown. In addition, the described parts can also be combined with other variations of the present invention that have been described.

[0083] Figure 1 An exemplary embodiment of the device according to the invention is shown schematically together with its functional relationships.

[0084] Figure 2 As a block diagram, it is shown that Figure 1 Embodiment of a computing environment of a device, wherein individual computing instances execute program modules that can each be run in one or more computers shown by way of example, and wherein interfaces shown therefrom can be implemented in software technology in one computer or in hardware technology between different computers.

[0085] Figure 3 A flow chart showing an exemplary embodiment of the method according to the invention is shown, wherein the method steps shown can be executed individually or in groups by program modules, and wherein according to Figure 2 The calculation instances and interfaces are shown exemplarily.

[0086] Figure 4 Shown on the timeline according to Figure 3 The method flow is shown in which the Figure 3 The processing process and the messages generated by the first processing unit and the second processing unit (the third processing unit is omitted for brevity). DETAILED DESCRIPTION

[0087] Figure 1A railway application controlled by a computing environment RU is schematically shown. The railway application has a track GL, on which various components of the switch technology are shown by way of example. This is a switch drive WA, which can adjust the switch WH. In addition, a transponder BL is mounted on one of the tracks GL, by means of which information can be exchanged with a train passing by the transponder. Finally, a light signaling device LS is shown, which is controlled by a controller CL.

[0088] The computer environment RU can have different hosts, namely a first host HR1, a second host HR2 and a third host HR3, on which applications for controlling railway applications are distributed in the form of application programs (this is further explained below). The first host HR1 is provided by a computing center RZ and is connected to a first storage unit SE1 via a first interface S1. The computing center RZ can be operated, for example, by a service provider of a railway operator or by the railway operator itself. The first host HR1 is connected to a private cloud CLD via a second interface S2, so that the first host is not locally bound to the railway application. The cloud CLD can be a private cloud CLD, where this is understood to be a cloud CLD that is limited to authorized users.

[0089] The control center LZ of the railway operator comprises a second host HR2, which is also connected to the cloud CLD via a third interface S3. In addition, the second host HR2 is connected to the second storage unit SE2 via a fourth interface S4.

[0090] Furthermore, the computer environment RU has, for example, a dispatching device STW, which includes a third host HR3, which is connected to the third storage unit SE3 via a sixth interface S6. In addition, the third host HR3 has a fifth interface S5 for the second host HR2. Not shown, the third host HR3 can also be connected to the cloud CLD. The third host HR3 also has a seventh interface S7 for the switch drive WA, an eighth interface S8 for the controller CL and a ninth interface S9 for the transponder BL.

[0091] according to Figure 1 , all interfaces S1 ... S9 are basically wired or even implemented by wireless transmission technology, such as radio. The layout of the hosts HR1 ... HR3 is only exemplary and can be expanded as desired in more complex railway installations. The computing environment RU is defined in this way, that is, the participating hosts HR1 ... HR3 can communicate with each other and thus process applications in a distributed manner on the hosts HR1 ... HR3 taking into account the available computing power. For this purpose, a computing instance, not shown in detail, is formed, which is described in detail below (see Figure 2 , where a calculation example RP) is shown.

[0092] In addition, Figure 1, the functions of which will be described in detail below. The intermediate cache ZS can either be part of the host (eg can be implemented in the working memory of the host) or part of the storage device.

[0093] like Figure 2 In the upper middle part, a platform approach based solely on software (also called distributed intelligent safety system, DS3 for short) is shown, which implements mechanisms for functional safety using only COTS hardware according to the prior art. Here, the approach is used to synchronize and control the determinism of the comparison of the independent working results. Its core is based on a strict time cycle for the sequence of working cycles and comparison cycles VT. Since the calculation amount for the comparison cycle VT is much larger than that for HW synchronization and HW comparison, this time cycle cannot be repeated with arbitrarily short beats, so currently, for example, Figure 2 The 100ms shown is the actual cycle time.

[0094] This is Figure 2 In the figure, five subunits are shown, each having three independent computing instances RP (which respectively constitute a redundant group GR), including a voter V as a comparator and a gateway GW for disconnecting communication with other subsystems SB, such as other subunits. For each subunit A, B, C, D, E (regardless of which host HR1 ... HR3 the subunit is assigned to as shown by the dotted lines), comparison is performed by the voter V assigned to each subunit. Taking the device called Simis W as an example, an interface computer IIC (also called interlocking interface component, abbreviated as IIC) for road section elements is set as a computing instance. Service programs are executed preferentially on the interface computer, and multiple application controllers AC1 ... AC4 (also called regional components) are set to process useful programs. The computing instances are connected by connecting lines, which represent the communication connections between the computing instances.

[0095] However, regardless of whether there are very few or very many items to be processed in the comparison cycle within the working cycle, they are all processed within the strict comparison cycle, which inevitably leads to idle time in the calculation instance RP. If only a few items need to be calculated in a subunit, and at the same time the complete processing of the subunit combination requires multiple such activities to be carried out quickly in sequence, then the entire processing will be greatly delayed, because further transmission is only possible after a complete comparison cycle (see below). Figure 4 ). Therefore, although the expected characteristics in terms of functional safety are fully met, the performance is affected due to the response time of the individual processes.

[0096] Now, within the scope of the present invention, the same five computing instances RP together with their three independent processing units VE1...VE3 can be regrouped into three independently working processing units VE1...VE3 (shown as bubbles), but only connected in front by a voter V as a comparator and a gateway GW (for communication decoupling with other or adjacent systems), and the other or adjacent systems (not shown) can preferably also be organized into bubbles. Here, the bubbles are logical processing units VE1...VE3, but are not based on hardware restrictions. However, it is advantageous that the computing instances RP of the redundant group GR are respectively set to different (virtual) computing cores or processors. For the second processing unit VE2, the regrouping of each computing instance RP in each subunit A...E is exemplarily shown using dotted arrows, and the same applies to the first processing unit VE1 and the third processing unit VE3.

[0097] The bubble clustering of physically decoupling the three redundancy groups GR corresponds to the above mentioned paradigm shift and represents an advantageous use by effectively utilizing the related properties and advantages of asynchronous and parallel processing of multiple computing cores (multi-cores) in the associated bubbles.

[0098] It is also shown that only external messages leaving the bubble are compared before being sent. For this purpose, a 100ms loop is set. The voter V and the gateway GW (not shown) can also be set multiple times to further utilize the scalability and efficiency of the resulting multi-core system through parallelization.

[0099] In order to control the determinism of the asynchronous parallel processing within the bubble itself (which is crucial for the above solution), the following ordering and flow control algorithm is now performed between the computing instances RP (as bubble participants) independently in each bubble (but according to the same criteria for all bubbles), instead of performing the original safety comparison and strict comparison cycle in each redundancy group GR, as follows Figure 3 shown.

[0100] Step 1 (abbreviated as START): Start the (superior) working cycle AZ

[0101] Step 2 (TRF-MSG for short): All existing input messages are transmitted to the computing instances RP assigned to (sent to, adressiert to) the processing units VE1 . . . VE3 (bubbles) for asynchronous and parallel processing by the computing instances RP.

[0102] The input messages have been received during the previous processing cycle and are temporarily stored externally until they are transmitted to the current processing cycle. The input messages thus define the work package for the current processing cycle. The amount and sequence of the input messages are the same for all processing units VE1 ... VE3 (bubbles).

[0103] Step 3 (abbreviated as CLC-MSG): All transmitted internal messages are processed asynchronously and in parallel by the computing instances RP. Each computing instance RP runs independently; during the processing, each computing instance RP can generate new messages. This can involve internal messages to other computing instances (inside the same bubble) or external messages to other external subsystems SB.

[0104] Step 4 (SVE-MSG for short): Intermediate buffering of newly generated messages is required. Newly generated messages within a bubble, whether internal messages to other computing instances RP in the bubble or external messages to external subsystems SB, are temporarily buffered instead of being directly forwarded for processing. This intermediate buffering is necessary so that messages can be subsequently sorted uniformly in the same way (by configuration, i.e., according to a deterministic sorting rule) for all bubbles and one or more voters V, see step 6.

[0105] Step 5 (WT-PROC): Wait until all compute instances RP finish their message processing. Only when all compute instances RP of a bubble are completed can a consistent total amount of newly generated messages be fully provided in each bubble. This is a prerequisite for the unified use of sorting rules.

[0106] Step 6 (SORT-MSG for short): Sort all intermediately buffered new messages according to the configuration set for the computation instance RP. This configuration is the same for all bubbles and determines a uniform processing order for new messages and thus uniform results, especially in later steps. This is the core feature that controls the deterministic nature of all participating bubbles.

[0107] Step 7 (TRF-MSG for short): All intermediately buffered and sorted messages are transmitted to the computing instance RP (internal messages) within the bubble for further asynchronous and parallel processing, and if necessary, transmitted to the voter V outside the bubble (external messages; this transmission can also be performed jointly for all generated messages following step 9, when the external messages are then intermediately buffered in the bubble).

[0108] Step 8 (NEW-MSG for short?) depends on the query: If there is still (new) sorted internal information for the calculation instance RP, asynchronous and parallel processing is performed again in the sub-cycle UZ (recursion, see point 3).

[0109] Step 9 (WT-PROC for short): If no further sequenced internal messages are sent to the computing instance RP, the waiting point of the bubble is reached.

[0110] Step 10 (VTE-MSG for short): The upper bubble work cycle is completed in all bubbles, that is, all work results have been calculated in the form of external information. Figure 2 As shown, this work cycle is executed redundantly in three bubbles in parallel. Figure 3 This is shown by the fact that each element in the flow chart is doubly superimposed (two shadows, so to speak) and three parallel flow arrows are shown. However, this does not mean that the processes in the three bubbles run synchronously. It only means that all bubbles must reach step 9 before step 10 begins. External messages must also be compared, which have certain characteristics due to the use of sorting rules and are therefore necessarily identical. The external messages from all bubbles are transmitted to the voter V for comparison and a vote is performed. In the case of a positive voting result, the external message is provided to the external subsystem SB via the gateway GW (refer to Figure 2 ).

[0111] Step 11 (abbreviated as END): The (superior) working cycle ends. The subsequent working cycle AZ can start with step 1.

[0112] exist Figure 4 3 shows the method flow according to the invention on the time axis ZA. Only the first processing unit VE1 and the second processing unit VE2 are shown here. However, the mechanism explained below also applies in the same way to the third processing unit VE3. This is omitted for the sake of simplicity.

[0113] An intermediate buffer ZS is provided outside the first processing unit VE1 and the second processing unit VE2 as a send buffer, which provides four exemplary storage locations for messages. The messages are referred to below as 1a, 2a, 3a and 4a. If new messages are generated from these initial messages in the computing instance RP by processing by the application program, these messages are respectively denoted by the following letters, i.e. 1b, 2b, 3b and 4b, etc. Figure 4 The generation of these messages is shown in FIG. 1 in proportion to the time axis ZA. An intermediate buffer ZS is also provided in the first processing unit VE1 and the second processing unit VE2, which is shown twice due to the time course within the processing units. However, each relates to the same intermediate buffer ZS.

[0114] 1a, 2a, 3a, 4a are transmitted in parallel as external messages from the intermediate buffer ZS (designed as a send buffer) to the first processing unit VE1 and the second processing unit VE2. There they are distributed to a plurality of computing instances RP, wherein the computing instances include reference Figure 2AC1, AC2 and AC3 have already been described. In the calculation instance RP, a progress bar indicates when the relevant message is processed. The result of the processing of the message is the generation of a new message. In the case of AC1, this is 1b, 4b and 4c, and in the case of AC3, this is 2b, 3b, 3c. These messages are stored in the intermediate buffer ZS arranged in the first processing device and the second processing device. AC2 is not currently assigned to the task of message processing.

[0115] When 1a, 2a, 3a and 4a have been processed, no more messages are available for processing. The messages are processed in parallel in the first processing unit VE1 and the second processing unit VE2, wherein jitter occurs in the first processing unit VE1, resulting in processing delays. Figure 4 It can be seen that in the first processing unit VE1, 3b is generated after 4b and 3c is generated after 4c, while in the second processing unit VE2, the messages are respectively generated almost simultaneously. However, this has no effect on the planned message comparison, because the messages stored in the intermediate buffer ZS are sorted in a manner not described in detail according to the sorting rule before the comparison. This results in that new external messages (i.e. 2b, 3b and 4b) that should be sent from the first processing unit VE1 and the second processing unit VE2 arrive at the voter V in the same order, but at different times. Therefore, if the messages are identical, the result of the vote is positive, because they are checked in the same order.

[0116] The newly generated internal messages, namely 1b, 4c and 3c, are then processed in AC2 and result in the generation of new messages 1c, 4d and 3d. Moreover, the messages are generated later in the second processing unit VE2 than in the first processing unit VE1 due to the jitter that occurs here. However, the messages are also stored in the intermediate buffer ZS and are not sorted until all internal messages have been processed. Therefore, the messages are compared in the order of 1c, 3d and 4d in the voter V and the consistency of the messages is determined. Subsequently, there are no more new messages, because all newly generated messages are external. The working cycle AZ is thus ended.

[0117] Exemplarily, the ordering rules used are selected based on the index of the message. First, they are sorted by Arabic numerals and then by subsequent letters. These ordering rules are selected only to illustrate the ordering mechanism. In practice, the ordering rules are preferably based on the message content or a hash value, which is created taking into account the message content.

[0118] In order to illustrate the advantages compared with the existing technology, Figure 4The lower part shows the process that has been explained as known before. Two arrows PF are used here, which should represent two working cycles according to the prior art. However, unlike the above-mentioned diagram using the time axis ZA, this diagram is not drawn to scale, just to emphasize the difference. As clearly shown in the accompanying drawings, two comparison cycles VT of 100ms each are required to complete the process, so according to the embodiment, twice the processing time is required (in fact, the effect is even more times). Each comparison cycle VT must wait for the last available message to be processed in each computing instance RP. Since only the working results of each computing instance RP are compared in an unshown manner, even if jitter occurs, the order of the working results is determined, and therefore leads to a positive result at the time of voting. For this reason, for each computing instance RP of the redundant group GR not specifically shown, there must be a working result in the form of a new message. The subunits are respectively formed by the redundant group GR of the computing unit here.

[0119] In this example, the workload required for the above-mentioned mechanism for establishing and guaranteeing the necessary determinism in all relevant bubbles, although partly shifted from multiple comparison cycles VT to a single working cycle AZ and requiring resources there, is available due to the distribution of the computing instances RP over multiple cores, whereas in the approach using multiple comparison cycles VT, these resources are idle due to the fact that multiple working phases are hardly fully utilized. In addition, since it does not have to be executed in a functionally safe manner, it can be processed independently and efficiently in each individual bubble, thus reducing the workload. In this case, the revelation of the error implicitly depends on the final comparison of the voter V, which is another advantage.

[0120] In another advantageous embodiment, the optional schemes for configuring the sorting and flow control algorithms can be expanded and improved by means of priorities, using an independent intermediate buffer ZS as a sending buffer for the configured receiver, using an independent intermediate buffer ZS as a receiving buffer for the configured sender, etc., so that the working characteristics of the bubble can be optimized and designed according to the way and method in which the computing instance RP works respectively and its dynamic characteristics.

[0121] List of Reference Numerals

[0122] AC1...AC4 Application Controller

[0123] AZ duty cycle

[0124] BL transponder

[0125] CL Controller

[0126] CLD Cloud

[0127] GL Track

[0128] GR Redundancy Group

[0129] GW Gateway

[0130] HR1 First Host

[0131] HR2 Secondary Host

[0132] HR3 Third Host

[0133] IIC interface computer

[0134] LS signal light

[0135] LZ Control Center

[0136] PF Arrow

[0137] RP Calculation Example

[0138] RU computing environment

[0139] RZ Computing Center

[0140] S1 First interface

[0141] S2 Second interface

[0142] S3 Third Interface

[0143] S4 Fourth interface

[0144] S5 Fifth interface

[0145] S6 Sixth interface

[0146] S7 seventh interface

[0147] S8 Eighth interface

[0148] S9 9th interface

[0149] SB Subsystem

[0150] SE1 First storage unit

[0151] SE2 Second storage unit

[0152] SE3 Third storage unit

[0153] STM Dispatching Agency

[0154] UZ sub-cycle

[0155] V Voting Machine

[0156] VE1...VE3 processing unit

[0157] VT comparison period

[0158] WA Turnout Drive

[0159] WH Turnout

[0160] ZA Timeline

[0161] ZS intermediate cache.

Claims

1. A method for computer-assisted execution of a technical process, a) wherein the application is executed in a redundant group (GR) consisting of N redundant computing instances (RP) and N redundant results are calculated therein, and b) A comparison of the N messages containing the results is then performed during voting, where: c) in case a plurality of messages contain the same result, said plurality of messages are used to continue the technical process, It is characterized in that Set up N processing units (VE1...VE3), where: d) in each processing unit (VE1 ... VE3) a plurality of different computing instances (RP) are respectively aggregated, wherein no processing unit (VE1 ... VE3) contains a plurality of computing instances (RP) from the same redundancy group (GR), e) when the N respectively generated redundant messages are to be sent as external messages to a computing instance (RP) which does not belong to the processing unit (VE1 . . . VE3) in which the message has been generated, the N respectively generated redundant messages are compared in a vote, f) For messages exchanged as internal messages between computing instances (RP) inside a processing element (VE1 . . . VE3), no voting is performed.

2. The method for computer-assisted execution according to claim 1, characterized in that: N processing units (VE1...VE3) work in a working cycle, where: g) at the beginning of each working period (AZ), the message of the calculation instance (RP) required for this working period (AZ) and intended for the relevant processing element (VE1 ... VE3) is transmitted to this processing element (VE1 ... VE), h) Subsequently, all messages required for executing the application are processed in the same order by the computing instance (RP) in the N processing units (VE1 . . . VE3), wherein new redundant messages are generated, i) Subsequently, the new redundant messages are compared with one another in steps b), c), d) and e) according to claim 1 .

3. The method for computer-assisted execution according to claim 2, characterized in that: Step h) according to claim 2 is performed in a sub-cycle (UZ), wherein: j) The computing instance (RP) of each of the N processing units (VE1 ... VE3) receives the message sent to it, k) subsequently processing the message, wherein newly generated internal messages during the processing are stored in at least one intermediate buffer of the processing unit (VE1 . . . VE3), l) subsequently, the messages stored in the intermediate buffer in step k) are sorted taking into account a sorting rule which is the same for all the N processing units involved (VE1 . . . VE3), m) Repeating steps j) and k) and l), wherein the computing instance (RP) receives and processes the message newly created in the previous step k) sent to it, until no unprocessed internal messages sent to the computing instance (RP) exist in the intermediate cache.

4. The method for computer-assisted execution according to any one of the preceding claims, characterized in that The voting is performed in a computing instance (RP) that does not belong to the N redundancy groups (GR).

5. The method for computer-assisted execution according to any one of the preceding claims, characterized in that Applications consist of useful programs designed to perform technical processes and service programs that support the functionality of the computing environment (RU).

6. The method for computer-assisted execution according to any one of the preceding claims, characterized in that All processing units (VE1 . . . VE3 ) of the computing instances (RP) comprising the redundancy group (GR) are respectively implemented on other processors or at least on other computing cores.

7. A computing environment (RP) having a plurality of computing instances, wherein: The N computing instances (RP) are respectively aggregated into one of the plurality of redundancy groups (GR), and in each redundancy group (GR) all computing instances (RP) are designed to execute the application program redundantly. It is characterized in that The computing environment (RU) is divided into the N processing units (VE1 ... VE3), wherein: n) In each processing unit (VE1 ... VE3), multiple computing instances (RP) are aggregated. o) no processing element (VE1 ... VE3) contains multiple compute instances (RP) from the same redundancy group (GR), And the computing environment (RU) has a computing instance (RP) designed for p) when N redundant messages generated by the computing instance (RP) leave the processing unit (VE1 ... VE3) as external messages, the voter (V) compares the N redundant messages generated by the computing instance (RP), and q) In case the message is exchanged as an internal message between the computing instances (RP) inside the processing unit (VE1 . . . VE3), the message is not compared.

8. The computing environment according to claim 7, characterized in that: A plurality of computing cores of a processor are aggregated in at least one processing unit (VE1 . . . VE3).

9. The computing environment according to claim 7 or 8, characterized in that: The computing instance (RP) configured as a voter (V) is an external computing instance (RP) that does not belong to any redundancy group (GR) and is configured to receive messages for voting.

10. The computing environment according to any one of claims 7 to 9, characterized in that: The computing environment has a plurality of voters (V).

11. A computer program comprising program instructions which, when the program is executed by a computer, cause the computer to implement the method according to any one of claims 1 to 6.

12. A computer-readable storage medium, on which the computer program product according to the preceding claim is stored.

Images