METHOD FOR COMPUTER-AIDED EXECUTION OF A TECHNICAL PROCESS IN PROCESSING UNITS

Description

Technical field

[0001] The invention encompasses the following subject matter: a method for carrying out a technical process. Furthermore, the invention encompasses the following subject matter: a computing environment comprising multiple computing instances. Furthermore, the invention encompasses the following subject matter: a computer program comprising program instructions. Furthermore, the invention encompasses the following subject matter: a storage medium that is readable by a computer. Technical background

[0002] For functionally safe applications in railway environments according to EN 50128 and EN 50129 with a Safety Integrity Level (SIL) > 2, various measures are required to ensure functional safety, including fault-free operation. The requirements for the certification of safety-related applications, for example in railway technology, are very high. According to standard EN 50129, four Safety Integrity Levels (SILs) are distinguished for safety functions to achieve the required functional safety. Safety Integrity Level 4 represents the highest and Safety Integrity Level 1 the lowest level of safety integrity. The respective Safety Integrity Level influences the confidence interval of a measured value; the higher the Safety Integrity Level that the respective device must meet, the smaller the confidence interval.The dimension of functional safety for the various Safety Integrity Levels (SILs) can be clearly described by the expected frequency of a failure of the safety-relevant system, MTBF (Mean Time Between Failures), which is expressed in years (a). For SIL-1, this ranges from 10 to 100 years, for SIL-2 from 100 to 1000 years, for SIL-3 from 1000 to 10000 years, and for SIL-4 from 10000 to 100000 years. A key measure is processing in independent computing instances that are either sufficiently independent and / or sufficiently error-free to guarantee the required level of safety.To combine the independent processing operations of a group of computing instances, a comparator, also called a voter, is required, which checks the identity of the processing results and, in case of equality or at least a successful majority decision, releases the checked result for further processing by the same or further computing instances.

[0003] A comparator, also called a voter, is a device used to determine the functionality of redundant systems. Majority decision systems, or MooN systems for short, are classified as active redundancy (majority redundancy). They are used to increase the fault tolerance of systems requiring a high level of functional safety against failure or the occurrence of errors. There are various MooN system architectures. Practical applications can be found in simplex (1oo2), duplex (2oo2), triplex (2oo3), and quadruplex (3oo4) architectures. The results of the MooN systems are compared by the majority decision-maker (voter) to determine the majority decision. The result is passed on as long as at least M of the N systems are functioning (this applies, for example, to hardware components and machines) or as long as M of the N results agree when compared (this applies, for example, to data and measured values).Otherwise, the entire system is considered to have failed, and an error message may be displayed.

[0004] A voter can be implemented in software or hardware. A software-based voter consists of a program module for comparison, also called voting, which processes the aforementioned results as input and generates an error or approval as output. In hardware, a voter can also be implemented as an analog computer that performs voting through a logical combination of its components. In particular, a program module can also run on a processor that is not itself involved in generating the results. This creates a hardware separation of the tasks of generating the results on the one hand and evaluating the results through comparison on the other.This has the advantage that the process steps of generating the results and comparing the results are less likely to influence each other, thereby increasing the operational reliability of the comparison process.

[0005] Voting is significantly resource-intensive and requires strict synchronization between independent computing instances to ensure that identical results generated in parallel are simultaneously available for voting within the voter. This effort depends heavily on the underlying solution approach (hardware and / or software implementation) and increases considerably with software-based solutions. However, when using commercial off-the-shelf (COTS) hardware instead of highly specialized, proprietary hardware solutions, process security through suitable software is essential. This includes both procedural security for the running processes and process synchronization, i.e., waiting for all results in the form of redundant messages for comparison, as a prerequisite for reliable voting. This represents a key challenge.

[0006] According to the state of the art, to achieve functional safety, such independent processing units are implemented on a processor (a CPU or a processing core), for which known and sufficient methods for deterministic processing (e.g., task prioritization) exist. A comparison of the results therefore leads with high reliability to the conclusion that the independent processing results are identical. This concept is described, for example, by S. Steffens et al. in "Development of a new safety platform DS3 - from research project to commissioning", SIGNAL + DRAHT (113) 6 / 2021.

[0007] Document US 2016 / 314057 A1 describes a computer-implemented method for detecting an error in a system and includes the following steps: Running at least three virtual machines, each running the same application software in separate and isolated memory segments and on a dedicated core of a multi-core processor. The virtual machines are synchronized and run concurrently by a common hypervisor. Error-free virtual machines provide an identical output message within a predefined time interval.

[0008] Document US 2020 / 175168 A1 describes a computer / data processing device comprising: a plurality of computer units, each computer unit comprising a computer resource; the computer device comprising at least three computer units, each computer unit comprising one / the same computer resource; each computer unit further comprising a computer unit access manager, each access manager being adapted to control access to the computer resource of the respective computer unit in response to at least one request; the computer unit access manager permitting a response to the at least one request only if a majority of the computer units provide the same response to the at least one request; and the computer device comprising, being deployed on a chip, and / or an integrated chip (IC) or microprocessor.

[0009] In the described method, when processing multiple functionally safe application programs in parallel, which cooperate in a network through continuous message exchange, synchronization and comparison are performed separately for each application program before the messages, thus verified and therefore (in terms of functional safety) safe, are exchanged between the cooperating application programs. The significantly increasing effort required to manage this task accumulates across the number of application programs involved, such that the overall response times for processing in such a network can increase significantly and even unacceptably. Summary of the invention

[0010] The object of the invention is to solve the problems described in the prior art. In particular, it is an object to provide a method for carrying out a technical process, a computing environment comprising several computing instances for carrying out the technical process, a computer program comprising program instructions, and a storage medium that is readable by a computer, wherein the computational effort associated with a functionally reliable execution of the method is kept as low as possible.

[0011] According to a first aspect of the invention, a method for carrying out a technical process with the aid of a computer is described. a) in which application programs are executed redundantly in a redundancy group consisting of a plurality N of computing instances, thereby calculating the plurality N of redundant results (whereby messages are received, processed and sent in a manner known per se for the execution of the application programs, the latter if results of the execution of the application programs are to be transmitted to other computing instances or to other hardware components involved in the technical process) and b) subsequently, a comparison of the plurality N of messages containing the results is carried out in a voting process, wherein c) in the case that a majority of the messages contain identical results, said majority of messages are used for the further execution of the technical process.

[0012] To avoid misunderstandings, it should be noted that individual claim features are numbered with lowercase Latin letters, without regard to the claim numbering. This means that each letter appears only once in the entire claim set, allowing for unambiguous addressing of the relevant claim features without mentioning the claim number. Therefore, the order of the letters is irrelevant.

[0013] When referring to a large number of redundant results, this means the technical presence of multiple results in different messages, represented by different data sets, as a result of parallel calculations.

[0014] Within the scope of this invention, multiple results are also referred to even if they are identical and, in terms of their information content, could be considered a single result. The results are sent and received by the participating computing instances in the form of messages. A majority of a plurality N of messages or results can also be equal to the plurality N of messages or results ("unanimous majority").

[0015] The useful content of a message relates to the result aimed at accomplishing a task to be completed by the technical process. At the same time, a message also contains content intended for controlling the processes running in the computing instances, which are preferably handled by utility programs (more on this below). This content does not necessarily have to be identical for a comparison to lead to the conclusion that the results of a large number of compared messages are identical; this content should also be referred to as control content.

[0016] A device is computer-aided or computer-implemented if it includes at least one computer or processor, or a method if at least one computer or processor performs at least one step of the method.

[0017] A computing environment is an IT infrastructure consisting of components such as processors, memory units, programs, and the data to be processed by these programs, which are used to execute at least one application that has a task to perform. The IT infrastructure can also consist of a network of these components.

[0018] A cloud (also known as a computing cloud or data cloud) is a computing environment for cloud computing. It refers to an IT infrastructure that is made available via network interfaces such as the internet. It typically includes storage space, computing power, or software as a service, without requiring these components to be installed on a computing instance using the cloud. The services offered within the framework of cloud computing encompass the entire spectrum of information technology and include, among other things, IT infrastructure, platforms, software, and computing power. The cloud provider distributes the available resources to cloud users according to their needs, with the goal of optimizing resource utilization.

[0019] Since railway technology is subject to high safety standards regarding the functionality (operational reliability, safety) and vulnerability (transmission security, security) of computer-implemented solutions, the functionalities of a cloud used in railway technology are typically limited with respect to their shared availability. In particular, restrictions are therefore necessary regarding access by a potentially unlimited number of cloud users. Access must also be limited with regard to the sharing of computing resources among different computing instances, in order to ensure necessary redundancy. A technology that takes these restrictions into account for railway technology is also referred to as a private cloud in the context of this invention, even though a private cloud only partially fulfills the technical characteristics associated with cloud technology.

[0020] Computing instances (or simply instances) form functional units within a computing environment that can be assigned to applications (defined, for example, by a number of program modules) and can execute them. During application execution, these functional units form self-contained systems, either physically (e.g., computer, processor) and / or virtually (e.g., program module).

[0021] Computers are electronic devices with data processing capabilities. For example, computers can be clients, servers, handheld computers, communication devices, and other electronic devices for data processing, which may have processors and memory units and may also be connected to a network via interfaces.

[0022] Processors can be, for example, converters, sensors for generating measurement signals, or electronic circuits. A processor can be a central processing unit (CPU), a microprocessor, a microcontroller, or a digital signal processor, possibly in combination with a memory unit for storing program instructions and data. The term "processor" can also refer to a virtualized processor or a soft CPU.

[0023] Storage units can be designed as computer-readable storage in the form of random-access memory (RAM) or data storage (hard drive or data carrier).

[0024] Program modules are individual software functional units that enable a program sequence of process steps according to the invention. These software functional units can be implemented in a single computer program or in several communicating computer programs. The interfaces implemented here can be implemented in software within a single processor or in hardware if multiple processors are used.

[0025] Interfaces can be implemented using hardware, for example via wired or wireless connections, or using software, for example as interaction between individual program modules of one or more computer programs.

[0026] According to the invention, a plurality N of processing units is provided, wherein d) several computing instances are grouped together in each processing unit, with each computing instance from one and the same redundancy group being assigned to a different processing unit, e) the respective multitude N of redundant messages generated are compared in the voting if these are sent as external messages to computing instances outside the processing unit to which the computing instance generating the message to be compared belongs, f) no voting is carried out for messages that are exchanged as internal messages between computing instances within a processing unit.

[0027] External messages could thus be described as the final results of a specific section of the technical process, and internal messages as intermediate results. According to the invention, only the redundant final results originating from different processing units (namely, the plurality N of these processing units that form a redundancy group for voting) are checked. These are messages whose identity with respect to their useful content is essential for the functional safety of the process, so that errors can be ruled out when these messages are externally transferred to other computing instances (which may also preferably be grouped into processing units), taking into account the required safety level.

[0028] According to the invention, internal messages that are only sent and received by computing instances within the processing units are not compared. This is also unnecessary because the processes running within the processing unit are protected from access from outside the processing units, and the redundant processing of other messages among the multitude of messages also takes place in other processing units, thus preventing interference in the parallel processes. In other words, the parallelization process is moved from the level of computing instances to a higher level of the processing units, so that the processes within a processing unit do not run redundantly and therefore advantageously do not need to be synchronized, or at least much less frequently (more on this below).

[0029] The undesirable accumulation of tasks and the associated excessive delays can be advantageously resolved with a paradigm shift based on the invention. This paradigm shift consists of the use of multiple computing instances that cooperate and exchange internal messages continuously and asynchronously with each other in any order as a combined independent processing unit (hereinafter also referred to as a "bubble") and ensure functional safety through a single subsequent comparison of the processing results (represented by external messages) of the plurality N of such processing units.

[0030] To achieve functional safety for multiple aggregated independent processing units (bubble), it is sufficient for each processing unit to be connected to external (d) .h. message to be transmitted to subsystems or neighboring systems (hereinafter referred to as external message) outside the bubble; the one-time secure comparison over a sufficiently large set (plural N) of messages with identical payloads (stored in data sections of the relevant data records reserved for this purpose), which represent the results of the tasks to be performed by the computing instances. According to the invention, these messages were previously generated by the parallel processing units. A prerequisite is that all computing instances of a redundancy group have been developed and configured according to the requirements necessary for the desired SIL of functional safety.For messages mediated between the individual computing instances within the processing unit (sent and received by computing instances) (hereinafter referred to as internal messages), voting can be advantageously omitted due to this property.

[0031] The effect is that fewer messages need to be compared in the voter overall (namely, only external messages and not internal ones), which leads to a performance gain in task processing. This performance gain stems not only from the elimination of the need to compare all messages, but also from the fact that the processing units can operate in a performance-oriented manner and thus asynchronously to the other processing units in a redundancy group. This eliminates the need to specify cycle times in the processing unit and the associated idle times.

[0032] According to a further aspect of the invention, a computing environment comprising several computing instances is described, wherein a plurality N of computing instances are grouped into one of several redundancy groups and in each redundancy group all computing instances are configured to execute an application program redundantly.

[0033] According to the invention, the aspects of the invention explained above are determined by the fact that that the computing environment is divided into the aforementioned multitude N of processing units, wherein n) several computing instances are grouped together in each of these processing units, o) none of these processing units contains several computing instances from one and the same redundancy group, and that the computing environment has a computing instance that is configured to p) compare, as a voter in a voting process, a multitude N of redundant messages generated by the computing instances, in the case that these leave a processing unit as external messages, and q) not compare messages in the case that these are exchanged as internal messages between computing instances within the processing unit.

[0034] The advantages associated with the described structure of the computing environment have already been described in connection with the method according to the invention and apply in the same way to the computing environment when it is used to carry out the method according to the invention.

[0035] According to a further aspect of the invention, a computer program is described, comprising program instructions which, when the program is executed by a computer, cause it to execute the method according to the invention.

[0036] According to the invention, a computer program containing program modules is described with program commands, wherein the inventive method and / or its embodiments can be carried out by means of the computer program and the described advantages are achieved by means of the execution.

[0037] According to a further aspect of the invention, a storage medium is described which is readable by a computer, on which the computer program product according to the last preceding claim is stored.

[0038] Furthermore, according to another aspect of the invention, a provisioning device for storing and / or providing the computer program in the form of a computer-readable storage medium is described. The provisioning device is, for example, a storage unit that stores and / or provides the computer program. Alternatively or additionally, the provisioning device is a network service, a computer system, a server system, in particular a distributed, for example cloud-based, computer system or virtual computer system, which stores the computer program on a computer-readable storage medium and preferably provides it in the form of a data stream.

[0039] The provision of the computer program is in the form of program data sets as a file, in particular as a download file, or as a data stream, in particular as a download data stream. The computer program is transferred, for example, using the provisioning device, into a computing environment so that the method according to the invention can be executed in a computing instance of this computing environment.

[0040] General embodiments of the invention and further developments of the invention are explained below without limiting the basic idea of ​​the invention.

[0041] According to one variant, the aspects of the invention explained above are determined by the fact that the plurality of N processing units operate in work cycles, wherein g) at the beginning of each work cycle, messages required for the work cycle and addressed to the computing instances of the processing unit in question are passed to that processing unit; h) subsequently, all messages required for the execution of the application programs are processed by the computing instances in the plurality N of processing units in identical order, generating new redundant messages; i) subsequently, the new redundant messages are compared with each other in steps b), c), d) and e) (so).

[0042] According to this embodiment of the invention, a further problem is solved, which is illustrated by an example of 3 computing instances A, B, C of a processing unit (in the Figure 2 and 4(also called AC1, AC2, and AC3) in comparison to other processing units within the same redundancy group, this is to be explained. In the event of a time delay (so-called jitter), for example, processing instance B would receive messages from processing instances A and C in the first processing unit in a different order than in the second or third (fourth...) processing unit of the redundancy group in question, resulting in different processing results in the various processing units of the redundancy group. "Different" here means both that the content of the individual processing results can differ, and that the same content can be in a different order. Different results would, however, lead to an error message during voting, even if the actually calculated results (payload data) are identical.

[0043] The advantage of this embodiment of the invention is that the occurrence of jitter no longer affects the subsequently calculated results. In other words, despite the occurrence of jitter, an overall result is generated which is considered identical in a vote (provided, of course, that the generated useful content is the same, because otherwise the voting should, in fact, indicate an error). This is achieved by ensuring that the messages are always processed in an identical order. The identical order is ensured by a suitable sorting algorithm. Such sorting algorithms are known per se. The sorting criteria can be freely chosen; it is only necessary that they are identical for all processing units of a redundancy group so that an identical order of the messages is established throughout the entire redundancy group.For example, all messages can be sorted based on the size of a determined hash value.

[0044] According to one variant, the aspects of the invention explained above are determined by the fact that step h) is carried out (so) as a subcycle, wherein j) the computing instances of each of the plurality N of processing units receive the messages addressed to them, k) the messages are then processed, with the newly generated internal messages being stored in at least one intermediate buffer of the processing unit, l) the messages stored in the intermediate buffer in step k) are then sorted according to sorting rules that are identical for all of the plurality N of processing units in question, m) steps j), k) and l) are repeated, with the computing instances receiving and processing messages addressed to them that were newly created in previous steps k) until no unprocessed internal messages addressed to the computing instances remain in the intermediate buffer.

[0045] Storing these messages in a buffer can be advantageously used to sort messages repeatedly placed in step k) in a single, consolidated step before they are submitted to the voting process (sending these messages to the voter). This leads to a further performance improvement, as the sorting overhead is reduced. During processing, the messages can be handled by the aforementioned computing instances without synchronization, i.e., in a non-deterministic order. All computing instances undergo at least one, and usually several, recursion loops, ensuring that all messages to be processed are ultimately considered.If the remaining messages that cannot be processed further are sorted, the overall result can be compared by the voter, since this produces a positive result of the voting (i.e., that the process can continue) provided that all or at least the majority of the individual messages each contain a message with identical useful content per computing instance.

[0046] According to one variant, the aspects of the invention explained above are determined by the fact that the voting is carried out in an external computing instance that does not belong to any of the plurality N of redundancy groups.

[0047] When this invention refers to an external computing instance, this means that this computing instance does not belong to any of the multitude of processing units that comprise the independently calculating computing instances for the redundant processing of messages, for example, from a redundantly executed application program. This does not mean that the external computing instance must be implemented on a different computer, processor, or processing core (i.e., no hardware separation is required); software separation through the definition of redundancy groups and associated message management, for example, according to a publish-subscribe protocol, is sufficient.The computing instance may also be included, for example, in another redundant group of computing instances in which no computing instances are involved in calculating the multitude N of results to be submitted for voting.

[0048] If the voting takes place in a computing instance external to the processing unit in question, the messages relating to the overall result being compared are external messages. In contrast, the messages required for the redundant processing of the respective tasks, and which are transferred to the redundancy group for this purpose or generated during processing within the redundancy group, are considered internal messages, since they do not need to be included in an (external) vote and therefore do not need to be sent from the processing unit forming the redundancy group.

[0049] According to one variant, the aspects of the invention explained above are determined by the fact that the application programs consist of utility programs that are aimed at carrying out the technical process and utility programs that support the functions of the computing environment.

[0050] In other words, application programs are those programs that support the technical process for which the inventive method is directed (for example, a railway application). These programs generate messages required for the execution of the technical process. These messages are generally further processed by other application programs of the technical process. The technical process can, for example, be a method for operating railway infrastructure. The railway infrastructure comprises, on the one hand, a track system with control elements and sensors, and on the other hand, vehicles with control elements and sensors.

[0051] Utilities are defined as application programs that are not directly involved in the execution of the technical process, but merely ensure the functionality of the computing environment itself. This includes, for example, the voter, which only ensures the operational reliability of the computing environment but does not provide any results that can be used as payload data in the technical process.

[0052] According to one variant, the aspects of the invention explained above are determined by the fact that all processing units containing computing instances of a redundancy group are each implemented on a different processor or at least each on a different computing core, preferably a different computing core of the same processor.

[0053] If the compute instances of a redundant group, and thus also the processing units in which the respective compute instance is located, are each housed on different cores of the same processor, the external messages to be subjected to voting can preferably be sent to a voter that is implemented on the same processor but preferably on different cores than those occupied by the processing units or compute instances. This advantageously leads to a physical separation of the processes executed in parallel by the different processing units and thus to a reduction in hardware-related errors. Furthermore, this ensures that the processing operations associated with voting are carried out on the same processor, which also advantageously results in a performance gain.

[0054] According to one embodiment, the aspects of the invention explained above are characterized by the fact that several processing cores of a processor are combined in at least one of the processing units (preferably in all processing units of at least one redundancy group). Furthermore, according to a further embodiment, within the processing unit in question (preferably all processing units of a redundancy group), each processing core is assigned only one of the processing instances of the processing unit. This ensures that all processing operations running in the respective processing instance occur in one and the same processing core, which increases operational reliability and advantageously further improves performance.

[0055] The performance gain associated with the parallel but time-independent processing of messages in different processing units is all the greater if the computing instances of such a processing unit are divided among several CPUs or several (virtual) cores for the purpose of parallel and thus more effective processing (this is a central motivation for the use of multi-core applications).

[0056] In this advantageous configuration, all computing instances of a bubble reside on cores of a single CPU. The communication paths within a bubble are therefore very fast, and the independence of multiple bubbles is advantageously leveraged by distributing related bubbles across multiple servers. The effectiveness of these measures can thus be quantitatively extended to bubbles with a comparatively large number of subunits ("large" bubbles).

[0057] In an advantageous form, the individual units of the system are adapted for a specific technical process such as the one described in Figure 1The depicted railway application, with regard to its data set to be processed – e.g., the size of the perimeter of a signal box (number of points, tracks, signals) – is optimally distributed across a number of computing instances depending on the required functional processing. This ensures that the work within the bubble is evenly distributed, especially when the workload increases across all subunits, i.e., when more and more scenarios need to be processed in parallel almost simultaneously. Specifically, this means that no single sub-step within a subunit becomes so excessive that it requires the entire bubble work cycle for complete processing or even necessitates an additional bubble work cycle.Thus, it is possible to ensure that, precisely during and despite the increase in workload across all processing units, the overall response times of several scenarios being processed in parallel can be kept stable, thereby achieving effective scaling.

[0058] In a further advantageous form, the proposed approach can be extended not only to scaling through distribution with respect to the quantity structure, but also to scaling through distribution with respect to the functionality itself, or rather, both aspects can be combined and enforced almost arbitrarily. This also includes the partitioning of an originally monolithic work unit. Specifically, this means that for the first time, parallelization and effective and deterministic multicore utilization become possible for originally monolithic work units, something that was previously impossible on conventional systems.

[0059] According to one variant, the aspects of the invention explained above are determined by the fact that the computing instance set up as a voter does not belong to any redundancy group as an external computing instance from which it is set up to receive messages for voting.

[0060] Designing the voter as an external computing instance advantageously ensures that all messages provided for voting by the redundant computing instances must be sent out of the redundancy group as external messages. This allows for a separation of the processing operations that generate the messages to be compared and the subsequent voting, thereby enabling the inventive method to be carried out with a higher degree of reliability.

[0061] According to one variant, the aspects of the invention explained above are determined by the fact that it has multiple voters.

[0062] The use of multiple voters advantageously leads to a performance gain in the execution of the method according to the invention. This is because, if several redundant groups were to send voting results in quick succession, these would have to be processed sequentially if only one voter were available. With multiple voters, however, the voting process can be parallelized.

[0063] Exemplary embodiments of the drawing. Further details of the invention are described below with reference to the drawing. Identical or corresponding drawing elements are provided with the same reference numerals in the individual figures and are only explained more than once to the extent that differences arise between the individual figures.

[0064] The exemplary embodiments described below are preferred embodiments of the invention. In these exemplary embodiments, the described components each represent individual variants of the invention, which can be considered independently of one another. Each of these variants further develops the invention independently and can therefore be regarded as part of the invention individually or in a combination other than that shown. Furthermore, the described components can also be combined with the variants of the invention described above.

[0065] Figure 1 The diagram schematically shows an embodiment of the device according to the invention with its interactions. Figure 2 shows an exemplary embodiment of a computing environment for the device according to Figure 1as a block diagram, wherein the individual computing instances execute program modules that can each run in one or more of the exemplary computers shown, and wherein the interfaces shown can accordingly be implemented in software within a computer or in hardware between different computers.

[0066] Figure 3 An embodiment of the method according to the invention is shown as a flowchart, wherein the process steps shown can be implemented individually or in groups by program modules, and wherein the computing instances and interfaces are defined according to Figure 2 are indicated by example.

[0067] Figure 4 represents the procedure according to Figure 3 on a timeline, where the processing operations and the generated messages of the first processing unit and the second processing unit are shown according to Figure 3The following are examples (the third processing unit is omitted for clarity) Detailed description of the drawing

[0068] In Figure 1 The diagram schematically depicts a railway application controlled by a computing environment RU. The railway application features tracks GL, on which various components of the interlocking system are shown as examples. These include a point motor WA, which can operate a point WH. Furthermore, a balise BL is installed in one of the tracks GL, enabling the exchange of information with trains passing over it. Finally, a light signal LS, controlled by a controller CL, is shown.

[0069] The computing environment RU can comprise several host computers: a first host computer HR1, a second host computer HR2, and a third host computer HR3. Applications for controlling the railway application are distributed across these host computers in the form of application programs (more on this below). The first host computer HR1 is provided by a data center (RZ) and is connected to a first storage unit SE1 via a first interface S1. The data center RZ can be operated, for example, by a service provider of the railway operator or by the railway operator itself. A second interface S2 connects the first host computer HR1 to a private cloud (CLD), thus making it geographically independent of the railway application. The cloud CLD can be a private cloud, meaning one where access is restricted to authorized users.

[0070] A control center (LZ) of the railway operator houses the second host computer (HR2), which is also connected to the cloud (CLD) via a third interface (S3). Furthermore, the second host computer (HR2) is connected to a second storage unit (SE2) via a fourth interface (S4).

[0071] The computer environment RU also includes, as an example, a signal box STW, which houses the third host computer HR3. HR3 is connected to a third storage unit SE3 via a sixth interface S6. Furthermore, the third host computer HR3 has a fifth interface S5 to the second host computer HR2. HR3 could also be connected to the cloud CLD, though this connection is not shown. The third host computer HR3 also has a seventh interface S7 to the point motor WA, an eighth interface S8 to the controller CL, and a ninth interface S9 to the balise BL.

[0072] All interfaces S1 ... S9 according to Figure 1These connections are generally wired or can be implemented using wireless transmission technology, such as radio. The arrangement of the host computers HR1 ... HR3 is merely an example and can be expanded as needed for more complex railway systems. A computing environment RU is defined by the ability of the participating host computers HR1 ... HR3 to communicate with each other, allowing applications to be processed across the host computers HR1 ... HR3, taking into account available computing resources. For this purpose, computing instances RP are created, which are not shown in detail below (see below). Figure 2 where the computing instances RP are represented).

[0073] Furthermore, in Figure 1Various intermediate storage devices (ISDs) are shown, the function of which will be explained in more detail below. The intermediate storage devices (ISDs) can either be part of the host computer (for example, implemented in the main memory of the host computer) or part of the storage devices.

[0074] An approach using a purely software-based platform, also known as Distributed Smart Safe System or DS3 for short, pursues, according to the state of the art, as described in Figure 2The above illustrates the implementation of functional safety mechanisms using exclusively COTS hardware. The method for synchronizing and controlling the determinism for comparing the inherently independent work results is based on a strict time cycle for the sequence of work cycles and comparison cycles (VT). Due to the significantly higher computational effort required for the comparison cycle (VT) compared to hardware synchronization and comparison, this cycle cannot be arbitrarily short. Therefore, currently, for example, the... Figure 2 The indicated 100 ms represents a realistic cycle duration.

[0075] In Figure 2This is shown for five subunits, each with three independent computing instances RP, forming a redundancy group GR – including a voter V as a comparator and a gateway GW to decouple communication with other subsystems SB, such as the other subunits. The comparison is performed for each subunit A, B, C, D, E (regardless of which host computer HR1 ... HR3, indicated by dashed lines, these subunits are assigned to) via the voter V assigned to the respective subunit. In the case of the example of a system called Simis W, the computing instances are therefore an interface computer IIC for track elements (also called Interlocking Interface Component, or IIC for short), on which utility programs are primarily executed, and several application controllers AC1 ... AC4 (also called Area Components) for processing the user programs.The computing instances are interconnected by connecting lines, which represent communication links between the computing instances.

[0076] However, processing in the strict comparison cycles occurs regardless of whether there was very little or a lot to process in a comparison cycle within the work cycle, inevitably resulting in idle times for the computing instances RP. If a subunit has little to process, but at the same time the rapid succession of several such activities is sequentially required for complete processing within the subunit network, the entire processing is significantly delayed, since forwarding is only possible after a complete comparison cycle (cf. Figure 4 , below). As a result, the desired functional safety properties are adequately met, but this comes at the expense of performance due to the response times of individual processing operations.

[0077] The same five computing instances RP, each with its three independent processing units VE1 ... VE3, can now, according to the invention, be clustered into three independently operating processing units VE1 ... VE3, represented as bubbles, but only in conjunction with a voter V as a comparator and a gateway GW to decouple communication with other or neighboring systems, which can preferably also be organized as bubbles (not shown). The bubbles represent the logical processing units VE1 ... VE3, but not hardware-based boundaries. However, it is advantageous to place computing instances RP of a redundancy group GR on different (virtual) processing cores or processors. For the second processing unit VE2, the regrouping of one computing instance RP from each subunit A ...E is exemplified by a dashed arrow; the same applies to the first processing unit VE1 and the third processing unit VE3.

[0078] Clustering as a bubble with physical decoupling of the three redundancy groups GR corresponds to the paradigm shift described above and, with its associated properties and advantages, such as asynchronous and parallel processing for the effective use of multiple computing cores (multi-core) in the bubble in question, represents an advantageous use.

[0079] Furthermore, it can be seen that comparison only takes place before sending external messages that leave the bubble. A cycle of 100 ms is provided for this. Additionally, there is the option of using multiple Voter V and Gateway GW units (not shown) to further maximize the scalability and efficiency of the resulting multicore system through parallelization.

[0080] To control the determinism essential for the solution described above during asynchronous and parallel processing within the bubbles themselves, instead of the original safe comparison and strict comparison clock in each redundancy group GR, the following algorithm for sorting and flow control is now performed independently in each bubble, but according to identical criteria for all bubbles, between the computational instances RP (as bubble participants), which is described in Figure 3 is shown. Step 1 (START): Beginning of the (higher-level) work cycle AZ. Step 2 (TRF-MSG): Transfer of all available incoming messages to the associated (addressed) compute instances RP in the processing unit VE1 ... VE3 (bubble) for asynchronous and parallel processing by the compute instances RP. These incoming messages were received during the last processing cycle and cached externally until they were transferred to the current processing cycle. The incoming messages thus define the work package for the current processing cycle. The quantity and sequence of the incoming messages are identical for all processing units VE1 ... VE3 (bubbles). Step 3 (CLC-MSG): Asynchronous and parallel processing of all transferred internal messages by the compute instances RP. Each compute instance RP runs independently; during this processing, each compute instance RP can generate new messages.This can involve internal messages to other computing instances RP (within the same bubble) or external messages to other, external subsystems SB. Step 4 (abbreviated SVE-MSG): Newly generated messages require buffering. Newly generated messages within a bubble, both internal messages for other computing instances RP in the bubble and external messages for external subsystems SB, are temporarily buffered and not immediately forwarded for processing. This buffering is necessary so that the messages can later be sorted uniformly for all bubbles and the voter(s) V in the same way (via configuration, i.e., according to deterministic sorting rules), see Step 6. Step 5 (abbreviated WT-PROC): Wait until all computing instances RP have completed their message processing.Only when all RP processing instances in the bubble have finished is a consistent set of all generated new messages fully available in each bubble. This is a prerequisite for the uniform applicability of the sorting rules. Step 6 (SORT-MSG): Sorting of all buffered new messages according to a predefined configuration for the RP processing instances. This configuration is identical for all bubbles and determines a uniform processing order for the new messages, thus ensuring uniform results in subsequent steps. This is the key feature for controlling deterministic behavior in all participating bubbles.Step 7 (TRF-MSG): Transfer of all buffered and sorted messages to the compute instances RP within the bubble for further asynchronous and parallel processing (internal messages) and, if necessary, to the voter V outside the bubble (external messages; this transfer can also occur after step 9 for all generated messages together, if the external messages are buffered in the bubble until then). Step 8 (NEW-MSG?) after query: Asynchronous and parallel processing again in a subcycle UZ (recursion, see point 3) if there are still (new) sorted internal messages available for the compute instances RP. Step 9 (WT-PROC): Reaching the wait point of the bubble if there are no further sorted internal messages available for the compute instances RP.Step 10 (abbreviated VTE-MSG): The overarching bubble work cycle is complete in all bubbles, meaning that all work results in the form of external messages have been calculated. This work cycle is, as in . Figure 2 depicted, executed redundantly in parallel in three bubbles, which in Figure 3This is indicated by the fact that the elements of the flowchart are each displayed with two overlapping layers (so to speak, having two shadows) and three parallel flow arrows are shown. However, this does not mean that the processes in the three bubbles run synchronously. It merely means that all bubbles must have reached the described step 9 before step 10 can begin. Now, the external messages must be compared. Due to the application of the sorting rules, these messages behave deterministically and must therefore be identical. The external messages from all bubbles are passed to the voter V for comparison, and the voting takes place. If the voting result is positive, the external messages are made available to external subsystems SB via the gateway GW (see...). Figure 2Step 11 (abbreviated END): the (parent) work cycle is completed. A subsequent work cycle AZ can be started with step 1.

[0081] In Figure 4 is the process sequence according to the invention according to Figure 3 The diagram is shown on a timeline ZA. Only the first processing unit VE1 and the second processing unit VE2 are visible. The mechanisms explained below apply equally to the third processing unit VE3, which has been omitted for clarity.

[0082] Outside the first processing unit VE1 and the second processing unit VE2, an intermediate storage ZS is provided as a send buffer, which, for example, offers four memory locations for messages. These messages are subsequently referred to as 1a, 2a, 3a, and 4a. If new messages are generated from these initial messages by processing application programs in the computing instances RP, these are each designated with the following letter, i.e., 1b, 2b, 3b, and 4b, etc. The generation of these messages is described in Figure 4 The time axis ZA is shown to scale. An intermediate storage ZS is also provided in the first processing unit VE1 and in the second processing unit VE2, which is shown twice due to the temporal progression within these processing units. However, it is the same intermediate storage ZS in each case.

[0083] From the intermediate storage ZS, which is implemented as a transmit buffer, messages 1a, 2a, 3a, and 4a are transferred in parallel as external messages to the first processing unit VE1 and the second processing unit VE2. There, they are distributed to the computing instances RP, which are composed of the following: Figure 2 The processing units AC1, AC2, and AC3, as previously described, exist. Progress bars in the processing units RP indicate when the respective messages are being processed. Processing messages results in the generation of new messages. In the case of AC1, these are 1b, 4b, and 4c, and in the case of AC3, they are 2b, 3b, and 3c. These messages are stored in the intermediate storage units ZS located in the first and second processing units. AC2 is not currently assigned any message processing tasks.

[0084] Once processes 1a, 2a, 3a, and 4a have been completed, no further messages remain for processing. Message processing in the first processing unit (VE1) and the second processing unit (VE2) occurred in parallel, but jitter occurred in the first processing unit (VE1), causing a delay. Figure 4It can be seen that in the first processing unit VE1, messages 3b were generated after 4b and 3c after 4c, while in the second processing unit VE2, the aforementioned messages were generated approximately simultaneously. However, this has no effect on the planned comparison of the messages because the messages stored in the buffer ZS are sorted according to sorting rules (not shown in detail) before comparison. This results in the new external messages 2b, 3b, and 4b being sent from the first processing unit VE1 and the second processing unit VE2, respectively, at different times but reaching the voter V in the same order. Therefore, the voting result will be positive as long as these messages are identical, since they are checked in the same order.

[0085] The newly generated messages, which are internal (1b, 4c, and 3c), are then processed in AC2, resulting in the generation of new messages 1c, 4d, and 3d. These messages are also generated later in the second processing unit, VE2, than in the first, VE1, due to jitter. However, these messages are also stored in the buffer ZS and only sorted after all internal messages have been processed. In the voter V, the messages are compared in the order 1c, 3d, and 4d, and their matches are determined. Afterward, no new messages are available, as all newly generated messages were external. The AZ work cycle is thus complete.

[0086] The sorting rules used are chosen as an example according to the message index. Sorting is performed first by Arabic numerals and then by the following letters. These sorting rules are chosen solely to illustrate the sorting mechanism. In reality, sorting rules are preferably based on the content of the messages or hash values, which are generated taking the message content into account.

[0087] To illustrate the advantage over the prior art, the lower part of the Figure 4A process, as previously described, is depicted. Two arrows PF are used here, representing two work cycles according to the state of the art. However, unlike the previously explained representation based on the time axis ZA, this depiction is not to scale but merely serves to illustrate the difference. It becomes clear that two comparison cycles VT of 100 ms each are required to complete the process, thus requiring twice the processing time according to the exemplary embodiment (in reality, the effect is many times greater). Each comparison cycle VT must wait until the last available message has been processed in each of the computing instances RP.Since a comparison, not shown, always only occurs between the work results of the respective computing instance RP, the order of the work results is deterministic even in the event of jitter and therefore leads to positive results in the voting. For this to work, the work results, in the form of new messages, must be completely available for each computing instance RP within a redundancy group GR (not shown in detail). The subunits are each formed by a redundancy group GR of computing units.

[0088] In this example, the effort required for the mechanism described above, which establishes and ensures the necessary determinism in all participating bubbles, shifts somewhat from several comparison cycles VT to a single work cycle AZ. This requires resources, but these resources are available due to the distribution of the computing instances RP across multiple cores. With multiple comparison cycles VT, these resources would have been unused due to the underutilized multiple work phases. Furthermore, this effort is reduced because it does not need to be functionally safe and can therefore be processed independently and efficiently in each individual bubble. This, and the fact that the disclosure of errors implicitly falls under the final comparison by the voter V, represents a further advantage.

[0089] In a further advantageous form, the possibilities for configuring the algorithm for sorting and flow control can be expanded and refined using priorities, separate intermediate storage ZS as send buffers to configured receivers, separate intermediate storage ZS as receive buffers from configured senders, etc., so that the operating behavior of a bubble can be optimally designed according to its dynamic characteristics, depending on how the computing instances RP cooperate. Reference symbol list

[0090] AC1... AC4 Application Controller AZ Work Cycle BLBalise CLController CLDCloud GLGrails GRRedundancy Group GWGateway HR1 First Host Computer HR2 Second Host Computer HR3 Third Host Computer IIC Interface Computer LS Light Signal LZ Control Center PFParrows RRP Computing Instance RUR Computing Environment RZ Data Center S1 First Interface S2 Second Interface S3 Third Interface S4 Fourth Interface S5 Fifth Interface S6 Sixth Interface S7 Seventh Interface S8 Eighth Interface S9 Ninth Interface SB Subsystem SE1 First Storage Unit SE2 Second Storage Unit SE3 Third Storage Unit STW Interlocking Unit UZ Subcycle VVoter VE1 ... VE3 Processing Unit VTV Comparison Clock WA Switch Drive WH Switch ZA Time Axis ZS Intermediate Storage

Claims

1. Method for the computer-aided execution of a technical process, a) in which application programs are executed in a redundancy group (GR) consisting of a plurality N of redundant computing entities and thereby calculate the plurality N of redundant results, and b) a comparison of the plurality N of messages containing the results is then carried out in a voting, wherein c) in the event that a majority of the messages contain identical results said majority of messages is used for further execution of the technical process, characterised in that, processing units (VE1... VE3) are provided in said plurality N, wherein d) a plurality of different computing entities (RP) is combined in each of these processing units (VE1... VE3), wherein none of these processing units (VE1... VE3) contains a plurality of computing entities (RP) from one and the same redundancy group (GR), e) the respectively generated plurality N of redundant messages is compared in the voting if these are to be sent as external messages to computing entities (RP), which do not belong to the processing units (VE1... VE3), in which the message was generated, f) no voting is carried out for messages that are exchanged as internal messages between computing entities (RP) within a processing unit (VE1... VE3).

2. Method for the computer-aided execution according to claim 1, characterised in that the plurality of N processing units (VE1... VE3) operates in work cycles, wherein g) at the beginning of each work cycle (AZ), messages required for the work cycle (AZ) and addressed to the computing entities (RP) of the processing unit (VE1... VE3) concerned are transferred to this processing unit (VE1... VE3), h) subsequently, all messages required for the execution of the application programs are processed by the computing entities (RP) in the plurality N of processing units (VE1... VE3) in identical order, wherein new redundant messages are generated, i) the new redundant messages are then compared with each other in steps b), c), d) and e) in accordance with claim 1.

3. Method for the computer-aided execution according to claim 2, characterised in that the step h) in accordance with claim 2 is carried out in sub-cycles (UZ), wherein j) the computing entities (RP) of each of the plurality N of processing units (VE1... VE3) receive the messages addressed to them, k) the messages are then processed, with the new internal messages generated during processing being stored in at least one intermediate buffer of the processing unit (VE1... VE3), 1) subsequently, the messages stored in the intermediate buffer in step k) are sorted taking into account sorting rules which are identical for all of the plurality N of processing units (VE1... VE3) concerned, m) steps j) and k) and l) are repeated, with the computing entities (RP) receiving and processing messages addressed to them that were newly created in previous step k), until there are no more unprocessed internal messages addressed to the computing entities (RP) in the intermediate buffer.

4. Method for computer-aided execution according to one of the preceding claims, characterised in that the voting is performed in a computing entity (RP) which does not belong to any of the plurality N of redundancy groups (GR).

5. Method for computer-aided execution according to one of the preceding claims, characterised in that the application programs consist of utility programs aimed at the execution of the technical process and service programs supporting the functions of the computing environment (RU).

6. Method for computer-aided execution according to one of the preceding claims, characterised in that all processing units (VE1... VE3) comprising computing entities (RP) of a redundancy group (GR) are each implemented on a different processor or at least each on a different computing core.

7. Computing environment having a plurality of computing entities (RP), wherein a plurality N of computing entities (RP) are combined to form one of a plurality of redundancy groups (GR) and all computing entities (RP) in each redundancy group (GR) are set up to execute an application program redundantly, characterised in that, the computing environment (RU) is divided into said plurality N of processing units (VE1... VE3), wherein n) a plurality of computing entities (RP) are combined in each of these processing units (VE1... VE3), o) none of these processing units (VE1... VE3) contains a plurality of computing entities (RP) from one and the same redundancy group (GR), and that the computing environment (RU) has a computing entity (RP) that is set up, p) to compare as a voter (V) in a voting a plurality N of redundant messages generated by the computing entities (RP), in the event that these leave a processing unit (VE1... VE3) as external messages and q) not to compare messages in the event that these are exchanged as internal messages between computing entities (RP) within the processing unit (VE1... VE3).

8. Computing environment according to claim 7, characterised in that a plurality of computing cores of a processor are combined in at least one of the processing units (VE1... VE3).

9. Computing environment according claim 7 or 8, characterised in that the computing entity (RP) set up as a voter (V), as an external computing entity (RP) does not belong to a redundancy group (GR) from which it is set up to receive messages for voting.

10. Computing environment according to one of claims 7 to 9, characterised in that this has a plurality of voters (V).

11. Computer program comprising program commands which, when the program is executed by a computer, cause the computer to carry out the method according to one of claims 1 - 6.

12. Storage medium which can be read by a computer, on which the computer program product according to the final preceding claim is stored.