METHOD FOR PERFORMING A TECHNICAL PROCESS IN DIRECT OPERATION AND REPAIR OPERATION

Description

Technical field

[0001] The invention encompasses the following subject matter: a method for carrying out a technical process. Furthermore, the invention encompasses the following subject matter: a computer program product comprising program instructions. The invention also encompasses the following subject matter: a provisioning device for the computer program product according to the last preceding claim. Technical background

[0002] Railway automation systems, i.e., communication networks or control systems used in railway automation, must meet high demands regarding the correct and reliable functioning of their components and the transmission of messages, such as control information, during operation. This is because the corresponding processes (computational operations, data storage, message transmission) have a direct impact on operational safety, also known as "safety." Such railway automation systems typically consist of at least one control unit that controls a multitude of end devices or queries information from them, using a suitable communication network for this purpose.A characteristic of railway automation systems is that they typically comprise a large number of devices or units and are often geographically extensive, resulting in a distributed system with components in different locations.

[0003] Document EP 3676991 A1, for example, describes that at least the transmission of messages during the operation of railway automation systems can be carried out using a publish-subscribe procedure in order to offer a reliable transmission technology that ensures greater flexibility in terms of configuration and scalability.

[0004] Document EP 2 884 392 A1 describes a computer-implemented method for detecting a fault in a system, comprising the following steps: running at least three virtual machines, each virtual machine running the same application software in separate and isolated memory segments and in a dedicated core of a multi-core processor; the virtual machines being synchronized and run concurrently by a common hypervisor; fault-free virtual machines providing an identical output message within a predefined time interval; and detecting a fault in an output from one virtual machine, the fault corresponding to another output message from the faulty virtual machine.

[0005] To secure security-relevant computing environments, it is also known that on a single computer, only the components required for processing the application in question are reliably installed across multiple computing instances. If the application then runs in parallel across these instances, a voting process, using a known method, can determine whether errors occur during calculation, thereby also revealing memory errors.

[0006] According to WO 2014 / 00924382, a method and a computer are described which include a verification algorithm for processing applications in the computing environment provided by the computer. Application programs are installed on the computer and executed redundantly, allowing the verification algorithm to detect errors by comparing the calculation results (also known as voting).

[0007] However, this method requires significant hardware resources and, moreover, does not allow for reliable fault detection in certain situations. If a fault is detected, the components of the railway automation system involved in its occurrence must be isolated for operational safety reasons. If there are no longer enough functioning components available, the railway automation system must be reinitialized, which results in an interruption of railway operations. Train delays, for example, are often a consequence of this. Summary of the invention

[0008] The object of the invention is to solve the problems described in the prior art. In particular, it is an object to provide a method for carrying out a technical process with voting that can continue to run for as long as possible even when errors are detected.

[0009] According to a first aspect of the invention, a method for carrying out a technical process is described, a) in which application programs are redundantly executed in a plurality N (N is a natural number) by independent computing instances (whereby messages are received, processed and sent in a manner known per se for the execution of the application programs, the latter if results of the execution of the application programs are to be transmitted to other computing instances or to other hardware components involved in the technical process) and b) based on a MooN system, where M (M is a natural number) is at least two and N is at least three, a comparison of the plurality N of results of the redundant execution of the application programs is carried out in a voting process, wherein c) in the case that a minority of the results differ from a majority of the results of identical content, said minority of results is disregarded in the execution of the technical process.

[0010] To avoid misunderstandings, it should be noted that individual claim features are numbered with lowercase Latin letters, without regard to the claim numbering. This means that each letter appears only once in the entire claim set, allowing for unambiguous addressing of the relevant claim features without mentioning the claim number. Therefore, the order of the letters is irrelevant.

[0011] To ensure redundant execution of the application programs, the computing instances operate independently of one another. This means that the processes running for the redundant execution of the respective application program in the computing instances do not interfere with each other. Preferably, computing instances access reserved memory areas of one or more memory units. Preferably, the computing instances that execute an application program redundantly do not exchange messages for the purpose of executing the application program.

[0012] A comparator, also called a voter, is a device for determining the functionality of redundant systems. Majority decision systems, or MooN systems for short, are classified as active redundancy (majority redundancy). They are used as a means of increasing the fault tolerance of systems for which a high level of operational safety against failure or the occurrence of errors is required. Various MooN system architectures exist. Practical applications within the scope of this invention can be found, for example, in triplex (2003) and quadruplex.

[0013] (3004) Architectures again. The results of the MooN systems are compared by the majority decision-maker (voter) in order to pass on the majority result. The result is passed on as long as at least M of the N systems are functioning (applies, for example, to hardware components and machines) or M of the N results agree when compared (applies, for example, to data and measured values). Otherwise, the entire system is considered to have failed, and an error may be reported and / or a protective measure (e.g., stopping the technical process) may be initiated.

[0014] The voter therefore makes a majority decision after comparing the results. The following scenarios can occur. 1. All results are identical (even with identical results, this description of the invention refers to multiple results, in the sense that they were calculated by different computing instances. In other words, the mathematical understanding that the same result is only one result is not relevant here). This is considered proof that the technical process runs flawlessly in all computing instances. Each respective result can be used in the computing instance involved in its generation for the further execution of the technical process or to generate messages for other computing instances. 2. The majority of the results are identical. This is considered proof that the majority of these results are correct.Each identical result can be used by the computing instance involved in its generation to further execute the technical process or to generate messages to other computing instances, while computing instances that have calculated a different result are excluded from executing the technical process. 3. There is no majority of identical results. This means that either all results differ from each other or the number of identical results does not constitute a majority compared to the number of results that differ from this result. This is considered evidence that the risk of an error is too high. A protective measure must be implemented for the execution of the technical process. This could, for example, consist of issuing a warning message or terminating the execution of the technical process.

[0015] An exclusion from the set of redundant computing instances involved in the technical process (or, more precisely, contributing), whether individual instances or the entire team (the team being the totality of computing instances redundantly executing the relevant process steps), can be communicated via messages, including to the computing instances themselves. The computing instances shut down (or, in the event of a malfunction of the shutdown function, they are shut down remotely) when identified as faulty by the voter and can subsequently be restarted without errors according to the invention (more on this below).

[0016] A voter can be implemented using software or hardware, with this invention preferably employing a software-based voter. A software-based voter consists of a program module for comparison, also called voting, which processes the aforementioned results as input and generates an error or approval as output. In hardware terms, a voter can also be implemented as an analog computer that performs voting through a logical combination of the analog computer's components. In particular, a program module can also run on a processor that preferably is not itself involved in generating the results. This results in a hardware separation of the tasks of generating the results on the one hand and evaluating the results by comparison on the other.This has the advantage that the process steps of generating the results and comparing the results are less likely to influence each other, thereby further increasing the operational reliability of the comparison process.

[0017] According to the invention, it is provided that d) in the case according to c) (so) the at least one computing instance affected by the generation of the minority of results is excluded from carrying out the technical process, e) in the case according to c) (so) by a computing instance not affected by the new initialization (i.e.f) a state copy is created from a state to be newly initialized by a computing instance affected by the generation of the majority of the results, and all messages (in the form of data records) sent to the computing instances from the creation of the state copy onwards, along with their order, are stored; f) during the new initialization, the state of the affected computing instance is restored according to the state copy, and all stored messages are processed by the affected computing instance in the stored order until the affected computing instance is again synchronized with the computing instances not affected by the new initialization; g) afterwards, the at least one computing instance (formerly affected by the generation of the minority of results) is reintegrated into the technical process.

[0018] If the affected computing instance is reintegrated into the technical process, this means that it will again operate synchronously with the computing instances that were previously part of the process. In other words, the reintegrated computing instance generates the required results in such close temporal proximity to the other computing instances that all the results can once again be compared by the voter after reintegration into the process, as described above.

[0019] An advantage of the invention is that computing instances excluded from the technical process due to the voting process—in other words, those in quarantine—can be "repaired" using the inventive method and reintegrated into the technical process after synchronization. This advantageously means that the technical process can continue to operate even if errors occur repeatedly. The only requirement is that a majority of the redundant computing instances are still running without errors, as this ensures the operational reliability of the technical process.

[0020] The majority of the redundant computing instances can also be used to create the aforementioned state copy. This ensures that the state copy is error-free, which is guaranteed with a sufficiently high probability by the consistent results from the majority of the computing instances. After the state copy is transferred to the quarantined computing instance, it can catch up on the "missed" calculation steps by utilizing the stored messages until it is synchronized again and can then be reintegrated into the technical process. Now, enough redundant computing instances are available to exclude the faulty instance from the process in the event of the next error. Otherwise, more and more computing instances would fail one after the other until the technical process came to a standstill.Thus, the invention contributes to an increase in the stability of the technical process without compromising safety.

[0021] According to another aspect of the invention, a computer program product is described that includes program instructions for carrying out the method according to one of claims 1-11.

[0022] According to the invention, a computer program containing program modules is described with program commands, wherein the inventive method and / or its embodiments can be carried out by means of the computer program and the described advantages are achieved by means of the execution.

[0023] According to a further aspect of the invention, a provisioning device for the computer program product according to the last preceding claim is described, wherein the provisioning device stores and / or provides the computer program product.

[0024] Furthermore, a provisioning device for storing and / or providing the computer program in the form of a computer-readable storage medium is described. The provisioning device is, for example, a storage unit that stores and / or provides the computer program. Alternatively or additionally, the provisioning device is a network service, a computer system, a server system, in particular a distributed computer system, such as a cloud-based system or virtual computer system, which stores the computer program on a computer-readable storage medium and preferably provides it in the form of a data stream.

[0025] The provision of the computer program is in the form of program data sets as a file, in particular as a download file, or as a data stream, in particular as a download data stream. The computer program is transferred, for example, using the provisioning device, into a computing environment so that the method according to the invention can be executed in a computing instance of this computing environment.

[0026] A device is computer-aided or computer-implemented if it includes at least one computer or processor, or a method if at least one computer or processor performs at least one step of the method.

[0027] A computing environment is an IT infrastructure consisting of components such as processors, memory units, programs, and the data to be processed by these programs, which are used to execute at least one application that has a task to perform. The IT infrastructure can also consist of a network of these components.

[0028] A cloud (also known as a computing cloud or data cloud) is a computing environment for cloud computing. It refers to an IT infrastructure that is made available via network interfaces such as the internet. It typically includes storage space, computing power, or software as a service, without requiring these to be installed on a computing instance using the cloud. The services offered within the framework of cloud computing encompass the entire spectrum of information technology and include, among other things, IT infrastructure, platforms, software, and computing power. The cloud provider distributes the available resources to cloud users according to their needs, with the aim of optimizing resource utilization.

[0029] Since railway technology is subject to high safety standards regarding the functionality (operational reliability, safety) and vulnerability (transmission security, security) of computer-implemented solutions, the functionalities of a cloud used in railway technology are typically limited with respect to their shared availability. In particular, restrictions are therefore necessary regarding access by a potentially unlimited number of cloud users. Access must also be limited with regard to the sharing of computing resources among different computing instances, in order to ensure necessary redundancy. A technology that takes these restrictions into account for railway technology is also referred to as a private cloud in the context of this invention, even though a private cloud only partially fulfills the technical characteristics associated with cloud technology.

[0030] In any case, the features presented according to the invention fulfill the task of reliably enabling the distributed execution of application programs on distributed computing instances of commercial origin (so-called COTS components, COTS stands for Commercial off-the-shelf). This advantageously reduces or even eliminates the dependence on local conditions and proprietary computer systems. Process stability can advantageously be ensured independently of the system.

[0031] Computing instances (or simply instances) form functional units within a computing environment that can be assigned to applications (defined, for example, by a number of program modules) and can execute them. During application execution, these functional units form self-contained systems, either physically (e.g., computer, processor) and / or virtually (e.g., program module).

[0032] Computers are electronic devices with data processing capabilities. For example, computers can be clients, servers, handheld computers, communication devices, and other electronic devices for data processing, which may have processors and memory units and may also be connected to a network via interfaces.

[0033] Processors can be, for example, converters, sensors for generating measurement signals, or electronic circuits. A processor can be a central processing unit (CPU), a microprocessor, a microcontroller, or a digital signal processor, possibly in combination with a memory unit for storing program instructions and data. The term "processor" can also refer to a virtualized processor or a soft CPU.

[0034] Storage units can be designed as computer-readable storage in the form of random access memory (RAM) or data storage (hard drive or data carrier).

[0035] Program modules are individual software functional units that enable a program sequence of process steps according to the invention. These software functional units can be implemented in a single computer program or in several communicating computer programs. The interfaces implemented here can be implemented in software within a single processor or in hardware if multiple processors are used.

[0036] Interfaces can be implemented using hardware, for example via wired or wireless connections, or using software, for example as interaction between individual program modules of one or more computer programs.

[0037] Unless otherwise specified in the following description, the terms "create," "determine," "calculate," "generate," "configure," "modify," and the like primarily refer to processes that create and / or modify data and / or convert data into other data. The data is primarily in the form of physical quantities, such as electrical pulses or analog electrical quantities. The necessary instructions are summarized in a computer program, referred to as software. Furthermore, the terms "send," "receive," "read," "extract," "transmit," and the like refer to the interaction of individual hardware components, particularly processors, and / or software components, particularly program modules, via interfaces.

[0038] General embodiments of the invention and further developments of the invention are explained below without limiting the basic idea of ​​the invention.

[0039] According to one variant, the aspects of the invention explained above are determined by the fact that h) in the event that a majority of results of identical content cannot be determined in the voting, the multitude N of results is disregarded when carrying out the technical process, i) in the case according to h), the multitude N of computing instances is excluded from carrying out the technical process, j) the multitude N of computing instances is reinitialized, whereby the redundant execution of application programs is restarted.

[0040] This variant of the invention describes the case where all or at least the majority of computing instances in a team deliver different results. In this case, it is not possible to create a state copy that can be considered sufficiently reliable as being error-free. Instead, all computing instances in the team are reinitialized. Synchronization is therefore not possible, as there are no computing instances that continue running during the reinitialization and could serve as a reference for synchronization. Instead, after the reinitialization, which reliably eliminates the presence of errors in the application programs or the processed data sets, the computing instances are made available to the technical process for executing new tasks in the form of application program execution.

[0041] This variant of the invention has the advantage that the process can continue even if an entire team of computing instances fails. This naturally requires that multiple teams of computing instances are available, which can ensure the process continues "as a substitute" by executing the necessary application programs while the affected team is being reinitialized. During this time, at most, a slowdown in processing may occur, but the process will not come to a complete standstill. Furthermore, it is advantageous that the teams can provide sufficient computing capacity so that the technical process is not slowed down when one team fails, and the computing instances do not run at full capacity when all teams are available. As a result, the process's performance is advantageously improved in terms of stability and availability.

[0042] According to one variant, the aspects of the invention explained above are determined by the fact that the state copy is only created by a computing instance not affected by the new initialization once the case according to c) occurs.

[0043] The computing instance not affected by the new initialization is one that is part of a majority of computing instances that deliver identical results. In contrast, affected computing instances are always those that were excluded from participating in the technical process due to producing a different result (which represents a minority).

[0044] Using state copies created by a computing instance unaffected by the new initialization has the advantage that they can be created on demand. This demand only arises when a computing instance is excluded from the execution of the technical process due to a differing result. As long as a majority of the computing instances deliver identical results, it can be assumed that an error-free state copy can be created by these instances. Since this only occurs when needed, and only then do the subsequent messages and their sequence need to be stored, the required computing capacity is advantageously reduced to a minimum. As a result, the performance of the technical process increases with respect to computing capacity.

[0045] Alternatively, the state copy could be created cyclically by each computing instance. Each time a new state copy is created, the previous one, including any subsequently stored messages, is deleted. If a computing instance fails, a state copy already exists that can be reverted to. This approach has the advantage of preventing the computing instances from influencing each other by adopting a state copy from another instance. Furthermore, if a computing instance fails, the new initialization can begin immediately without having to wait for a state copy to be created. As a result, this improves the performance of the technical process in terms of the speed of the new initialization.

[0046] According to one variant, the aspects of the invention explained above are determined by the fact that the content of the results of the majority of computing instances from at least one preceding comparison step, preferably at least 10 preceding comparison steps, are stored and, when processing the messages according to step f) of claim 1, the calculated results are compared in at least one comparison step following this processing for synchronization with at least one of the aforementioned stored results.

[0047] The comparison step for synchronization is preferably performed by the same voter as the comparison of results according to step b) of the method according to the invention. Storing the results of the preceding comparison steps advantageously facilitates synchronization of the computing instances both during normal operation in step b) and when reintegrating a computing instance affected by an error in step f). A successful comparison by the voter is then also possible even if the results to be compared differ in time within the range of the stored results. In this context, the following will refer to a synchronization window within which synchronization succeeds even with a certain time offset in the generation of the results to be compared.In the event of the reintegration of an affected computing instance, this can advantageously take place earlier, since it does not have to completely catch up with the unaffected computing instances in order to be reintegrated.

[0048] The advantage of this approach is that the process runs more stably, since the synchronization of result generation by the application programs only needs to occur within the synchronization action window defined by the stored results. This allows for the reintegration of an affected computing instance after a shorter synchronization time.

[0049] According to one variant, the aspects of the invention explained above are determined by the fact that the at least one computing instance affected (by the generation of the minority of results) is reintegrated into the technical process when, in at least one subsequent comparison step, preferably in at least three successive subsequent comparison steps carried out in the order of the stored results, a correspondence between the respective stored result and the associated calculated result is established.

[0050] In the context of this invention, subsequent comparison steps are those comparison steps required for the reintegration of an affected computing instance according to step f). These do not differ in content from the comparison steps performed in step b) of the method according to the invention. They are only subsequent insofar as the new initialization of the affected computing instance creates a time delay. This delay can then be compensated for by subsequently processing those steps of the application program installed on the affected computing instance that were already processed by the unaffected computing instances.For this purpose, starting from the state copy in the affected computing instance, the stored messages are processed in the stored order until the affected computing instance has reached the synchronization window again with regard to the results to be compared.

[0051] To determine successful synchronization—that is, that the affected computing instance made no errors when subsequently processing the messages—at least a match with a stored result is required. However, it is advantageous to wait until three consecutive results match before reintegrating the data, which increases the certainty that the affected computing instance is operating synchronously without errors. This, in turn, improves system performance with regard to safety.

[0052] According to one variant, the aspects of the invention explained above are determined by the fact that the order of the messages is determined taking into account the time of sending the messages, wherein the order corresponds to the temporal sequence of sending.

[0053] In this case, the message sequence describes a determinism that allows interdependent work steps to be processed with the same results (as the unaffected computing instances). This is necessary to send intermediate results from preceding work steps as messages to subsequent work steps, or to receive messages required for processing work steps.

[0054] This variant of the invention thus has the advantage that not only parallel work steps that run independently of each other on a computing instance, but also sequential work steps that must be carried out in a specific temporal order, can be replicated using step F of the inventive method.

[0055] According to one variant, the aspects of the invention explained above are determined by the fact that the time of sending the messages is stored as a digital timestamp.

[0056] If a digital timestamp is available for the time the messages were sent, the order of the messages can be reliably determined at any time by analyzing the digital timestamp. It is particularly advantageous if the digital timestamp forms part of the message so that it can be uniquely assigned to the respective message. Furthermore, by reading the message in this way, the sending time can be determined at any time, allowing a large number of messages to be ordered chronologically.

[0057] According to one variant, the aspects of the invention explained above are determined by the fact that the state copy and the messages are sent and received via a message broker.

[0058] Message brokers advantageously handle the organization of sending and receiving messages, which affect the relevant technical processes as well as the processes of reintegrating excluded computing instances explained above.

[0059] According to one variant, the aspects of the invention explained above are determined by the fact that the news broker operates with a publish-subscribe method. Thus, a publish-subscribe system is used.

[0060] The publish-subscribe system includes at least one sending-side facility set up for publishing messages, at least one sending-side message broker, at least one receiving-side message broker, and at least one receiving-side application set up for receiving messages.

[0061] Publish-subscribe systems are known from other application areas and generally allow the decoupling of an information provider from an information receiver. Sending applications (i.e., application programs running on computing instances) are often referred to as "publishers," and receiving applications as "subscribers."

[0062] Implementing a publish-subscribe system means that sending and receiving applications do not need to be aware of each other. This means, in particular, that if another receiving application wants to receive messages or data from the sending application, the sending application does not need to be modified to also transmit the messages to that other receiving application.

[0063] For the method according to the invention, this means that computing instances excluded from the technical process can be easily replaced by other computing instances until they can be reintegrated into the process. The change of tasks between computing instances is ensured by subscribing to the necessary messages. Similarly, reintegrated computing instances can update their subscriptions to receive the latest messages. Even for the synchronization process prior to reintegration, the relevant older messages can be retrieved in the required order.

[0064] According to one variant, the aspects of the invention explained above are determined by the fact that k) the messages are contained in application data sets containing data sections, l) the voting is carried out with multiple identically modified redundant data sections as results (of the redundant execution of the application programs), m) in the case according to c) of claim 1, the application data sets which contain data sections that are causal for an error identification (i.e. form a minority of results that differs from the majority of the results) are disregarded in the execution of the technical process.

[0065] It is advantageous to store the messages in individual data sections of application data records. This allows for targeted addressing of, for example, the results of a redundant application program, in order to compare them in a voter as described above. Other data sections in the application data records can also be advantageously compared, as they likewise provide insights into the reliable functioning of the technical process (more on this below).

[0066] According to one variant, the aspects of the invention explained above are determined by the fact that a storage unit of the computing instances is operated in such a way that n) Application data records are stored in the storage unit and are encoded before storage, o) Application data records are retrieved from the storage unit and decoded after retrieval, wherein the storage unit is monitored for errors by performing a temporal sequence of computer-aided test runs for the storage unit, and wherein the new initialization of the affected computing instance according to step f) of claim 1 is only started when at least one, preferably two, successive test runs show that no errors are present.

[0067] Running a test is the minimum requirement to ensure that each application data record has been checked at least once before the affected computing instance is reinitialized. It is even safer to wait for two consecutive test runs, as it must be assumed that a test run is in progress when a computing instance fails. Since it is error-prone to determine at this stage which application data records have already been checked and therefore need to be checked in the next test run before the integrity of all application data records can be established, it is simpler to wait for the positive result of the first test run and then perform another complete test run.If this also produces a positive result, it is certain that each application data record has been checked at least once (partially twice), without having to check in detail which application data records had not yet been checked in the previous test run at the time of the failure of the computing instance.

[0068] In general, the method for operating the storage unit and executing application programs can be used to determine, by checking the data section containing data for the application programs and the test data section containing further criteria that facilitate verification, which data records are actually or at least potentially corrupt and therefore jeopardize operational reliability during the execution of the application programs, especially the user programs. The affected data records are marked by outputting an error and preferably subsequently excluded from data processing.

[0069] In this variant, operational reliability is, in other words, linked to the data sets themselves. For this purpose, these data sets are provided with suitable test data sections according to the invention. This advantageously allows the data sets to be stored on one and the same storage unit, even if processes run in parallel (redundantly) for operational reliability reasons. In particular, this allows commercially available software and hardware components, so-called COTS components, to be used for storing the data sets and for processing the application programs, without compromising operational reliability requirements. Such components can therefore also be used, for example, in railway technology applications and replace proprietary systems. COTS components are advantageously inexpensive to purchase and can also be easily replaced if necessary and integrated into cloud solutions.

[0070] According to one variant, the aspects of the invention explained above are determined by the fact that, in the event that an error is detected in one of the test runs, the procedure is carried out from step e) (regardless of whether case c) of claim 1 occurs.

[0071] It is advantageous to correct errors in the application data records as soon as they are noticed. These errors can potentially lead to errors in processing the application data records (especially those of the application programs), which poses a security risk to the operation of the technical process. However, the process of re-initialization also affects the stored application data records that are copied from an intact (unaffected) computing instance when the state copy is created.

[0072] According to one variant, the aspects of the invention explained above are determined by the fact thatthat for the initial encoding (COD) of the data, p) at least one application data record (ADS) containing data sections with application data for at least one of the application programs and test data sections (PA) is created or selected, q) for each application data record (ADS), the test data section (PA) is populated with count data (ZD) that identifies the test run currently in progress, r) each application data record (ADS) is encoded and stored, and that, for checking the data in the test run currently in progress, after retrieving and decoding (DEC) the application data records (ADS), s) for each application data record (ADS), an error is detected if the count data (ZD) does not identify either the test run currently in progress or the most recently completed test run, t) the test data section (PA) of the relevant application data section is populated with count data (ZD).which indicate the test run currently in progress, are recorded if no error was detected, u) the relevant application data record (ADS) is recoded and stored if no error was detected.

[0073] By assigning a test data section (which was previously created if no test data section existed, or selected if one already existed for the data section in question) to each data segment during initial encoding, counter data containing information about the running test can be stored in the respective data record. The subsequent encoding of the data record protects the counter data, as well as the other data within the data segment, from unauthorized access until decoding. In its encoded state, the data cannot be accidentally (e.g., due to a malfunction) or intentionally (e.g., through an external attack) altered without any such change being detected as an error during decoding.At least it is extremely unlikely that the change would go unnoticed as an error when the data set is decoded. Therefore, there is no protection against changes per se, but only against undetected changes. By cyclically checking the memory contents for correct encoding (using the counter data), so-called dormant errors are also detected. These are errors that can occur during data storage, for example, due to physical changes in the storage medium (bit flips, etc.). According to this approach, the low probability of failing to detect errors makes it possible to achieve higher security levels (SEL-1 ... SIL-4).

[0074] Preferably, all data required by the application program is protected in the data set, i.e., both the data that constitute the program itself and the data that represents information to be processed.

[0075] For example, it is possible that the count data may be altered due to storage errors, i.e., errors that occur during data storage on a storage unit (such as bit flips), or due to processing errors, i.e., errors that occur during the processing of the data set. Such an alteration will then be detected during the next check run, when the count data no longer identifies either the current check run or the most recently completed check run. In such a case, an error is detected. Even if its cause cannot be definitively determined and might be harmless to data processing, for reasons of maintaining the required level of security, once the error is detected, it is, for example, reported and / or measures are taken to prevent further processing of the erroneous data.

[0076] These errors are also detected during voting, so the affected computing instance is excluded according to the procedure described above. Afterwards, a re-initialization process is performed, in which, in this described variant, one or even two consecutive test runs are awaited before the initialization begins. This also reliably corrects any memory errors that occur. The redundantly stored data sets of other computing instances are available for this purpose.

[0077] Whenever no error is detected during a test run, the count data in the test data section is populated with the count data from the test run currently in progress, the data record is coded, and stored again. This simultaneously marks the data record in question as having been checked in the respective test run.

[0078] Count data must have the property of forming a series in which the predecessor and successor of each element in the count data set are known. In principle, all mathematical series can be used. The set of natural numbers is particularly preferred.

[0079] To perform the test run, an application program (utility program) is preferably used. For this purpose, the application program, which can also be called the test program, accesses the storage unit, decodes, checks, and encodes data records one by one until a complete test run has been performed. If an error is detected, it can be output by the test program. The test program can also include functions that react to a detected error, for example, suspending the execution of an application program (utility program) on the affected computing instance that uses the erroneous data sections of the application (also called application data sections) and could therefore potentially cause safety-relevant errors.This advantageously reveals additional sources of error, even if they are not directly related to the redundant processing of the data itself.

[0080] The execution of the test run can be controlled, for example, by addressing the individual data records. If the addresses of all data records are known at the beginning of the test run, the data records can be accessed sequentially until the test run is complete (more on this below).

[0081] If a test run is executed incorrectly in the entirety, meaning it fails to check all data records, this will be detected at the latest during the next test run, provided that the unchecked records are checked again in the subsequent run. These records will then still contain the count data from the penultimate test run, which will be noticed during the following run. This will trigger the detection and reporting of an error. The count data therefore also enables monitoring of the proper execution of the test runs themselves. This identifies another potential source of error. Data classified as outdated and thus potentially erroneous (because it is not regularly checked in a test run) is not sufficiently secure with regard to its integrity, which is why it is considered an error.

[0082] This creates an additional safety mechanism that enhances the operation of the storage unit and the execution of application programs (these are utility programs or user programs; more on this below). Safety-relevant applications, such as railway applications, which require certain safety levels (also known as safety integrity levels, SIL-1) as a condition for approval, particularly benefit from this enhancement. ...must meet SIL-4 (or Safety Integrity Level). As mentioned, the term "safety" within the scope of this invention is to be understood in the sense of operational safety. In particular, the encoding is primarily based on operational safety considerations and not on transmission security considerations. Therefore, this variant of the invention preferably employs an encoding method that achieves high performance during both encoding and decoding (resulting in short encoding and decoding times) and does not guarantee a high degree of difficulty in decoding the code without authorization.

[0083] Furthermore, according to another aspect of the invention, a computer program containing program modules with program commands for carrying out the said method according to the invention and / or its embodiments is described, wherein the method according to the invention and / or its embodiments can be carried out by means of the computer program.

[0084] Furthermore, according to another aspect of the invention, a provisioning device for storing and / or providing the computer program is described. The provisioning device is, for example, a storage unit that stores and / or provides the computer program. Alternatively and / or additionally, the provisioning device is, for example, a network service, a computer system, a server system, in particular a distributed, for example cloud-based, computer system and / or virtual computer system, which preferably stores and / or provides the computer program in the form of a data stream.

[0085] The provision of the computer program is in the form of a program data set as a file, in particular as a download file, or as a data stream, in particular as a download data stream. This provision can, for example, also take the form of a partial download consisting of several parts. Such a computer program is transferred to a computing environment, for example, using the provisioning device, so that the method according to the invention can be executed in a computing instance.

[0086] Exemplary embodiments of the drawing. Further details of the invention are described below with reference to the drawing. Identical or corresponding drawing elements are provided with the same reference numerals in the individual figures and are only explained more than once to the extent that differences arise between the individual figures.

[0087] The exemplary embodiments described below are preferred embodiments of the invention. In these exemplary embodiments, the described components each represent individual variants of the invention, which can be considered independently of one another. Each of these variants further develops the invention independently and can therefore be regarded as part of the invention individually or in a combination other than that shown. Furthermore, the described components can also be combined with the variants of the invention described above.

[0088] Figure 1 schematically shows a railway application with a computing environment and its interrelationships, wherein an embodiment of the inventive method can be carried out with the computing environment. Figure 2(consisting of partial figures 2A and 2B, distributed over two pages) shows an embodiment of the method according to the invention using a computing environment in railway applications according to Figure 1 with two host computers as a block diagram, wherein the individual functional units contain program modules that make up application programs and can each run in one or more processors, and the interfaces can accordingly be implemented in software or hardware,

[0089] Figure 3 and 4 The diagram shows exemplary embodiments of the method according to the invention as a flowchart, wherein the individual process steps can be implemented individually or in groups by program modules, and wherein the functional units and interfaces are shown according to Figure 2 are indicated by example.

[0090] Figure 5An embodiment of the method according to the invention is shown as a flowchart, wherein the process steps shown can be implemented individually or in groups by program modules, and wherein the computing instances and interfaces are defined according to Figure 2 are indicated by example.

[0091] Regardless of the grammatical gender of terms, persons with male, female or other gender identities are equally included. Detailed description of the drawing

[0092] In Figure 1The diagram schematically depicts a railway application controlled by a computing environment RU. The railway application features tracks GL, on which various components of the interlocking system STW are shown as examples. These include a point motor WA, which can operate a point WH. Furthermore, a balise BL is installed in one of the tracks GL, enabling the exchange of information with trains passing over it. Finally, a light signal LS, controlled by a controller CL, is shown.

[0093] The computing environment RU can have several host computers: a first host computer HR1, a second host computer HR2, and a third host computer HR3. Applications for controlling the railway application, in the form of application programs AP1 to AP5 (more on these below), are distributed across these host computers. The first host computer HR1 is provided by a data center (RZ) and is connected to a first storage unit SE1 via a first interface S1. The data center (RZ) can be operated, for example, by a service provider of the railway operator or by the railway operator itself. A second interface S2 connects the first host computer HR1 to a private cloud (CLD), thus making it geographically independent of the railway application. The cloud (CLD) can be a private cloud, meaning one where access is restricted to authorized users.

[0094] A control center (LZ) of the railway operator houses the second host computer (HR2), which is also connected to the cloud (CLD) via a third interface (S3). Furthermore, the second host computer (HR2) is connected to a second storage unit (SE2) via a fourth interface (S4).

[0095] The computer environment RU also includes, as an example, a signal box STW, which houses the third host computer HR3. HR3 is connected to a third storage unit SE3 via a sixth interface S6. Furthermore, the third host computer HR3 has a fifth interface S5 to the second host computer HR2. HR3 could also be connected to the cloud CLD, though this connection is not shown. The third host computer HR3 also has a seventh interface S7 to the point motor WA, an eighth interface S8 to the controller CL, and a ninth interface S9 to the balise BL.

[0096] All interfaces S1 ... S9 according to Figure 1These connections are generally wired or can be implemented using wireless transmission technology, such as radio. The arrangement of the host computers HR1 ... HR3 is merely an example and can be expanded as needed for more complex railway systems. A computing environment is defined by the ability of the participating host computers HR1 ... HR3 to communicate with each other, allowing applications to be processed across the host computers HR1 ... HR3, taking into account available computing resources. For this purpose, computing instances are created, which are not shown in detail below (see below). Figure 2 where the computing instances RP1 ... RPn are represented).

[0097] Figure 2 represents the configuration of the first host computer HR1 and the second host computer HR2 according to Figure 1This is an example. The integration of additional host computers can be done analogously. The host computers are organized so that specific task complexes are organized on the host computers in the form of program complexes PK1 ... PK4, which consist of individual application programs AP1 ... AP5. A first application program AP1, a second application program AP2, a third application program AP3, and a fourth application program AP4 are used for processing railway applications, as in Figure 1 They are presented, planned, and are therefore utility programs.

[0098] Program complexes PK1 ... PK4 generally group together a number of application programs AP1 ... AP5, whose joint execution can be summarized with regard to the entirety of applications. In particular, it can be provided that all application programs AP1 ... AP5 contained in a data set are grouped into a program complex. This takes into account the fact that the data set, with respect to the data to be applied, results in a grouping of data sections DA, while in parallel, a program complex groups together the corresponding application programs AP1 ... AP5 to which the data sections DA are assigned.

[0099] Configuration data KD1 ... KD13 refers to data that configures application programs AP1 ... AP5 for the specific requirements of the current use case. The configuration defines the interaction between the various application programs AP1 ... AP5 and their function on the hardware components where they are installed. Furthermore, the configuration includes adjustments specific to the use case for which the respective application program is intended (for example, parameters that may differ between various use cases).

[0100] Using a fifth application program AP5 as an example, it is also shown that this can be implemented by individual subprograms TG, VT, GW, and MB. The subprograms TG, VT, GW, and MB of the fifth application program AP5 are a gateway GW, a voter VT, a clock generator TG, and a message broker MB (more on this below). However, this is only to be understood as an example of how the voter VT used according to the invention can be implemented in software and integrated into a functional environment. Alternatively, for example, the clock generator TG could run in a different (non-safety-critical) application, while the remaining subprograms TG, VT, GW, and MB run as described in the (safety-critical) fifth application program AP5.

[0101] For the purposes of this invention, subprograms TG, VT, GW, MB are generally understood to be smaller units such as program modules, the entirety of which constitutes the application program. Thus, it is advantageously possible to structure application programs AP1 ... AP5 modularly. dh For example, program modules can be provided that are used in several application programs AP1 ... AP5. The subprograms TG, VT, GW, MB can be configured with different configuration data KD1 ... KD13, depending on their use. Subprograms TG, VT, GW, MB thus make it easier to create application programs AP1 ... AP5 and therefore to adapt the computing environment more easily to a specific use case.

[0102] In connection with the creation of program complexes PK1 ... PK4, application programs AP1 ... AP5, and subprograms TG, VT, GW, MB, it should be noted that configuration data KD1 ... KD13 can be assigned to each of the program complexes PK1 ... PK4, the application programs AP1 ... AP5, and the subprograms TG, VT, GW, MB. This can result in certain data with the same content being stored multiple times, each instance forming data segments DA that can be uniquely assigned to a specific program complex, application program AP1 ... AP5, or subprogram TG, VT, GW, MB. The ability to assign this unique data is crucial for implementing test functions, particularly for the storage units, by providing uniquely addressable data segments DA (see the diversity characteristics DD1 ... DD4 described below).

[0103] The fifth application program, AP5, is organized identically in all program complexes PK1 ... PK4. Messages can be exchanged with the private cloud CLD via the gateway GW. Therefore, the gateway GW forms the second interface S2 and the third interface according to... Figure 1 Messages are distributed within the program complex via the Message Broker (MB), preferably using the publish-subscribe method. For example, the Gateway (GW) uses a fifteenth interface, S15, to make received messages available to redundant computing instances RP1 ... RPn via the Message Broker (MB). These messages are then retrieved by the redundant computing instances RP1 ... RPn. This is indicated by nodes (KN) in the fifteenth interface, S15 (and also in the other interfaces S10 ... S14, which will be described below).

[0104] In Figure 2For clarity, the program complexes PK1 ... PK4 are each implemented entirely on a single host computer HR1 ... HR2. In reality, program complexes PK1 ... PK4, with their application programs AP1 ... AP5 and their subprograms TG, VT, GW, MB, can also run distributed across multiple host computers (not shown). This allows for the advantageous use of host computer resources when they do not provide sufficient capacity for configuring an entire program complex, by sharing the resources of several host computers for the program complex in question.

[0105] The program complexes PK1 ... PK4 can be designated for a specific set of tasks. For example, one program complex might be used to control a particular railway component (light signal LS, interlocking STW, switch WH, balise BL, axle counter, etc.). Controlling this railway component generally requires several application programs AP1 ... AP5. In particular, the fifth application program AP5, already explained above, is also needed to ensure the reliable execution of the application and communication with other program complexes PK1 ... PK4 or host computers. This program is considered a utility program that serves to safeguard the host computer's functionality and thus executes an application related to the host computer (in contrast to the application programs AP1 ... AP5, which process user data for railway components and are therefore referred to as user programs).The fifth application program AP5 also runs in at least one computing instance RP9... RP12 per host computer, but preferably not redundantly.

[0106] A multitude of redundant computing instances within the meaning of the invention is understood to be a software implementation on the host computers HR1 ... HR3, which allows parallel, i.e., simultaneous, processing of application programs AP1 ... AP5, preferably within the respective program complex. Figure 2The diagram shows program complexes PK1 ... PK4, each with three redundant computing instances (for example, RP1, RP2, and RP3) to form a redundant 2oo3 system. However, more redundant computing instances RP1 ... RPn are also conceivable, as illustrated by the first program complex PK1. The following explains the procedure for processing the application programs AP1 ... AP5 using the first program complex PK1 ... PK4 as an example. This procedure focuses on the first redundant computing instance RP1, the second redundant computing instance RP2, and the third redundant computing instance RP3 for processing the first application program AP1. The processing for program complexes PK1 ... PK4 proceeds analogously and therefore does not require further explanation.

[0107] In the first redundant computing instance RP1 through the third redundant computing instance RP3, the first application program AP1 is executed redundantly, i.e., simultaneously and in parallel. This is an application program that performs a task for the railway application according to Figure 1 From the first redundant computing instance RP1 to the third redundant computing instance RP2, initial configuration data KD1 is also available, which is required for executing the first application program AP1 to process the individual task of the railway application. For example, the first application program AP1 can generally be used to control light signals LS, whereby the initial configuration data KD1 defines the application of the first application program AP1 to the light signal LS according to Figure 1 This requires, for example, communication with the CL controller according to Figure 1 be ensured.

[0108] Configuration data KD1 ... KD13 is also available for all other program complexes PK1 ... PK4, application programs AP1 ... AP5, and subprograms TG, VT, GW, MB. Accordingly, the configuration data KD1 ... KD13 contains the data required for each of these program complexes (PK1 ... PK4, application programs AP1 ... AP5, and subprograms TG, VT, GW, MB) to perform their assigned tasks in the respective application. The configuration data KD1 ... KD13 is immutable and can therefore be stored in a data section (DA) with a known start and end. Likewise, all program complexes (PK1 ... PK4, application programs AP1 ... AP5, and subprograms TG, VT, GW, MB) are stored as data sections (DA) with a known start and end. For this purpose, the first storage unit (SE1), the second storage unit (SE2), and the third storage unit (SE3) are available, for example. Figure 1available. Data stored in one of the aforementioned storage units, or which remains stored in one of the aforementioned storage units for a certain period of time, is subject to regular checks that can detect storage errors in the stored data (more on this below). Storage errors are defined as errors that occur in the data during storage or retrieval, or that arise while the data is stored in the storage unit.

[0109] Data that changes during program execution is exchanged between the participating partners as messages. As mentioned previously, the Message Broker MB is available for this purpose. Furthermore, the individual host computers HR1 and HR2 communicate with each other via external interfaces S2 and S3, for example, using the private cloud CLD, so that data can also be exchanged between different program sets PK1 to PK4 on different host computers. After the data is changed, it is stored again in the first storage unit SE1, the second storage unit SE2, or the third storage unit SE3. Errors can also occur during data processing; these are more precisely referred to as processing errors within the scope of this invention.

[0110] The processes in the railway application according to Figure 1These are safety-relevant for the operational safety of the railway application. This is why the first application program AP1 is executed in parallel, i.e., redundantly, in the first redundant computing instance RP1 up to the third redundant computing instance RP3. The first redundant computing instance RP1, the second redundant computing instance RP2, and the third computing instance RP3 send the result of the execution of the first application program AP1 to the message broker MB. Specifically, the first redundant computing instance RP1 sends the result via an eleventh interface S11, the second redundant computing instance via a twelfth interface S12, and the third redundant computing instance via a thirteenth interface S13. These results are retrieved via the aforementioned interfaces by the voter VT, which performs a voting procedure VTG. Only if the majority of the results agree (i.e.,With three redundant computing instances in the 2003 system, at least two results are generated; with four redundant computing instances, at least three results are generated; ... with n redundant computing instances, at least n / 2+1 for even and n / 2+0.5 for odd n), the result is made available to the Message Broker MB via a fourteenth interface S14 and can be retrieved by the Gateway GW via the fourteenth interface S14 for transmission to other units via the second interface S2.

[0111] To ensure that the calculation results for the voting process (VTG) are simultaneously available to the voter (VT), the processes in the first redundant computing instance (RP1), the second redundant computing instance (RP2), and the third redundant computing instance (RP3) are clocked via the clock generator (TG). This generator provides clock signals via a tenth interface (S10), which can also be retrieved by the first redundant computing instance (RP1) and the second redundant computing instance (RP2) via the message broker (MB).

[0112] The described method of task processing by the first application program AP1 is ensured by the fifth application program AP5. The fifth application program AP5 is therefore an internal application program that supports the functionality of the host computers HR1 ... HR3 and is thus a utility program. This makes it clear that application programs AP1 ... AP5 are not only for the application of the railway application according to Figure 1 (Utilities), but must also be provided for the processing of applications for the host computers HR1 ... HR3 (utilities).

[0113] The grouping of application programs AP1 ... AP5 into program complexes PK1 ... PK4, as well as the subdivision of application programs AP1 ... AP5 into subprograms TG, VT, GW, MB, facilitates the compilation of application programs AP1 ... AP5 and the verification of task execution for errors. For this purpose, data is grouped into data sections DA, each of which can be uniquely identified and addressed (by defining a start and end point for data section DA). As already mentioned, data sections DA contain subprograms TG, VT, GW, MB, application programs AP1 ... AP5, program complexes PK1 ... PK4, and their respective configuration data KD1 ... KD13 (which typically consist of numerous data sections DA).

[0114] In addition to the redundancy already described during processing, redundancy in data storage can also be advantageously implemented. Here, the required data is preferably stored multiple times using so-called diversity identifiers DD1 ... DD4 to mark the respective redundant storage, so that the data sections DA and configuration files can be uniquely assigned. In other words, in this case, different application programs AP1 ... AP5 will not encounter problems if they use identical configuration data KD1. ... KD13 does not access the same storage location for this data, but always the respective data section DA assigned to it, in which the data is available. As already described, the data is also preferably stored in coded form.

[0115] In Figure 3The process step of initial data encoding is schematically depicted during the execution of the technical process. In this process, new data (work results) are repeatedly generated, each of which is to be encoded before being stored. This is illustrated for a computing environment, for example, consisting of the first host computer HR1, the first storage unit SE1, and the second storage unit SE2. In principle, the first host computer HR1 can access data stored in the first storage unit SE1 and the second storage unit SE2. This access can involve both reading (RE) and writing (WT), as indicated by the corresponding arrows.

[0116] For example, application data for applications AP1 ... AP5 can be stored in the storage units SE1, SE2 (see below). Figure 2) for executing application programs AP1 ... AP5. Furthermore, it is possible to store count data ZD as well as a set VR of diversity characteristics DD1 ... DD4 (i.e., first diversity characteristic DD1, second diversity characteristic DD2, third diversity characteristic DD3, and fourth diversity characteristic DD4). In order to use the application data AD for applications within the meaning of the invention, i.e., to carry out a method for the computer-aided execution of an application program for carrying out the technical process in the manner according to the invention, the application data AD must be stored in the form of application data sets ADS, which are created using the method according to Figure 3 created and stored as COD coded after a coding process.

[0117] In Figure 3This is merely an example showing how the application data AD, the count data ZD, and the diversity characteristics DD1 ... DD4 occupy individual memory areas of the first storage unit SE1 and the second storage unit SE2. In principle, it is arbitrary where the corresponding data is stored; it is located through appropriate addressing, and there are no restrictions on which application data record ADS is stored where in the storage units SE1 and SE2.

[0118] Furthermore, the diversity of the diversity parameters DD1 ... DD4 is indicated by hatching, which is intended to clarify that application data records (ADS) can be identified by the diversity parameters DD1 ... DD4 from the VR repository. As shown in the VR repository, a longitudinal hatch, a transverse hatch, and two diagonal hatches, which are at a 90° angle to each other, are available. The in Figure 3The application data set ADS shown in detail, for example, has the hatching that indicates the first diversity characteristics DD1.

[0119] As the enlarged application data set ADS shows, it consists of a data section DA for the application data AD and a check data section PA, which contains the first diversity characteristics DD1, a counter element in the count data ZD, and redundancy data RD. The first diversity characteristics DD1, the count data ZD, the redundancy data RD (which is populated with a start value), and the application data AD are combined and stored in the first host computer HR1, for example, in a write operation WT in a working memory (not shown), to form the application data set ADS. Subsequently, the application data set ADS is encoded in an encoding operation COD and transferred to the first storage unit SE1, where the diversity, based on the first diversity characteristics DD1, is also indicated in the first storage unit SE1 by the aforementioned hatching. There, the application data set ADS is available for further retrieval (see Figure 4) available.

[0120] In Figure 4 The use of the application data set ADS according to Figure 3 and further application data sets ADS with the second diversity characteristics DD2 and the third diversity characteristics DD3 are schematically represented. The three application data sets ADS shown are intended to contain identical application data AD in order to enable the parallel processing according to the invention in a group GR of computing instances RP1, RP2, RP3 with the subsequent voting VTG (these form a 2oo3 system). The test data section PA is in each case populated with the respective different diversity characteristics DD1 ... DD4. The count data ZD and the redundancy data RD can also differ from one another.

[0121] The application data records (ADS) are executed in the three computing instances RP1, RP2, and RP3. For this purpose, the application data records (ADS) are read into each computing instance in a read operation (RE). Each computing instance (RP1, RP2, and RP3) is assigned a specific diversity, which is represented by hatching. This hatching corresponds to the diversity characteristics DD1 to DD4 of the VR database.

[0122] It can also be seen that a computing instance RPn can process data from two diversities, in this case the application datasets ADS labeled with the third diversity characteristic DD3 and the fourth diversity characteristic DD4. This allows for optimal utilization of the computing capacity available to the computing instance RPN.

[0123] The computing instances RP1, RP2, and RP3 each read the application data records (ADS) of the correct diversity. This is achieved by background utilities, ensuring that the computing instances RP1, RP2, and RP3 automatically address the correct application data records (ADS). This is for the application data record (ADS) according to Figure 3 The first diversity indicators DD1 are presented in more detail and will be explained in more detail below.

[0124] When this application data record (ADS) is retrieved, it is first decoded in a decoding process (DEC) before being read (RE). Decoding allows the initial diversity identifiers (DD1), the current count data (ZD), and the redundancy data (RD) to be read along with the application data (AD), enabling the application of utilities that detect any memory errors. It can be verified whether the initial diversity identifiers (DD1) originate from the repository (VR) and / or match the diversity of the first computing instance (RP1). The count data (ZD) can be used to verify the proper execution of check runs, as it must identify the current or previously completed check run. Only if the check confirms that the data contains no memory errors are they released for reading (RE) and processed by the first computing instance (RP1). This applies to both the data in Figure 4The parallel processing of the application data set ADS by application programs AP1 ... AP5 in the computing instances RP1, RP2, RP3 (regular operation of a 3oo2 system) as well as for the new initialization of the computing instance RPn (repair operation), which is carried out in parallel to the regular operation (more on this below).

[0125] After processing the application data record ADS, the first processing instance RP1 writes it back to the first storage unit SE1. Here, a check of the test data section PA, the first diversity indicator DD1, the count data ZD, and the redundancy data RD can be performed to identify any processing errors in the processing of the application data record ADS (a detected error leads to the exclusion of the affected processing instance and its reinitialization, with the remaining processing instances forming a 2oo2 system). Furthermore, the count data ZD is equated with the counter element that identifies the currently running test run. Subsequently, the application data record ADS is encoded (COD) and written to the first storage unit SE1 (WT).

[0126] This procedure, although not shown in detail, is also performed for the other application data records (ADS) in the computing instances RP2 and RP3 (normal operation) and, during the subsequent processing of messages stored as application data records (ADS) in the stored order, also by the computing instance RPn (repair operation). After successful processing of the application data records (ADS), a voting check (VTG) is additionally performed for the application data records (ADS) to determine that the application data records (ADS) have been identically modified by the processing by the computing instances RP1, RP2, and RP3. If this is not the case, it indicates a processing error in normal operation.With three (or four) computing instances, application data (AD) that is mostly identical can be used for further processing, while application data that differs from this can be blocked from further processing. If only two computing instances are available in normal operation as a 2oo2 system for the VTG voting process, normal operation must be stopped if another error occurs in one of the two computing instances. All computing instances RP1, RP2, RP3, and RP4 must then be initialized. However, no state copy is created, and no messages are saved because all computing instances have been excluded from executing the technical process in normal operation.

[0127] The processing of messages stored as application data records (ADS) during repair mode occurs in parallel with the processing of the application data records (ADS) of the computing instances RP1, RP2, and RP3, as described above. Therefore, the currently modified application data record (ADS) of computing instance RPn can also be considered in the aforementioned voting process (VTG). As soon as a match is found between the modified application data records (ADS) of all computing instances RP1, RP2, RP3, and RPn within the synchronization window already explained above, computing instance RPn can be reintegrated into regular operation to carry out the technical process, so that it works in parallel with computing instances RP1, RP2, and RP3 (which together then form a 3oo4 system).

[0128] Based on Figure 5This document outlines a possible process flow for the computer-aided operation of a storage unit and the parallel execution of an application program with subsequent voting (VTG). Before starting the process, an initialization step (Step 1, or INI) is performed, enabling proper memory access to a storage unit not shown. After starting the process (Step 2), the following steps are shown: performing test runs of the storage unit (top right and top center), executing application programs AP1 to AP5 in normal operation (left side), and performing a repair operation (bottom right). These steps can be executed individually, sequentially, or preferably in parallel, and are therefore represented in a single flowchart.

[0129] First, the procedure for performing the test run will be explained. In a definition step for the count data ZD (step 3, abbreviated DTM_ZD), a starting value for the count data ZD is defined. This count data ZD is then made available, if needed, to the procedure for executing an application program (left side) via an input step for count data ZD (step 35, abbreviated ZD_IN) in an output step for count data ZD (step 4, abbreviated ZD_OT).

[0130] The actual test run consists of repetitive procedures that are performed for all application data records (ADS) stored in the storage unit (in Figure 5(shown on the right). For each application data record ADS with the current counter elements of the counter data ZD, the following is performed: In a decoding step for the application data record ADS (step 6, abbreviated DEC_ADS), the application data record ADS is decoded. In a check step for the counter data ZD (step 7, abbreviated TST_ZD), it is checked whether the counter element corresponds to the currently running check or the last check. In a check run for the diversity characteristics DD1 ... DD4 (step 8, abbreviated TST_DD), it is checked whether the application data record ADS has diversity characteristics DD1 ... DD4 that are within the available pool VR of diversity characteristics DD1 ... DD4 (see...). Figure 3 and 4 ). In a check step for the redundancy data RD (step 9, abbreviated TST_RD), it is checked whether the redundancy data RD has an expected value, in particular a default value (optional).

[0131] Once all test steps have been completed, a query step for deviations (step 10, abbreviated DVG?) checks whether any of the test steps, as described above, have produced deviations from the expected result. If so, an error is output in an output step for errors (step 11, abbreviated ER_OT) (more on this below). If not, the tested application data record ADS is recoded in a coding step for the application data record ADS (step 12, abbreviated COD_ADS), always being coded in the count data ZD with the counter element of the current test run.Once the test run for all application data records (ADS) has been performed, they will contain the current counter element in the counter data (ZD), and the counter data (ZD) can be updated in an update step for the counter data (step 13, abbreviated UPD_ZD) for the executing utility so that they now contain the counter element of the test run that is subsequently started.

[0132] In the procedure for computer-aided execution of an application program (left side in Figure 5Following the previously mentioned input step 5 for the count data ZD, the decoding step for the relevant application data record ADS (step 14, abbreviated DEC_ADS) is repeated for all required application data records ADS of the application executed by the application program. Subsequently, as already described for the test run, a test step for the count data ZD (step 15, abbreviated TST_ZD), a test step for the diversity characteristics DD1 ... DD4 (step 16, abbreviated TSD_DD), and a test step for the redundancy data RD (step 17, abbreviated TSD_RD, optional) are performed.

[0133] The special feature is that the application runs on three unspecified computing instances RP1, RP2, RP3 (compare the computing instances in the first program complex PK1 in Figure 2The process is carried out with varying levels of diversity in each instance, so that the diversity parameters DD1 ... DD4 checked in the test step for diversity parameters DD1 ... DD4 (step 18, abbreviated TSD_DT) must correspond exactly to the respective diversity of the relevant computing instance on which the application program is to be executed. For the sake of clarity, the subsequent steps, which are performed equally and preferably in parallel in the three computing instances RP1, RP2, and PR3 (more on sequential execution below), are therefore shown overlapping.

[0134] During the execution of the application program, for each required application data record (ADS), check step 18 for deviations (DVG?) is performed in each of the three computing instances RP1, RP2, and RP3 to determine whether the check steps (TST...) have identified deviations from the expected content of the application data records (ADS). If so, an error (ERR_OT) is displayed in output step 11, as previously explained. Otherwise, the check of the application data records (ADS) continues until all application data records (ADS) required for the application program have been checked. Only under this condition is the application program executed in parallel with the other two (error-free) computing instances in the relevant of the three computing instances (RP1, RP2, and RP3) during an execution step (step 19, abbreviated RUN_APP).

[0135] The verification of the application data records (ADS) can preferably be performed stepwise for the application program for each message generated as a result (which is also contained in new or modified application data records ADS) (in Figure 5 (not shown in detail). This means that the execution of the application program is divided into execution steps. In this sense, all application data records (ADS) required for and generated by the application program must be checked, each of which is necessary for the next step to be performed by the application program. In execution step 19 for the application program RUN_APP, the respective step of the application program is then executed. For each application program, this results in... Figure 5several recursion loops, which, after the coding step for the application data set ADS (step 20, or COD_ADS for short, on the left side of the following, are described below), Figure 5 ) leads back to the input step of the count data ZD.

[0136] The execution step is completed by a voting VTG (step 28), in which messages generated in parallel by the three computing instances are compared. These messages must be identical at least with respect to the application data AD in the data section DA. If the voting VTG is positive, i.e., the majority of the messages are the same, this majority (i.e., two or three of the three results of the VTG) is then applied. Figure 5 (as shown in the 2oo3 system) for the next step NW_ADS? (su) released.

[0137] After the execution step for the application program RUN_APP, a check is performed to determine whether the application data records ADS existing after the program's execution are new application data records ADS. This check (query step 21 for new application data record ADS, abbreviated NW_ADS?) is necessary so that test data can be assigned to new application data records ADS in a definition step for a test data section PA (step 22, abbreviated DTM_PA). This test data enables a subsequent test TST... of the new application data record ADS in the further steps of the presented procedure. In any case, the new application data record ADS, as well as the old and modified application data records ADS, are re-encoded in coding step 20 for application data records ADS COD_ADS and stored in the memory unit.Subsequently, another application program or, as described above, another step of a running application program can be carried out (repetition of ZD_IN, input step for count data ZD and the following steps).

[0138] Execution step 19 for the application program RUN_APP can also produce results which (preferably via the message broker MB, see below) Figure 2 ) should be displayed as messages. Before this happens, optionally, shown in the middle of Figure 5A test procedure is also performed. This involves the steps already described: the check step for the count data ZD (step 23, abbreviated TSD_ZD), the check step for the diversity characteristics DD1 ... DD4 (step 24, abbreviated TSD_DD), and (optionally) the check step for the redundancy data RD (step 25, abbreviated TSD_RD). In a subsequent query step for deviations (step 26, abbreviated DVG?), it is checked again whether deviations were detected in the check steps. If so, an error signal is generated in output step 11 for error ERR_OT, as already described. Otherwise, the result is output in an output step for the result (step 27, abbreviated OT_RS) and / or in further steps (for example, in another program section according to Figure 2 ) further processed.

[0139] In the event that an error is output in output step 11 for error ERR_OT, the following will be done in the example according to Figure 5 The repair process has been initiated for the affected computing instance. This will be explained in more detail below.

[0140] If, during the VTG voting (step 28), not all messages are rated as equal, but a majority of the messages are identical (in a 2oo3 system, this means two out of three messages), then the repair process is initiated only with the message that differs from the two identical messages. If no majority of identical messages can be determined (in a 2oo3 system, this means three different messages are present), then the repair process is initiated for all messages. In either case, the output step for error ERR_OT is performed. In a subsequent query step (step 29, abbreviated ALL_RP?), it is checked whether all messages are designated for the repair process. If so, the execution of the application program is stopped (step 30, abbreviated STOP), and all involved computing instances are reinitialized before being restarted.

[0141] In the event that the majority of the messages were identical, the procedure described above for processing the application program (left side of) is executed. Figure 5 ) continues, while the repair operation is started in parallel (bottom right of Figure 5 ). In the example according to Figure 5 Thus, in normal operation, the application programs AP1 ... AP5 are processed using two computing instances, while repair operation is initiated for one computing instance.

[0142] For the accompanying repair operation, a state copy of the application data records (ADS) currently present and involved in normal operation is first generated in a copy step (step 31, abbreviated GEN_CPY). Since the affected computing instance is already excluded from normal operation, this state copy must be created from the application data records (ADS) of one of the continuing computing instances. In a subsequent capture step (step 32, abbreviated REC_STP), the application data records (ADS) subsequently created and modified by the selected continuing computing instance are continuously copied and saved. As soon as the state copy has been written to the affected computing instance, it begins the subsequent processing (step 33, abbreviated RUN_APP) of the application program. The computing instance also uses the saved application data records (AD) as needed.After completing each of the completed steps 33, a VTG voting (step 34) takes place as described. In this process, the message created during repair mode is compared with messages generated during normal operation, which may, for example, lie within a synchronization window containing the last ten generated messages.

[0143] If a match is found between the compared messages during the VTG voting process, the affected computing instance is reintegrated into normal operation. This demonstrates that the instance has recovered the time lost during the repair process that was associated with uploading the state copy. To increase reliability during reintegration, it can also be stipulated that it only occurs after, for example, three consecutive messages have been identified as matching during the VTG voting process. Reference symbol list

[0144] ADA Application Data ADA Application Data Records AP1 First Application Program AP2 Second Application Program AP3 Third Application Program AP4 Fourth Application Program AP5 Fifth Application Program BLBalise CLController CLDCloud COD Coding Process DA Data Section DD1 First Diversity Identifier DD2 Second Diversity Identifier DD3 Third Diversity Identifier DD4 Fourth Diversity Identifier DEC Decoding Process GL Track GR Group GW Gateway HR1 First Host Computer HR2 Second Host Computer HR3 Third Host Computer KD1...KD13 Configuration Data KD1 First Configuration Data KNK Node LS Light Signal LZ Control Center MB Message Broker PAP Test Data Section PK1 ...PK4 Program complex PK1 First program complex RDRedundance data RERead process RURacuity environment RZComputing center S1 First interface S2 Second interface S3 Third interface S4 Fourth interface S5 Fifth interface S6 Sixth interface S7 Seventh interface S8 Eighth interface S9 Ninth interface S10 Tenth interface S11 Eleventh interface S12 Twelfth interface S13 Thirteenth interface S14 Fourteenth interface S15 Fifteenth interface SE1 First storage unit SE2 Second storage unit SE3 Third storage unit STWInterlock TGTact generator TG,VT,GW,MBSubprograms VRInventory VTVoter VTGVoting WASwitch drive WHSwitch WTWrite process ZDCount data.

Claims

1. Method for performing a technical process, a) in which application programs (AP1 ... AP5) are executed redundantly in a plurality N of computing instances and b) on the basis of an MooN system, wherein M is at least two and N is at least three, a comparison of the plurality N of results of the redundant execution of the application programs (AP1 ... AP5) is performed in a voting (VTG), wherein c) in the event of a minority of the results being different from a majority of the results with identical content, said minority of results is not taken into account during the performance of the technical process, d) in a case according to step c), the at least one computing instance affected by the generation of the minority of results is excluded from the performance of the technical process, e) in a case according to step c), a state copy of a status to be reinitialised is created by a computing instance affected by the generation of the majority of the results, and f) during the reinitialisation, the status of the affected computing instance is established according to the state copy, g) the at least one computing instance affected is then reintegrated into the performance of the technical process, characterised in that e1) additionally, all messages sent to the computing instances from the creation of the state copy and their sequence are stored by the computing instance affected by the generation of the majority of the results, and f1) during the reinitialisation, the status of the affected computing instance all stored messages are processed in the stored sequence by the affected computing instance until the affected computing instance runs synchronously again with the computing instances not affected by the reinitialisation.

2. Method according to claim 1, wherein h) in the event that a majority of results with identical content cannot be determined in the voting (VTG), the plurality N of results is not taken into account during the performance of the technical process, i) in a case according to step h), the plurality N of computing instances is excluded from the performance of the technical process, j) the plurality N of computing instances is reinitialised, wherein the redundant execution of application programs (AP1 ... AP5) is restarted.

3. Method according to claim 1 or 2, wherein the state copy is only created by a computing instance not affected by the reinitialisation as soon as the case according to step c) in claim 1 occurs.

4. Method according to one of the preceding claims, wherein the content of the results of the majority of computing instances from at least one preceding comparison step, preferably at least 10 preceding comparison steps, are stored and, during processing of the messages according to step f), in claim 1, calculated results are compared with at least one of said stored results in at least one comparison step downstream of this processing for synchronisation.

5. Method according to claim 4, wherein the at least one computing instance affected is reintegrated into the technical process if a match between the respective stored result and the associated calculated result is determined in at least one downstream comparison step, preferably in at least three successive subsequent comparison steps performed in the sequence of the stored results.

6. Method according to one of the preceding claims, wherein the sequence of the messages is determined taking into account the time of sending the messages, wherein the sequence corresponds to the chronological sequence of the sending.

7. Method according to claim 6, wherein the time of sending the messages is saved as a digital time stamp.

8. Method according to one of the preceding claims, wherein the state copy and the messages are sent and received by a message broker.

9. Method according to claim 8, wherein the message broker works with a publish / subscribe method.

10. Method according to one of the preceding claims, wherein k) messages are contained in application data sets (ADS) containing data sections (DA), l) voting (VTG) is performed with redundant data sections (DA) that have been changed identically several times as results, m) in a case according to step c) in claim 1, the application data sets (ADS) containing data sections (DA) causative for error identification are not taken into account during the performance of the technical process.

11. Method according to claim 10, wherein a memory unit of the computing instances is operated in such a way that n) application data sets (ADS) are filed in the memory unit and are coded before being filed, o) application data sets (ADS) are retrieved from the memory and decoded after retrieval, wherein the memory unit is monitored for errors by performing a chronological sequence of computer-aided test runs for the memory unit, and wherein the reinitialisation of the affected computing instance according to step f) in claim 1 is only started when at least one, preferably two, successive test runs reveal that no errors are present.

12. Method according to claim 11, wherein, in the event of an error being determined in one of the test runs, the method is performed from step e) in claim 1.

13. Method according to claim 11 or 12, wherein, for the initial coding (COD) of the data, p) at least one application data set (ADS) containing data sections (DA) with application data (AD) for at least one of the application programs (AP1 ... AP5) and test data sections (PA) is generated or selected, q) for each application data set (ADS), the test data section (PA) is occupied by count data (ZD) that identifies the test run being performed, r) each application data set (ADS) is coded and filed, and that, in order to test the data in the test run being performed after retrieving and decoding (DEC) the application data sets (ADS), in each case s) an error is determined for an application data set (ADS) if the count data (ZD) does not identify either the test run being performed or the most recent test run that has been completed, t) the test data section (PA) of the relevant application data section is occupied by count data (ZD) that identifies the test run being performed if no error was determined, u) the relevant application data set (ADS) is coded and filed again if no error was determined.

14. Computer program product with program instructions for performing the method according to one of claims 1 - 11.

15. Provisioning apparatus for the computer program product according to the last preceding claim, wherein the provisioning apparatus stores and / or provides the computer program product.