Method, computer program product, computer readable medium and system

Abstract

The invention relates to a method, in particular a computer-aided method, for operating a software application (app) which runs two instances in parallel, wherein one of the two instances is temporarily an active instance and the other of the two instances is a passive instance, wherein the passive instance is not executed and is synchronized at determined intervals by the active instance, with the result that the passive instance forms a redundant instance with respect to the active instance.

Description

[0001] Method, computer program product, computer-readable medium and system

[0002] The present invention relates to a method, in particular a computer-based method, for operating a software application (app). The invention further relates to a computer program product and a computer-readable medium. The invention also relates to a system.

[0003] Particularly for reasons of rationalization, the automation of industrial processes, plants, and machinery is playing an increasingly important role. At the same time, high quality must be ensured for products manufactured in industrial processes. Traceability is especially crucial in this regard. For example, it may be necessary to determine, even years after a product has been manufactured, the production conditions under which it was produced and what the raw materials were.

[0004] It is becoming increasingly common to continuously store and monitor data during the manufacturing process, i.e., during industrial processes. This can be done, for example, using specific software applications (apps). These can run directly on the automation system, such as a programmable logic controller (PLC) or an industrial PC, or in a cloud environment. Analyzing this manufacturing data allows not only for traceability but also for the optimization of industrial processes.

[0005] Such software applications operate alongside the classic real-time control of industrial machines and plants and are also referred to as non-real-time services. Increasingly, however, the productivity of industrial plants depends on the use of such non-real-time services. Accordingly, there is a need to ensure high availability of these software applications. For such non-real-time services, a redundancy solution is usually implemented via a cloud provider. Typically, a backup server is started as soon as a production server running the software application fails. This usually involves relatively long switchover times. Furthermore, there is a risk of data loss, which may necessitate the repetition of complex calculations, such as those performed by neural networks.

[0006] The publication WO 2006 / 033880 A1 - Krajewski et al. “CONFIGURING REDUNDANCY IN A SUPERVISORY PROCESS CONTROL SYSTEM” reveals such a redundancy concept for a SCADA system, in which synchronization data is exchanged between the production system and the backup system via a separate redundancy message channel.

[0007] The publication WO 2023 / 174550 A1 - Harmatos et al. “METHODS, COMPUTING NODES AND SYSTEM FOR CONTROLLING A PHYSICAL ENTITY” also shows such a redundancy concept, in which the synchronization of the internal data of the redundant instances is provided.

[0008] Against this background, the object of the invention is to provide an alternative method for operating a software application (app) which, in particular, ensures high availability and short switching times of the software application. Furthermore, data loss should preferably be reduced to a minimum.

[0009] This problem is solved by a method, in particular a computer-based method, for operating a software application (app) which runs in parallel in two preferably identical instances, wherein one of the instances is at least temporarily an active instance and the other of the two instances is a passive instance, wherein the passive instance is not executed and is synchronized by the active instance at certain intervals, so that the passive instance forms a redundant instance to the active instance.

[0010] The invention is based on the fundamental idea of ​​improving the availability of such non-real-time services by having the software application exist on or run in two different instances. These different instances can be, in particular, different physical instances, such as compute nodes, edge devices, PCs, or similar.

[0011] In principle, it is also conceivable that the software application exists or runs on more than two instances. In this case, the software application is only executed in one active instance. This means that the passive instance is essentially just present, and the software application is merely synchronized within it. If the software application fails in the active instance for any reason, the passive instance can immediately become the active instance without any significant delay and take over the corresponding tasks virtually seamlessly. This ensures high availability of the software application and / or non-real-time services. Consequently, downtime of industrial plants is reduced, resulting in increased productivity. A time-consuming startup of a backup computer or server is not required.

[0012] In a further embodiment of the method according to the invention, the passive instance and its synchronization can be transparent to the software application. This means that, in particular, the active instance is completely unaware of the passive instance and its preferably regular synchronization. As a result, neither the active nor the passive instance needs to have or implement any synchronization measures. Therefore, any commercially available application, software, or service can be used.

[0013] Preferably, the software application is not real-time capable. This means, in particular, that the software application is not used for the direct control of an industrial plant or machine, but merely runs in the background. For example, the software application can be used to record and capture parameters in industrial processes, such as the production of goods on industrial plants or machines. The software application can then be used to analyze and optimize these parameters. Specifically, the software application can be used to analyze production data from a manufacturing plant. The software application can incorporate and / or interact with artificial intelligence to perform cost-effective analysis and optimization of production data.The recorded manufacturing data can include, for example, physical parameters such as pressures, temperatures, forces, chemical compositions, or similar information.

[0014] According to the invention, the software application runs within an operating system process. The software application can access operating system resources. These resources can include, for example, memory, in particular main memory, files, and / or other operating system objects. These can include, for example, mutexes and / or semaphores or the like. In other words, the software application can access resources of the operating system. The operating system can be a Linux operating system. According to the invention, the operating system resources have identification labels, in particular identification numbers, and preferably the same identification labels are used for the operating system resources in both instances. This prevents compatibility problems from arising when switching between the two instances.Similarly, the same virtual addresses can be used for all data in both instances.

[0015] Synchronization of the passive instance can be performed via a component that is not part of the operating system. It is also possible for synchronization to be performed via a component that is part of the operating system. In other words, synchronization of the passive instance can be performed via a corresponding service or a separate application, which is specifically not part of the operating system. Preferably, the synchronization is not part of the software application.

[0016] Preferably, the two instances run on separate hardware nodes. These hardware nodes can be, for example, control devices such as programmable logic controllers (PLCs), and / or a PC, particularly an industrial PC, and / or a server. This means that the two instances run physically separate from each other. Preferably, the two hardware nodes are physically separated. This ensures that even in the event of damage, such as a fire, usually only one hardware node is affected, allowing one of the two instances to continue running and thus enabling virtually uninterrupted operation of the software application.

[0017] In a further development, the hardware nodes can be part of a network. They can have interfaces, especially Ethernet interfaces. In other words, the hardware nodes can be part of a larger network that includes other servers, PCs, or computer equipment in general.

[0018] Synchronization of the passive instance by the active instance can occur at regular intervals. This approach is based on the idea that synchronization is relatively simple and always takes place after defined time intervals. The shorter the intervals, the worse the performance of the software application becomes, because more computing power is required for synchronization. However, in such cases, the passive instance can continue its work in virtually the same state. It is also possible for synchronization of the passive instance to occur when the active instance is about to send data to an external client. Such an external client could, for example, be another computer on the network. In this case, synchronization does not occur at regular intervals, but rather precisely when data is to be sent.Specifically, synchronization can occur before the active instance sends data to an external client. It can be configured that the passive instance acknowledges synchronization back to the active instance after it has completed. Accordingly, the process can be designed so that data is only transferred to the external client once the passive instance has acknowledged synchronization back to the active instance.

[0019] This design is based on the principle that sending data to an external client is only possible after the passive instance has been synchronized. This ensures that, at the time the data is sent to an external client, for example via a network or the internet, the passive instance is in the same state as the active instance. This guarantees, for instance, that an external client receives the same message or response from the passive instance even after the active instance fails.

[0020] A combination of both methods is also possible. For example, synchronization can occur both at regular intervals and whenever the active instance wants to send data to an external client. Such a combination is particularly useful if the active instance only sends data to external clients very rarely.

[0021] During the initial synchronization of the passive instance by the active instance, all data necessary to bring the passive instance to the same state as the active instance at the time of synchronization can be transferred. In other words, a relatively large amount of data can be transferred during the initial synchronization. This ensures that the passive instance is brought to the same state as the active instance.

[0022] During synchronization, the contents of the active instance's memory can be physically copied into the passive instance's memory. In other words, a physical image of the active instance's memory is written to the passive instance's memory. Since the memory addresses are preferably the same for both instances, this is unproblematic. This can be ensured through appropriate memory management.

[0023] In a further configuration, a delta update can be performed during synchronization. This means, in particular, that not all memory contents are transferred from the active instance to the passive instance, but only areas that have changed since the last synchronization.

[0024] Delta updates preferably divide the main memory into units. An identifier, such as a hash value, can be stored for each memory unit. This identifier allows changes to be detected in the affected memory unit. As long as the identifiers are the same, the corresponding memory unit has not changed and therefore does not need to be transferred during synchronization. If a change has occurred, this memory unit can then be transferred. Delta updates can significantly reduce computing power and bandwidth requirements.

[0025] The identifier of the storage unit is preferably stored locally, particularly on the hardware node where the active instance is running. The determined identifier can be compared with the previous identifier, so that only the units whose identifier has changed are synchronized.

[0026] According to the invention, the operating system resources are synchronized. It is conceivable that the operating system resources are synchronized at regular intervals and / or when operating system resources are changed or added.

[0027] A similar approach can be taken with file system objects or files. This is based on the idea that the software application can store part of its state in files on a persistent medium. This content also needs to be synchronized to the passive system. Here, too, the use of a delta update is conceivable, in which only the changes in the files are transferred.

[0028] The problem underlying the invention is further solved by a computer program product comprising instructions which, when the program is executed by a computer, cause it to carry out the method as described above.

[0029] Furthermore, the problem underlying the invention is solved by a computer-readable medium, in particular a storage medium, in which such a computer program product is stored.

[0030] Furthermore, the task is solved by a data processing system, comprising means for executing the procedure as previously described.

[0031] Preferably, the system comprises at least two, and in particular exactly two, hardware nodes on which the software application runs or can run, with the active instance running on one hardware node and the passive instance running on another. The hardware nodes can be interconnected via a network or be part of a network. For this purpose, the hardware nodes can have interfaces, in particular Ethernet interfaces. The network can contain further components, such as additional computer or control units, servers, and human-machine interfaces.

[0032] For further details of the invention, reference is made to the dependent claims and to the following description of an exemplary embodiment with reference to the drawing. The drawing shows:

[0033] Figure 1 shows a system according to the invention and the process according to the invention in a schematic representation.

[0034] Figure 1 shows a system 1 according to the present invention, which has a schematically represented network 2 with two hardware nodes 3a, 3b shown in the upper part of Figure 1. The two hardware nodes 3a, 3b are designed as industrial PCs and each has an Ethernet interface 4.

[0035] System 1 can be used to execute a method for operating a software application 5 (App). The software application 5 can be a non-real-time application, which is used in particular to acquire and / or analyze manufacturing data from a production plant. Preferably, it is not an application for the direct control of a production plant, an industrial plant or machine, or an industrial process.

[0036] The software application 5 runs in two instances, 6 and 7, where instance 6 is the active instance and instance 7 is the passive instance. The software application 5 is only executed in the active instance 6. The active instance 6 runs on hardware node 3a, and the passive instance 7 runs on hardware node 3b.

[0037] The software application 5 runs within an operating system process. This means that each hardware node 3a, 3b has its own operating system 8. The software application 5 accesses operating system resources. These resources can include, for example, communication resources 9, memory 10, files 11, and other operating system objects 12.

[0038] The passive instance 7 of the software application 5 is not executed and is synchronized by the active instance 6 at specific intervals. Accordingly, the passive instance 7 forms a redundant instance to the active instance 6.

[0039] Synchronization of the passive instance can be performed via a synchronization component 13, which is not part of the operating system 8 in this case.

[0040] In this case, the passive instance 7 can be synchronized by the active instance 6 at regular intervals. It is also conceivable that the passive instance 7 is synchronized when the active instance 6 is supposed to send data to an external client.

[0041] Specifically, a delta update can be performed when synchronizing the passive instance 7. This means that the main memory 10 can be divided into units, and an identifier is stored for each unit, allowing changes to be detected. This identifier can be saved locally, particularly on hardware node 3a, where the active instance 6 is running. By comparing the identifier with the previous identifier, it can be determined whether a change has occurred in the affected memory unit.

[0042] It is possible for operating system resources, such as communication resources 9, RAM 10, files 11, and / or other operating system objects 12, to be synchronized at regular intervals. Additionally or alternatively, operating system resources can be synchronized when they are modified or new operating system resources are added.

[0043] In this example, Linux is used as the operating system. A ptrace interface (14) and a procfs interface (15) can be used for synchronization. The same interfaces are used in the passive instance (7). These two interfaces (14 and 15) are available on all common Linux operating systems. Therefore, the synchronization component (13) is located outside the operating system and is thus not subject to an open-source license.

[0044] The inventive method, in particular the regular synchronization of the passive instance 7 from the active instance 6, ensures that in the event of a failure of the hardware node 3a and thus of the temporarily active instance 6, the passive instance 7 can practically step in immediately, i.e. become the active instance, and thus a high availability of the software application 5 is achieved.

[0045] Although the invention has been illustrated and described in detail by the preferred embodiment, the invention is not limited by the disclosed examples and other variations can be derived by the person skilled in the art without leaving the scope of protection of the invention.

[0046] Regardless of the grammatical gender of a particular term, persons with male, female or other gender identities are included.

Claims

Patent claims 1. A method, in particular a computer-based method, for operating a software application (5) (app) which runs in parallel in two instances, wherein one of the two instances is temporarily an active instance (6) and the other of the two instances is a passive instance (7), wherein the passive instance (7) is not executed and is synchronized by the active instance (6) at certain intervals, so that the passive instance (7) forms a redundant instance to the active instance (6), characterized in that the software application (5) runs in an operating system process, wherein the software application (5) accesses operating system resources, wherein the operating system resources comprise memory, in particular main memory (10), files (11) and / or other operating system objects (12), in particular mutexes and / or semaphores, that the operating system resources are synchronized, that the operating system resources contain identification labels,in particular identification numbers, wherein the same identification designations are used for the resources of the operating system (8) in both instances (6,7), and that the same virtual addresses are used for all data used in both instances (6,7).

2. Method according to claim 1, characterized in that the passive instance (7) and the synchronization are transparent to the software application (5), and / or that the software application (5) is not real-time capable, and / or that the software application (5) is used to analyze manufacturing data of a production plant.

3. Method according to one of the preceding claims, characterized in that the synchronization of the passive instance (7) is carried out via a component (13) that is not part of the operating system (8), or that the synchronization is carried out via a component (13) that is part of the operating system (8).

4. Method according to one of the preceding claims, characterized in that the two instances each run in different hardware nodes (3a, 3b), wherein, in particular, the hardware nodes (3a, 3b) are part of a network (2) and / or have interfaces, in particular Ethernet interfaces (4).

5. Method according to one of the preceding claims, characterized in that the passive instance (7) is synchronized by the active instance (6) at regular intervals.

6. Method according to one of the preceding claims, characterized in that a synchronization of the passive instance (7) takes place when the active instance (6) is to send data to an external client.

7. Method according to claim 6, characterized in that the synchronization takes place before the active instance (6) sends data to an external client, wherein, in particular, the passive instance (7) acknowledges this back to the active instance (6) after synchronization, wherein, preferably, the data to the external client is only transferred when the passive instance (7) has acknowledged the synchronization back to the active instance (6).

8. Method according to one of the preceding claims, characterized in that, during the initial synchronization of the passive instance (7) by the active instance (6), all data necessary to bring the passive instance (7) to the same state as the active instance (6) at the time of synchronization are transferred, and / or that during synchronization, the contents of the main memory (10) of the active instance (6) are physically copied into the main memory (10) of the passive instance (7).

9. Method according to one of the preceding claims, characterized in that a delta update is performed during synchronization, wherein, in particular, during the delta update the main memory (10) is divided into units and an identifier, in particular a hash value, is stored for each memory unit, by which changes in the affected memory unit are recognized, wherein, preferably, the identifier of the memory unit is stored locally, in particular on the hardware node (3a, 3b) on which the active instance (6) runs, and the determined identifier is compared with the previous identifier, so that only the units whose identifier has changed are synchronized.

10. Method according to one of the preceding claims, characterized in that the operating system resources are synchronized at regular intervals, and / or that the operating system resources are synchronized when operating system resources are changed or added.

11. Computer program product comprising instructions that, when executed by a computer, cause the computer to execute the method according to any of the preceding claims.

12. Computer-readable medium, in particular storage medium, on which the The computer program product according to claim 11 is stored.

13. System (1) for data processing, comprising means for carrying out the method according to any one of claims 1 to 10.

Images