DE102004029614A1 - Computer for safe technical arrangement of transport system with rail-bound train, has information area including logical blocks, each with validity note, where computer allows execution of program in volatile memory - Google Patents

Abstract

The computer has an information area (2) including logical blocks (2a, 2b), each with a marking and a validity note. The validity note is set in an invalid position, before the carry over by pointers (5, 6) of the blocks. The validity note is set in a valid position, after carrying out a writing. The pointers of block (2b) are carried over in a same manner as that of the pointers of block (2a), by resetting the validity note. The computer allows execution of a program in a volatile memory. An independent claim is also included for a method of safe storage of user data using a program, which can be executed on a computer for safe technical arrangement of transport system with a rail-bound train.

Description

The The invention relates to a secure computer and a method for secure storage of user data for a secure computer according to the generic terms the claims 1 and 6.

assurance Technical Facilities for Transport systems with track-bound trains are well known. These are today with a computer for executing application programs equipped, whereby the computer with fuse-technical plants regularly as secure computer is formed. Such a calculator can consist of two parallel computer channels which execute the same program steps in parallel, where by comparing, for example, the results of the two channels detectable is whether the calculator is working correctly and the results are therefore "safe", so none have computer-related errors. The work of the calculator includes As a rule, user data of the system in a retentive memory store. The user data can be logs of an operating procedure or else configurations of the plant and the like. to Reduction of access time to the payload data is information about the Nutzdatenspeicherung, so management information, also in retentive memory stored. The filing of the data is done in such a way that the User data in a data area and the associated information data in an information area is stored in each case on data storage locations. Write pointers point to the next ones that have been released for writing and read pointer to the next Data memory locations to be read. The Informational data is for each payload in an associated one Block of the information area filed. The writing pointer will after describing a data storage location and the read pointers continued after reading a data storage space, ie for example, increased by the value 1. So that in each block the continued pointers currently available are, they will be overwritten accordingly. The storage of the user data can take place in a series of data records. Also known are level counter, the Implicitly result from the position of read and write pointer.

comes it's a sudden Failure of the computer, for example in the event of a power failure, while writing a payload (payload) or informational data (Management information) occurs, so it can at restart of the computer to an inconsistent data content in the remanent memory or even a complete one Data loss come. The remanent memory cells have one undefined content on when the power failure during the write process occurs. Does this affect the payload before the informational data with the pointers in the remanent memory have been updated the pointers to the hitherto current payload records. occurred but the power failure when overwriting the write or Read pointer, so be completely read incorrect user data or overwrite correct user data, with maybe catastrophic consequences for the transport system.

at a secure computer with two parallel computer channels can be by comparing the two read or write pointers of the two independent computer channels at least determine that an error has occurred. Not detectable is which of the two channels saved the data correctly.

The The object of the invention is a secure computer and a method specify the storage of the user data by means of a a computer executable Program with little effort and still with high security.

The solution is for the secure computer by the features of claim 1 and the method given for safe storage by the features of claim 6. In the features of the subclaims are advantageous embodiments.

The solution With regard to the secure computer, each block in the Information area a second time redundant and in each block declaration of validity is filed before overwriting the two pointers to the state invalid and after completion of writing again valid on the state is set, and that after overwriting the two pointers of a block respectively also the two pointers of the associated redundant blocks in the same way, overriding the validation become.

to increase the computational speed, the program is in a volatile Memory executed.

These Speed leaves continue to increase if the block in the volatile Memory is loaded and the pointers are relayed there before they are overwritten accordingly in the information area in the corresponding block become.

The at least the address of the last data read and the address of the last described data memory available in each block are further safety enhancing.

The simple technical design of the remanent memory provides that the information area as ring buffer for the addresses is formed, so that the addresses only after one complete Overwritten circulation become.

The solution With regard to the procedure, each block in the information area a second time redundant and a validation in each block is filed before overwriting the two pointers to the state invalid and after completion of writing again valid on the state is set, and that after overwriting the two pointers of a block respectively also the two pointers of the associated redundant blocks in the same way, overriding the validation become.

One embodiment the invention will be described in more detail below with reference to a drawing, the only figure being the remanent memory of a secure computer a fuse-technical system in a schematic representation shows.

The embodiment relates to a security system of a transport system with track-bound trains, having a computer for controlling the system, wherein the computer the high safety requirements of the transport system.

The figure shows from the computer of the plant the remanent memory 1 in a schematic representation, for which as storage media EEPROM, FLASH-ROM, NV-RAM, FRAM and the like can be used. The computer also has a fast volatile memory. In the volatile memory work programs can be loaded, which current user data 9 in remanent memory 1 lay down.

This information about the data storage in the form of information data 4 . 5 . 6 . 7 . 8th additionally in remanent memory 1 stored. The filing takes place in each case on data storage locations in the form of data records, the user data 9 in a data area 3 of the remanent memory 1 and the to the payload 9 associated information data in an information area 2 of the remanent memory 1 , where the information area 2 from the data area 3 is independent and the information data is stored in blocks.

The information area 2 has two blocks for this purpose 2a . 2 B on, with the block 2a with the block 2 B is identical, ie each block 2a is again as a copy (block 2 B ) filed. Each date of use 9 So are two identical blocks 2a . 2 B assigned.

The data storage locations for the information data 4 . 5 . 6 . 7 . 8th a block 2a . 2 B are in remanent memory 1 stored consecutively (or else it is distributed data storage locations, the block 2a . 2 B make logical).

As 1 is removable, contains each block 2a . 2 B a validity note 4 (VALID), a write pointer 5 (PUT), a read pointer 6 (GET), the number 7 the records to be read (Counter = 2) and the CRC checksum 8th (CRC). In the data area 3 are for that to the information area 2 associated useful date 9 the successive accumulating data values (records) (Record #) one behind the other stored from top to bottom. The data area 3 can also be designed as a ring memory, so that the memory locations are overwritten after a complete cycle. To distinguish between the free and the occupied memory locations are marked differently (the memory locations Record # 0, Record # 1, Record # 2 in the figure are already occupied with data values and the memory locations Record # 3, ...., Record # MAX-2 , Record # MAX-1 and Record #MAX are still free). In this case, a write pointer is displayed in each block 5 (PUT) to the data value (here record # 2), namely, that in the place of the write pointer 5 the address of the next data space released for writing is what is indicated by the connecting line 10 is shown. Furthermore, the read pointer contains the address of the data memory location (here Record # 1), which is to be read next. This is through the line 11 shown. Because the block heads 2a . 2 B are duplicated, this also applies to the lines 10 . 11 to.

Next to the writing pointer 5 and the read pointer 6 are in the two block heads 2a . 2 B still a validation 4 stored in the state that may be invalid or valid.

There is also the number 7 the records to be read are entered in the block; this is equal to 2 here (Counter = 2). Next is the CRC checksum 8th stored in the block.

Due to the speed advantages, the entire block of the currently active payload of the remanent memory is here in each case 1 loaded into the volatile memory.

• 1. Kopiere DIR = DIR#1 vom remanenten Speicher 1 in den flüchtigen Speicher,
• 2. Schreibe DATA, den Datenwert des Nutzdatums, in den remanenten Speicher 1; alle Zeigeroperationen werden im flüchtigen Speicher DIR ausgeführt,
• 3. Schreibe CRC in den remanenten Speicher 1,
• 4. Lösche in DIR#1 den Gültigkeitsvermerk 4 „GÜLTIG/VALID",
• 5. Schreibe DIR#1 = DIR vom flüchtigen Speicher in den remanenten Speicher 1 zurück,
• 6. Setze in DIR#1 den Gültigkeitsvermerk 4 auf „GÜLTIG/VALID",
• 7. Lösche in DIR#2 den Gültigkeitsvermerk 4 „GÜLTIG/VALID",
• 8. Schreibe DIR#2 = DIR vom flüchtigen Speicher in den remanenten Speicher 1 zurück,
• 9. Setze in DIR#2 den Gültigkeitsvermerk 4 „GÜLTIG/VALID",

For secure storage (writing) of a current useful date 9 (ie its current data value) is the following program sequence ausrei accordingly:

• 1. Copy DIR = DIR # 1 from the remanent memory 1 in the volatile memory,
• 2. Write DATA, the data value of the payload, into the remanent memory 1 ; all pointer operations are executed in the volatile memory DIR,
• 3. Write CRC in the remanent memory 1 .
• 4. Delete in DIR # 1 the validation 4 "VALID / VALID"
• 5. Write DIR # 1 = DIR from the volatile memory to the remanent memory 1 back,
• 6. Set the validity note in DIR # 1 4 to "VALID",
• 7. Delete in DIR # 2 the validity note 4 "VALID / VALID"
• 8. Write DIR # 2 = DIR from the volatile memory to the remanent memory 1 back,
• 9. Set the validity note in DIR # 2 4 "VALID / VALID"

• 1. Kopiere DIR = DIR#1 vom remanenten Speicher 1 in den flüchtigen Speicher,
• 2. Lese DATA, den Datenwert des Nutzdatums, vom remanenten Speicher 1 in den flüchtigen Speicher; alle Zeigeroperationen werden im DIR ausgeführt,
• 3. Prüfe CRC,
• 4. Lösche in DIR#1 den Gültigkeitsvermerk 4 „GÜLTIG/VALID" 5. Schreibe DIR#1 = DIR vom flüchtigen Speicher in den remanenten Speicher 1 zurück,
• 6. Setze in DIR#1 den Gültigkeitsvermerk 4 „GÜLTIG/VALID",
• 7. Lösche in DIR#2 den Gültigkeitsvermerk 4 „GÜLTIG/VALID",
• 8. Schreibe DIR#2 = DIR vom flüchtigen Speicher in den remanenten Speicher 1 zurück,
• 9. Setze in DIR#2 den Gültigkeitsvermerk 4 „GÜLTIG/VALID",

Similarly, the program sequence for reading a payload is:

• 1. Copy DIR = DIR # 1 from the remanent memory 1 in the volatile memory,
• 2. Read DATA, the datum of the datum, from the remanent memory 1 in the volatile memory; all pointer operations are performed in the DIR,
• 3. Check CRC,
• 4. Delete in DIR # 1 the validation 4 "VALID / VALID" 5. Write DIR # 1 = DIR from volatile memory to remanent memory 1 back,
• 6. Set the validity note in DIR # 1 4 "VALID / VALID"
• 7. Delete in DIR # 2 the validity note 4 "VALID / VALID"
• 8. Write DIR # 2 = DIR from the volatile memory to the remanent memory 1 back,
• 9. Set the validity note in DIR # 2 4 "VALID / VALID"

• 1. Schreiben des Datenwerts des Nutzdatums 9
• 2. Schreiben der ersten Informationsdaten 4, 5, 6, 7, 8 (Verwaltungsinformationen/Block 2a)
• 3. Schreiben der redundanten Informationsdaten 4, 5, 6, 7, 8 (Verwaltungsinformationen/redundanter Block 2b).

If there is an undesired switch-off of the computer, the data loss is limited to at most a single data record, since the writing process is divided into three steps:

• 1. Write the data value of the useful date 9
• 2. Writing the first informational data 4 . 5 . 6 . 7 . 8th (Management information / block 2a )
• 3. Write the redundant information data 4 . 5 . 6 . 7 . 8th (Management Information / Redundant Block 2 B ).

By the temporal succession of the three steps can only each one of the three parts to be broken:

Case 1: Useful date defective

In this case, both are blocks 2a . 2 B still at the old state. With a restart of the computer is the (anyway incomplete) new data value (data record) of the Nutzdatums 9 lost.

Case 2: first block 2a malfunction

Because the block 2a At the beginning of writing, the state was set to invalid, after the computer is restarted, the redundant block 2 B used. It still contains the status immediately before the failed saving of the datum of the datum 9 , which is then lost, but beyond that, no further damage. This case is the least favorable.

Case 3: redundant block 2 B malfunction

Here is the data value of the useful date 9 and the first block 2a written correctly. When the computer is restarted, all data is retrieved and the redundant block is corrected.

One Defect in both blocks, which would be very unlikely An additional Signal hardware or software errors and provide the appropriate activities trigger.

Claims (6)

Secure computer, in particular for a security system of a transport system with track-bound trains, on which a program can be executed, the user data ( 9 ) and information data ( 4 . 5 . 6 . 7 . 8th ) about the useful data storage in a remanent memory ( 1 ) safely stores the payload ( 9 ) on data storage locations in a data area ( 3 ) and the associated information data ( 4 . 5 . 6 . 7 . 8th ) in an information area ( 2 ), whereby a write pointer ( 5 ) with the address of the next data memory released for writing and a read pointer ( 6 ) with the address of the next data memory to be read in a common logical block ( 2a ) and wherein after writing a data storage location the write pointer ( 5 ) and after reading a data storage location the read pointer ( 6 ) and in the information area ( 2 ) in the logical block ( 2a ) be overwritten accordingly, characterized in that each block ( 2a . 2 B ) in the information area ( 2 ) redundant a second time and in each block ( 2a . 2 B ) a validity note ( 4 ), which before overwriting the two pointers ( 5 . 6 ) is invalidated to the state and after successful writing is reset to the state valid, and that after overwriting the two pointers ( 5 . 6 ) of a block ( 2a ) in each case also the two pointers ( 5 . 6 ) of associated redundant blocks ( 2 B ) in the same way, with the validation ( 4 ) are overwritten. Secure computer according to claim 1, characterized that the program is in a volatile Memory executed becomes. Secure computer according to claim 2, characterized in that the block ( 2a ) is loaded into the volatile memory and the pointers ( 5 . 6 ) are stored in the volatile memory before being stored in the information area ( 2 ) in the associated block ( 2a . 2 B ) be overwritten accordingly. Secure computer according to one of claims 1-3, characterized in that in each block ( 2a . 2 B ) at least the address of the last read and the address of the last described data memory are available. Secure computer according to one of claims 1-4, characterized in that the information area ( 2 ) is designed as a ring memory for the addresses, so that the addresses are overwritten after a complete cycle. Method for the secure storage of user data by means of a program that can be executed on a computer, in particular a security system of a transport system with track-bound trains, wherein the user data ( 9 ) and information data ( 4 . 5 . 6 . 7 . 8th ) about the useful data storage in a remanent memory ( 1 ), the user data ( 9 ) on data storage locations in a data area ( 3 ) and the associated information data ( 4 . 5 . 6 . 7 . 8th ) in an information area ( 2 ), whereby a write pointer ( 5 ) with the address of the next data memory released for writing and a read pointer ( 6 ) with the address of the next data memory to be read in a common logical block ( 2a ) and after writing a data storage location the write pointer ( 5 ) and after reading a data storage location the read pointer ( 6 ) and in the information area ( 2 ) in the logical block ( 2a ) be overwritten accordingly, characterized in that each block ( 2a ) in the information area ( 2 ) redundant a second time and in each block ( 2a . 2 B ) a validity note ( 4 ), which before overwriting the two pointers ( 5 . 6 ) is invalidated to the state and after successful writing is reset to the state valid, and that after overwriting the two pointers ( 5 . 6 ) of a block ( 2a ) in each case also the two pointers ( 5 . 6 ) of the associated redundant block ( 2 B ) in the same way, with the validation ( 4 ) are overwritten.