Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
  • G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
  • G06F11/0715—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in a system implementing multitasking
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
  • G06F11/0793—Remedial or corrective actions
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/14—Error detection or correction of the data by redundancy in operation
  • G06F11/1402—Saving, restoring, recovering or retrying
  • G06F11/1415—Saving, restoring, recovering or retrying at system level

Definitions

• the invention relates to a method for processing a computer program on a computer system, which comprises at least one computing unit.
• the computer program comprises at least one runtime object.
• An error occurring during the execution of the runtime object is detected by an error detection unit. If a fault is detected, the error detection unit generates an error detection signal.
• the invention also relates to a computer system on which a computer program can be executed.
• the computer program comprises at least one runtime object.
• An error occurring during execution of the runtime object on the computer system can be recognized by an error detection unit.
• the invention further relates to a computer program executable on a computer system and to a machine-readable data carrier
• Errors When processing a computer program on a computer, errors may occur. Errors can be distinguished according to whether they are caused by the hardware (processor, bus systems, peripherals, etc.) or by the software (application programs, operating systems, BIOS, etc.).
• transient errors When errors occur, a distinction is also made between permanent errors and transient errors. Permanent errors are always present and are based, for example, on faulty hardware or incorrectly programmed software. In contrast, transient errors are only temporary and therefore much more difficult to reproduce and predict. In the case of binary stored, binary transmitted and / or binary processed data, transient errors occur, for example, in that individual bits are changed by electromagnetic influences or radiation (alpha radiation, neutron radiation).
• Runtime objects are, for example, processes, tasks, or threads. During the execution of the computer program occurring errors can thus be assigned in principle to the running runtime object.
• Permanent error handling is typically based on the shutdown of the computer system or at least the shutdown of Operay stemen.
• this has the disadvantage that the functionality of the computer system or the subsystem is no longer available.
• the subsystems of a computer system are designed, for example, redundant.
• transient errors are also dealt with by shutting down subsystems. It is also known to shut down one or more subsystems in case of transient errors that occur and to start again and, for example, to conclude by a self-test on a now error-free processing of the computer program. If no new error is detected, the subsystem continues to work. In this case, it is possible that the task interrupted by the error or the runtime object processed at this time is no longer executed (so-called forward recovery). For example, forward recovery is used on real-time systems.
• Checkpoint resumed Such a technique, known as backward recovery, is used, for example, on computer systems used to conduct transactions in financial markets.
• an error handling routine be selected from a predefinable set of error handling routines in dependence on an identifier associated with the runtime object and the selected one
• one or more runtime objects that are executed on the computer system are assigned an identifier, which in turn designates at least one error handling routine. If an error occurs during the execution of the runtime object, the error handling routine corresponding to the identifier of the runtime object is selected and executed.
• this identifier can already be defined during the programming of the runtime object or during the installation of the runtime object on the computer system. This can already during the programming of the computer system or during the installation of the computer program on the computer system in the event of an occurring
• Error to be performed error handling routine to be determined.
• a runtime object that relates to a security-relevant and / or time-critical function can be assigned a different identifier than a runtime object that relates to a non-real-time function. This allows a very flexible treatment of errors occurring different maturity objects.
• the error handling routine is additionally dependent on the.
• Error detection unit generated error detection signal selected.
• the error detection unit can determine, for example, whether it is a hardware error or a software error, or which hardware unit (processor, bus system, memory, etc.) has triggered the error. Furthermore, it is possible for the error detection unit to determine whether the error that has occurred is more of a permanent error or a transient error. For this purpose, the error detection unit for each runtime object provide a counter that counts the number of errors occurred. If a large number of errors occur during the execution of a specific runtime object, then the error detection unit can switch to a permanent runtime
• the error detection signal contains information about a determined size, For example, the current count of the number of errors encountered during execution of the runtime object includes. This allows a particularly flexible selection of an error handling routine.
• the computer system comprises a plurality of arithmetic units
• the arithmetic unit on which the runtime object was executed and the error occurred can be identified on the basis of the error detection signal. If one and the same runtime object runs, for example, on a plurality of different arithmetic units and these arithmetic units are assigned to different environments of different security relevance, then different error handling routines can be selected in the event of an error occurring during the execution of the runtime object, depending on which arithmetic unit the runtime object was executed, although Runtime object is always assigned the same identifier.
• error handling can provide, for example, the result that is made available by the arithmetic unit on which the error occurred during further processing (for example, during a voting to be subsequently performed). to ignore.
• the error handling is carried out as a function of at least one variable characterizing the executed runtime object and / or the execution of the runtime object.
• a size may for example be a priority assigned to the runtime object. That's it possible to perform an error handling additionally depending on the priority of the executed runtime object.
• a variable characterizing the execution of the run-time object can also designate the execution time that has already taken place or that is still available. If, for example, the error occurs shortly after the runtime object has been loaded, it can be provided to reload and execute the entire runtime object. However, if the runtime object is already close to the end of the available execution time, or if another runtime object is to be processed urgently, it can be provided that
• Runtime object during which the error occurred simply terminate.
• the computer system comprises a plurality of arithmetic units.
• the runtime object is executed redundantly on at least two of the arithmetic units.
• a comparison of the redundantly generated results of the at least two arithmetic units is performed and an error detection signal is generated if the results do not match.
• a computer system comprising several computing units is referred to, for example, as a dual-core architecture (two computing units) or as a multi-processor architecture (multiple computing units).
• a particularly flexible error handling can be carried out in particular in the redundant execution of runtime objects.
• the method in a motor vehicle, in particular in a
• Motor vehicle control unit or used in a safety-related system.
• Security-relevant systems are used, for example, for controlling aircraft. In these areas, it is particularly important to treat transient errors systematically and flexibly and thus to achieve the highest possible availability of the corresponding system.
• At least one of the error handling routines realizes in the predeterminable amount of
• Error handling routines one of the following error handling options:
• the execution of the runtime object is aborted and, for example, another runtime object is executed instead. - Abort the execution of the runtime object and ban a new one
• Reset The entire computer system or a subsystem is restarted.
• the method according to the invention is used to treat transient errors.
• the selection of the error handling routine is performed depending on whether the detected error is a transient error or a permanent error.
• a detected permanent error can be handled, for example, by the runtime object no longer being executed or a subsystem being switched off permanently.
• a detected transient error can simply be ignored or handled by means of forward recovery.
• a hardware test is performed by means of a test routine.
• the error detection signal is then generated as a function of the result of the execution of the test routine. This makes it possible, for example, to detect a hardware defect particularly reliably and thus to deduce a permanent error.
• different identifiers are assigned to the runtime object for different error types. For example, if a permanent error is detected during the execution of a runtime object, a different error handler may be selected than if during the runtime
• the runtime object can be assigned different identifiers for different runtime environments.
• a runtime object may be assigned an identifier for execution in a security-relevant environment, another identifier for redundant execution on a redundant processor, and another identifier for execution in a time-critical environment.
• This embodiment enables a more flexible treatment of an error that has occurred during the execution of a runtime object and can increase the availability even further.
• the object is also achieved by a computer system of the type mentioned above in that the runtime object is assigned an identifier and, depending on the identifier, an executable error handling routine can be selected from a predefinable set of error handling routines.
• the computer program on a computer system, in particular on a computing device, executable and programmed to carry out the method according to the invention erf programmiertndungswashen.
• the invention is realized by the computer program, so that the computer program represents in the same way the invention as the method which the computer program is suitable for executing.
• the computer program is preferably stored on a machine-readable data carrier.
• a machine-readable medium for example, a random access memory, a read-only memory, a
• Flash memory a digital versatile disc or a compact disc are used.
• Figure 1 is a schematic representation of components of a
• FIG. 2 shows a flow diagram for a schematic representation of the method according to the invention in a first embodiment
• FIG. 3 shows a flow chart for a schematic representation of the method according to the invention in a second embodiment.
• FIG. 1 shows a computer system 1 is shown schematically, the
• the computer system 1 has two arithmetic units 2, 3.
• the arithmetic units can be, for example, complete processors (CPUs) (so-called dual-core architecture).
• the dual-core architecture makes it possible to operate the two arithmetic units 2, 3 in such a redundant manner that a process or a runtime object is executed almost simultaneously on both arithmetic units 2, 3.
• the arithmetic units 2, 3 can also be arithmetic logic units, so-called arithmetic local units (ALUs) (dual ALU architecture).
• ALUs arithmetic local units
• the two computing units 2, 3 are assigned a common program memory 4 and an error detection unit 5.
• the error detection unit 5 is designed, for example, as a comparator, which makes it possible to compare values calculated by the processors 2 and 3.
• an operating system 6 runs on the computer system 1.
• the operating system 6 has a scheduler 7 and an interface 8.
• the scheduler 7 manages the computing time provided by the computing units 2, 3 by deciding when which process or which run-time object is executed on the computing units 2 and 3.
• the interface 8 allows the error detection unit 5 to notify detected errors by means of an error detection signal to the operating system 6.
• the operating system 6 has access to a memory area 9.
• the memory area 9 contains for each executable runtime object the identifier assigned to this runtime object or the identifiers associated with this runtime object. It is both possible to image the memory area 9 and the program memory 4 on one and the same memory element as well as on different memory elements.
• the memory element or the memory elements can be assigned, for example, to the arithmetic unit 2 or the arithmetic unit 3
• Be memory or a cache Be memory or a cache.
• the computer system 1 could have only one computing unit.
• An error in the execution of a runtime object could then be done, for example, by the error detection unit 5 by means of a plausibility check.
• one and the same runtime object could be executed several times in succession on the arithmetic unit 2, 3.
• the error detection unit 5 could then compare the results produced in each case and in the event of a deviation of the results from one another, conclude the presence of an error.
• the computer system 1 has more than two arithmetic units 2, 3.
• a runtime object could then be executed redundantly, for example, on three of the existing computing units 2, 3. By comparing the results thus obtained, the error detection unit could
• step 100 the scheduler 7 initiates the arithmetic units 2, 3
• Runtime object from the program memory 4 read and execute.
• a step 102 it is checked whether there is an error during the execution of the runtime object. This is done, for example, by the error detection unit 5, which compares the redundantly calculated by the arithmetic units 2, 3 results. If there is no error, the method branches back to step 101 and a further run-time object is executed in the arithmetic units 2, 3.
• an error detection signal is generated by the error detection unit in step 103 and transmitted to the operating system 6 via the interface 8.
• a step 104 the operating system 6 determines the faulty runtime object. This information can be obtained, for example, from the scheduler 7.
• a step 105 the identifier assigned to the runtime object determined in step 104 is determined.
• a table can be stored, in which for each extendable runtime object the identifier assigned to this is stored.
• the identification associated with the runtime object is stored together with the runtime object itself in the program memory 4. If a run-time object is loaded for execution in the arithmetic unit 2, 3, it can be provided that the identifier is stored in a memory area, for example a register, allocated to the respective arithmetic unit 2, 3. In this case, the operating system 6 could request the identifier of the runtime object from the respective computing unit 2, 3.
• the error detection unit determines the identifier associated with the runtime object and makes it available to the operating system via the interface 8 together with the error detection signal, for example as a parameter.
• an error handling routine is selected as a function of the error detection signal and the identifier associated with the runtime object.
• the identification associated with the runtime object can uniquely determine the error handling routine to be selected. For example, the identifier may determine that the erroneous runtime object should be aborted and should not be reactivated. The identifier can also determine that you want to jump back to a given checkpoint and from there the runtime object should be executed again (backward recovery). The identifier may further determine that a forward recovery is performed, the execution of the runtime object is repeated, or no further error handling is to be performed.
• Operating system 6 transmitted error detection signal information can be found in terms of the type of error occurred. For example, this type can indicate whether it is transient or permanent.
• the error signal can also be configured such that information about it can be found on which the
• Arithmetic units 2, 3 the error has occurred.
• several identifiers can be assigned to the runtime object.
• a first identifier can describe the error handling routine to be executed when the permanent error occurs.
• a second identifier is the one to be executed when a transient error occurs
• the computer system 1 is designed as a multi-processor system or as a multi-ALU system, it may be advantageous to select the
• Error handling routine depending on whether the runtime object has occurred on one or more of the processors or the ALUs. This information could, for example, be taken from the error detection signal.
• the runtime object could in this case have different identifiers for the cases that the runtime object is executed on only one arithmetic unit 2, 3 and that the runtime object on several arithmetic units 2, 3 is executed incorrectly.
• the error handling is performed in which the error handling routine selected by the operating system 6 is executed. Depending on the selected error handling routine, for example, the operating system may cause the scheduler 7 to abort all the runtime objects currently executing on the arithmetic units 2, 3
• a step 108 the inventive method for error treatment ends.
• the processing of a program with sequential execution of run-time objects shown in FIG. 2 and subsequent checking for the presence of an error at this point is not necessarily also terminated. if the
• step 108 If the execution of the program has not yet ended when step 108 has been reached, it is possible to return to step 101 (dashed line).
• FIG. 3 schematically shows a further embodiment of the method according to the invention by means of a flowchart, in which further variables are taken into account in the selection of the error handling routine to be carried out.
• the method begins in a step 200.
• the steps 201 to 205 may correspond to the steps 101 to 105 shown and described in FIG.
• a variable characterizing the runtime object or the execution of the runtime object is determined.
• a variable characterizing the run-time object can describe, for example, a security relevance assigned to this run-time object.
• variable characterizing the runtime object can also describe whether and from which further runtime objects the variables calculated by the present runtime object are required, or whether and from which further runtime objects Runtime objects that depend on the sizes of the runtime object. Thus dependencies of the runtime objects could be described among each other.
• variable characterizing an execution of a runtime object can describe, for example, whether memory access by the runtime object has already taken place at the time the error occurs, if the error took place relatively shortly after the runtime object was loaded, if the variables to be calculated by the runtime object are urgently required by other runtime objects are required and / or how large the for a runtime object nor for
• Is available time span Is available time span. These quantities can then be taken into account in a selection of the error handling routine. For example, if there is not enough time to rerun the entire runtime object, it may be scheduled to perform backward recovery or forward recovery.
• a step 207 it is determined whether there is a permanent or a transient error. For example, error counters that indicate how frequently an error occurs when a particular runtime object is executed can be included. If this happens particularly frequently or always, a permanent error can be assumed.
• Steps 206 and 207 are initially independent of each other and can be performed individually. A version in reverse order is possible.
• the variable determined in step 206 and characterizing the runtime object or the execution of the runtime object is used as an input value for determining the type of fault in step 207.
• the two steps 206 and 207 in the be processed in the specified order.
• steps 206 and 207 do not necessarily have to be executed sequentially; they can also be processed in parallel.
• Computer system 1 that is, for example, a computing unit 2, 3 to assign an error counter. If, for example, it is determined that the execution of especially many runtime objects is faulty on a computer unit 2, 3 of the computer system 1, then the existence of a permanent error (eg a hardware error) can be inferred.
• a permanent error eg a hardware error
• an error handling routine is selected.
• the variables ascertained in steps 205 to 207 in particular one or more identifiers associated with the erroneous runtime object, one or more of the runtime object or the execution of the
• the error handling routine is selected by the operating system 6, for example.
• the selection can by means of the aforementioned sizes in a kind
• a step 209 the error handling is performed and in a step 210 the method according to the invention for error handling is ended.
• the processing of a program shown in FIG. 3 is sequential
• step 210 Execution of runtime objects and subsequent check for the presence of an error at this point is not necessarily terminated. if the If the execution of the program has not yet ended when step 210 has been reached, it is possible to return to step 201 (dashed line).
• a variable characterizing the nature of the error (transient / permanent), a variable characterizing the runtime object itself or a variable characterizing the execution of the runtime object can be used to select the error handling routine.
• information which is determined by the error detection unit 5, for example an identity of the arithmetic units 2, 3 on which the runtime object was executed during the occurrence of the error, in the selection of the error handling routine. It can from the information, whether the considered
• Runtime object on only one of the arithmetic units 2, 3 or on both arithmetic units 2, 3 was processed simultaneously / will be closed to the safety relevance of the runtime object at the current processing time. Furthermore, it is possible to provide further information of the computer system and / or the periphery (eg current value range of
• Error handling routine causes re-execution of the faulty runtime object again leads to an error.
• it could be provided to again select an error handling routine, but this time a different one. For example, it may be provided in this case to switch off the entire system or a subsystem.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Quality & Reliability (AREA)
• Physics & Mathematics (AREA)
• General Engineering & Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Hardware Redundancy (AREA)
• Retry When Errors Occur (AREA)
• Storage Device Security (AREA)
• Debugging And Monitoring (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=35447817

Family Applications (1)

Country Status (6)

Families Citing this family (12)

Citations (1)

Family Cites Families (28)

• 2004
  • 2004-09-25 DE DE102004046611A patent/DE102004046611A1/de not_active Withdrawn
• 2005
  • 2005-09-12 JP JP2007532882A patent/JP4903149B2/ja not_active Expired - Fee Related
  • 2005-09-12 CN CN200580032522.9A patent/CN101027647B/zh not_active Expired - Fee Related
  • 2005-09-12 EP EP05784608A patent/EP1794680A1/de not_active Withdrawn
  • 2005-09-12 US US11/662,611 patent/US8316261B2/en not_active Expired - Fee Related
  • 2005-09-12 WO PCT/EP2005/054513 patent/WO2006032617A1/de active Application Filing

Patent Citations (1)

Also Published As

Similar Documents

Legal Events