EP2798495A2

EP2798495A2 - Method for combining results of periodically operating edp components at the correct time

Info

Publication number: EP2798495A2
Application number: EP12822954.9A
Authority: EP
Inventors: Stefan Poledna
Original assignee: FTS Computertechnik GmbH
Current assignee: Tttech Computertechnik AG
Priority date: 2011-12-27
Filing date: 2012-12-27
Publication date: 2014-11-05
Also published as: WO2013096986A3; WO2013096986A2; US9407696B2; US20150046603A1

Abstract

The invention relates to a method for combining results of a multiplicity of periodically operating components of a distributed computer system at the correct time, wherein the components communicate solely by means of messages via at least one communication system, and wherein each component has a global time with the precision P. Provision is made for each component to be unambiguously associated with one of n hierarchical levels, preferably in system design, wherein the durations of the periods of the components, which are derived from the progression of the global time, are an integer multiple of one another, and wherein the phase of transmitting each message is synchronized with the corresponding phase of receiving each transmitted message within each longest period of the entire distributed computer system even if the transmitting components and the receiving components are arranged on different hierarchical levels and are spatially distributed. The invention also relates to a computer system for carrying out such a method.

Description

PROCESS FOR THE CONTINUOUS COMBINATION OF RESULTS OF

PERIODIC WORKING COMPONENTS

The present invention is in the field of computer technology.

Specifically, the invention relates to a method for timely aggregation of results of a plurality of periodically operating components of a distributed computer system, wherein the components communicate exclusively by means of messages via at least one communication system, and wherein each component has a global time with the precision P.

Furthermore, the invention relates to a distributed computer system, in particular for the timely combination of results of a plurality of periodic components, the computer system comprising a plurality of periodically operating components, wherein the components communicate exclusively by means of messages via at least one communication system, and wherein each component over a global time with the precision P features.

In addition, the invention also relates to a distributed computer architecture for the timely combination of the results of periodically operating components, in particular computer components.

The invention describes an innovative method with which a multiplicity of periodically operating components of a distributed real-time system can be embedded in a hierarchical structure and how the results of these components can be brought together in a timely manner by means of a time-controlled communication system.

In distributed real-time systems, eg in an aircraft, a multiplicity of components-in the example of the aircraft-more than a hundred components-must work together to solve the tasks set. The complexity of such a system can be reduced by embedding the components in a hierarchical structure, the communication between the components according to predetermined Timed rules, and the temporal behavior of the components and the communication is predictable.

The reduction in complexity is also required to predict system behavior after a fault has occurred in one of the components. In a safety-critical real-time system-as in the example of the aircraft-essential system functions must remain upright even after the failure of components.

The special role that hierarchical models play in understanding complex processes has already been dealt with in detail by Simon [5] in 1962. Also in [1] it is proposed to structure a large system-of-systems hierarchically.

It is an object of the present invention to provide a combination of hierarchical system structure with synchronous behavior of the components and systematic fault containment at the various levels of the hierarchy.

This object is achieved by a method as mentioned above and a computer system mentioned in the introduction by assigning each component, preferably in a system design, uniquely to one of n hierarchical levels, and the durations of the periods of the components derived from the progression of the global time , within an integer multiple of each other, and within each longest period of the entire distributed computer system, the phase of transmission of each message is synchronized with the corresponding phase of reception of each transmitted message, even if the transmitting components and the receiving components are arranged on different hierarchical levels and spatially distributed.

In the present invention, it is proposed to form a hierarchy of periodic components, wherein the duration of the period of a component is an integer multiple of a smallest period and a component is uniquely assigned to a hierarchical level on the basis of the duration of its period. The Components with the shortest period form the lowest hierarchical level, and the components with the longest period form the topmost hierarchical level.

The present invention thus discloses how to build a security-critical distributed real-time system to reduce complexity. Reducing complexity reduces software development and testing time and significantly reduces the cost of system development.

The present invention discloses how a safety-critical distributed real-time system can be constructed to reduce the cognitive effort required to understand the functions of the system. The complexity of such a system can be reduced, in which the components are embedded in a hierarchical structure, the communication between the components proceeds according to predetermined rules, and the temporal behavior of the components and the communication is predictable. Reducing complexity reduces software development and testing time and significantly reduces the cost of system development.

Further advantageous embodiments of the method according to the invention and of the computer system according to the invention are described in the subclaims.

It is thus advantageous if the time of the message transport by a time-controlled communication system is synchronized with the end of the period of the component sending a message.

It is favorable if a component of a hierarchy level only communicates with a component of a higher hierarchical level.

In addition, it is expedient for a component of a higher hierarchical level to receive messages from a plurality of components of the subordinate hierarchy levels. It is of particular advantage that the behavior of a set of hierarchically arranged components, which forward information to the next higher hierarchical level and wherein the information flow forms an in-tree, is replaced or replaceable by a simulation system which determines the upward behavior of the root of the in-trees replaced.

It is expediently provided that the global time is synchronized with the temps atomique international (TAI) with an accuracy of A.

It is advantageous if the global time is sparse.

In addition, it may be provided that an excellent period of the series of possible periods has the duration of exactly one TAI second.

Appropriately, it is provided that the messages received and sent by a component are distributed over a TTEthernet communication system.

Moreover, it is advantageous if the communication system is designed to be redundant.

Moreover, it is favorable if the at least one component, preferably each component forms a fault-containment unit.

In addition, it can be provided that a component produces either correct, no or recognizably false messages.

It is preferably provided that the global time is fault-tolerant.

It is advantageous if the dynamic change of parameters of the components or of the communication system is ensured by cryptographic protocols.

Finally, it can advantageously be provided that a component is a restart unit which attempts to restart immediately after detecting an error. Furthermore, it can still be provided that a component receiving a message checks whether the content of the message corresponds to the dynamic input assurance provided for this message.

Moreover, it is advantageous if the behavior of the individual components is observed in the correct time, without influencing the time behavior of the components.

In real-time data processing, a result or result is only correct if it corresponds to the specification in the value range and in the time range. It therefore makes sense to understand the term component to mean a unit of software and hardware, since only such a unit has a defined behavior in the range of values and in the time domain. This component notion includes both a physical component where the component is a physical hardware unit and a virtual component where a software module is executed in a hypervisor-provided partition of a larger hardware unit.

It is advantageous if each component is a fault containment unit (FCU) in order to be able to restrict the immediate consequences of a fault cause of the specified fault class (eg, hardware or software) to a single component. If such components communicate exclusively by means of messages, a subsequent error of a faulty component can propagate only across a faulty message across the component boundaries. A message can be faulty in the time domain or in the value range. When a timed communication system such as TTEthernet [6] is used, the timed communication system that forms an independent FCU can detect the time domain error and prevent the propagation of the error. In the general case, errors in the value range must be recognized by the component that receives the message. To do this, the message recipient must check that incoming messages match an input assertion. It is advantageous if this input assurance can be changed dynamically in order to be able to adapt the input check to the current state of the system changing with time. If a component has fail-silent behavior, that is, it produces either correct, no, or noticeably false messages, all component errors in the time domain can be caused by the Timed communication system can be detected. A fail-silent component will generally consist of two FCUs. In coordination with the error hypothesis, one of these two FCUs can be very simple, eg an independent watchdog which constantly monitors the function of the component and immediately triggers a restart after detecting an error. Since experience has shown that in most cases the cause of the error is transient, this restart will be successful in the majority of cases.

Since the technical processes that are controlled by a real-time system run according to the laws of physics, the physical time plays a special role in real-time data processing. Therefore, according to the invention, a fault-tolerant global time is introduced which can be accessed by all components of the system. The construction of a fault-tolerant time with a known precision P and an accuracy A is described in detail in ([4], chapter 3). If all significant events occurring in the real-time system are sparse events (see [4], chapter 3), a consistent temporal order of these events can be established throughout the system.

The invention will be explained in more detail below with reference to the drawing. In this shows

Fig. 1 shows a number of components associated with four levels of abstraction, and

2 shows the sequence of a processing cycle in the periodic representation of the time.

The following description of a realization represents only one of many possibilities for technical implementation of the invention.

FIG. 1 shows a system with ten components 11-14, 21-23, 31, 32, 41 which exchange messages via a time-controlled communication system 50. The timed communication system 50 is a priori, ie before use, announced when a component sends a message and how long the message may be maximum. This specification of the communication parameters can be done dynamically and is preferably, like all other parameters that can be changed dynamically, secured by cryptographic protocols. The timed Communication system 50 is thus able to detect a time misconduct of a component. If the components are fail-silent, the timed communication system can detect all component errors.

In this invention, in the system design, a hierarchy of periodic components 11-14, 21-23, 31, 32, 41 is formed, wherein the duration of the period assigned to a component is an integer multiple of a smallest period. The periods are determined by the progression of global time. We refer to the smallest period as base period. The period of the entire distributed computer system results from the least common multiple (kgV) of the periods of all components. It is advantageous if the durations of the periods are a power of two of the smallest period. In this case, the least common multiple of the entire system corresponds to the longest period of a component. After the product kgV * base period, the temporal behavior of the entire distributed computer system is repeated.

In the present architecture, the processing times of the components may be different. However, it must be ensured that the processing time of a component is shorter than the duration of the period assigned to that component, i. the difference between period duration and processing time, the laxity, must be positive.

This assignment of the components to the hierarchy levels 1, 2, 3, 4 is based on the logic of the given application. An example of such an assignment is shown in FIG. According to the logic of the illustrated application, the ten components 11-14, 21-23, 31, 32, 41 are assigned four hierarchy levels 1, 2, 3, 4. If e.g. If the kgV of the periods of these components has the value 30, the temporal behavior of the entire distributed computer system will repeat itself after 30 basic periods.

According to the invention, it is advantageous if a component of a lower hierarchical level only communicates with a component of a higher hierarchical level. For example, in FIG. 1, the component 11 communicates with the Component 21 and the component 12 with the component 21, but not the component 11 with the component 12. Such a direct communication between the components 11 and 12 should only in exceptional cases, if the application necessarily requires done. The component 21 has three communication interfaces, two downwardly directed to the components 11, 12 and an upward to the component 31.

If the components 11, 12 e.g. Have sensors with which they can observe their environment, so the flow of information between the components 11, 12, 21 can be described by an in-tree, with the component 21 forms the root of the in-trees [3]. In this In-tree the information flows in Figure 1 from bottom to top. According to the invention, this in-tree can be replaced by a simulation system which simulates the environment observed by the nodes 11, 12, 21 at the communication interface between the components 21 to 31. Thus, in this architecture it is possible to replace parts of the real system for the purpose of testing by a simulation system. This significantly reduces the test effort required to commission large distributed systems.

For example, For example, a camera may be connected to the component 11 shown in FIG. 1 and a radar device for monitoring the environment may be connected to the component 12. The component 21 performs a data fusion of the results of these two observations to identify the objects in the environment. Component 31 decides which reactions to take on the basis of the observed objects. In the test phase, the component 21 can be replaced by a simulation system in order to test the correct reactions of the entire system in the most diverse situations.

In order to observe the behavior of a component or a complete in-tree without affecting the timing of the application, the communication system 50 may copy and send selected messages to an independent monitoring component. A corresponding procedure for timely observation of the communication between components is disclosed in [2].

Figure 2 shows the timing of processing in a component and the Communication between components. According to the invention, it is assumed that all components operate periodically. The time is divided into periods, wherein within each period, the circle of Figure 2 is run in a clockwise direction. An event within a period is specified by the phase position, ie the phase of the event to the period origin. For example, in FIG. 2, the event 100, the period origin in FIG. 2, the phase 0 degrees, the event 120, the phase 90 degrees. The period origin (event 100) can be synchronized with the global time.

FIG. 2 describes the communication between the components 11, 21, 31 of FIG. 1, the period of component 31 being shown in FIG. When the periodic event 100 occurs, the component 11 begins processing, e.g. reading the sensors of the component 11. At the time 110, the processing in the component 11 is completed and the timed communication system 50 is ready to transport the result of the component 11 in the form of a message to the component 21. Upon arrival of the message at component 21 at time 120, component 21 begins processing. The processing is completed at time 130. At this point in time 130, the timed communication system 50 is ready to transport the result of the component 21 in the form of a message to the component 31. As can be seen from FIG. 2, according to the invention, in the proposed architecture, the phases of the processing in the components and the communication between the components are synchronized. According to Wikipedia [7], synchronization is understood as the temporal alignment of processes. Synchronization thus ensures that actions occur in a certain order or simultaneously; H. take place synchronously [7].

According to the invention, the schedules for processing the data in the components and for inter-component communication by a scheduler are such that, within each longest period of the entire distributed computer system, the phase of transmission of each message coincides with the receipt of each message sent is synchronized, ie that in each period the sending of a message takes place before the reception of this message. This determination prevents a component of a previous period from being consumed by a component before it corresponding message of the current period was produced. This type of synchronization must also be ensured if the sending component and the receiving component are arranged on different hierarchical levels and spatially distributed. The realization of such a schedule calculated by a scheduler, which fulfills the conditions set out above, can be realized with the TTEthernet system [6].

It is advantageous if an element of this series of periods corresponds exactly to the physical second, so that the actions of systems that do not have common internal synchronization can be synchronized over the external time.

In a safety-relevant application, there must be no component whose failure leads to faulty behavior or failure of the entire system. It is therefore advantageous to configure the communication system redundant in security-relevant applications, so that the failure of a subsystem of the communication system can be tolerated.

The technical development of microelectronics makes it possible to realize many of the presented process steps in one or more FPGA chips or directly in ASICs. For example, fault-tolerant clock synchronization, fault containment at the component level, or temporal fault detection in the time-triggered communication system can be substantially supported by hardware-implemented functions. Such hardware support results in a reduction in power consumption and silicon area while increasing throughput.

In summary, the innovative method disclosed here reduces the complexity of safety-critical real-time systems, increases reliability, and significantly lowers the costs of system development, testing, and maintenance.

Quoted literature [1] US 7,979,247 Butterfield, et al. System, method and computer program product for developing a system-of-systems architecture model. Granted July 12, 2011

[2] Austrian Patent Application A 1842/2011 by FTS Computertechnik GmbH dated 19.12.2011. Method for the timely observation of TTEthernet messages.

[3] Wikipedia. Graph theory tree.

[4] Kopetz, H. Real-Time Systems, Design Principles for Distributed Embedded Applications. Springer Verlag. 2011th

[5] Simon, H.A. , Science of the Artificial. WITH Press. 1,962th

[6] SAE standard by TT Ethernet. URL: http://standards.sae.org/ as6802

[7] Wikipedia. Sychronisation.

Claims

\. A method for time-correct merging of results of a plurality of periodic components of a distributed computer system, wherein the components communicate exclusively by means of messages via at least one communication system, and wherein each component has a global time with the precision P, characterized in that each component, preferably in a system design, is uniquely assigned to one of n hierarchical levels, and wherein the durations of the periods of the components derived from the progression of the global time are in an integer multiple, and within each longest period of the entire distributed computer system, the phase of the Sending each message is synchronized with the corresponding phase of the reception of each message sent, even if the transmitting components and the receiving components arranged on different hierarchical levels and spatially distributed s ind.

2. The method according to claim 1, characterized in that the time of the message transport is synchronized by a time-controlled communication system with the end of the period of the message sending component.

3. The method of claim 1 or 2, characterized in that a component of a hierarchical level communicates only with a component of a higher hierarchical level.

4. The method according to any one of claims 1 to 3, characterized in that a component of a higher hierarchical level receives messages from a plurality of components of the subordinate hierarchy levels.

5. The method according to any one of claims 1 to 4, characterized in that the behavior of a set of hierarchically arranged components that forward information to the next higher hierarchical level and wherein the information flow a In-tree forms, is replaced or replaced by a simulation system that replaces the upward behavior of the root of the In-trees.

6. The method according to any one of claims 1 to 5, characterized in that the global time with the temps atomique international (TAI) is synchronized with an accuracy of A.

7. The method according to any one of claims 1 to 6, characterized in that the global time is sparse.

A method according to any one of claims 1 to 7, characterized in that an excellent period of the series of possible periods has the duration of exactly one TAI second.

9. The method according to any one of claims 1 to 8, characterized in that the received and sent by a component messages are distributed over a TTEthernet communication system.

10. The method according to any one of claims 1 to 9, characterized in that the communication system is designed to be redundant.

11. The method according to any one of claims 1 to 10, characterized in that at least one component, preferably each component forms a fault-containment unit.

12. The method according to any one of claims 1 to 11, characterized in that a component produces either correct, no or recognizable false news.

13. The method according to any one of claims 1 to 12, characterized in that the global time is fault-tolerant.

14. The method according to claims 1 to 13, characterized in that the dynamic change of parameters of the components or of the communication system is secured by cryptographic protocols.

15. The method according to any one of claims 1 to 14, characterized in that a component is a restart unit, which immediately tries to restart after detecting an error.

16. The method according to any one of claims 1 to 15, characterized in that a component which receives a message, checks whether the content of the message corresponds to the intended for this message dynamic input assurance.

17. The method according to any one of claims 1 to 16, characterized in that the behavior of the individual components is observed in the correct time, without affecting the time behavior of the components.

18. Distributed computer architecture for the timely combination of the results of periodically operating components, in particular computer components, characterized in that one or more of the disclosed in claims 1-17 process steps in a computer hardware consisting of one or more CPUs, FPGAs or ASICs is realized ,

19. A distributed computer system comprising a plurality of periodically operating components, wherein the components communicate exclusively by means of messages via at least one communication system, and wherein each component has a global time with the precision P, characterized in that each component, preferably in a system design, is uniquely associated with one of n hierarchical levels, and wherein the durations of the periods of the components derived from the progression of the global time are in an integer multiple, and within each longest period of the entire distributed computer system, the phase of sending each message is synchronized to the corresponding phase of the reception of each message sent, even if the transmitting components and the receiving components are arranged on different hierarchical levels and spatially distributed.

A computer system according to claim 19, characterized in that the time of message transport by a time-controlled communication system is synchronized with the end of the period of the message sending component.

21. Computer system according to claim 19 or 20, characterized in that a component of a hierarchy level only communicates with a component of a higher hierarchical level.

22. A computer system according to any one of claims 19 to 21, characterized in that a component of a higher hierarchical level receives messages from a plurality of components of the subordinate hierarchy levels.

23. Computer system according to one of claims 19 to 22, characterized in that the behavior of a set of hierarchically arranged components, which forward information to the next higher hierarchical level and wherein the information flow forms an in-tree, is replaced or replaceable by a simulation system, which replaces the upward behavior of the root of the in-tree.

24. Computer system according to one of claims 19 to 23, characterized in that the global time is synchronized with the temps atomique international (TAI) with an accuracy of A.

25. Computer system according to one of claims 19 to 24, characterized in that the global time is sparse.

A computer system according to any one of claims 19 to 25, characterized in that an excellent period of the series of possible periods has the duration of exactly one TAI second.

27. Computer system according to one of claims 19 to 26, characterized in that the components received and sent by a component are distributed over a TTEthernet communication system.

28. Computer system according to one of claims 19 to 27, characterized that the communication system is redundant.

29. Computer system according to one of claims 19 to 28, characterized in that at least one component, preferably each component forms a fault containment unit.

30. Computer system according to one of claims 19 to 29, characterized in that a component produces either correct, no or recognizably false messages.

31. Computer system according to one of claims 19 to 30, characterized in that the global time is fault-tolerant.

32. Computer system according to claims 19 to 31, characterized in that the dynamic change of parameters of the components or the communication system is secured by cryptographic protocols.

33. Computer system according to one of claims 19 to 32, characterized in that a component is a restart unit, which immediately attempts to restart after the detection of an error.

A computer system according to any one of claims 19 to 33, characterized in that a component receiving a message checks to see if the content of the message corresponds to the dynamic input assurance provided for that message.

35. Computer system according to one of claims 19 to 34, characterized in that the behavior of the individual components is observed in the correct time, without influencing the time behavior of the components.