WO2010049339A1

WO2010049339A1 - Device and method for generating redundant but different machine codes from a source code for verification for a safety-critical system

Info

Publication number: WO2010049339A1
Application number: PCT/EP2009/063870
Authority: WO
Inventors: Volker Roelke
Original assignee: Robert Bosch Gmbh
Priority date: 2008-10-31
Filing date: 2009-10-22
Publication date: 2010-05-06
Also published as: DE102008043374A1

Abstract

The invention relates to a method and a device for the automated generation of at least two redundant but different ways of implementation of a safety-critical system, characterized in that the at least two ways of implementation are generated from a single system description, particularly for a software-based solution, a source code being translated into two different machine codes by means of a compiler, the machine codes being formed from asynchronous command sequences and allowing an error check by comparing the results.

Description

5 description

title

Device and method for generating redundant but different machine codes from a source code for verification for a safety-critical system

State of the art

The invention is based on a device or method according to the category of L 5 independent claims. As is known, technical systems have one

Susceptibility to error, which can come from different causes. Each component of such a system may include temporary errors that occur sporadically, or systematic errors. Components can consist of software or hardware components. Especially with> 0 safety-critical systems, there is a need to recognize and respond appropriately to errors, i. to design such systems fault-tolerant or error-detecting. For this reason, there are also various security requirements in the development and application of computer-aided solutions in order to avoid serious consequences due to software or hardware errors. There are various standards for this purpose, such as the SIL (Safety Integrity Level) in accordance with IEC / DIN EN 61508 or the Automotive Safety Integrity Level (ASIL) in the automotive environment in accordance with ISO CD 26262.

The redundant design of systems, for example, in aircraft construction, where avionics units are present in multiple places, whose calculation results are compared and made plausible, is generally known. In this case, the systems are several times available in terms of hardware. As a result, for example, errors are detected that occur singularly in a hardware caused

35 for example, by a production error or a defect in exactly this a hardware unit. Not covered here are errors that are due to the design of the hardware, as well as errors in the software, which is identical to the hardware units present.

5 Due to the double, independent development of a software with the same

Task a software technical redundancy can be achieved. Thus, human programming errors, as well as compiler errors or the like can be detected, as well as possibly temporary hardware errors such as Bitkipper etc.

L O

The combination of such methods not only temporary errors, but also permanently temporary errors, that is, errors that occur reproducibly in a specific system, as well as systematic errors, such as design errors are recognized.

L 5

This parallel architecture and / or parallel development, however, leads to increased costs, since a higher development effort and / or multiple hardware is necessary.

> 0 State of the art is that nowadays almost every program in one

Written high-level language (for example, C or C ++), which is translated by a so-called compiler into a machine language that the respective microprocessor (for example, in a PC or in an embedded system) understands. That means that between creating a software

> 5 (program) and execution on a hardware this intermediate step is carried out.

In EP 1 723 513 Bl a method is described that allows a clear and flexible configuration of a computer program. Here, the possibility is created by means of global and special configuration files from a single program code (source text) to generate a machine code by means of a compiler.

In US 2004/0034814 Al a method is described, the alternative 35 versions of code segments, in particular a code segment in an optimized and another code segment in a non-optimized variant generated. Usually, the optimized code is executed at runtime, whereby upon detection of an error a program recovery is performed at a certain earlier time and then the second (non-optimized) code is executed, which should lead to the theoretically same (but error-free) result 5. The alternative version of the code is only executed if an error has been detected during execution of the first code.

Disclosure of the invention

L O The inventive method with the features of the independent

Anspruchs realizes a fault-tolerant system, which can be used especially in safety-critical applications and should discover the temporary and systematic error. For such a system exists a system description, or requirement profile, which of a generator

L 5 is implemented such that it becomes a physical realization variant

(Realization path) is formed. According to the invention, this generator generates at least two implementation paths which result in the same effect or a similar result, but achieve this on a different approach, and are therefore redundant but different from one another. error

> 0 in the common underlying system description can not be detected thereby, however, such errors in one of the two implementation paths, for example, caused by an erroneous generation, or in particular errors on an execution platform of such a realization path. Through an appropriate failure mode or

> Impact analysis for the respective concrete system can be examined or it can be found out which errors can be intercepted and which parts of the system paths are configured redundantly and at which points Single Points of Failure exist.

The advantage is thus the elimination of temporary, permanently temporary, systematic and / or design errors and simultaneous cost savings, since a system description must be created only once. Depending on the implementation, the system itself does not have to be held a second time, provided that the at least two implementation paths can be executed on the same system

35 are. For safety testing usually would Results of the at least two implementation paths are compared with each other for equality or plausibility, whereby it depends on the security concept in what exact form or how often or at what times what is carried out. Thus, depending on the specific application and the respective security level, corresponding safety standards can be set at low

Effort and costs are met.

If the implementation paths themselves consist of different individual components, it is advantageous if these components are not

L O occur simultaneously (synchronously) in the at least two ways of realization. Thus, an error that is present in a certain component can be uncovered, since one of the implementation paths implements the realization without using this component. The errors are usually discovered in a comparison of the results or intermediate results or

L 5 intermediate steps of the realization paths.

In probably the most common embodiment of the invention, software is created that conforms to the system description, usually in a high level language such as C or C ++. A so-called compiler sets this

> 0 high-level language into a language that uses the one used

Microprocessor platform understands (machine language). The compiler corresponds to the automated generator, but may also be an interpreter (e.g., programming language Basic or Java) or another form of language translator. The invention also includes a reaction in

> 5 equally effective implementation paths, for example, the implementation path via the programming of an FPGA module, or various microcontroller or microcontroller elements optionally with different functionality (for example, main microcontroller / safety controller (SCON)) or other hardware.

30

According to the invention, this compiler generates from a source text of the high-level language two machine codes which describe redundant but different realization paths. Since the system requirement for this is usually the same and the source code is the same, the results of both of them must also be the same

35 machine codes come to an identical or plausible result. Optionally, the at least second realization path can also calculate an approximation result which is suitable for a plausibility check of the real result of the one realization path. The mere calculation 5 of an approximate result can have resource advantages, in particular runtime advantages.

This decision (plausibility check) is carried out by a body known as Voter.

Advantage is the described possibility of the unique development of a

L O Software, which is automatically translated into two different machine codes, which allows a plausibility check on certain types of errors. The additional effort or costs are very low, especially compared to the usual procedure of a double development of source code. Using multitasking processors or serial computation

In a processor, the at least two machine codes may also run on a single hardware, thereby avoiding parallel architecture and duplicate hardware costs. In particular, errors that occur during compilation can be intercepted if they only have an effect on one of the implementation paths. The same applies to temporary errors in

> 0 a hardware, no matter whether sporadic errors or errors that have arisen due to component scattering or systematic or design errors in the hardware, which do not come in at least one of the realization paths in the same manner as in the other implementation path. The voter in this case would make a difference between the different ones

> Determine 5 ways of realization or depending on the number of

Realization paths can also determine the correct result. With regard to the number of ways of implementation of the design of voters and the consequent different levels of fault tolerance, reference is made to corresponding technical literature.

30

The terminology of the compiler in singular parlance is also to be interpreted as meaning that the method according to the invention is also implemented by means of at least two compilers, with a first compiler generating the first machine code or implementation path and the others

35 compilers the other machine codes. For development purposes it likes be advantageous to start by a few manual interactions, or the multiple compiler runs to keep the development effort here too low. This can also take place via cascaded program structures, for example batch programs, which is known to a person skilled in information technology, however, in any case.

In the generation of the at least two machine codes, the compiler advantageously converts the instructions from the high-level language into respectively different machine code instructions or machine code instruction sequences. This

L o has the advantage of having an error by calling a specific one

Machine codes would be created in the other machine code are not called and would come into play, which allows error detection. Unless every instruction of the machine code can be substituted by another instruction, one is

L 5 complete asynchronous design of the machine codes may not be possible. However, avoiding the synchronous use of machine instructions contributes to fault tolerance as much as possible.

The invention specifically uses the properties and freedoms when compiling

> 0, since there is no rule for a compiler to have a program in one

Must translate high-level language into the target language. The compiler presented here makes use of the fact that there are several possibilities to replace a command from the high-level language into the target language. Thus, the high-level language command in the various implementation paths is as possible

> 5 completely different machine language instructions or command sequences translated.

This can be done for example by a classical translation table, whereby the corresponding property can be guaranteed and the compiler can be certified according to standard if necessary. However, certification is also possible by other proof of the mentioned properties.

30

However, the use of different machine codes or command sequences also leads to the fact that the running time and / or storage space requirement and / or the program size of the different machine programs are different. Advantageously, the compiler run can now be adjusted

35 that the properties mentioned on the different Machine codes are distributed according to their purpose. For example, it may be attempted to produce code that is equally fast for the various implementation paths, for example by virtue of the fact that a recurring command in the high-level language is used in the two

5 realization paths alternately but asynchronously implemented.

Fast code is usually preferred when the calculation results of the realization paths must be available at the same time, for example, if the result may not be used without a plausibility check. Alternatively, for example, a very

L o faster implementation path and other slow exist, if the result must be calculated very quickly, and a plausibility or error response even after use or evaluation of the result is still possible. For example, a realization path can take over the calculation of real-time results in one time-critical cycle, and another

L 5 Realization path also run distributed over several clock cycles. A comparison of the results of the implementation paths in the voter or a call of the voter can then be done regularly but not necessarily in every bar. Also, the variation of the program size of the various machine codes may be useful, this is always in a first machine code, the shorter each

> 0 command sequence used, and in the other machine codes, the longer.

This can be useful, for example, if the various machine codes are to run in different memory areas, the shorter, for example, in a fast, but scarce or expensive memory or if one in a so-called safe island, that is a specially secured

> 5 area, should run.

It is advantageous to use only a single microprocessor or

Microcontroller or integrated component for the execution or

Processing the at least two implementation paths or machine codes, since in this case a second hardware can be saved. For this usually a higher internal or software technical effort is required to

Multitasking or a parallel processing or serial processing of the different realization paths or machine codes to enable.

However, these methods are state of the art and easily accessible through various toolkits. Another advantage here is that the voter as well Software within the same hardware, that is, the same microcontroller can be integrated.

Modern microcontrollers often have different computing units, 5 for example floating point units, different computer cores, PCP, etc. Thus, for example, arithmetic operations of the floating point units can be simulated by means of integer operations in the normal computer core, to later plausibility. In this case, errors that occur in only one of the two arithmetic units can be detected. Furthermore, in L O different computer cores of a microcontroller, the different

Machine codes are processed.

If the idea described so far is taken up and extended by an additional inventive step, the possibility arises instead of one

L 5 source text or a system description an existing one

Machine code or realization way to use to generate by means of an automatic generator at least a second realization path or machine code. The automatic generator would be a suitable program, for example, which contains the machine code instructions

> 0 or recognized machine code instruction sequences of the source machine code by means of, for example, a translation table of the instructions to alternative instruction code sequences in order to generate a second machine code. The advantage here is that a redesign of the compiler or a second compiler is more complex to implement, as such

> 5 machine code converter. Furthermore, an already existing

Machine code for safety-critical systems can be designed fault-tolerant by this idea. Even if a corresponding source text in the high-level language no longer exists or has been lost, such a second machine code can be generated in order to meet the corresponding requirements

30 meet.

Definitions

In software development, the programmer usually uses a software in the form of a source code or source code in a specific one High-level language created. A compiler converts these into so-called object codes, which in turn are linked together by a linker with other program components to form a machine code. If necessary, an intermediate step via a machine language

5 performed. Machine language, in the form of source text, also called assembler, is a 1 to 1 mapping to the so-called machine code, which is binary. For the present invention, it is irrelevant whether the machine language, machine code, object code or assembler is mentioned, as well as the term compiler or automatic generator

L o optionally a linker or other software tools or components to

Generation of the machine code includes. It is equally unimportant whether the different machine codes are created by one or more compilers; the decisive factor is the use of a single source text for the generation of different but redundant machine codes.

L 5

In a fault-tolerant system, a so-called "single point of failure" refers to points in the system where different paths are merged, so a failure at that point would result in a total error. "A common single point of failure is the so-called voter the

> 0 plausibility unit which brings together different calculation methods or their solutions, compares them and evaluates the overall result.

Description of the drawings

> 5 embodiments of the invention are illustrated in the drawings and explained in more detail in the following description. Show it

Figure 1 shows various arrangements for fault-tolerant systems, Figure 2 shows an exemplary implementation of a multiplication command.

30

FIG. 1a shows, by way of example, the basic structure of a fault-tolerant system, in which there are at least two paths, wherein an occurrence of an error on one of these paths is detected, in that the voter shown here as a comparator determines a difference.

35 FIG. 1 b shows how a single software SW is converted by means of a compiler C into a machine code M which is used on different hardware HW1, HW2 and thus makes it possible to detect a defect in one of the various hardware.

5

In FIG. 2c, two different software SW1, SW2 are shown, which are translated into a machine code M1, M2 after a translation by means of a (possibly similar / the same) compiler C and are executed in a hardware. Analogously to Figure b part can also here

L o different, i. separate units of hardware are used.

Such a system ensures that an error that occurs in only one of the software is detected.

In FIG. 1 d, the method according to the invention is presented, wherein a single L 5 software here inputs a source code SW into a compiler C, which generates two different machine codes M 1, M 2, which are executed on the hardware. The final error assessment is performed as usual by a comparator (voter). In addition, when using an interpreter, for example, which uses high-level languages such as Java or Basic in particular, the block designated here with compiler C can come to lie in the hardware itself, the interpreter independently converting the instructions into machine code in two different ways and the method according to the invention follows. An interpreter typically functions to sequentially read and directly process the high-level language instructions 5 into machine code instructions that are executed immediately by the microprocessor and not, like a compiler C, to first translate the entire program into the complete machine code.

In Figure e the idea of the sibling method claim is shown. This involves using a classic compiler C from a source code SW

Machine code Ml generated. Another machine code M2 is generated from the machine code Ml by means of a generator G. Both then come on the hardware for execution. FIG. 2 shows the exemplary implementation of a multiplication command in a high-level language (FIG. 2 a) which is represented in two different variants of the machine code, here as assembler command sequence (FIG. Part b, c). The source or assembly texts in this example are not specific

5 High or machine language based on the savvy computer scientist can this

However, just adapt languages to the platform used and will find enough illustrations in this example. According to the invention, the command line in FIG. 1 a is generated during the generation of a first machine code by means of the command sequence as shown in FIG

L O for the second machine code using the command sequence as shown in

Figurteil c shown is generated. Thus, one implementation variant is that the compiler has a translation table which allows it to translate any high-level language command into at least two different types of machine code.

L 5

In this example, the multiplication command in the high-level language in the variant in FIG. 2 b was translated by means of the assembler-multiplication command. In an asynchronous variant in part c, this command was realized by means of a loop and additions.

> 0

Another embodiment, which is not illustrated here in a figure, would be, for example, the implementation of so-called branch operators which are each performed with negated test conditions. Usually, jumps in the machine code by testing individual

> 5 result bits of a previous calculation executed. common

Assembler commands are bz (branch zero) and bnz (branch not zero), which lead directly to a double, different realization of a branching operator. Only the condition must be previously negated with at least one additional command, but with all

30 common instruction sets readily possible. Depending on the implementation of

Commands in the machine code can also be realized a translation of the same branch by the check of various conditions. For example, by using the so-called count register, a branch number zero can be simulated by setting the register to the value to be tested + 1 and instead of

35 bnz the command bdnz (decrement count register and branch if not zero) to use.

Claims

claims

1. Procedure

- for automated generation

5 - at least two redundant but different ways of implementation

- For a safety-critical system, characterized in that

- The at least two implementation paths are generated from a single system description, which

L O - come on at least one hardware to run and

- The results of the at least two implementation paths are compared with each other for equality or plausibility.

2. The method according to claim 1, characterized in that L 5 - in the generation of the realization paths

- Components of a first implementation path are used asynchronously in the at least second realization path.

3. The method according to any one of the preceding claims, characterized in that> 0 - in the system description is a source code of a high-level language

- and in the realization paths to program object code or machine code

- and in the automated generation is a compilation or a program implementation.

.5

4. The method according to claim 3, characterized in that

the compilation generates the at least two machine codes in such a way that different machine code instructions or command sequences are used to implement a command from the high-level language.

30

5. The method according to claim 3 and 4, characterized in that

- The compilation is configured such that runtime and / or storage space requirement and / or program size of the at least two machine codes is adjusted.

35

6. The method according to any one of the preceding claims, characterized in that

the execution of the at least two realization paths or machine codes takes place in a single microprocessor or integrated component.

5. The method according to claim 6, characterized in that

the execution of the at least two realization paths or of the machine code, or components thereof, are carried out in different units of the microprocessor or of the integrated component.

L O 8. Procedure

- for automated generation

one of at least one redundant but different realization path or machine code

- For a safety-critical system L 5 characterized in that

the at least one realization path or machine code is generated from an existing realization path or machine code, and

- The two machine codes then come on at least one hardware to run and

> 0 - the results of the at least two implementation paths or machine codes are compared with each other for equality or plausibility.

9. Device

- To generate at least two redundant, but different> 5 implementation paths

- for a safety-critical system

- characterized by an automated generator characterized in that

the at least two ways of realization are generated from a single system description,

which are executed on at least one hardware and

the results of the at least two ways of realization are compared by means of a vote for equality or plausibility.