Method for operating an IT system, and IT system

• US 20140298104A1
• Filed: 10/15/2012
• Published: 10/02/2014
• Est. Priority Date: 10/14/2011
• Status: Active Grant

• Current Assignee: Continental Automotive GmbH (Continental AG)
• Original Assignee: Continental Automotive GmbH (Continental AG)
• Inventors: Meyer, Bernd, Pyka, Stefan, Von Oheimb, David
• Granted Patent: US 9,367,297 B2
• Time in Patent Office: Days
• US Class Current: 714/38.1
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

An IT system includes at least one first processing unit and one second processing unit The first and second processing units jointly execute an application program and are each associated with an installation routine designed to control updating of a first or second program part of the application program. A first actual state is associated with the first processing unit and a second actual state is associated with the second processing unit. After system reboot, or as soon as the first and second program part have been successfully stored, or an error is detected when storing the first and/or second program part, predefined processing steps are respectively carried out in a predefined order by the first processing unit aid the second processing unit depending on the actual state of the first processing unit and the actual state of the second processing unit.

Claims

1-12. -12. (canceled)

13. A method for operating an IT system (10) having at least one first processing unit (CM) and one second processing unit (SM) connected to one another and configured to jointly execute an application program, the first processing unit (CM) being assigned a first memory that stores a first program part of the application program, which can be executed by the first processing unit (CM), and the second processing unit (SM) being assigned a second memory that stores a second program part of the application program, which can be executed by the second processing unit (SM), the first processing unit (CM) and the second processing unit (SM) each being assigned an installation routine (SUC1, SUC2) configured to control updating of the first program part sad the second program part, the method comprising:

assigning an actual state if ore a predefined set of possible states to the first processing unit (CM) and assigning a second actual state from the predefined set of possible states to the second processing unit (SM) on the basis of a state of the respective installation routine (SUC1, SUC2) and on the basis of respective updating progress of the first program part and of the second program part during updating of the application program; and

after the system (10) has been restarted or as soon as successful storage of the first program part and of the second program part is identified or as soon as an error is identified when storing the first program part and/or the second program part, carrying out predefined processing steps respectively in a predefined order by the first processing unit (CM) and by the second processing unit (SM) on the basis of the assigned actual state of the first processing unit (CM) and the assigned second actual state of the second processing unit (SM).

14. The method as claimed in claim 13, wherein the set of possible states comprises a first state (ZA) representing a first valid program part or a second valid program part and a respective inactive installation routine (SUC1, SUC2), a second state (ZSUCa) representing a first valid program part or a second valid program part and a respective active installation routine (SUC1, SUC2), and a third state (ZSUCb) representing a first invalid program part or a second invalid program part and an active installation routine (SUC1, SUC2) of the first processing unit (CM) or of the second processing unit (SM).

15. The method as claimed in claim 14, further comprising, after the system (10) has been restarted or as soon as successful storage of the first program part and of the second program part is identified or as soon as an error is identified when storing the first program part and/or the second program part, respectively assigning a new actual state on the basis of the assigned actual state of the first processing unit (CM) and the assigned actual second state of the second processing unit (SM) under predefined conditions according to the following rule:

if the first processing unit (CM) is in the first state (ZA) and the second processing unit (SM) is in the second state (ZSUCa), the second processing unit (SM) can return to the first state (ZA) or the first processing unit (CM) must change over to the second state (ZSUCa),

if the first processing unit (CM) is in the first state (ZA) and the second processing unit (SM) is in the third state (ZSUCb) the first processing unit (CM) must change to the second state (ZSUCa),

if the first processing unit (CM) is in the second state (ZSUCa) and the second processing unit (SM) is in the first stare (ZA), the second processing unit (SM) can change to the second state (ZSUCa) or the first processing unit (CM) must return to the first state (ZA), and

the respective actual states remain the same in all other cases.

16. The method as claimed in claim 15, further comprising, as soon as the successful storage of the first program part and of the second program part is identified, first returning the first processing unit (CM) to the second state (ZSUCa) insofar as it is not already in said state, and then changing the second processing unit (SM) to the first state (ZA).

17. The method as claimed in claim 13, wherein two binary flags (CMU, CMI, SMU, SMI) are respectively used to characterize the actual state of the first processing unit (CM) and the actual slate of the second processing unit (SM) a respective first binary flag (CMU, SMU) represents an inactive or active installation routine (SUC1, SUC2) of the first processing unit (CM) or of the second processing unit (SM) depending on its binary slate (_erased, _set), and a respective second binary flag (CMI, SMI) represents a valid or invalid first program part or second program part depending on its binary state (_erased, _set).

18. The method as claimed in claim 17, further comprising, after the system (10) has been restarted or as soon as the successful storage of the first program part and of the second program part is identified or as soon as an error is identified when storing the first program part and/or the second program part, carrying out the predefined processing steps in a predefined order by the first processing unit (CM) and by the second processing unit (SM) on the basis of the binary states of the respective first binary flags (CMU, SMU) and second binary flags (CMI, SMI).

19. The method as claimed in claim 18, further comprising, as soon as the successful storage of the first program part and of the second program part is identified resetting the binary states of the respective first binary flags (CMU, SMU) and second binary flags (CMI, SMI) to the binary state representing a valid program pan or an inactive installation routine (SUC1, SUC2) in a predefined order on the basis of the binary states of the respective first binary flags (CMU, SMU) and second binary flags (CMI, SMI).

20. The method as claimed in claim 13, in which the first processing unit (CM) is configured to initiate a start of the updating of the application program and/or to initiate an end of the updating of the application program.

21. The method as claimed in claim 13, in which the second processing unit (SM) is configured to decide whether the updating of the application program is started and/or ended.

22. The method as claimed in claim 13, in which the second processing unit (SM) is configured to verify integrity of the first program part and/or of the second program part.

23. An IT system (10) comprising:

at least one first processing unit (CM) and one second processing unit (SM) connected to one another and configured to jointly execute an application program, the first processing unit (CM) being assigned a first memory that stores a first program part of the application program, which can be executed by the first processing unit (CM), and the second processing unit (SM) being assigned a second memory that stores a second program part of the application program, which can be executed by the second processing unit (SM), the first processing unit (CM) and the second processing unit (SM) each being assigned an installation routine (SUC1, SUC2) configured to control updating of the first program part and of the second program part,

wherein;

the first processing unit (CM) is configured to assign itself an actual state from a predefined set of possible states on the basis of a state of the installation routine (SUC1, SUC2) assigned to it and on the basis of updating progress of the first program part during updating of the application program,

the second processing unit (SM) configured to assign itself a second actual state from the predefined set of possible states on the basis of a state of the installation routine (SUC1, SUC2) assigned to it and on the basis of updating progress of the second program part during updating of the application program, and

the first processing unit (CM) and the second processing unit (SM) are configured to respectively carry out predefined processing steps in a predefined order on the basis of the assigned actual state of the first processing unit (CM) and the assigned second actual state of the second processing unit (SM) after the system (10) has been restarted or as soon as successful storage of the first program part and of the second program part is identified or as soon as an error is identified when storing the first program part and/or the second program part.

24. The IT system (10) as claimed in claim 23, therein the IT system (10) is a digital tachograph, the first processing unit (CM) comprises an application controller, and the second processing unit (SM) comprises a security controller.