Method for operating an IT system, and IT system having at least one first processing unit and one second processing unit connected to one another

• US 9,367,297 B2
• Filed: 10/15/2012
• Issued: 06/14/2016
• Est. Priority Date: 10/14/2011
• Status: Expired due to Fees

• Current Assignee: Continental Automotive GmbH (Continental AG)
• Original Assignee: Continental Automotive GmbH (Continental AG)
• Inventors: Meyer, Bernd, Pyka, Stefan, Von Oheimb, David
• Primary Examiner(s): Aponte, Francisco
• Application Number:
  US14/351,427
• Publication Number:
  US 20140298104A1
• Time in Patent Office: 1,338 Days
• Field of Search: 717168-178
• US Class Current: 1/1
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

An IT system includes at least one first processing unit and one second processing unit. The first and second processing units jointly execute an application program and are each associated with an installation routine designed to control updating of a first or second program part of the application program. A first actual state is associated with the first processing unit and a second actual state is associated with the second processing unit. After system reboot, or as soon as the first and second program part have been successfully stored, or an error is detected when storing the first and/or second program part, predefined processing steps are respectively carried out in a predefined order by the first processing unit aid the second processing unit depending on the actual state of the first processing unit and the actual state of the second processing unit.

Claims

1. A method for operating an IT system having at least one first processing unit and one second processing unit connected to one another and configured to jointly execute an application program, the first processing unit being assigned a first memory that stores a first program part of the application program, which can be executed by the first processing unit, and the second processing unit being assigned a second memory that stores a second program part of the application program, which can be executed by the second processing unit, the first processing unit and the second processing unit each being assigned an installation routine configured to control updating of the first program part and the second program part, the method comprising:

assigning an actual state from a predefined set of possible states to the first processing unit and assigning a second actual state from the predefined set of possible states to the second processing unit on the basis of a state of the respective installation routine and on the basis of respective updating progress of the first program part and of the second program part during updating of the application program; and

after the system has been restarted or when successful storage of the first program part and of the second program part is identified or when an error is identified when storing the first program part and/or the second program part, carrying out predefined processing steps respectively in a predefined order by the first processing unit and by the second processing unit on the basis of the assigned actual state of the first processing unit and the assigned second actual state of the second processing unit,

wherein the set of possible states comprises a first state representing a first valid program part or a second valid program part and a respective inactive installation routine, a second state representing a first valid program part or a second valid program part and a respective active installation routine, and a third state representing a first invalid program part or a second invalid program part and an active installation routine of the first processing unit or of the second processing unit.

2. The method as claimed in claim 1, further comprising, after the system has been restarted or when the successful storage of the first program part and of the second program part is identified or when the error is identified when storing the first program part and/or the second program part, respectively assigning a new actual state on the basis of the assigned actual state of the first processing unit and the assigned actual second state of the second processing unit trader predefined conditions according to the following rule:

if the first processing unit is in the first state and the second processing unit is in the second state, the second processing unit can return to the first state or the first processing unit must change over to the second state,

if the first processing unit is in the first state and the second processing unit is in the third state, the first processing unit must change to the second state,

if the first processing unit is in the second state and the second processing unit is in the first state, the second processing unit can change to the second state or the first processing unit must return to the first state, and

the respective actual states remain the same in all other cases.

3. The method as claimed in claim 2, further comprising, when the successful storage of the first program part and of the second program part is identified, first returning the first processing unit to the second state insofar as it is not already in said state, and then changing the second processing unit to the first state.

4. The method as claimed in claim 1, wherein two binary flags are respectively used to characterize the actual state of the first processing unit and the actual state of the second processing unit, a respective first binary flag represents an inactive or active installation routine of the first processing unit or of the second processing unit depending on its binary state, and a respective second binary flag represents a valid or invalid first program part or second program part depending on its binary state.

5. The method as claimed in claim 4, further comprising, after the system has been restarted or when the successful storage of the first program part and of the second program part is identified or when the error is identified when storing the first program part and/or the second program part, carrying out the predefined processing steps in a predefined order by the first processing unit and by the second processing Unit on the basis of the binary states of the respective first binary flags and second binary flags.

6. The method as claimed in claim 5, further comprising, when the successful storage of the first program part and of the second program part is identified, resetting the binary states of the respective first binary flags and second binary flags to the binary state representing a valid program part or an inactive installation routine in a predefined order on the basis of the binary states of the respective first binary flags and second binary flags.

7. The method as claimed in claim 1, in which the first processing unit is configured to initiate a start of the updating of the application program and/or to initiate an end of the updating of the application program.

8. The method as claimed in claim 1, in which the second processing unit is configured to decide whether the updating of the application program is started and/or ended.

9. The method as claimed in claim 1, in which the second processing unit is configured to verify integrity of the first program part and/or of the second program part.

10. An IT system comprising:

at least one first processing unit and one second processing unit connected to one another and configured to jointly execute an application program, the first processing unit being assigned a first memory that stores a first program part of the application program, which can be executed by the first processing unit, and the second processing unit being assigned a second memory that stores a second program part of the application program, which can be executed by the second processing unit, the first processing unit and the second processing unit each being assigned an installation routine configured to control updating of the first program part and of the second program part, wherein;

the first processing unit is configured to assign itself an actual state from a predefined set of possible states on the basis of a state of the installation routine assigned to it and on the basis of updating progress of the first program part during updating of the application program,

the second processing unit is configured to assign itself a second actual state from the predefined set of possible states on the basis of a state of the installation routine assigned to it and on the basis of updating progress of the second program part during updating of the application program, and

the first processing unit and the second processing unit are configured to respectively carry out predefined processing steps in a predefined order on the basis of the assigned actual state of the first processing unit and the assigned second actual state of the second processing unit after the system has been restarted or when successful storage of the first program part and of the second program part is identified or when an error is identified when storing the first program part and/or the second program part,

wherein the set of possible states comprises a first state representing a first valid program part or a second valid program part and a respective inactive installation routine, a second state representing a first valid program part or a second valid program part and a respective active installation routine, and a third state representing a first invalid program part or a second invalid program part and an active installation routine of the first processing unit or of the second processing unit.

11. The IT system as claimed in claim 10, wherein the IT system is a digital tachograph, the first processing unit comprises an application controller, and the second processing unit comprises a security controller.