JP5428050B2 - Computer system and module execution method - Google Patents

Description

  The present invention relates to a computer system, and more particularly to a computer system that manages the execution of modules.

  An information control system such as a railway operation management system, once the system is built, is not modified for about 10 to 15 years, and the existing source code included in the system is mainly modified. Or refurbishment. If such modification or modification continues for many years, the source code becomes complicated and difficult to read. In addition, due to the transfer or retirement of experts, the number of human resources who can take a bird's-eye view is reduced. As a result, the system becomes a black box, and a lot of man-hours are required for countermeasures when a failure occurs.

  Therefore, it is required to solve these problems by shifting the black boxed source code in the system to a source code with good visibility, that is, a source code that is easy for the user to understand. In particular, social infrastructure systems such as railway operation management systems are strongly required to secure the current reliability (that is, the reliability of the current system), so the source code does not have to be recreated from scratch. Based on the above, a method of making a white box and recreating it step by step is taken.

  Since the railway operation management system is constructed by combining multiple modules, the developer creates a white box for each module and recreates the module. Therefore, there are a plurality of versions of modules having the same input / output and function of the module.

  One of these different versions of the module is an old version module (hereinafter referred to as an old module) that has the current reliability but is black boxed. The other is a new version of the module (hereinafter referred to as “new module”) that has been white boxed and has a good structure.

  Although this new module has inherited the source code of the old module, the source code configuration has been changed so that it has a good-looking structure. . In the unlikely event that a failure occurs in a new module, it becomes a big problem in a social infrastructure system such as a railway operation management system. Also, since the railway operation management system cannot be stopped, a mechanism that can be restored immediately is necessary.

  Under such circumstances, a technique has been proposed in which a module that can be replaced with a failed module is searched for when a failure occurs, and the operation as a system is continued by replacing the failed module and the module of the search result. (For example, refer to Patent Document 1).

JP 2000-181753 A

  The technique proposed in Patent Document 1 replaces a failed module with another replaceable module. For this reason, it is not possible to obtain information for identifying the cause of the failure, such as how the module in which the failure has occurred, how the result is output, and where there is a difference. Refurbishment becomes difficult. In addition, in order to specify the repair location, various input data are prepared and an operation test is performed, resulting in a huge work cost.

  An object of the present invention is to extract where there is a difference in the execution result of a new module while continuing the operation of the system, and to acquire data for correcting a source code included in the module.

According to a representative aspect of the present invention, there is provided a computer system including a computer that includes a memory and includes a computer that executes a plurality of modules that are programs executable by the computer, the module including the first module, The computer system includes a plurality of generations of the modules including a second generation of the second module after the revision of the first module, and the memory includes a first storage area and a second storage area Stores the same data in the first storage area and the second storage area, executes the first module using the data stored in the first storage area, and then using the data stored in the second storage area, and executes the second module, compares the execution result of the first module, and an execution result of said second module, before Information indicating data to be copied to the second storage area is held, and data whose value is changed among the data stored in the first storage area according to the held information is changed to the second storage area. By replicating to the storage area, the same data is stored in the first storage area and the second storage area, and the second module uses the second data among the data used for execution thereof. The data stored in the storage area is executed using the data stored in the second storage area, and the data stored in the second storage area is not stored in the second storage area. It is executed using data stored in one storage area.

  According to an exemplary embodiment of the present invention, it is possible to obtain a difference between modules in which a failure has occurred.

It is a block diagram which shows the system configuration | structure of the module execution management apparatus of embodiment of this invention. It is explanatory drawing which shows a system in case the module of embodiment of this invention is a single run. It is explanatory drawing which shows a system in case a part of module of embodiment of this invention is a coexistence run. It is explanatory drawing which shows the module definition information of embodiment of this invention. It is explanatory drawing which shows the data definition information of embodiment of this invention. It is explanatory drawing which shows the comparison result information of embodiment of this invention. It is explanatory drawing which shows module management information in case the module of embodiment of this invention is a single run. It is explanatory drawing which shows module management information in case a part of module of embodiment of this invention is a coexistence run. It is explanatory drawing which shows the data management information of embodiment of this invention. It is explanatory drawing which shows the time correction information of embodiment of this invention. It is a flowchart which shows the process of the module execution means of embodiment of this invention. It is a flowchart which shows the process by the mode change means of embodiment of this invention. It is explanatory drawing which shows the example of a display by the comparison result display means of embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS.

  FIG. 1 is a block diagram illustrating a system configuration of a module execution management apparatus 10 according to the embodiment of this invention.

  In addition, although a railway operation management system is used as an example in the system of the present embodiment, the present invention is not limited to the railway operation management system, and the present invention can be applied to any system as long as the system operates by a program. The system described below is a social infrastructure system such as a railway operation management system.

  The module execution management apparatus 10 includes a storage unit 11, a CPU 12, a memory 13, an input unit 14, an output unit 15, and a communication unit 16. The storage unit 11 is a hard disk that stores data and programs. The CPU 12 is a processor for executing a program by performing calculations. The memory 13 stores temporary information related to programs and calculations.

  The input unit 14 is a device such as a keyboard or a mouse for inputting data to the module execution management device 10 by the user. The output unit 15 is a device such as a display for displaying an execution result or the like to the user. The communication unit 16 is an interface for connecting to Ethernet (registered trademark, the same applies hereinafter) or the Internet.

  The storage unit 11 stores data such as module definition information 21, data definition information 22, comparison result information 23, module management information 31, data management information 32, and time correction information 33. The storage unit 11 holds programs such as a module execution unit 41, a mode change unit 42, a comparison result display unit 43, and a module 50 group. The module execution management apparatus 10 loads various programs from the storage unit 11 to the memory 13 and executes various programs by performing calculations using the CPU 12.

  Note that the system of the present embodiment is constructed by combining a plurality of modules 50, and operates by loading the modules 50 in order. When the system operates, data between the modules 50 is exchanged via a shared memory included in the memory 13. Specifically, the input to the module 50 is that the module 50 reads data included in the shared memory, and the output from the module 50 is to output to the shared memory.

  Further, the module 50 includes a module 50 for executing the module 50, such as an address resolution unit 501, a time correction unit 502, and a log output unit.

  The memory 13 in this embodiment holds a shared memory (primary) 131, a shared memory (secondary) 132, and a shared memory (for saving) 133. The shared memory (primary) 131, the shared memory (secondary) 132, and the shared memory (for saving) 133 are areas for storing input values to the module 50, and the calculation results by the module 50 are output by the module 50. It is an area. Note that the shared memory (primary) 131, the shared memory (secondary) 132, and the shared memory (for storage) 133 may be mounted in different memory areas, or the data may be logically divided. May be implemented.

  In the present embodiment, the data that is input / output of the system and that is input to another system is only the data stored in the shared memory (primary) 131, and the shared memory (secondary) 132 and the shared memory (for storage) The data stored in 133 is a copy of the shared memory (primary) 131.

  Further, the module 50 is created as one file by creating a program, that is, by statically linking with another program at the time of creating the module 50, and is created as another file and dynamically linked. There is a case. Although the present invention can be used in either program creation method, the module 50 in this embodiment is a program prepared as a separate file such as DLL (Dynamic Link Library) or SO (Shared Object), It is dynamically linked and called.

  2A and 2B show the outline of the present invention.

  The module execution management apparatus 10 manages three types of modules 50, 50A, 50B, and 50C. For each module 50, an old version (hereinafter referred to as an old module 50) and a new version (hereinafter referred to as a new module 50). (Denoted as module 50).

  Further, the module execution management apparatus 10 has an execution mode for each module 50. There are two execution modes: “single run” and “coexistence run”. “Single run” is a mode in which only the old module 50 or the new module 50 is executed. The “coexistence run” is a mode in which both the old module 50 and the new module 50 are executed. By changing the execution mode, when a problem occurs in the new module 50, information for solving the problem can be collected while continuing the operation as the system.

  In the present embodiment, the problem is that there is a coding error or the like in the module 50, which means that data that the system should originally acquire cannot be acquired.

  FIG. 2A is an explanatory diagram showing a system when the module 50 according to the embodiment of the present invention is a single run.

  In FIG. 2A, module 50A, module 50B, and module 50C are all executed by a new version of “single run”. The module 50A, the module 50B, and the module 50C are controlled by the module execution unit 41, and are executed in the order of the module 50A, the module 50B, and the module 50C. Further, the module 50A, the module 50B, and the module 50C acquire the input value from the shared memory (primary) 131 and return the output result to the shared memory (primary) 131.

  Here, when a problem occurs in the module 50A, the system of the present embodiment is in the state shown in FIG. 2B.

  FIG. 2B is an explanatory diagram showing a system when a part of the module 50 according to the embodiment of the present invention is a coexistence run.

  The module 50A in FIG. 2B is executed by the “coexistence run”, and the modules 50B and 50C are executed by the old version “single run”. This is a result of changing the execution mode because a problem has occurred in the new version of the module 50A shown in FIG. 2A.

  The old module 50 </ b> A, the old module 50 </ b> B, and the old module 50 </ b> C obtain input values from the shared memory (primary) 131 and return output results to the shared memory (primary) 131. Further, the new module 50 </ b> A acquires the input value from the shared memory (secondary) 132 and returns the output result to the shared memory (secondary) 132.

  Since the old module 50 is executed in all the modules 50 shown in FIG. 2B, the operation as the system is executed by the old version of the module 50 that has a history of operation in the past. That is, the version is switched to a version that can operate more safely.

  In addition, the new module 50 and the old module 50 are executed for the problematic module 50A, and the results of the new module 50 are different by comparing the results of the old module 50 and the new module 50. Can be extracted. Then, the source code of the new module 50 can be easily corrected by reviewing the source code of the part that generates a different execution result part.

  In this embodiment, when the module 50 in which the problem has occurred is changed to the “coexistence run”, the module 50 in which the problem has not occurred is also replaced with the old module 50, but all the modules 50 are independent. For example, the module 50 in which no problem has occurred may remain the new module 50.

  Thereafter, in the development of the system, the development of the new module 50 is completed, and a problem occurs in the module 50A of the new version of the module 50 when executing all by the new version “single run” as shown in FIG. 2B, the case of executing by “coexistence run”, and the case of correcting the new version of the module 50A having a problem, and again executing by the new version “single run” mode as shown in FIG. 2A. explain.

  FIG. 3 is an explanatory diagram illustrating the module definition information 21 according to the embodiment of this invention.

  FIG. 3 shows module definition information 21 for managing definition information related to the module 50 used by the module execution management apparatus 10. The module definition information 21 illustrated in FIG. 3 holds definition information regarding the module 50A, the module 50B, and the module 50C, which are the modules 50 used by the system of the present embodiment.

  The module definition information 21 illustrated in FIG. 3 includes a module name 2101, a version 2102, a file name 2103, and a dependency module 2104. The dependency module 2104 includes a name 2105 and a version 2106.

  A module name 2101 indicates the name of the module 50. The modules 50 in the system are executed according to the order of the module names 2101.

  The version 2102 includes an identifier that uniquely indicates the version number of the module 50. In the present embodiment, the identifier of the old version is “1” (hereinafter described as version 1), and the identifier of the new version is “2” (hereinafter described as version 2). Each module 50 included in the module definition information 21 of FIG. 3 includes an old version version 1 and a new version version 2. In this embodiment, the version 2102 is only “1” and “2”, but three or more versions may be stored.

  The file name 2103 indicates the name of the module file that stores the source code of the module 50 and the like.

  When the module 50 has a dependency relationship with another module 50, the module definition information 21 can define a module 50 having a dependency relationship. The dependency module 2104 indicates information on the module 50 having a dependency relationship with the module 50 indicated by the module name 2101. The name 2105 indicates the name of the module 50 having a dependency relationship with the module 50 indicated by the module name 2101, and the version 2106 indicates the version of the module 50 having a dependency relationship with the module 50 indicated by the module name 2101.

  For example, record 213 indicates that in order to execute version 1 module 50B, it is necessary to execute version 1 module 50C together.

  FIG. 4 is an explanatory diagram showing the data definition information 22 according to the embodiment of this invention.

  FIG. 4 shows data definition information 22 for managing definition information related to data included in the shared memory used by the module 50. The data definition information 22 includes a data name 2201, a size 2202, a copy rule 2203, a comparison rule 2204, a shared memory (primary) start address 2205, a shared memory (sub) start address 2206, and a shared memory (storage) start address 2207. .

  The data name 2201 indicates the name of data included in the shared memory used by the system. The data definition information 22 of this embodiment holds definitions of three types of data whose data names 2201 are “station information”, “train information”, and “traffic signal information”.

  A size 2202 indicates the size of data indicated by the data name 2201. In this embodiment, the unit of the size 2202 is a byte.

  The copy rule 2203 indicates that when the module 50 whose execution mode is “coexistence run” occurs, the data indicated by the data name 2201 is transferred from the shared memory (primary) 131 to the shared memory (secondary) 132 and the shared memory (for saving). ) 133 indicates whether or not the data to be copied.

  When the module 50 whose execution mode is “coexistence run” occurs, the comparison rule 2204 indicates that the data indicated by the data name 2201 has a value between the shared memory (primary) 131 and the shared memory (secondary) 132. Indicates whether the data is a comparison target. In the comparison in the present embodiment, the data size is compared for each data, and it is determined whether all are equal or not.

  The shared memory (primary) head address 2205, the shared memory (secondary) head address 2206, and the shared memory (for saving) head address 2207 indicate the head address among the addresses on the shared memory to which the respective data are mapped. .

  For example, since data whose data name 2201 is “station information” is data that cannot be rewritten by the module 50, the copy rule 2203, the comparison rule 2204, the shared memory (secondary) head address 2206, and the shared memory (for saving) head A value is not stored in the address 2207. Accordingly, the module 50 always uses the shared memory (primary) 131 when reading data whose data name 2201 is “station information”.

  On the other hand, data whose data names 2201 are “train information” and “traffic signal information” are data that can be rewritten by the module 50, so the copy rule 2203, shared memory (secondary) head address 2206, and shared memory (for saving) head A value is stored at address 2207. As a result, the old module 50 and the new module 50 can change the access destination addresses by the data.

  That is, when the old module 50 reads the “train information” data, the old module 50 reads the area where the shared memory (primary) head address 2205 is “12000”. When the new module 50 reads “train information” data, the new module 50 reads an area in which the shared memory (sub) head address 2206 is “22000”.

  Further, if necessary, by setting a value in the comparison rule 2204, the execution results of the old module and the new module are respectively compared to verify whether there is a difference.

  Note that “◯” is stored in the copy rule 2203 and the comparison rule 2204 in this embodiment. When the value of the copy rule 2203 is “◯”, the copy rule 2203 indicates that the entire data area indicated by the data name 2201 is copied. When the value of the comparison rule 2204 is “◯”, the comparison rule 2204 is displayed. Indicates that all areas of the data indicated by the data name 2201 are compared.

  The shared memory (primary) start address 2205, the shared memory (secondary) start address 2206, and the shared memory (for storage) start address 2207 have a method of fixing the stored value and the value stored. There is a method to be assigned.

  How the value to be stored is fixed is to be decide in advance which areas are used to reserve space for the addresses to the OS included in the module execution management apparatus 10. In addition, the method of dynamically allocating the module execution management apparatus 10 refers to the data definition information 22 at the time of activation, obtains a necessary size from the data size 2202, the shared memory (primary) 131, the shared memory (secondary) 132, In the shared memory (for storage) 133, an area for the obtained size is secured, and the address of the secured area of the shared memory is stored in the data definition information 22.

  FIG. 5 is an explanatory diagram illustrating the comparison result information 23 according to the embodiment of this invention.

  FIG. 5 shows the contents of the shared memory (primary) 131 and the shared memory (secondary) 132 storing the respective execution results when the module execution management apparatus 10 executes a plurality of new version and old version modules 50. And the comparison result information 23 which stores the result which compared the content is shown. The comparison result information 23 includes a module name 2301, time 2302, data name 2303, timing 2304, data 2305, and determination result 2306.

  The module name 2301 indicates the name of the module 50 in which the new version and the old version are executed together. The time 2302 indicates the time when the module 50 indicated by the module name 2301 is started for comparison.

  A data name 2303 indicates the data name of the target for which the comparison has been made. The timing 2304 indicates at which timing the data stored in the data 2305 is acquired, and the data 2305 indicates the content of the data acquired by the execution of each module 50. In the data 2305, data before executing the module 50, data as a result of executing the old module 50, and data as a result of executing the new module 50 are stored.

  The determination result 2306 indicates the result of comparing the execution results of the new version module 50 and the old version module 50. If there is no difference between the execution result of the new module 50 and the execution result of the old module 50, “OK” is stored in the determination result 2306, and there is a difference between the execution result of the new module 50 and the execution result of the old module 50. If there is, “NG” is stored.

  In addition, when “NG” is stored in the determination result 2306, the position of the data having a difference in the execution result may be stored together with the value of “NG”. For example, in the determination result 2306 shown in FIG. 5, “(second byte to second byte)” indicating the position of the data having a difference may be stored.

  FIG. 6A is an explanatory diagram illustrating the module management information 31a when the module 50 according to the embodiment of this invention is a single run.

  FIG. 6B is an explanatory diagram illustrating the module management information 31b when a part of the module 50 according to the embodiment of this invention is a coexistence run.

  6A and 6B show module management information 31 for managing information related to the module 50 to be executed. 6A shows the module management information 31a in the state of FIG. 2A, and FIG. 6B shows the module management information 31b in the state of FIG. 2B.

  The module management information 31 includes a module name 3101, an execution mode 3102, a single run version 3103, a coexistence run 3104, an old version 3105, and a new version 3106 for each module 50 to be executed.

  A module name 3101 indicates the name of the module 50 to be executed. The execution mode 3102 indicates the execution mode of the module 50 indicated by the module name 3101. The single run version 3103 indicates the version of the module 50 when the module 50 indicated by the module name 3101 is “single run”.

  The old version 3105 included in the coexistence run 3104 indicates the version of the old module 50 when the module 50 indicated by the module name 3101 is “coexistence run”. The version of the new module 50 included in the coexistence run 3104 is also shown.

  For example, the record 31a1 indicates that the execution mode of the module 50A is “single run” and the version 2 module 50A is executed. The record 31b1 indicates that the execution mode of the module 50A is “coexistence run”, and the old module 50 of version 1 and the new module 50 of version 2 are executed together.

  FIG. 7 is an explanatory diagram illustrating the data management information 32 according to the embodiment of this invention.

  FIG. 7 shows data management information 32 for managing an address on the shared memory that stores data referred to by the module 50. The data management information 32 holds the addresses of the shared memory (primary) 131 and the shared memory (secondary) 132 for each execution mode and data type.

  The data management information 32 includes a data name 3201, a shared memory top address 3202 for a single run, a coexistence run 3203, a shared memory top address 3204 for an old module, and a shared memory top address 3205 for a new module.

  A data name 3201 indicates the name of data stored in the shared memory. The single-run shared memory head address 3202 indicates the head address of the shared memory in which data is stored in the “single run”. The shared memory head address 3202 for a single run is all the address of the shared memory (positive).

  An old module shared memory start address 3204 included in the coexistence run 3203 indicates the start address of the addresses of the shared memory in which data referred to by the old module 50 is stored in the “coexistence run”. Also, the new module shared memory start address 3205 included in the coexistence run 3203 indicates the start address of the addresses of the shared memory in which the data referenced by the new module 50 is stored in the “coexistence run”.

  The values of the old module shared memory start address 3204 and the new module shared memory start address 3205 differ from the single run shared memory start address 3202 depending on the value of the copy rule 2203 of the data definition information 22.

  For example, when the data name 3201 is data whose value is not changed by the module 50 such as “station information”, the value is not stored in the copy rule 2203 shown in FIG. It is not copied to (secondary) 132. For this reason, as shown in the record 321 shown in FIG. 7, the old module 50 and the new module 50 refer to the same address.

  On the other hand, when the data name 3201 is data whose value is changed by the module 50 such as “train information” and “traffic signal information”, the value is stored in the copy rule 2203 shown in FIG. Copied between. For this reason, as shown in the record 322 shown in FIG. 7, the old module and the new module refer to different shared memory addresses.

  The data management information 32 is generated from the data definition 22 in accordance with the copy rule 2203 shown in FIG. Therefore, the data management information 32 includes a case where a fixed value is stored and the module execution management as well as the addresses of the shared memory (primary) 131, the shared memory (secondary) 132, and the shared memory (for saving) 133. A value may be dynamically stored when the device 10 is activated.

  FIG. 8 is an explanatory diagram showing the time correction information 33 according to the embodiment of this invention.

  FIG. 8 shows time correction information 33 for correcting a difference in time when the old module 50 and the new module 50 are executed when the execution mode is “coexistence run”. The time correction information 33 holds time information 331 immediately before starting execution of the old module and time information 332 immediately before executing the new module.

  FIG. 9 is a flowchart showing processing of the module execution unit 41 according to the embodiment of this invention.

  The module execution means 41 sequentially executes the modules 50 in the order determined in the module definition information 21.

  The execution of the module 50A in FIG. 2A will be described as an example.

  The module execution means 41 refers to the module management information 31, refers to the execution mode 3102 of the module 50 to be executed, and determines whether it is “single run” or “coexistence run” (step 411). In step 411, the module execution unit 41 refers to, for example, the record 31a1 related to the module 50A of the module management information 31a shown in FIG. Get some information. Then, the module execution means 41 proceeds to step 412 because the execution mode 3102 is “single run”.

  Next, the module execution means 41 refers to the module definition information 21 and executes the module 50 corresponding to the information acquired in step 411 (step 412). For example, when the version of the module 50A to be executed acquired in step 411 is “2”, the module execution means 41 refers to the record 212 of the module definition information 21 shown in FIG. 2 ”is executed.

  The module 50A in FIG. 2A is executed as described above.

Thereafter, the module execution means 41 sequentially executes the modules 50 indicated by the module name 2101 of the module definition information 21 by loop processing.

  Next, the execution of the module 50A in FIG. 2B will be described as an example.

  The module execution means 41 refers to the module management information 31, refers to the execution mode 3102 of the module 50 to be executed, and determines whether it is “single run” or “coexistence run” (step 411). In step 411, the module execution means 41 refers to the record 31b1 related to the module 50A of 31b shown in FIG. 6B, the execution mode 3102 is “coexistence run”, and the old version 3105 included in the coexistence run 3104 is “1”. Yes, information indicating that the new version 3106 included in the coexistence run 3104 is “2” is acquired.

  The module execution means 41 proceeds to step 413 because the execution mode 3102 is “coexistence run”.

  The module execution means 41 refers to the data definition information 22 and the data management information 32 and copies the data on the shared memory (primary) 131 to the shared memory (secondary) 132 and the shared memory (for saving) 133 ( Step 413).

  For example, the module execution means 41 refers to the data definition information 22 shown in FIG. 4 in step 413, so that the record whose value is stored in the copy rule 2203 is the data name 2201 is train information, and the size 2202 is It is acquired that the record 222 is 2000 and the data name 2201 is the traffic signal information and the data of the record 223 has a size 2202 of 4000 bytes. That is, the module execution means 41 is a copy target of data whose data name 2201 is “train information” (size 2202 is 2000 bytes) and data whose data name 2201 is “traffic signal information” (size 2202 is 4000 bytes). Get to be.

  Further, the module execution means 41 refers to the data definition information 22 shown in FIG. 4 and acquires the copy source and copy destination addresses on the shared memory. The module execution means 41 uses the value of the record 222 indicating data whose data name 2201 is “train information”, and the start address “22000” of the shared memory (secondary) 132 and the start address of the shared memory (for saving) 133 An area of “2000” bytes of the start address “12000” of the shared memory (primary) 131 is copied to both of the “32000” area.

  Further, the module execution means 41 uses the value of the record 223 indicating the data whose data name 2201 is “signal information”, and the start address of the start address “26000” of the shared memory (secondary) 132 and the start of the shared memory (for saving) 133. The area of “4000” bytes is copied from the head address “16000” of the shared memory (primary) 131 to both the area of the address “36000”.

  After step 413, the module execution means 41 acquires the current time using a function such as an OS, and stores the acquired current time in the time correction information 33 (step 414). Since the current time acquired in step 414 is the time immediately before the old module 50 is executed and is the base point of the time when the old module 50 is started, the module execution means 41 uses the time correction information 33 shown in FIG. The acquired current time is stored in a record 331 which is a record of the old module execution start time.

  After step 414, the module execution means 41 refers to the module definition information 21 and the module management information 31 and executes the corresponding old module 50 (step 415). For example, the module execution unit 41 refers to the record 31b1 related to the module 50A of the module management information 31b in FIG. 6B and acquires information whose version of the old module 50 is “1”. Therefore, the module execution means 41 executes the file “ma.so.1” with reference to the record 211 of the module definition information 21 shown in FIG.

  After step 415, the module execution unit 41 acquires the current time using a function such as an OS, and stores the acquired current time in the time correction information 33 (step 416). Since the current time acquired in step 416 is the time immediately before the new module 50 is executed and is the base point of the time when the new module 50 is started, the module execution means 41 uses the time correction information 33 shown in FIG. The acquired current time is stored in the record 332 which is a record of the new module execution start time.

  After step 416, the module execution means 41 refers to the module definition information 21 and the module management information 31 and executes the corresponding new module 50 (step 417). For example, the module execution unit 41 refers to the record 31b1 related to the module 50A of the module management information 31b of FIG. 6B, and acquires information that the version of the new module 50 is “2”. Therefore, the module execution unit 41 executes the file “ma.so.2” with reference to the record 212 of the module definition information 21 shown in FIG.

  After step 417, the module execution means 41 refers to the data definition information 22 and the data management information 32, and outputs the data of the shared memory (correct) 131 from which the execution result of the old module is output and the execution result of the new module. The data in the shared memory (secondary) 132 is compared, and the comparison result is stored in the comparison result information 23 (step 418).

  For example, the module execution unit 41 refers to the record 222 and the record 223 shown in the data definition information 22 of FIG. 4, and the data name 2201 is “train information”, the size 2202 is 2000 bytes, and the data name 2201 is It is acquired that the “traffic signal information” and the data having a size 2202 of 4000 bytes are data for comparing the results generated by the old and new modules 50.

Therefore, the module execution means 41, for the data whose data name 2201 shown in FIG. 4 is “train information”, follows the record 222 shown in the data definition information 22 of FIG. 5 is compared with an area for “2000” bytes with the starting point “22000” of the shared memory (sub) 132 as a base point, and the comparison result is shown in FIG. The comparison result information 23 is output.

  Then, the module execution means 41 records the record 231 shown in FIG. 5, that is, for the record in which the module name 2301 indicates the module 50A and the data name 2303 is “train information”, the data after the execution of the old module 50 is “0010. ”Is acquired. Further, the data after execution of the new module 50 is “0020...” By the record 231, and the result of comparing the execution results of the old and new modules 50 is “NG (2nd byte to 2nd byte)”. To get. As described above, “NG” means that the execution results of the old and new modules 50 are different.

  On the other hand, for the data whose data name 2201 shown in FIG. 4 is “traffic signal information”, the module execution means 41 follows the record 223 of the data definition information 22 shown in FIG. 4 and the first address “16000” of the shared memory (primary) 131. 5 is compared with the area of “4000” bytes with the starting point “26000” of the shared memory (sub) 132 as the base point, and the comparison result is shown in FIG. The result information 23 is output.

  Then, the module execution means 41 records the record 232 shown in FIG. 5, that is, for the record in which the module name 2301 indicates the module 50A and the data name 2303 is “signal information”, the data after execution of the old module 50 is “3333. ”Is acquired. Further, it is acquired from the record 232 that the data after the execution of the new module 50 is also “3333...” And the result of comparing the execution results of the old and new modules 50 is “OK”. As described above, “OK” means that the execution results of the old and new modules 50 are equal.

  In addition, since the data before the execution of the new and old modules 50 is stored in the shared memory (for storage) 133, the module execution means 41 is shared when storing the comparison result of the aforementioned data in the comparison result information 23. Referring to the memory (for saving) 133, the data before the execution of the new and old modules 50 is stored in the data 2305 whose timing 2304 in FIG.

  The execution of the module 50A in FIG. 2B, that is, Steps 413 to 418 shown in FIG. Thereafter, when there is a module 50 to be executed following the module 50A, the module execution means 41 repeats the flow shown in FIG.

  Note that when the module execution unit 41 executes the module 50 in step 412, step 415, and step 417, the module execution unit 41 uses the address resolution unit 501, the time correction unit 502, and the log output unit 503.

  As described above, when the module 50 such as Step 412, Step 415, and Step 417 accesses data on the shared memory, the access destination address differs depending on the execution mode. Therefore, the module execution means 41, in step 412, step 415, and step 417, according to the execution mode of the module 50 to be executed from now on, the correspondence table between the data name 3201 such as the data management information 32 and the address on the shared memory. Is notified to the address resolution means 501 of the module 50.

  The address resolution unit 501 refers to the correspondence table between the data name 3201 notified from the module execution unit 41 and the address on the shared memory, resolves the address from the data name 3201 to be accessed, and then accesses the data. .

  Further, when the execution mode is “single run”, the module execution means 41 may use the current actual time. However, when the execution mode is “coexistence run”, the module execution means 41 executes the new module 50 after executing the old module 50, and therefore the time when the module 50 is executed differs. A slight time difference in the system can affect the outcome of the process.

  Therefore, the time correction means 502 refers to the time correction information 33, calculates the corrected time, and returns the corrected time to the module 50 being executed in step 417. The corrected time is “real time−difference in execution start time between the old module 50 and the new module 50 + α”. “+ Α” is a value for adjusting the time required for overhead such as process switching. “Α” may be a negative value.

  For example, as shown in FIG. 8, when the execution start time of the old module 50 is “10: 00: 00.100” and the execution time of the new module 50 is “10: 00: 10.150”, The difference in execution start time between the module 50 and the new module 50 is 0.050 seconds. Furthermore, in step 417, when the actual time acquired by the new module 50 during execution is “10: 00: 00.1070” and “+ α” is 0, the time correction unit 502 sets “10:00 Is calculated by subtracting 0.050 second from “10.170”, and the calculated time is returned to the new module 50 as the corrected time.

  As described above, the time correction unit 502 corrects the time according to the execution mode, acquires the time treated as the current time, and returns the time to the module 50.

  The time correction unit 502 stores the execution start time of the old module 50, and returns the execution start time of the old module 50 stored when the old module 50 and the new module 50 make a current time acquisition request. The time may be corrected.

  Further, when the module 50 outputs a log (journal) to a file, if the old module 50 and the new module 50 output logs to the same log file, the logs are mixed, and the module 50 that has been finally executed has no log. It is also unknown which module has been output, and it is also unknown which module 50 has been executed. Therefore, the log output unit 503 causes the module 50 executed in the “single run” and the module 50 executed as the old module 50 in the “coexistence run” to output the original log file, and in the “coexistence run”. The module 50 executed as a new module is output to another log file.

  Since the system of this embodiment employs the execution result of the old module as actual data, the log output unit 503 leaves the log of the process finally executed in the original log file. Note that the log output unit 503 adds information such that the execution result of the new module 50 executed in the “coexistence run” can also be recognized as the execution result of the new module 50, and logs the original log file. It may be output.

  FIG. 10 is a flowchart showing processing by the mode changing unit 42 according to the embodiment of this invention.

  After the module execution unit 41 executes the module 50, especially after step 412, the mode change unit 42 detects inconsistency in the execution result data in the verification of the execution result by the user, and the operation of the system as it is is dangerous. It is activated when it is determined that there is a parameter or when a parameter is specified from the user via the input unit 14 such as an external console. That is, the mode changing unit 42 is activated when a problem such as a failure occurs in the system or when a test by the user is performed.

  The mode change means 42 is activated by specifying the name of the module 50 to be switched, that is, the name of the module 50 in which a problem such as a failure has occurred, the failure flag, the changed execution mode, and the version after changing the execution mode. To do. The “failure flag” is a flag stored in the module execution management apparatus 10 automatically or manually when a problem occurs in the specific module 50 as described above.

  Hereinafter, an example in which the execution mode is changed from FIG. 2A to FIG. 2B when a problem occurs in the module 50A will be described. In FIG. 10, since a problem has occurred in the module 50A, the mode change means 42 has the name of the module 50 “A (module 50A)”, the failure flag is “ON”, and the changed execution mode is “coexistence”. It is assumed that the parameter “run” is specified and started.

  In the present embodiment, when the execution mode is “coexistence run”, it is designated in advance that it coexists with the previous version, but an arbitrary version may be designated by the user.

  The mode changing unit 42 determines whether the failure flag is ON or OFF (step 421). Here, since the failure flag is ON, the process proceeds to step 422.

  The mode changing unit 42 changes the execution mode of the designated module 50A to “coexistence run” (step 422). In step 422, the mode changing unit 42 changes the record related to the module 50A of the module management information 31 used until a problem occurs, as shown in the execution mode 3102 of the record 31b1 shown in the module management information 31b of FIG. 6B.

  Further, the mode change unit 42 refers to the module definition information 21 shown in FIG. 3 and acquires that the previous version of the version 2 executed as the module 50A until the problem occurs is “1”. Then, “1” is stored in the old version 3105 of the record related to the module 50 </ b> A of the module management information 31, and “2”, which is the version of the module 50 </ b> A until the problem occurs in the new version 3106. Thereby, the mode changing means 42 generates a record 31b1 shown in FIG. 6B.

  After step 422, the mode changing unit 42 changes the execution mode 3102 of the modules 50 other than the designated module 50A to “single run” by the old module 50 (step 423). Since the old version 3105 of the module 50A is “1” in step 423, the mode change means 42 also records the records 31b2 and 31b3 of the module management information 31b in FIG. As described above, “single run” is stored in the execution mode 3102, and “1” is stored in the version 3103 of the single run.

  Thereby, the mode changing means 42 generates the record 31b2 and the record 31b3 shown in FIG. 6B. In the present embodiment. The version 3103 of the module 50B and the module 50C is the same “1” as the old version 3105 of the module 50A. However, if the system can maintain the current reliability when operating together with the version “1” of the module 50A, Any version is acceptable.

  As described above, the mode changing unit 42 changes the execution mode of the module 50A to “coexistence run” as shown in FIGS. 2A to 2B.

  Hereinafter, an example in which the execution mode of the module 50A is changed from “coexistence run” to “single run” by the new module will be described. For this reason, the mode changing means 42 has the name of the module 50 “A (module 50A)”, the failure flag “OFF”, the execution mode “single run”, and the version “2”. It is assumed that a certain parameter is specified and started.

  The mode changing unit 42 determines whether the failure flag is ON or OFF (step 421). Since the failure flag is “OFF”, the process proceeds to step 424.

  The mode changing unit 42 changes the execution mode of the designated module 50A to “single run” by the designated version “2” (step 424). In step 424, the mode changing unit 42 stores “single run” in the execution mode 3102 and stores “2” in the version 3103 of the single run as in the record 31a1 related to the module 50A of the module management information 31a in FIG. 6A. To do.

  The mode changing means 42 repeats the above processing for all of the modules 50A, 50B, and 50C, thereby changing the state of “coexistence run” as shown in FIG. 2B to a new module as shown in FIG. 2A. Change to the “single run” status.

  As described above, the execution mode of the module 50A can be changed to “single run” by the new module 50 as shown in FIGS. 2B to 2A.

  In step 422 and step 424 of this embodiment, the mode changing unit 42 changes the execution mode of only the designated module 50. However, when there is a dependency relationship between specific versions of the module 50, the execution mode of the module 50 having the dependency relationship is changed together with the change of the execution mode of the specified module 50.

  For example, the module definition information 21 in FIG. 3 includes the version 2102 “1” of the module 50 (module 50B) whose module name 2101 is “B” and the version 2106 “of the module 50 (module 50C) whose name 2105 is“ C ”. 1 ”and the version 2102“ 2 ”of the module 50 (module 50B) whose module name 2101 is“ B ”and the version 2106“ 2 ”of the module 50 (module 50C) whose name 2105 is“ C ”. It shows that there is a dependency between.

  When the system of the present embodiment is in the state of the module definition information 21 shown in FIG. 3, the mode changing unit 42 sets the module 50 </ b> C to the version 1 “single run” when the module 50 </ b> B sets the version 1 “single run” Change to Further, when the module 50B is changed to the “coexistence run” of version 1 and version 2, the module 50C is also changed to the “coexistence run” of version 1 and version 2.

  Further, when there is a dependency relationship between the module 50A in which the problem has occurred and another module 50, the execution mode of the module 50A in which the problem has occurred is set to “coexistence run”, and there is no problem but the dependency on the module 50A. The execution mode of other related modules 50 is set to “coexistence run”.

  Further, the mode changing means 42 changes the execution mode to “single run” in the old version for the module 50 that is not specified in the above-described step 423, but the reliability of the new version is sufficiently confirmed. May be executed without performing step 423 but in a “single run” according to the new version.

  FIG. 11 is an explanatory diagram illustrating a display example by the comparison result display unit 43 according to the embodiment of this invention.

  FIG. 11 shows an example in which the comparison result display means 43 displays the comparison result information 23 generated when the module 50 is executed by the module execution means 41 by the “coexistence run” to the user. The comparison result display means 43 totals the comparison result information 23 for a certain period of the compared modules 50 and displays the total result.

  The contents displayed by the comparison result display means 43 include the compared module name 431, the period 432 executed by the “coexistence run”, the number of times the module 50 has been executed 433, and the comparison determination result 434. Further, the comparison result display means 43 displays the result of comparing the execution results by the module 50 in the comparison result 435.

  In the period 432 illustrated in FIG. 11, when there is at least one “NG” in the determination result 2306 of the comparison result information 23 illustrated in FIG. 5, “NG” is displayed in the determination result 434. Further, in the period 432 shown in FIG. 11, when all the determination results 2306 of the comparison result information 23 shown in FIG. 5 are “OK”, “OK” is displayed in the determination result 434.

  The comparison result 435 includes a data name 4351, a position 4352, and an NG count 4353. If “NG” is present in the determination result 2306 of the comparison result information 23, the comparison result display means 43 displays the data name 2303 that has become “NG” in the data name 4351, and the data at which position is NG. Is displayed at a position 4352, and the number of times the module 50 has been executed 433 is displayed in the NG number 4353 when the module 50 is executed.

  The position 4352 indicates which data item in the data corresponds to “NG” by referring to the data structure definition (structure definition: not shown) like the data item of “progress permission flag” shown in FIG. You may display whether to do.

  The user can extract the difference in the execution result of the new module 50 by referring to the comparison result 435. Then, by reviewing the part of the source code that generates the execution result part having a difference, it is possible to tie the source code of the new module 50 to correction.

  Further, the user can confirm that the new module 50 is executing the same processing as the old module 50 by testing the new module 50 by “coexistence run” for a long period of time such as 24 hours. If the determination result is “OK” in the long-term test and it is found that the execution results of the old module 50 and the new module 50 are equal, the new module 50 has the current reliability (the reliability provided in the system by the current module 50). ) Can be confirmed. If the new module 50 has the current reliability, the user can determine that the “coexistence run” may be switched to the “single run” by the new module.

  The comparison rule 2204 of the data definition information 22 shown in FIG. 4 indicates “all comparison” in which “◯” is stored and it is verified whether the data size is equal to 2202 or not. However, not only the comparison of all the data size 2202 but also an area not compared with the comparison rule 2204 may be designated.

  For example, in the development from the old module 50 to the new module 50, a part that does not need to be verified by comparison because it has not been changed, or has been sufficiently verified and verification by further comparison is not necessary, the comparison rule The comparison rule 2204 may be set so that the area specified in 2204 is excluded from the comparison range.

  In addition, since the function is expanded when developing from the old module 50 to the new module 50, the comparison rule 2204 is set so that the area that is known to have different output to the shared memory is also excluded from the comparison range. A value may be stored. Furthermore, the comparison method is not only “equal” but also a comparison rule 2204 is set for a specific data item in the data, “the difference between the output result of the old module 50 and the output result of the new module 50 is within a certain range”. It is good. For the data whose function has been expanded in the new module 50, “whether it is a specific value” may be used as the comparison rule 2204.

  In general, the old module 50 does not have a function of switching the address on the shared memory as a reference destination unlike the address resolution unit 501, and often directly refers to the address of the fixed shared memory (primary) 131. . Even if the execution mode is either “single run” or “coexistence run”, the old module 50 always refers to the shared memory (correct) 131, and therefore does not have a function of switching addresses. can do. The new module 50 may have the address resolution means 501. In particular, when the new module 50 is developed so that the source code has good visibility, the address resolution means 501 can have a part for managing data by separating data and processing.

  As described above, the present invention manages and executes the modules 50 constituting the system in a large-scale information control system that is operated for a long time and requires high reliability such as a railway operation management system.

  The system of the present invention manages a plurality of versions of the module 50, and each module 50 has two execution modes: a single version “single run” mode and a plurality of versions “coexistence run” mode. When a problem occurs in the module 50, the system switches from the “single run” mode to the “coexistence run” mode.

  In the “single run” mode, the module 50 is executed using the shared memory (primary) 131. In the “coexistence run” mode, the data of the shared memory (primary) as the input of the module 50 is copied to another shared memory (secondary) 132 and the old version of the module 50 is executed using the shared memory (primary) 131. Then, the new version of the module 50 is executed using the shared memory (secondary) 132. The contents of the shared memory (primary) 131 that stores the output of the old version module 50 and the shared memory (secondary) 132 that stores the output of the new version module 50 are compared. Output the difference.

  According to the present invention, the execution of the new module 50 is performed by comparing and verifying the execution result of the reliable old module 50 and the execution result of the new module 50 in which a problem has occurred while continuing the operation as the system. You can extract where in the results there are differences. Then, by reviewing the source code of the part that generates a different execution result part, the source code of the new module 50 can be corrected. At that time, by referring to the data including the input before the execution of the module 50, it is possible to grasp at what input the difference occurs.

10 Module Execution Management Device 11 Storage Unit 12 CPU
13 Memory 14 Input unit 15 Output unit 16 Communication unit 21 Module definition information 22 Data definition information 23 Comparison result information 31, 31a, 31b Module management information 32 Data management information 33 Time correction information 41 Module execution unit 42 Mode change unit 43 Comparison result Display means 50, 50A, 50B, 50C Module 131 Shared memory (correct)
132 Shared memory (secondary)
133 Shared memory (for storage)
501 Address resolution means 502 Time correction means 503 Log output means

Claims (13)

A computer system including a computer and a computer that executes a plurality of modules that are programs executable by the computer,
The module includes a plurality of generations of the modules, including the first module and a second generation of the second module after revision of the first module ;
The memory includes a first storage area and a second storage area. The computer system includes:
Storing the same data in the first storage area and the second storage area;
Executing the first module using data stored in the first storage area;
Thereafter, using the data stored in the second storage area, the second module is executed,
Comparing the execution result of the first module with the execution result of the second module ;
Holding information indicating data to be replicated in the second storage area;
According to the held information, among the data stored in the first storage area, the data whose value is changed is duplicated in the second storage area, whereby the first storage area and the first storage area are copied. Store the same data in two storage areas,
The second module is executed using the data stored in the second storage area for the data stored in the second storage area among the data used for the execution, The computer system is characterized in that data that is not stored in the second storage area and whose value is not changed is executed using the data stored in the first storage area . The computer system is
Before the problem occurs in the second module, the second module is executed using the data stored in the first storage area,
The computer system according to claim 1, wherein when a problem occurs in the second module, the second module is executed after the first module is executed. The computer system is
Holding dependencies between the plurality of modules;
When executing the first module and the second module, the fourth module that is dependent on the second module is identified,
A third module of an old generation that is dependent on the first module and that is before the revision of the fourth module;
The computer system according to claim 1, wherein the third module and the fourth module are executed. The computer system, when executing the second module , executes a module of a generation that matches the first module for a module that is not dependent on the second module. The computer system according to any one of 1 to 3.   The computer system is
  Of the execution results of the first module and the execution results of the second module, information indicating data to be compared is retained,
  5. The data for comparing the execution result of the first module and the execution result of the second module according to the information indicating the data to be compared is generated. The computer system as described in one.   The memory includes a third storage area;
  The computer system is
  Copying the data stored in the first storage area to the third storage area;
  The data for comparing the execution result of the first module, the execution result of the second module, and the data copied to the third storage area is generated. To 5. The computer system according to any one of 5 to 5.   The computer system is
  Obtaining a time at which the first module is executed and a time at which the second module is executed;
  Calculating a time difference between the time when the acquired first module is executed and the time when the acquired second module is executed;
  7. The time used for executing the second module is corrected based on the time when the acquired second module is executed and the calculated time difference. The computer system as described in one.   The computer system is
  Obtaining a time at which the first module is executed;
  7. The computer system according to claim 1, wherein the first and second modules are executed according to a time at which the first module is executed. 8.   A module execution method by a computer that includes a memory and executes a plurality of modules that are programs executable by the computer,
  The module includes a plurality of generations of the modules, including the first module and a second generation of the second module after revision of the first module;
  The memory includes a first storage area and a second storage area.
  The method
  The computer stores the same data in the first storage area and the second storage area,
  The computer executes the first module using data stored in the first storage area,
  Thereafter, the computer executes the second module using the data stored in the second storage area where the data is duplicated,
  The computer compares the result of the execution of the first module with the result of the execution of the second module;
  The computer holds information indicating data to be copied to the second storage area,
  The method
  The computer copies the data whose value is changed among the data stored in the first storage area in accordance with the held information to the second storage area, thereby the first storage. Storing the same data in the area and the second storage area;
  The computer uses the data stored in the second storage area for the data stored in the second storage area among the data used for the execution of the second module. The module execution method is characterized in that data that is executed and is not stored in the second storage area and whose value is not changed is executed using the data stored in the first storage area.   Before a problem occurs in the second module, the computer executes the second module using data stored in the first storage area,
  10. The module execution method according to claim 9, wherein when a problem occurs in the second module, the computer executes the second module after executing the first module.   The computer maintains dependency relationships between the plurality of modules,
  The method
  When executing the first module and the second module, the computer specifies the fourth module that is dependent on the second module;
  The computer identifies a third module of an older generation that is dependent on the first module and that is before the revision of the fourth module;
  The computer executes the third module and the fourth module;
  11. The module execution method according to claim 9, wherein the computer executes a module of a generation that matches the first module for a module that is not dependent on the second module.   The computer holds information indicating data to be compared between the execution result of the previous first module and the execution result of the second module,
  The memory includes a third storage area;
  The method
  The computer replicates data stored in the first storage area to the third storage area;
  The computer generates data for comparing the result of executing the first module and the result of executing the second module according to the information indicating the data to be compared,
  The computer generates data for comparing the execution result of the first module, the execution result of the second module, and the data copied to the third storage area. The module execution method according to any one of claims 9 to 11.   The method
  The computer obtains a time at which the first module is executed and a time at which the second module is executed;
  The calculator calculates a time difference between a time at which the acquired first module is executed and a time at which the acquired second module is executed;
  The computer corrects a time used to execute the second module based on the time when the acquired second module is executed and the calculated time difference. The module execution method according to any one of 1 to 12.

Images