Abstract:
The invention relates to the computer engineering, and its usage ensures the possibility to recognize in due time the failures being occurred during operation of the program computing means, and to response respectively for the failure of each type. The method is realized in a program computing means (PCM) comprising a processor operating under the control of a predetermined operating system and intended for processing data under the control of at least one program being executed; a core memory intended for storing said at least one program being executed and data being processed; time interval sequence generators. The technical result is achieved owing to performing steps of: defining in advance the states of the program being executed different from the start and end states thereof, hereinafter referred to as the restart points, for resuming the operation of the program being executed after a failure during execution thereof; in the case of failure occurrence, determining the following failures in the PCM operation: a) an error in storing the core memory content, determined by checking a respective part of the core memory content; b) a control transfer to a wrong command, determined by monitoring the correctness of every control transfer in the processor; and c) various time interruptions determined by monitoring a run duration of a respective part of the program being executed and predetermined operating system; while processing a respective interruption and upon occurrence of anyone of the failures being recognizable, in the case of allowable conditions for continuing the operation, restarting the execution of said program being executed beginning with the nearest restart point preceding to this interruption.

Description:
RELATED APPLICATIONS 
       [0001]    This application is a Continuation of PCT application serial number PCT/RU2006/000693 filed on Dec. 25, 2006 which is incorporated herein by reference in its entirety. 
         [0002]    This application claims priority to Russian Patent Application No. 2005140748, filed on Dec. 27, 2005, which is incorporated herein by reference in its entirety. 
     
    
     BACKGROUND OF THE INVENTION 
       [0003]    This invention relates to the computer engineering, and particularly to the method for ensuring the reliable operation of the program computing means. 
         [0004]    The reliable operation of any computing means utilizing a software is an actual question up to now. Numerous implementations made in this direction are already known. 
         [0005]    Thus, the RU 2011216 C1 (15 Apr. 1994) describes an apparatus for managing a control computing machine, which apparatus manages, while proceeding to an interruption processing, a timing chart portion that is common for external and internal interruptions. 
         [0006]    The RU 2050588 C1 (20 Dec. 1995) describes the method for managing and debugging real time programs and the apparatus for implementing thereof. This method has four modes for localizing an error, each of which modes comparing an address of some cell with the address set with tumblers. 
         [0007]    The RU 2066877 C1 (20 Sep. 1996) describes the apparatus for managing an electronic computer detecting the control altering errors by comparing the real addresses with admissible ones. 
         [0008]    The RU 2094842 C1 (27 Oct. 1997) discloses another apparatus for managing a control computer, which apparatus manages the correctness in addressing modules of said computer, the correctness in switching the sequence of interrupt service routines, and correctness in proceeding to a new linear program part. The RU 2001118437 A1 (10 Jun. 2003) describes the method for sharing time of the central processing unit between tasks in computerized systems for controlling technological processes using the planning management file. In this method which is based on the allocation of priorities in processing the jobs, a cycle of job switch sequence in accordance with their ranking defined yet at the design stage is assigned. 
         [0009]    The U.S. Pat. No. 5,966,530 A (12 Oct. 1999) discloses the method for restoring the instruction boundary machine states. In this method, each instruction, at the moment of its issue, is assigned an identifying mark bound with the location in the memory. Data on this location is upgraded in response to instruction activity status changes. 
         [0010]    The U.S. Pat. No. 6,374,364 B1 (16 Apr. 2002) describes the fault tolerant computing system using instruction counting, wherein an interruption occurs after a predetermined number of instructions have been executed. 
         [0011]    The US 2002/0178209 A1 (28 Nov. 2002) discloses the method for determining the load of a computing element, wherein the program is subdivided into several tasks, and time intervals between interruptions are selected such that at least one task is started and ended during the time interval. 
         [0012]    All these known methods ensure some increase of the program computing means operation reliability, however, each being directed onto solving some particular task. 
         [0013]    The analogue closest to the claimed invention is described in the U.S. Pat. No. 5,911,040 A (8 Jun. 1999). The computing system disclosed in this document is fault tolerant due to the fact that, upon detecting an error while running the program, a step of returning to the previous checkpoint is carried out, and the program restarts from this checkpoint, the checkpoint set being held in the processor memory. However, this method does not ensure the required reliability too, since it does not recognize types of failures (errors), and hence it is not able to correct those failures (errors) in various manners depending on the type thereof. 
       SUMMARY OF THE INVENTION 
       [0014]    The object of this invention is in developing such a method for ensuring a reliability in the operation of any program computing means (PCM), which could avoid disadvantages of analogues existing in the background, i.e., would ensure a possibility to recognize timely the failures occurred during the PCM operation, and to respond accordingly to the failure of each type. 
         [0015]    In order to solve the set task and to achieve the indicated technical result, the present invention provides a method for ensuring the reliable operation of the program computing means (PCM) including at least: a processor operating under the control of a predetermined operating system and intended for processing data under the control of at least one program being executed; a core memory intended for storing said at least one program being executed and data being processed; time interval sequence generators; the method comprising steps of: defining in advance at least one state of said program being executed different from the start and end states thereof, which state being hereinafter referred to as the restart point and intended for resuming the operation of said program being executed after a failure during execution thereof; when executing, in the PCM, said program being executed, in the case of failure occurrence, determining, due to respective monitoring, the following failures in the PCM operation: a) an error in storing the core memory content, which error being hereinafter referred to as the M-type interruption and determined by checking a respective part of the core memory content; b) a control transfer to a wrong instruction, which transfer being hereinafter referred to as the C-type interruption and determined by monitoring the correctness of every control transfer in the processor; and c) various time interruptions being hereinafter referred to as the T-type interruptions determined by monitoring a run duration of a respective part of the program being executed and predetermined operating system; while processing a respective one of said interruption types and upon occurrence of anyone of the failures being recognizable, in the case of allowable conditions for continuing the operation, restarting the execution of said program being executed beginning with the nearest restart point of said program being executed preceding to this interruption; if the determined failure appears again during the following attempts to restart said program being executed, stopping the execution of the program being executed and recording the presence of the respective failure during execution of the program being executed. 
         [0016]    Other features and advantages of the claimed method would be obvious from the following specification and appended claims. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0017]    The present invention is illustrated with the drawings, where similar elements are denoted with the same reference numbers, and wherein: 
           [0018]      FIG. 1  illustrates the general mechanism of the PCM memory operation; 
           [0019]      FIG. 2  is the flow chart of the PCM operation in the case of processing the M-type interruptions; 
           [0020]      FIG. 3  is the flow chart of the PCM operation in the case of processing the C-ty[rho]e interruptions without addressing a routine; 
           [0021]      FIG. 4  is the flow chart of the PCM operation in the case of processing the C-type interruptions in the case of addressing a routine; 
           [0022]      FIG. 5  is the flow chart of the PCM operation in the case of processing the T-type interruptions for the system time; 
           [0023]      FIG. 6  is the flow chart of the PCM operation in the case of processing the M-type interruptions for the program time. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       [0024]    Prior to describing the proposed method, it is necessary to make some explanations. 
         [0025]    During the operation of any system being the program computing means (PCM) or in which the PCM is employed (as known from the background, e.g., from the closest analogue, the U.S. Pat. No. 5,911,040 A), it is necessary to recognize, automatically and as early as possible, an occurred failure of the computing process in such a system. Otherwise, such unrecognized failure leads, in short time (not more than one millisecond) and with the probability close to 1, to a fault of the whole system. 
         [0026]    Any computing process in any PCM, during normal behavior of the process, is set in an arbitrary time moment by condition of programs and data recorded in the PCM memory at the time of executing the current instruction, and by correct execution of this instruction by the whole aggregate of devices in the system. Hence it follows that for any deviation from the normal execution, whether due to failures in the hardware, or due to errors in initial data or program, the recognition of such deviation is realized formally in a certain cause-and-effect combination of only three different forms:
       nonconservation of the memory content (M-type failure, from the word “Memory”),—this is, e.g., a hardware failure or core memory fault, which is determined by the parity check unit when executing the current instruction, or an unauthorized record into the core memory, or a nonconservation of register state of some external device;   wrong control transfer in the processor (C-type failure, from the word “Control”),—this is, e.g., a false detection or false skip of the interruption from the external device, or an unauthorized control transfer into an arbitrary address of the core memory;   illegal operation time (T-type failure, from the word “Time”),—this is, e.g., an inadmissible quick or slow response of an external device, or a program cycling, or a processor halt.       
 
         [0030]    The proposed invention just monitors failures of all three types in order to ensure a quick localization of disturbance in the system and isolation the system from the disturbance influence. For this purpose, excess system resources are used. In a single-processor system having the memory page organization, such resources are: 
         [0031]    for the processor,—an excess of the available processor time relative to the time required for executing the main system tasks (the single resource of the processor, which is created by the processor&#39;s relative speed), 
         [0032]    for the core memory,—the per-page equivalence or repeatability of programs or data within saving the inter-page relations. 
         [0033]    The general form of excessiveness of any external (for the given system) device or subsystem of an underlying layer (in the given system) is as follows: the presence of one or more stable states of the external device or subsystem, the emergency transfer, as quick as possible, into the nearest stable state when needed, and the possibility for continual repetitions in the case of failed attempts to use the external device or subsystem from the given system&#39;s end. 
         [0034]    The proposed invention is based on the usage of said excessive resources, the usage occupying only several percents of the PCM processor time and memory. One would speak conditionally about creating the M-service, C-service, and T-service of the reliability in the PCM. 
         [0035]    The concept of the M-service is based on designing a recognizer for coinciding the essential parts of the real value in the core memory and registers of external devices to the required (theoretical) value of the same parts in respective time moments. To realize such recognizer of maintenance of the core memory state, each memory page should be divided into two parts: monitored and unmonitored. Any constant information, i.e., program bodies or data, not varying its value in the course of time greater than some predetermined characteristic value, should be situated in the beginning of the core memory page (the monitored part), and intermediate results having a varying content should be situated in the end of the page or in separate pages (the unmonitored part). 
         [0036]    In the first words of the page, the length of the constant part of this page and the supplement to the checksum of this constant part should be located. Then, upon interruption while checking by the parity check unit or in another hardware-software conflict, as well as periodically, a subroutine dedicated specifically for this purpose could determine an occurrence of the M-type failure and give the information necessary for taking care on regenerating or replacing this page. 
         [0037]    The concept of the C-service is based on determining the loss of control, which leads to a wrong control transfer. 
         [0038]    In order to determine the loss of control, which leads to the control transfer into the unused memory, it is necessary to record into all unused words of pages, as well as into the zero and last words of the used pages the trap instruction like CALL LCONT for calling the system subroutine intended for analyzing the loss of control. Then, in the case of accidental control transfer into such addresses, the call to this system procedure will occur with the indication of the possible conflict place. Thus, direct linear control transfers from the current page into the next one are prohibited. 
         [0039]    In the case of the loss of control, which leads to the control transfer into the used memory, i.e., into the area of programs, data, or intermediate results, either a hardware interruption of the processor under an impossible instruction (executing a “hash”), or an accidental control transfer into the memory area in the core memory will occur with probability close to one. One of the possible techniques to design the mechanism for separating accidental control transfers from the right (really programmed) control transfers is the known formalism of statement parentheses, i.e., the representation of executable operator sequence of the program in the form of blocks strictly nested one in another. If one has compiled in advance the description of parentheses structure in using the program pages for each of the tasks being solved, then it is sufficient to replace in all programs the direct control transfers from page into another page with accessing the system program BONDTO for control transfer analysis, which is especially designed for indicating in general a progress of the computing process along the respective parentheses structure. Then an accidental control transfer will not coincide with the indicated previous state of the processor, which fact will be determined by this special program with probability close to one. Realization of this mechanism requires choosing the memory distribution for the specific program only on the base of designing its strict logic block diagram in accordance with the principles of the structured programming (see [1, 2]). 
         [0040]    An important instance for organizing the C-service is the case of calling the subroutine under the command JSR, i.e., the control transfer with return. For this case, the mechanism for separating accidental control transfers from the right ones must be as follows. AU subroutine calls must be replaced with the call to the system subroutine BONDSR with the indication of the required program address as the argument. Upon receiving the total information on arrangement of the call and required program in the core memory, the subroutine BONDSR checks the validity of calling the required subroutine, and then performs the direct call of this subroutine. Upon completing the operation of this subroutine, the validity of the control return is checked, and the control is returned to the continuation of the main program. Such a mechanism would allow to determine, with probability close to one, the accidental control transfers to subroutine bodies and the losses of control during the program execution. 
         [0041]    Yet another kind of the accidental control transfer does not determined by all said mechanisms of the C-service. This is the control transfer forward or backward within the parentheses structure operating without its corruption at the moment. Such a failure leads, in the former case, to the super quick program execution (missing a part of operators), and in the latter case, to the program cycling. For protecting from such T-failures, the T-service must use three timers of the following kinds:
       real-time clock of the microsecond scale (the PCM clock train);   clock of the millisecond scale, which forms the interruptions, e.g., each 20 ms;   system clock of the second scale with a battery power supply independent from power supply network, which system clock has the value of the least significant bit about 1 second and not less than 25-bit register of the second counter (i.e., designed for =3.14×10 sec/year).       
 
         [0045]    Such a set of clock is necessary for ensuring a reliable hardware of the continuous time system service both in the case of failure of some of these clocks, and in the case of the network blackout. In the words following the supplement to the checksum of the page comprising the entrance to the parentheses structure with the monitored duration of the execution, the lower TSMALL and the upper TLARG boundaries for the duration of the execution of this structure should be placed. Then the system programs realizing the time service get the possibility to monitor the implementation of the progression charts of any events in the system from several tens of microseconds, i.e., the characteristic durations of program failure progression, up to tens months including intermediate durations at scales of milliseconds (characteristic actuation times of various electromechanical devices in the system with PCM), seconds (characteristics duration of dialogues with the personnel), and periodic events at intervals of hour, day, etc. 
         [0046]    A general means for overcoming the occurred failure, after recognizing and registering its characteristics, must be a certain predetermined number of attempt to repeat the given branch of the computing process beginning from the nearest previous checkpoint, or restart point, which is specified by the nature of the occurred failure (the checkpoint in the closest analogue, the U.S. Pat. No. 5,911,040 A). 
         [0047]    The method in accordance with the present invention is realized, as discussed above, in any system having a Program Computing Means (PCM). In such a means, the processor executes programs that are stored in the core memory of this processor.  FIG. 1  shows schematically a general mechanism for func-tioning the PCM memory. As usual, this mechanism provides for loading some user program into the user memory area, starting the program, and performing the M-type, C-type, and T-type interruptions being occurred during execution of this program. Each of these interruptions leads to the start of respective handlings, which algorithms are shown in one of  FIG. 2 to 6 . Each of these drawings has the marking similar to the chessboard marking, which facilitates the identifi-ability of respective action in one or another algorithm. The alphabetic part of this marking (i.e., Latin letters in the column labels in the drawings) alters from one Figure to another, and the numerical part (i.e., the numbering of rows in the drawings) remains without change. Herewith, some actions in  FIG. 2  to  6  are designated with Russian letters distinct from the Latin letters, as the steps referred to in the appended claims.  FIG. 2 to 6  include the following acronyms: s/r—subroutine, c/t—control transfer, s_l—system log. 
         [0048]    The flow-chart of the PCM functioning in the case of processing the M-type interruptions is shown in  FIG. 2 . The M-type interruption processing begins from determining the context of the M-type failure (block A 1 ). After that, at the step B), the check is performed, as to whether the context of the program being executed has been saved (block A 2 ). The result of this check (block A 3 ) is recorded in the system log (block A 4  in the case when the context is integral, block B 1  in the case when the context has not been saved). If, at the step B), the context of the program being executed has been saved, then, after recording the characteristics of the happened failure in the system log (block A 4 ), the check is performed, as to whether this failure happened previously (block A 5 ). If the occurred failure did not happen previously, then, at the step T), a context restart point of the program being executed is determined (block A 6 ), after which a re-execution (restart) of the program being executed is performed beginning from the restart point found at the step T). 
         [0049]    If the context of the program being executed has been saved, and the occurred failure happened previously, then, after recording this fact in the system log as the PCM fault in the given configuration (block B 4 ), the check is performed at the step JJ), as to whether such fault happened previously (block B 5 ). If such fault did not happen previously, then the PCM configuration is changed for the program being executed (block B  6 ), and the process proceeds to the mentioned step T), i.e., to the block A 6  for determining the context restart point and for restarting the program being executed. 
         [0050]    If, at the step B), it is recognized that the context of the program being executed has not been saved, then, after recording the characteristics of the occurred M-type failure in the system log (block B 1 ), the check is performed at the step  5 K), as to whether such failure happened previously (block B 2 ). If such failure did not happen previously, then the context of the program being executed is regenerated (block B 3 ), and the process proceeds to the mentioned step T), i.e., to the block A 6  for determining the context restart point and for restarting the program being executed. 
         [0051]    If at the step JJ) or at the step  3 K) is determined that respective fault or failure did happen previously, then the characteristics of the happened system failure is recorded in the system log (block C 1 ), and the check is performed at the step  3 ), as to whether the context of the PCM operating system has been saved (block C 3 ). If the context of said operating system has been saved (block CA-), then this fact is recorded in the system log as a possible failure in the PCM operation (block C 5 ), and the check is performed at the step H), as to whether such failure happened previously (block C 6 ). If such failure did not happen previously, then the process proceeds to the mentioned step T). If it is determined at the step  3 ) that the context of said operating system has not been saved (block C 4 ), or it is determined at the step H) that such failure in the PCM operation did happen previously (block C 6 ), then, at the step JI), all programs running in the PCM are terminated abnormally (block D 3 ), after which the body of said operating system is regenerated (block D 4 ), the system failure is recorded in the system log (block D 5 ), and said operating system is restarted (block D 6 ). 
         [0052]    It should be noted especially, that actions in the columns A and B in  FIG. 2  are related to the program failure, and actions in the columns C and D are related to the system failure. 
         [0053]    The flow-chart of the PCM functioning for processing the C-type interruptions in the case of control transfer is shown in  FIG. 3 , and in the case of accessing the subroutine is shown in  FIG. 4 . The C-type interruption processing begins from determining the fact, what kind of the C-type interruption has happened. Herewith, the context of the occurred C-type interruption (block E 1  in  FIG. 3 ), or the context of accessing the subroutine (block E 5  in  FIG. 4 ) is determined, depending on whether the control transfer in the program being executed or accessing the subroutine has happened. 
         [0054]    In the case of control transfer (see block E 1  in  FIG. 3 ), the check is performed, as to whether this control transfer is the stipulated control transfer (block F 1 ). If this control transfer is the stipulated one, then the execution point of the program being executed is found out at the time diagram thereof (block E 2 ), and the check is performed, as to whether the current time is admissible (block F 2 ). If the found execution point corresponds to the admissible current time, then the execution of the program being executed continues (block E 3 ). If the found execution point does not correspond to the admissible current time, then this fact is recorded in the system log as the T-type failure (block G 3 ), and the check is performed, as to whether such failure happened previously (block H 2 ). If such failure did not happen previously, then the process proceeds to the step B) (see  FIG. 2 ), and if such failure did happen previously, then the process proceeds to the step JX) (see  FIG. 2 ). 
         [0055]    But if (block F 1 ) the control transfer is not stipulated, then the check is performed, as to whether this control transfer is a trap-command (block G 1 ), i.e., is it a command of the control transfer according to the predetermined vector, with which command, when starting the PCM, is filled all the core memory un-used by the programs being executed. Depending on whether this control transfer command is the trap-command or not, either characteristics of the loss of control (block H 1 ), or characteristics of the C-type failure (block G 2 ) are recorded, respectively, in the system log, after which, in the both cases, the check is performed, as to whether such event happened previously (block H 2 ). If such event did not happen previously, then the process proceeds to the step B) (see  FIG. 2 ), and if such event did happen previously, then the process proceeds to the step JS) (see  FIG. 2 ). 
         [0056]    In the case of accessing the subroutine (see block E 5  in  FIG. 4 ), the check is performed, as to whether this accessing is valid (block F 5 ), and if so, then this accessing is carried out, and when returning from this subroutine, the check is performed, as to whether this returning is valid (block G 6 ), and if so, the step of returning to the program being executed is carried out. But if the check of validity of accessing the subroutine (block F 5 ) or the check of validity of returning from the subroutine (block G 6 ) brings to the negative result, then the C-type failure in the case of accessing the subroutine is recorded in the system log, and the check is performed, as to whether such failure happened previously (block H 5 ). If such failure did not happen previously, then the process proceeds to the step B) (see  FIG. 2 ), and if such failure did happen previously, then the process proceeds to the step JS) (see  FIG. 2 ). 
         [0057]      FIGS. 5 and 6  show flow-charts of the PCM functioning for processing the T-type interruptions for the system time and for the program time, respectively. A specific form of the T-type interruption processing depends on the fact, according to what clock&#39;s vector this interruption occurs. These clocks, i.e., at least three independent clock trains of different scales, are generated by the time interval sequence generators included in the PCM. The first of these trains (sequences), hereinafter referred to as the TM clock (from the phrase “time micro”), is the PCM clock train, i.e., it has time lengths about microseconds and even less (depending on the timing frequency of the processor being used), the second of these trains, hereinafter referred to as the TC clock (from the phrase “time centi”), has time lengths about milliseconds, and the third of these trains, hereinafter referred to as the TH clock (from the phrase “time hour”), has time lengths about seconds or minutes, as described above in the general concept of the method of the present invention. Specific values of the time lengths of all three indicated clocks are defined by both the design peculiarities of the PCM being used, and the peculiarities of the software being used in that PCM. 
         [0058]    For processing the system time interruptions ( FIG. 5 ) in the case of interruption according to the TM clock vector, first the values of the TM clock and TC clock are read (block T 1 ), after which the check is performed, as to whether the values of the TM clock and TC clock coincide (block J 1 ), and in the case of coincidence of the values of the TM clock and TC clock, the step of restarting the TM clock is carried out (block  12 ). But in the absence of coincidence of the values of thp TM clock and TC clock, the value of the TH clock is read (block K 1 ), and coincidence of the values of the TC clock and TH clock is checked (block K 2 ). If at this step the values of the TC clock and TH clock coincide, the TM clock failure is recorded in the system log (block J 2 ), and at the step IT) the check is performed, as to whether such failure happened previously (block J 3 ). If such failure did not happen previously, then the step of restarting the TM clock is carried out (block J 4 ), after which the process proceeds to the step  3 ) (see  FIG. 2 ), and if such failure did happen previously, then the process proceeds to the step JI) (see  FIG. 2 ). 
         [0059]    In the absence of coincidence of the values of the TC clock and TH clock, the value of the world astronomical clock, hereinafter referred to as the TW clock (from the phrase “time world”), is read (block L 1 ), and coincidence of the values of the TH clock and TW clock is checked (block L 2 ). If at this step the values of the TH clock and TW clock coincide, then the TC clock and TM clock failure is recorded in the system log (block L 3 ), and the check is performed at the step [Phi]), as to whether such failure happened previously (block K 3 ). If such failure did not happen previously, the step of restarting the TC clock is carried out (block (K 4 ), then the step of restarting the TM clock is carried out (block J 4 ), after which the process proceeds to the step  3 ) (see  FIG. 2 ). But if the check at the step [Phi]) (block K 3 ) determines that such failure did happen previously, the process proceeds to the step JI) (see  FIG. 2 ). 
         [0060]    In the case of interruption according to the TC clock vector, first the values of the TC clock and TH clock are read (block  14 ), after which the check is performed, as to whether the values of the TC clock and TH clock coincide (block J 5 ), and in the case of coincidence of the values of the TC clock and TH clock, the step of restarting the TC clock is carried out (block  15 ). In the absence of coincidence of the values of the TC clock and TH clock, the value of the TW clock is read (block K 5 ), and coincidence of the values of the TH clock and TW clock (block L 5 ) is checked. If at this step the values of the TH clock and TW clock coincide, then the TC clock failure is recorded in the system log (block L 3 ), and the process proceeds to the step [Phi]). 
         [0061]    But if the values of the TH clock and TW clock do not coincide (block L 5 ), then after recording the TH clock failure in the system log (block K 6 ), the check is performed at the step LQ, as to whether such failure happened previously (block L 6 ). If such failure did not happen previously, then the process proceeds to the step  3 ) (see  FIG. 2 ), and if such failure did happen previously, the process proceeds to the step JI) (see  FIG. 2 ). 
         [0062]    In the case of interruption according to the TH clock vector, first the values of the TH clock and TW clock are read (block  16 ), after which the check is performed, as to whether the values of the TH clock and TW clock coincide (block J 6 ), and in the case of coincidence of the values of the TH clock and TW clock, the step of restarting the TH clock is carried out (block  17 ). But if the values of the TH clock and TW clock do not coincide, then the TH clock failure is recorded in the system log (block K 6 ), and the process proceeds to the step LQ (block L 6 ). 
         [0063]    During a real operation of the user application programs with time events, there could be two methods for binding the event time diagrams to the current time. For time processes being controlled by the user program, these event time diagrams could be bound to the relative program time, and for events being not controlled, but called for by the user program, these event time diagrams could be bound to the absolute system time. These alternatives are shown in  FIGS. 6   a  and  6   b , respectively. 
         [0064]    For the relative program event (block M 1  in  FIG. 6   a ) the validity of the moment of occurrence of the event is checked (block N 1 ), and if this moment is valid, the step of returning to the program being executed is carried out. But if the moment of occurrence of that event is not valid, then the program context of the time error is determined (block  01 ), and after recording the occurred T-failure in the system log (block P 1 ), the process proceeds to the step B) (see  FIG. 2 ). 
         [0065]    For the absolute program event (block M 3  in  FIG. 6   b ) the fact of occurrence of this event is determined (block M 4 ), and if this event has been occurred, the step of returning to the program being executed is carried out. But if this event has not been occurred, the context of the program being executed is determined (block N 3 ), and after recording the characteristics of this failure in the system log (block O 3 ), the check is performed, as to whether the context of the program being executed has been saved (block P 3 ). If the context of the program being executed has been saved (block P 4 ), then the step of returning into the program being executed is carried out, and if the context of the program being executed has not been saved, then the process proceeds to the step}K) (see  FIG. 2 ). 
         [0066]    Thus, the method of the present invention ensures the maximum possible account of types of the occurred failures on order to respond to those failures. Herewith, in practice, any fault or failure in the program computing means is recognized in due time, which does not allow this fault or failure to move to the fault of the whole system used such program computing means. An exclusion from this affirmation are all possible disturbances of the time diagrams, which could, by definition of disturbance itself, be recognized only after termination of the time interval for occurrence of this event. 
         [0067]    In conclusion of the specification of this invention, it should be noted that realization thereof does not depend on application peculiarities of the users&#39; programs, and, in this respect, it is applicable for all purposes. At the same time, it is expedient to supplement the abstract monitoring mechanism with specific protections on the users&#39; programs, appearing from the application peculiarities of the process being programmed. Yet one more important consequence of the all-purpose applicability of this invention is the reflexivity, i.e., self-applicability of the claimed method. In other words, this method is applicable also to the operating system realizing thereof.
   [1]. D. Knuth. “The art of computer programming”, v. 1, 2.3, “Addison-Wesley Publishing Company”, 1968   [2]. N. Wirth. “Systematic programming. An introduction”, “Prentice-Hall, inc.”, New Jersey, 1973.