Adaptive integrity levels in electronic and programmable logic systems.

Abstract

Method and apparatus for adaptive integrity levels in electronic and programmable logic systems. In one embodiment, an interface for communication between a first component and a second component is provided. The interface includes logic configured to change an integrity level for communication from the first component to the second component during operation of the first component and the second component.

Description

[Technical field]

[0001] Embodiments of the present disclosure relate generally to integrity levels in electronic systems, and more specifically to components that interact with other components at various integrity levels, where at least one of the components can effectively change its integrity level due to the interaction with another one of the components. [Background technology]

[0002] Electronic systems, programmable systems (e.g., central processing unit (CPU)), and programmable logic (PL)-based systems can be used in a variety of data processing environments. These types of systems may handle different types of communication protocols, such as a communication protocol for data transfer between an integrated circuit (IC) and a memory separate from the IC (e.g., an external memory), and a communication protocol between components within the system. Data transferred between an IC and an external memory may correspond to data transferred by an application executed by or running on the IC to an external memory where data associated with the application is stored. Communication protocols between components within the system may correspond to transactions and messages to maintain consistency of instruction and / or data caches of those components.

[0003] However, communication protocols (both between ICs and external memory, and between components of the system) can experience errors that result in operational errors, data corruption, or other data accuracy issues in the components, or that indicate data security issues. In some cases, detection of such errors is important to maintain the safety and operation of high reliability applications. For example, in functional safety applications, the accuracy of these communication protocols is critical. Communication errors and data corruption can result from a variety of causes, including transient errors, permanent failures in logic or memory elements along the communication path, cybersecurity attacks, and the like.

[0004] However, where the probability of such errors is low, certain standards mandate that compliant devices implement mechanisms to ensure communication accuracy, safety, and / or security and to detect communication errors and data corruption between source and sink points. These mechanisms may include communication protocols using different integrity levels, ranging from no integrity checking, to parity checking or error correction code (ECC) checking, to double, triple, and higher levels of redundant communication channels. Detection of such corruption of information transferred over a communication channel may be detected by an integrity level check. An integrity level check may include eliminating or reducing the risk of failure, detecting failures in a predictable manner, or gracefully reacting to failures in a predictable manner. These integrity level checks may check the integrity of the internal functions of electronic, programmable, and / or PL components in a system and / or check the integrity of communications between components, which may be homogenous components (e.g., multiple application specific integrated circuit (ASIC) components) or heterogeneous components (e.g., a data processing engine (e.g., for artificial intelligence) and a PL fabric component).

[0005] Unfortunately, such integrity level checks often involve redundant processing, communication, and data paths that can result in reduced performance and / or increased resource usage and corresponding costs. Therefore, improved data accuracy mechanisms are desirable. Summary of the Invention [Problem to be solved by the invention]

[0006] The embodiments described herein relate generally to interfaces between system components and methods for selecting and / or changing the integrity level of communications between the system components. Thus, the techniques described herein enable integrity level checking of communication messages, including data transfers, between components having different integrity level checking capabilities. [Means for solving the problem]

[0007] In one embodiment, an interface for communication between a first component and a second component is provided, the interface including logic configured to change an integrity level for communication from the first component to the second component during operation of the first component and the second component.

[0008] In another embodiment, an integrated circuit (IC) is provided that includes an interface for communication between a first component coupled to the interface and a second component coupled to the interface, the interface comprising a communications hub, the interface including logic configured to change an integrity level for communication from the first component to the second component during operation of the first component and the second component.

[0009] In yet another embodiment, a method of communication is provided, the method including determining a first integrity level of a first component, determining a second integrity level of a second component, selecting an integrity level for a first communication from the first component to the second component based on the first integrity level and the second integrity level at an interface between the first and second components, and transmitting the first communication from the first component to the second component over the interface in accordance with the integrity level for the first communication.

[0010] These and other aspects can be understood with reference to the following detailed description.

[0011] So that the above features briefly summarized may be understood in detail, a more particular description can be made by reference to exemplary implementations, some of which are illustrated in the accompanying drawings. It should be noted, however, that the accompanying drawings illustrate only typical example implementations and therefore should not be considered as limiting the scope thereof. [Brief description of the drawings]

[0012] [Figure 1] 1 illustrates an automobile having various sensors and an advanced driver-assistance system (ADAS) in which embodiments of the present disclosure may be implemented. [Diagram 2] 1 shows a block diagram of components of a system implementing an integrity level check in which embodiments of the present disclosure may be practiced. [Figure 3A] 1 shows a block diagram of a system according to an embodiment of the present disclosure. [Figure 3B] 1 shows a block diagram of a system according to an embodiment of the present disclosure. [Figure 4A] 1 illustrates a block diagram of an operation of an integrity level converter according to an embodiment of the present disclosure. [Figure 4B] 1 illustrates a block diagram of an operation of an integrity level converter according to an embodiment of the present disclosure. [Figure 4C] 1 illustrates a block diagram of an operation of an integrity level converter according to an embodiment of the present disclosure. [Figure 4D] 1 illustrates a block diagram of an operation of an integrity level converter according to an embodiment of the present disclosure. [Diagram 5] 1 illustrates an exemplary communications hub having an integrity level translator that implements adaptive integrity levels to support different integrity classes and facilitate communication between two components, according to an embodiment of the present disclosure. [Figure 6] 6 illustrates an example operation by the integrity level translator of FIG. 5 according to an embodiment of the present disclosure. [Figure 7] 1 illustrates an example system including an example adaptive integrity level hub, according to an embodiment of the present disclosure. [Figure 8] 1 depicts a flowchart of a method for communication by components in a system according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] To facilitate understanding, wherever possible, identical reference numbers have been used to designate identical elements common to the figures. It is contemplated that elements of one embodiment may be beneficially incorporated in other embodiments.

[0014] Embodiments of the present disclosure provide methods and apparatus for implementing adaptive integrity levels in electronic and programmable logic systems. In this manner, various components (some with fixed integrity levels and others with adaptive integrity levels) can communicate with each other at various integrity levels. The integrity levels can change in response to application characteristics that change over time and / or space. Furthermore, with adaptive integrity levels, portions of resources can be redeployed to lower integrity level applications when one or more components change from a higher integrity level to a lower integrity level.

[0015] Various features are described below with reference to the drawings. It should be noted that the drawings may or may not be drawn to scale, and that elements of similar structure or function are represented by similar reference numerals throughout the drawings. It should be noted that the drawings are intended to facilitate the description of features only. They are not intended as an exhaustive description of the claimed invention or as limiting the scope of the claimed invention. In addition, an illustrated embodiment need not have all aspects or advantages shown. An aspect or advantage described in connection with a particular embodiment is not necessarily limited to that embodiment and may be implemented in any other embodiment even if not so illustrated or explicitly described. Furthermore, while the methods described herein may be described with a particular sequence of operations, other methods according to other embodiments may be implemented in various other sequences with more or fewer operations (e.g., including different serial or parallel execution of various operations).

[0016] In the following description, the term "integrity level check" refers to functions performed to verify the integrity of the internal functions of electronic, programmable, and programmable logic (PL) components in a system, as well as to check the integrity of communications between components. Integrity level checks can range from low-level to higher-level integrity checks. Low-level integrity checks may consume less resources, less power, and potentially enable a higher level of performance of components for a given resource footprint. Examples of lower-level integrity checks include error detection of merged signals or states, such as parity checks, error correction codes (ECC), and cyclic redundancy checks (CRCs). Depending on the desired level of integrity check, parity, ECC, or CRC may be applied across a merged logical group of signals, such as request and response signals, or may be merged across all available signals, such as requests, responses, and data, in a communication protocol. A state integrity check may include a CRC or a secure hash algorithm (SHA) calculated over a coalesced logical group of registers (e.g., registers within a component, or coalesced key register values ​​across components, such as key routing table registers across components). Higher level integrity checks may consume significantly more resources compared to lower level integrity checks, increasing power consumption and potentially reducing performance levels for the same resource footprint. Examples of higher level integrity checks include redundant signals and / or component states. For example, double redundancy for signals or states significantly increases the error detection capability of a component, while triple or more redundancy not only increases error detection capability, but also significantly reduces the risk of failure and improves the ability of a component or system to gracefully react to failures.

[0017] Computing systems and devices include components that may be used in a variety of applications or situations, some of which may be safety and / or data critical situations, such as one or more of the automotive, industrial, aerospace, defense, or similar industries. The components may be heterogeneous, such as a mix of programmable logic (PL) fabrics, processing subsystems (PS), or offload accelerators (e.g., image sensor processors (ISPs) or data processing engines for artificial intelligence, etc.). The heterogeneous components may interact with each other at various integrity levels while collectively performing heterogeneous functions. That is, each component may check at least one of messages, status, or data received from other components and its own functionality at an integrity level independent of the integrity level checks performed by the other components.

[0018] Coalesced signal or state error detection may be applied to functions within a component, direct communications between components, and / or to communication hubs connecting multiple components.

[0019] Techniques for achieving high integrity levels, such as redundancy, can be used both for functional safety considerations and for security considerations: for example, integrity checks on redundant components can flag physical intrusion attacks, such as attempts to steal cryptographic secrets using voltage glitch attacks.

[0020] Due to the significant impact (resources, power, and performance) of providing high integrity levels to components and communication hubs between components, current techniques involve making trade-offs during system design and implementation between overall performance and the integrity level achieved. Once implemented, trade-off decisions made during implementation can hardly be changed. Thus, implementations targeting high integrity level functions and applications typically consume more resources and power than implementations targeting low integrity level functions. Similarly, implementations constrained by resource limitations and / or power consumption limitations will be limited to low integrity level functions and applications. However, many systems are heterogeneous, with domain-specific components interconnected such that functionality best performed in the software domain is enabled by processing components, functionality best performed in the application specific integrated circuit (ASIC) domain is enabled by ASIC-like components, artificial intelligence (AI) functionality is enabled by machine learning (ML) accelerators such as graphic processor units (GPUs), math engines, or tensor processors, and functionality requiring adaptivity or acceleration is enabled by programmable logic components. In such heterogeneous systems, the integrity level vs. resource / power tradeoff can be constrained such that the system implements either (1) the lowest integrity level across all heterogeneous components (e.g., depending on the type of computation or application specific to the component) or (2) an integrated processor (IP (e.g., provided by a third party)) that has a fixed integrity level and dictates that all components communicate with this IP at a higher integrity level than would have been selected for the system if they did not communicate with this IP.

[0021] Additionally, different applications may require different levels of integrity to be built into their components, and often computational data (e.g., sensor data) may be common to different applications, but are computed differently (e.g., different sensor fusion functions) and at different levels of integrity. For example, in an automotive deployment, applications may include a subset of sensors that are common, but the level of computation and the level of integrity of each computation may differ.

[0022] Thus, the current approach of implementations that are fixed to a certain integrity level has the drawback that targeting different integrity levels entails different implementations of the system. Otherwise, the sunk cost of a higher integrity level must be accepted in order to reuse the same implementation for applications that require a lower integrity level. Also, the data being processed may be common and processed for different applications (with different integrity levels) using a common set of components. When cost or resource usage is prioritized and only the integrity level changes during the computation, specific designs are traditionally implemented to target a set of applications.

[0023] The present disclosure provides apparatus and techniques that allow various components to communicate with each other at various integrity levels (e.g., integrity levels that can be effectively and programmatically changed). Some of the components can be designed with fixed integrity levels, while other components can be designed to use adaptive integrity levels (also referred to as programmable integrity levels) that can be changed. The integrity levels can be adjusted according to the changing (e.g., varying over time and / or space) demands of the application. The embodiments of the present disclosure can be used in any of a variety of suitable applications. For example, the embodiments of the present disclosure can be implemented in an automobile to provide a higher integrity level while the automobile is being autonomously controlled or driven at higher speeds and a lower integrity level while the automobile is parked. The integrity levels can also be adjusted according to the demands of the application that change with space. For example, two instances of the same implementation can be used in an automobile to provide different integrity levels at two different locations. The techniques provided in the present disclosure apply equally to a communication hub that can accommodate multiple source components with various integrity levels that communicate with destination components that have the same or different integrity level capabilities as the source components.

[0024] An advantage of the techniques described herein is that a single implementation can target different integrity levels. Depending on the implementation, some or all of the resources deployed to achieve a higher integrity level can be redeployed for other functions within the application that require a lower integrity level. Another advantage of the techniques described herein is that a common implementation using a common set of components can run at various integrity levels depending on the application in which the computation is being performed. This can allow an implementation to run at a first integrity level in a first deployment (e.g., a luxury car) and the same implementation can run at a second integrity level in a second deployment (e.g., an entry-level car). Another advantage of the techniques described herein is that a safety qualification and certification process (or security qualification and certification process) can be performed for the same implementation by adapting / changing the integrity levels of the components and the communications between the components, because such an adaptive integrity level system is evaluated for various qualification and certification criteria. By varying the integrity levels of components during qualification and certification, a system can be qualified or certified for multiple implementations in a single certification or qualification process. Thus, the techniques described herein enable components to be adaptable across integrity levels, improve power efficiency, and improve security, such that the resulting device can scale up performance or functionality such that more resources are available for applications requiring lower integrity levels (e.g., lower safety and / or security), as well as scale up the level of functional safety and / or security provided by deploying more resources to achieve higher integrity levels. Further details are provided below with respect to Figures 1-8.

[0025] FIG. 1 illustrates an automobile 100 having various sensors and advanced driver assistance systems (ADAS) according to an embodiment of the present disclosure. The sensors include ultrasonic sensors 102a-102h, thermal / infrared camera 104, laser radar 106, cameras 108a-108g, and short-range radars 110a-110e. A central driver assistance (DA) module 120 may implement various ADAS, such as a lane departure warning system, an automatic parking system, a lane change assist system, and / or an autonomous driving system. In implementing various ADAS, the central DA module 120 may implement integrity level 1, integrity level 2, integrity level 3, integrity level 4, and integrity level 5, which correspond to no integrity check, Automotive Safety Integrity Level (ASIL) A, ASIL B, ASIL C, and ASIL D, respectively.

[0026] The central DA module 120 may send output commands to the vehicle control module 130 for braking, steering, engine power, lighting, and / or human-machine interface (HMI). The central DA module 120 may use data from the forward cameras 108a, 108b, and 108g to implement a lane departure warning system. The central DA module 120 may implement a lane departure warning system with an integrity level of 1 or 2. The central DA module 120 may use data from the cameras 108a, 108c, 108e, 108f, the short-range radars 110a-110e, and the ultrasonic sensors 102a-102h to implement an automatic parking system. The central DA module 120 may implement an automatic parking system with an integrity level of 3. The central DA module 120 may use data from the cameras 108a, 108c, 108e, and 108f and the short-range radars 110a-110e to implement a lane change assist system. The central DA module 120 may implement a lane change assist system at an integrity level of 3. The central DA module 120 may use data from the ultrasonic sensors 102a-102h, the thermal / infrared camera 104, the laser radar 106, the cameras 108a-108g, and the short-range radars 110a-110e to implement an autonomous driving system. The central DA module 120 may further implement a machine learning (e.g., deep learning) system along with the autonomous driving system, and the central DA module 120 may implement the autonomous driving system at an integrity level of 4 or 5.

[0027] 2 illustrates a block diagram of components 202 and 220 of a system 200 implementing an integrity level check according to an embodiment of the present disclosure. Component 202 may be, for example, a sensor, a processor, an ASIC, a PL fabric, a memory, a network interface card, a data storage device, or any other device configured to deliver communication protocol information (e.g., messages, interrupts, or data), hereafter referred to as "data", to component 220. Component 220 may be, for example, a DA module, a vehicle control module, a processor, an ASIC, a PL fabric, a memory, a network interface card, a data storage device, a logger, or any other device configured to receive data from component 202. Component 220 receives data from component 202 via a communication protocol interface 212. For example, component 220 may be the central DA module 120 shown in FIG. 1, and component 202 may be the camera 108a also shown in FIG. 1. As an example, system 200 may operate at integrity level 2. For example, component 220 may check that the integrity attributes (eg, CRC) of the data provided via communication protocol interface 212 match the provided integrity attributes 210 .

[0028] When providing data to the component 220 via the communication protocol interface 212, the component 202 generates one or more integrity attributes 210 using an integrity attribute generator function 204. The component 202 transmits the integrity attributes 210 in association with the data. The component 220 receives the integrity attributes 210 and the data, and verifies the data with the provided integrity attributes 210 using an integrity attribute checker function 222. When the provided data passes the integrity attribute check, the integrity attribute checker function 222 sends an instruction 230 to the processor function 224 (e.g., sets a flag in memory or sends an electronic signal). When the processor function 224 gets the instruction 230, the processor function 224 then processes the provided data 212. If the data 212 fails an integrity attribute check performed by the integrity attribute checker function 222, the integrity attribute checker function 222, the processor function 224, or an error checking function within the component 220 may generate an error message or otherwise indicate the error in order to maintain the integrity level.

[0029] 3A and 3B show block diagrams of a system 300 according to an embodiment of the present disclosure. The system 300 includes redundant components 302a and 302b (e.g., a pair of image sensor processors set up in a mirrored configuration) and a component 320. The components 302a and 302b can be, for example, a pair (or more) of sensors, processors, ASICs, PL fabrics, memory banks, network interface cards, data storage devices, or any other redundant devices configured to distribute data to the components 320. The components 320 can be, for example, a DA module, a vehicle control module, a processor, an ASIC, PL fabric, memory, network interface cards, data storage devices, loggers, or any other devices configured to receive data from the components 302a and 302b. In FIG. 3A, the system 300 can operate at an integrity level 2 or 3, for example.

[0030] When providing data to the component 320 via the communication protocol interface 312, the component 302a generates one or more integrity attributes using the integrity attribute generator function 304a. The component 302a transmits the integrity attribute 310 in association with the data. The component 320 receives the integrity attribute 310 and the data, and verifies the data with the provided integrity attribute 310 using the integrity attribute checker function 322. When the provided data passes the integrity attribute check, the integrity attribute checker function 322 sends an instruction 330 to the processor function 324 (e.g., sets a flag in memory or sends an electronic signal). When the processor function 324 gets the instruction 330, the processor function 324 then processes the data provided via the communication protocol interface 312. If the data fails an integrity attribute check performed by the integrity attribute checker function 322, the integrity attribute checker function 322, the processor function 324, or an error checking function within the component 320 may generate an error message or otherwise indicate the error in order to maintain the integrity level.

[0031] 3B, system 300 may operate at a higher integrity level, such as integrity level 4. Redundant component 302a provides a first copy of data to component 320 via communication protocol interface 360, and redundant component 302b provides a second copy of the same data to component 320 via communication protocol interface 362. Component 302a transmits the first copy of the data via communication protocol interface 362 in conjunction with component 302b transmitting the second copy of the data via communication protocol interface 360. Component 320 receives the first copy of the data and the second copy of the data and verifies that the first copy of the data matches the second copy of the data using redundant communication protocol interface checker function 323.

[0032] The redundant communication protocol interface checker function 323 and the integrity attribute checker function 322 (see FIG. 3A) may be implemented as separate functions or as subroutines within the data integrity check function (not shown). The redundant communication protocol interface checker function 323 and the integrity attribute checker function 322 (see FIG. 3A) may also be implemented as a reconfigured programmable logic (PL) block with the option of conserving PL resources when the PL block is configured as the integrity attribute checker function 322 and consuming more PL resources when the PL block is configured as the redundant communication protocol interface checker function 323. When the redundant communication protocol interface checker function 323 verifies that the first copy of the data matches the second copy of the data, the redundant communication protocol interface checker function 323 sends a copy of the data and / or an instruction 330 to the processor function 324 (e.g., sets a flag in memory or sends an electronic signal). When the processor function 324 obtains the data or the instruction 330, the processor function 324 then processes the data. If the redundant communications protocol interface checker function 323 does not verify that the first copy of the data matches the second copy of the data, the redundant communications protocol interface checker function 323 or an error checking function within component 320 may indicate an error to maintain a level of integrity.

[0033] In another embodiment of the present disclosure, for a higher integrity level, such as integrity level 5, system 300 may be operated with a triple redundant integrity attribute. For this embodiment, a third redundant component (not shown) provides a third copy of the same data to component 320 via another communications protocol interface (not shown). If the data passes the integrity attribute check performed by redundant communications protocol interface checker function 323 over one but not both of the redundant channels, redundant communications protocol interface checker function 323, processor function 324, or an error checking function within component 320 may indicate an error of lesser severity such that processor function 324 may continue to process the data provided from the two redundant communications protocol interfaces 360 and 362 that passed the integrity attribute check.

[0034] In an embodiment of the present disclosure, the system may implement an integrity level translator to facilitate compatible integrity level communication between components. That is, if two components support different integrity levels, an integrity level translator may be implemented to allow the two components to send and receive data to each other, and each component may verify the integrity of the data received from the other component. For example, if the component that sends data (referred to herein as the "sending component") determines the integrity attributes based on all combined signals and the component that receives data (referred to herein as the "receiving component") determines the integrity attributes based only on the send / receive data subset, then the send integrity level translator may terminate the integrity attributes of all non-data request signals and connect the integrity attributes of all data signals. Meanwhile, the receive integrity level translator may generate the integrity attributes of all non-data request signals and connect the integrity attributes of all data signals. In another embodiment, if the sending component is an integrity level 2 component having a parity integrity attribute determined based on each of the combined request, request data, response, and response data logical groups of signals, and the receiving component is an integrity level 3 component that determines an ECC integrity attribute based on each of the combined request, request data, response, and response data logical groups of signals, the sending integrity level translator may convert the parity integrity attribute of the sending component to an ECC integrity attribute for compatibility with communications with the integrity level 3 receiving component, while the receiving integrity level translator does the reverse to convert the ECC integrity attribute of the integrity level 3 receiving component to a parity integrity attribute in the response path to the integrity level 2 sending component.

[0035] 4A-4D show block diagrams of example modes of operation of the integrity level converter 410 according to an embodiment of the present disclosure. As described herein, the integrity level converter 410 is an interface operating between two blocks, block A and block B, and may include functionality embedded in either or both of blocks A and B, or in a communication hub, as described in FIGS. 5-7, and thus the integrity level converter is represented by a dashed line. Blocks A and B may be physical components (e.g., ASIC or PL fabric) or logic functions embedded in one component (e.g., logic functions in a system on a chip (SoC)). The modes of operation of the integrity level converter 410 may include connect, convert, generate, terminate, or mode integrity class, as described below.

[0036] FIG. 4A illustrates an integrity level converter 410 implementing the connection integrity class 400. The connection integrity class between two blocks describes a mode in which both blocks have an exact match of integrity levels, including error protection, propagation, detection, and reporting capabilities, and therefore also an exact match of signals on the transmit / receive interfaces of each block. In the embodiment illustrated in FIG. 4A, block A 402 operates at integrity level 4 or integrity level 5, and block B 404 operates at the same integrity level. The integrity level converter 410 determines that block A 402 and block B 404 are operating at the same integrity level. The integrity level converter 410 connects the integrity attribute of block A 402 to the integrity attribute of block B 404 for communication from block A 402 to block B 404. Similarly, the integrity level converter 410 connects the integrity attribute of block B 404 to the integrity attribute of block A 402 for communication from block B 404 to block A 402.

[0037] 4B illustrates an integrity level converter 410 that implements a conversion integrity class 420. A conversion integrity class between two blocks A and B describes a mode in which either (1) block A has a subset of block B's error protection, propagation, detection, and reporting capabilities, or (2) block A has a different error protection, propagation, and / or detection method than block B. An example of block A having a subset of block B's capabilities may be that block A has data path protection but lacks both the control and data path protection capabilities of block B. An example of block A having a different error protection, propagation, and / or detection method than block B may include block A having parity protection while block B has ECC protection. Another example of block A having a different error protection, propagation, and / or detection method than block B might be that block A has a fully redundant set of signals with integrity checking across all redundant pairs of signals, while block B only has parity or ECC integrity checking on signals or groups of signals.

[0038] In the example shown in FIG. 4B, block A 422 operates at integrity level 2 (e.g., parity checking of data), while block B 424 operates at integrity level 3 (e.g., error correction code). The integrity level converter 410 determines that block A 422 operates at integrity level 2 and block B 424 operates at integrity level 3. The integrity level converter 410 converts the integrity level 2 integrity attributes sent by block A 422 in communication to block B 424 to integrity level 3 integrity attributes for delivery to block B 424. For example, the integrity level converter 410 may remove parity information from the data and generate error correction code for the data. Similarly, the integrity level converter 410 converts the integrity level 3 integrity attributes sent by block B 424 in communication to block A 422 to integrity level 2 integrity attributes for delivery to block A 422. For example, the integrity level converter 410 extracts the data from the error correction code sent by block B 424 and appends parity information to the data.

[0039] FIG. 4C shows an integrity level converter 410 implementing a termination integrity class 440 and a generation integrity class 441. A generation integrity class 441 between two blocks describes a mode in which one block's error protection, propagation, detection, and reporting capabilities are not available at all at its block partner. In a generation integrity class between two blocks A and B, where block A has error protection, propagation, detection, and reporting capabilities and block B does not, block B has its error protection, propagation, detection, and reporting capabilities generated before sending traffic to block A. A termination integrity class between two blocks A and B, where block A has error protection, propagation, detection, and reporting capabilities and block B does not, block A has its error reporting, propagation, detection, and reporting capabilities terminated before sending traffic to block B.

[0040] In the example shown in Figure 4C, block A 442 has a particular integrity capability, while block B 444 does not. The integrity level converter 410 determines that block A 442 has the integrity capability and block B 444 does not. The integrity level converter 410 terminates the integrity attributes of block A 442 for communication from block A 442 to block B 444 according to the termination integrity class. Similarly, the integrity level converter 410 generates the integrity attributes of block B 444 for communication from block B 444 to block A 442 according to the generation integrity class.

[0041] FIG. 4D illustrates an integrity level converter 410 implementing a mode integrity class 460. A mode integrity class between two blocks A and B describes an interface where one block (e.g., block B) optionally has the error protection, propagation, detection, and reporting capabilities of its interface block partner (e.g., block A), while the interface block partner can only be enabled with a connection integrity class. As a result, the mode integrity class exhibits the characteristics of one of the connection, generation, or termination integrity classes depending on the enabled mode. A mode integrity class between two blocks A and B may enable a termination mode where block A has its error protection, propagation, detection, and reporting capabilities terminated before sending traffic to block B because block B, for example, wants to conserve its resources and use those resources for other non-integrity checking functions. A mode integrity class between two blocks A and B may enable a generation mode where block B has its error protection, propagation, detection, and reporting capabilities generated before sending traffic to block A. A mode integrity class between two blocks A and B may enable a connection mode in which both blocks have an exact match of error protection, propagation, detection, and reporting capabilities, and therefore also an exact match of signals on the transmit / receive interfaces of each block. Thus, block B may utilize its resources for integrity check functions due to the application integrity level that block B wants to achieve. Mode integrity classes may be applied to programmable logic (PL) blocks, providing users of implementations with the option of saving PL resources by not generating error protection, propagation, detection, and reporting capabilities depending on the desired integrity level of the user's application.

[0042] In the embodiment shown in Figure 4D, block A 462 has certain integrity capabilities that are enabled only in the connection integrity class, and block B 464 optionally has these integrity capabilities. The integrity level converter 410 determines whether block B 464 is operating in these integrity capabilities. If block B 464 is operating in these integrity capabilities, the integrity level converter 410 implements the connection integrity class in both directions between block A 462 and block B 464. If block B 464 is operating without these integrity capabilities, the integrity level converter 410 implements the termination integrity class for communication from block A 462 to block B 464 and the origination integrity class for communication from block B 464 to block A 462.

[0043] FIG. 5 illustrates an example system 500 having a component A 502, a component B 506, and a communication hub having an example integrity level converter 504, according to an embodiment of the present disclosure. The integrity level converter 504 can implement adaptive integrity levels and support various integrity classes, thereby facilitating communication between the components A 502 and B 506. The example communication hub having the integrity level converter 504 obtains data via a main signal path 530 and obtains optional integrity attributes from the component A 502 destined for the component B 506 via an integrity path 540. The example integrity level converter 504 determines the integrity level used by the component A 502 and the integrity level used by the component B 506. Then, based on these determinations, the integrity level selection function 510 selects whether to terminate the integrity attribute at the termination logic 512, convert the integrity attribute at the conversion logic 514, generate the integrity attribute at the generation logic 516, or connect the integrity attributes at the connection logic 518. If the integrity level selection function 510 selects to terminate the integrity attribute, the communications hub with the integrity level converter 504 delivers the data to component B 506 via the main signal path 530, but the integrity attribute is not delivered via the integrity path 540. If the integrity level selection function 510 does not select to terminate the integrity attribute, the communications hub with the integrity level converter 504 delivers the converted integrity attribute 522, the connected integrity attribute 524, or the generated integrity attribute 526 to component B 506 (via the main signal path 530) along with the data (via the integrity path 540).

[0044] 6 illustrates an example operation 600 by the integrity level converter 504 and component B 606 to facilitate communication involving adaptive integrity levels between component A 602 and component B 606, according to an embodiment of the present disclosure. In each of states 610, 620, 630, and 640, component A 602 operates at either integrity level 4 or integrity level 5, while component B 606 changes its integrity level in transitions between states. In other words, component A may represent a fixed integrity level component (or an adaptive integrity level component that maintains its integrity level), while component B may represent an adaptive integrity level component.

[0045] For example, in state 610, component B is operating at integrity level 1 and the integrity level translator 504 selects to terminate integrity attribute 614 from component A 602 while delivering data 612 from component A 602 to component B 606. In state 620, component B is operating at integrity level 2 and the integrity level translator 504 selects to generate integrity attribute 626 based on data 622 and delivers generated integrity attribute 626 and data 622 to component B 606. Integrity attribute 624 from component A, if any, may be ignored by the integrity level translator 504. In state 630, component B is operating at integrity level 3 and the integrity level translator 504 selects to convert integrity attribute 634 from component A 602 to integrity attribute 636. The integrity level translator 504 then delivers integrity attribute 636 and data 632 to component B 606. At 640, component B is operating at integrity level 4 or 5, and the integrity level translator 504 selects to connect the integrity attribute 644 from component A 602 to the integrity attribute 646. The integrity level translator 504 then delivers the integrity attribute 646 and the data 642 to component B 606.

[0046] 6 depicts component B 606 transitioning incrementally from integrity level 1 to integrity level 4 or 5, embodiments of the present disclosure are not so limited. Component B 606 may transition directly from any integrity level to any other integrity level, and integrity level converter 504 may similarly transition directly from operating in any one of states 610, 620, 630, and 640 to operating in any other one of states 610, 620, 630, and 640 corresponding to the current integrity level of component B, simply by changing the integrity level selected by integrity level selection function 510.

[0047] FIG. 7 illustrates an example system 700 including an example adaptive integrity level hub 710 according to an embodiment of the present disclosure. The example system 700 includes a component A 702, a component B 740, and a component C 750. Each of the components A 702, B 740, and C 750 is capable of operating at any of integrity levels 1-5. In this embodiment, the component A 702 may act as both a source and a destination of data, the component B 740 may act only as a source of data, and the component C 750 may act only as a destination of data. Thus, the adaptive integrity level hub 710 may include four integrity level translators 712, 714, 716, and 718, which may be embodiments of the integrity level translator 504 described with reference to FIGS. 5 and 6.

[0048] The two integrity level converters 712 and 714 are configured to communicate with component A 702. The integrity level converter 712 is configured to receive data 704 and integrity attributes 705 from component A 702. The integrity level converter 714 is configured to send data 706 and integrity attributes 707 to component A 702.

[0049] Because component B 740 can only act as a source of data, one integrity level converter 718, in this example, is configured to communicate with component B 740. The integrity level converter 718 is configured to receive data 742 and integrity attributes 743 from component B 740.

[0050] Because component C 750 can only act as a destination of data, one integrity level converter 716 is configured in this example to communicate with component C 750. Integrity level converter 716 is configured to send data 752 and integrity attributes 753 to component C 750.

[0051] The adaptive integrity level hub 710 further comprises routing logic and switching facilities that allow integrity level converters 712 and 718 to connect to component C 750. When integrity level converter 712 is connected to component C 750, integrity level converter 712 delivers data 704 and integrity attributes 708 to component C 750 as data 752 and integrity attributes 753, respectively. When integrity level converter 718 is connected to component C 750, integrity level converter 718 delivers data 742 and integrity attributes 744 to component C 750 as data 752 and integrity attributes 753, respectively. The adaptive integrity level hub 710 further comprises routing logic and switching facilities that allow integrity level converter 718 to connect to component A 702. When integrity level converter 718 is connected to component A 702, it distributes data 742 and integrity attributes 744 to component A 702 as data 706 and integrity attributes 707, respectively. Adaptive integrity level hub 710 further comprises routing logic and switching facilities that allow integrity level converter 714 to connect to component B 740. When integrity level converter 714 is connected to component B 740, integrity level converter 714 may receive data 742 and integrity attributes 743 from component B 702 as data 706 and integrity attributes 709, respectively. Adaptive integrity level hub 710 may further comprise routing logic and switching facilities that allow integrity level converters 712, 714, 716, and 718 to connect to other components not shown.

[0052] The following table illustrates exemplary integrity class settings for disparate integrity class components exchanging information via the adaptive integrity level hub 710 with reference to FIG.

[0053] [Table 1]

[0054] 8 depicts a flow diagram of example operations 800 for communication. The operations 800 may be performed by components in a communication system, such as the automobile 100 and systems 200 and 300 of Figures 1, 2, and 3, respectively, according to an embodiment of the present disclosure. The flow diagram includes blocks that represent the operations 800.

[0055] The operations 800 may begin at block 802 by determining a first integrity level of a first component. In some embodiments, this corresponds to determining an integrity level of one of the ultrasonic sensors 102a-102h, the thermal / infrared camera 104, the laser radar 106, the cameras 108a-108g, and the short-range radars 110a-110e shown in FIG. 1. In other embodiments, this corresponds to determining an integrity level of the central DA module 120 or the vehicle control module 130 shown in FIG. 1. In still other embodiments, this corresponds to determining an integrity level of the components 202, 302, 402, 404, 422, 424, 442, 444, 462, 464, 502, 602, 702, or 740 shown in FIG. 2-7.

[0056] The operations 800 continue at block 804 by determining a second integrity level of a second component. In some embodiments, this corresponds to determining the integrity level of the central DA module 120 or the vehicle control module 130 shown in Figure 1. In other embodiments, this corresponds to determining the integrity level of components 220, 320, 402, 404, 422, 424, 442, 444, 462, 464, 506, 606, 702, or 750 shown in Figures 2-7.

[0057] The operations 800 continue at block 806 by selecting an integrity level for a first communication from the first component to the second component based on the first integrity level and the second integrity level at an interface between the first and second components. In some embodiments, this corresponds to selecting an integrity level or integrity class, such as those described herein, at one of the integrity level translators 410, 504, 712, 714, 716, or 718 shown in FIGS.

[0058] The operations 800 continue at block 808 by transmitting the first communication from the first component to the second component over the interface according to the integrity level for the first communication. In some embodiments, this corresponds to transmitting the data through one of the integrity level translators 410, 504, 712, 714, 716, or 718 shown in Figures 4-7 as described herein, optionally receiving integrity attributes from the first component, and optionally transmitting integrity attributes to the second component according to the selected integrity class.

[0059] According to some embodiments, the operations 800 further include determining that at least one of the first integrity level or the second integrity level has changed. In this case, the operations 800 may further include selecting an integrity level for the second communication from the first component to the second component at the interface (e.g., with the integrity level selection function 510). The second communication may then be transmitted over the interface from the first component to the second component according to the integrity level for the second communication. For some embodiments, the integrity level for the second communication is lower than the integrity level for the first communication. In this case, the operations 800 may further include controlling a reallocation of one or more resources of the first component based on the selection of the integrity level for the second communication. For other embodiments, the integrity level for the second communication is higher than the integrity level for the first communication. In this case, the operations 800 may further include controlling an allocation of one or more resources of the first component based on the selection of the integrity level for the second communication.

[0060] According to some embodiments, the first integrity level of the first component is different from the second integrity level of the second component, the first component having a subset or a different set of the plurality of integrity capabilities associated with the second component. In this case, operation 800 may further include translating the integrity attributes for the first communication from the first component to the second component such that, for the first communication, the first integrity level of the first component effectively matches the second integrity level of the second component.

[0061] According to some embodiments, the first integrity level of the first component is lower than the second integrity level of the second component such that the integrity capabilities associated with the second component are not available for the first component. In this case, operations 800 may further include generating an integrity attribute for the first communication from the first component to the second component such that, for the first communication, the first integrity level of the first component effectively matches the second integrity level of the second component.

[0062] According to some embodiments, the first integrity level of the first component is higher than the second integrity level of the second component such that the integrity capabilities associated with the first component are not available for the second component. In this case, operation 800 may further include terminating an integrity attribute for the first communication from the first component to the second component such that, for the first communication, the first integrity level of the first component effectively matches the second integrity level of the second component.

[0063] In the above, reference is made to examples presented in the present disclosure. However, the scope of the present disclosure is not limited to the specific described examples. Instead, any combination of the described features and elements is contemplated to implement and practice the contemplated examples, whether or not related to different examples. Furthermore, the embodiments disclosed herein may achieve advantages over other possible solutions or prior art, but whether or not a particular advantage is achieved by a given embodiment does not limit the scope of the present disclosure. Thus, the above aspects, features, embodiments, and advantages are merely illustrative and are not considered elements or limitations of the appended claims unless expressly recited in one or more of the claims.

[0064] As will be appreciated by those skilled in the art, the embodiments disclosed herein may be embodied as a system, method, or apparatus, etc. Thus, the embodiments may take the form of an entirely hardware embodiment, or a combination of hardware products, or an embodiment combining hardware aspects with corresponding programs, all of which may be generally referred to herein as "circuitry" or "systems." Additionally, certain aspects, such as programmable logic blocks, lookup tables (LUTs), etc., may take the form of hardware components that can be controlled using corresponding programs.

[0065] Any combination of one or more computer readable media may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (non-exhaustive list) of computer readable storage media include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this specification, a computer readable storage medium is any tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device.

[0066] A computer-readable signal medium may include a propagated data signal in which computer-readable program code is embodied, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electrical, magnetic, optical, electromagnetic, or any suitable combination thereof. A computer-readable signal medium is not a computer-readable storage medium, but may be any computer-readable medium that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0067] The program code embodied on the computer readable medium may be transmitted using any suitable medium, including, but not limited to, wireless (e.g., radio frequency (RF) or infrared), wireline, fiber optic cable or cables, or the like, or any suitable combination of the foregoing.

[0068] Computer program code for implementing the operations or programs of the embodiments of the present disclosure may be written in any combination of one or more programming languages, including, for example, object-oriented programming languages ​​such as Java, Smalltalk, C++, and procedural programming languages ​​such as the "C" programming language or similar programming languages. The program code may execute completely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer, partially on a remote computer, or completely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet Service Provider).

[0069] Embodiments of the present disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (e.g., systems), and computer program products presented herein. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, or other programmable data processing apparatus such that the instructions, executed via a processor of the computer or other programmable data processing apparatus, result in a machine that creates means for implementing the functions / acts specified in the blocks of the flowchart and / or block diagrams.

[0070] These computer program instructions may also be stored on a computer-readable storage medium, where the instructions stored on the computer-readable storage medium can direct a computer, programmable data processing apparatus, and / or other device to function in a particular manner to produce an article of manufacture including instructions that implement aspects of the functions / acts specified in the flowchart and / or block diagram blocks.

[0071] Computer program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be executed on the computer, other programmable apparatus, or other device to generate a computer-implemented process, such that the instructions executing on the computer or other programmable apparatus provide a process for implementing the functions / acts specified in the flowchart and / or block diagram blocks.

[0072] In some non-limiting examples, the disclosure may be expressed as a method. In a first example, a method of communication may include determining a first integrity level of a first component, determining a second integrity level of a second component, selecting an integrity level for a first communication from the first component to the second component based on the first integrity level and the second integrity level at an interface between the first and second components, and transmitting the first communication from the first component to the second component through the interface in accordance with the integrity level for the first communication.

[0073] In a second example, the method of the first example may further include determining that at least one of the first integrity level or the second integrity level has changed, selecting an integrity level for a second communication from the first component to the second component at the interface, and sending the second communication through the interface from the first component to the second component in accordance with the integrity level for the second communication.

[0074] In a third example, the method of the second example may include a lower integrity level for the second communication than the integrity level for the first communication, and may further include controlling reallocation of one or more resources of the first component based on a selection of the integrity level for the second communication.

[0075] In a fourth example, the method of the first example includes a first integrity level of the first component different from a second integrity level of the second component, and the first component having a subset or a different set of the plurality of integrity capabilities associated with the second component, the method further including transforming integrity attributes for a first communication from the first component to the second component such that, for the first communication, the first integrity level of the first component effectively matches the second integrity level of the second component.

[0076] In a fourth example, the method of the first example includes generating an integrity attribute for a first communication from the first component to the second component, such that the first integrity level of the first component is lower than the second integrity level of the second component such that an integrity capability associated with the second component is not available for the first component, such that for the first communication, the first integrity level of the first component effectively matches the second integrity level of the second component.

[0077] In a fifth example, the method of the first example includes the first integrity level of the first component being higher than the second integrity level of the second component such that integrity capabilities associated with the first component are not available for the second component, and further includes terminating an integrity attribute for a first communication from the first component to the second component such that, for the first communication, the first integrity level of the first component effectively matches the second integrity level of the second component.

[0078] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and apparatus according to various embodiments of the present disclosure. In this regard, each block in the flowcharts or block diagrams may represent a portion of a circuit configuration, a program for such circuit configuration, or instructions for such circuit configuration, including one or more executable instructions for controlling or programming the circuit configuration to perform a specified logic function. In some alternative implementations, the functions described in the blocks may occur out of the order described in the figures. For example, two blocks shown in succession may in fact be executed substantially simultaneously, or the blocks may be executed in reverse order, depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart illustrations, as well as combinations of blocks in the block diagrams and / or flowchart illustrations, may be executed by a dedicated hardware-based system that performs the specified functions or operations, or a combination of dedicated hardware and computer instructions.

[0079] While the forgoing is directed to specific embodiments, other and further embodiments may be devised without departing from the basic scope thereof, which is determined by the following claims.

Claims

1. 1. An interface for communication between a first component and a second component, the interface including logic configured to change an integrity level for communication from the first component to the second component during operation of the first component and the second component.

2. The interface of claim 1 , wherein the integrity level for the communication includes at least one of a safety level or a security level.

3. 2. The interface of claim 1, wherein the logic is configured to change the integrity level for the communication from a higher integrity level to a lower integrity level, the logic further configured to control a reallocation of one or more resources of the first component based on the change to the lower integrity level.

4. 2. The interface of claim 1, wherein the logic is configured to change the integrity level for the communication from a lower integrity level to a higher integrity level, the logic further configured to control allocation of one or more resources of the first component based on the change to the higher integrity level.

5. The interface of claim 1 , wherein at least one of the first component or the second component has an adaptive integrity level that can be programmatically changed.

6. 2. The interface of claim 1, wherein one of the first component or the second component has an adaptive integrity level that can be programmatically changed, and the other of the first component or the second component has a fixed integrity level.

7. The interface of claim 1 , wherein a portion of the interface is located within the first component and another portion of the interface is located within the second component.

8. the first component having a subset or a different set of the plurality of integrity capabilities associated with the second component; 2. The interface of claim 1, wherein the logic is configured to transform integrity attributes for the communication from the first component to the second component such that a first integrity level of the first component effectively matches a second integrity level of the second component.

9. a first integrity level of the first component is lower than a second integrity level of the second component such that a full capacity associated with the second component is not available for the first component; 2. The interface of claim 1, wherein the logic is configured to generate an integrity attribute for the communication from the first component to the second component such that the first integrity level of the first component effectively matches the second integrity level of the second component.

10. a first integrity level of the first component is higher than a second integrity level of the second component such that a full capacity associated with the first component is not available for the second component; 2. The interface of claim 1, wherein the logic is configured to: finalize an integrity attribute for the communication from the first component to the second component such that the first integrity level of the first component effectively matches the second integrity level of the second component.

11. The interface of claim 1 , wherein the logic is configured to change the integrity level based on at least one requirement of an application that changes with at least one of time or space.

12. a first integrity level of the first component is different from a second integrity level of the second component; 2. The interface of claim 1, wherein the logic is further configured to change a level of integrity for another communication from the second component to the first component during operation of the first and second components such that for that other communication, the second integrity level of the second component effectively matches the first integrity level of the first component.

13. a main signal path for routing the communication from the first component to the second component; 2. The interface of claim 1, further comprising: an integrity path for routing integrity attributes from the first component to the second component, wherein the logic is configured to change the integrity level of the communication by controlling the integrity path.

14. 1. A method of communication comprising: determining a first integrity level of a first component; determining a second integrity level of the second component; selecting an integrity level for a first communication from the first component to the second component based on the first integrity level and the second integrity level at an interface between the first component and the second component; transmitting the first communication from the first component to the second component over the interface in accordance with the integrity level for the first communication.

15. determining that at least one of the first integrity level or the second integrity level has changed; selecting an integrity level for a second communication from the first component to the second component at the interface; 16. The method of claim 15, further comprising: transmitting the second communication from the first component to the second component through the interface in accordance with the integrity level for the second communication.

Images