Method for coded diagnostics in functional safety systems - Patents.com

Abstract

The method includes storing a set of valid code words including a first valid functional code word representing a functional timeout state of the second controller, a first valid fault code word representing a fault timeout state of the second controller and characterized by a minimum Hamming distance from the first valid functional code word, a second valid functional code word representing a functional state of the system, and a second valid fault code word representing a fault state of the system; storing the first valid functional code word in a first memory in response to detecting receipt of a safety message from the second controller within a predetermined amount of time; outputting the second valid functional code word in response to detecting a match between the contents of the first memory and the first valid functional code word; and outputting the second valid fault code word in response to detecting a mismatch between the contents of the first memory and any code word in the first set of valid code words.

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application claims the benefit of U.S. Provisional Application No. 63 / 217,674, filed July 1, 2021, U.S. Provisional Application No. 63 / 217,682, filed July 1, 2021, and U.S. Provisional Application No. 63 / 217,684, filed July 1, 2021, each of which is incorporated by reference in its entirety.

[0002] This application is related to U.S. Patent Application No. 17 / 192,657, filed March 4, 2021, and U.S. Patent Application No. 17 / 332,635, filed May 27, 2021, which are incorporated by reference in their entireties.

[0003] The present invention relates generally to the field of functional safety, and more particularly to a novel and useful method for coded diagnostics in functional safety systems in the field of functional safety. [Brief description of the drawings]

[0004] [Figure 1] FIG. 1 is a flow chart diagram of the method. [Diagram 2] 2A and 2B are schematic diagrams of one variation of the method. [Diagram 3] FIG. 3 is a schematic diagram of one variation of the method. [Figure 4] FIG. 4 is an exemplary table according to one variation of the method. [Diagram 5] 5A-5D are exemplary tables according to one variation of the method. [Figure 6] FIG. 6 is an exemplary table according to one variation of the method. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0005] The following description of the embodiments of the present invention is not intended to limit the present invention to these embodiments, but rather to enable those skilled in the art to implement and use the present invention. The variations, configurations, implementations, exemplary implementations, and examples described herein are optional and are not limited to the variations, configurations, implementations, exemplary implementations, and examples they describe. The invention described herein may include any and all permutations of these variations, configurations, implementations, exemplary implementations, and examples.

[0006] 1. Method As shown in FIGS. 1, 2A, and 2B, the method S100 includes storing, at a first controller in a safety module coupled to the system, a first set of valid code words in block S110, the first set of valid code words including a first valid functional code word representing a functional state of a first subsystem of the first set of subsystems in the first controller, a first valid fault code word representing a fault state of the first subsystem and characterized by a first minimum Hamming distance from the first valid functional code word, and a second valid fault code word representing a functional state of the first controller. a second valid fault code word representing a functional state of the first controller and characterized by a second minimum Hamming distance from the second valid functional code word; a third valid fault code word representing a functional state of a first input coupled to the system; a third valid fault code word representing a fault state of the first input and characterized by a third minimum Hamming distance from the third valid functional code word; a fourth valid functional code word representing a functional state of the system; and a fourth valid fault code word representing a fault state of the system and characterized by a fourth minimum Hamming distance from the fourth valid functional code word.

[0007] The method further includes, during the first time period, at the first controller, in block S120, storing a first valid functional code word in a first memory in response to detecting functional operation of the first subsystem, and in block S122, storing a third valid functional code word in a second memory in response to detecting functional operation of the first input.

[0008] The method further includes, during a second period after the first period, outputting, at the first controller, in block S130, a first safety message including the second valid function code word and a fourth valid function code word in response to detecting a match between the contents of the first memory and the first valid function code word and in response to detecting a functional operation of the first input.

[0009] The method further includes, during a third period after the second period, storing, at the first controller, a first valid functional code word in a first memory in response to detecting a functional operation of the first subsystem in block S120, and storing a third valid functional code word in a second memory in response to detecting a functional operation of the first input in block S122.

[0010] The method further includes, during a fourth period after the third period, outputting, at the first controller, in block S130, a second safety message including a second valid fault code word and a fourth valid fault code word in response to detecting a mismatch between the contents of the first memory and any code word in the first set of valid code words.

[0011] 1.1 Controller Infrastructure Diagnostics and Safety Module Timeout As shown in FIGS. 1, 2A, and 2B, one variation of method S100 includes storing, at a first controller in a safety module coupled to the system, a first set of valid code words in block S110, the first set of valid code words including: a first valid functional code word representing a functional state of a first subsystem of the first set of subsystems in the first controller; a first valid fault code word representing a fault state of the first subsystem and characterized by a first minimum Hamming distance from the first valid functional code word; a second valid fault code word representing a functional state of the first controller; a second valid fault code word representing a fault state of the first controller and characterized by a second minimum Hamming distance from the second valid functional code word; and a third valid functional code word representing a functional state of a first input coupled to the system. a third valid fault code word representing a fault state of the first input and characterized by a third minimum Hamming distance from the third valid fault code word; a fourth valid fault code word representing a functional state of a second controller in the safety module; a fourth valid fault code word representing a fault state of the second controller and characterized by a sixth minimum Hamming distance from the fourth valid fault code word; a fifth valid fault code word representing a functional timeout state of the second controller; a fifth valid fault code word representing a fault timeout state of the second controller and characterized by a fifth minimum Hamming distance from the fourth valid fault code word; a sixth valid fault code word representing a functional state of the system; and a sixth valid fault code word representing a fault state of the system and characterized by a sixth minimum Hamming distance from the sixth valid fault code word.

[0012] This variation of method S100 further includes storing a first valid function code word in a first memory in response to detecting a functional operation of the first subsystem at the first controller during a first period of time, in block S120, storing a third valid function code word in a second memory in response to detecting a functional operation of the first input, in block S122, interrogating an input register coupled to the second controller, in block S140, detecting a first safety message including a fourth valid function code word from the second controller at the input register, in block S142, and storing a fifth valid function code word in a third memory in response to detecting the first safety message at the input register within the first amount of time, in block S124.

[0013] This variation of method S100 further includes, during a second period after the first period, outputting, at the first controller, in block S130, a second safety message including the second valid function code word and a sixth valid function code word in response to detecting a match between the contents of the first memory and the first valid function code word, in response to detecting a match between the contents of the third memory and the fifth valid function code word, and in response to detecting a functional operation of the first input.

[0014] This variation of method S100 further includes, during a third period after the second period, at the first controller, in response to detecting functional operation of the first subsystem in block S120, storing a first valid functional code word in a first memory, in response to detecting functional operation of the first input in block S122, storing a third valid functional code word in a second memory, in response to detecting functional operation of the first input in block S122, interrogating the input register in block S140, and storing a fifth valid fault code word in a third memory in response to detecting non-receipt of a third safety message at the input register within the second amount of time in block S124.

[0015] This variation of method S100 further includes, during a fourth period after the third period, outputting, at the first controller, in block S130, a fourth safety message including the second valid function code word and a sixth valid fault code word in response to detecting a match between the contents of the first memory and the first valid function code word and in response to detecting a match between the contents of the third memory and the fifth valid fault code word.

[0016] 1.2 Controller Infrastructure Diagnostics As shown in Figures 1, 2A, and 2B, another variation of method S100 includes storing, in a first controller in a safety module coupled to the system, in block S110, a first set of valid code words, the first set of valid code words including a first valid functional code word representing a functional state of a first subsystem of the first set of subsystems in the first controller, a first valid fault code word representing a fault state of the first subsystem and characterized by a first minimum Hamming distance from the first valid functional code word, a second valid functional code word representing a functional state of the first controller, and a second valid fault code word representing a fault state of the first controller and characterized by a second minimum Hamming distance from the second valid functional code word.

[0017] This variation of method S100 further includes storing a first valid functional code word in a first memory in response to detecting, at the first controller, functional operation of the first subsystem in block S120 during the first time period.

[0018] This variation of method S100 further includes, during a second period after the first period, outputting, at the first controller, a first safety message including a second valid function code word in response to detecting, at block S130, a match between the contents of the first memory and the first valid function code word.

[0019] This variation of method S100 further includes storing, at the first controller, a first valid functional code word in a first memory in response to detecting functional operation of the first subsystem in block S120 during a third period after the second period.

[0020] This variation of method S100 further includes, during a fourth period after the third period, outputting, at the first controller, in block S130, a second safety message including a second valid fault code word in response to detecting a mismatch between the contents of the first memory and any code word in the first set of valid code words.

[0021] 1.3 Safety Module Timeout As shown in FIGS. 1, 2A, and 2B, another variation of method S100 includes storing, at a first controller in a first safety module coupled to the system, a first set of valid code words in block S110, the first set of valid code words including a first valid functional code word representing a functional timeout state of a second controller in the first safety module, a first valid fault code word representing a fault timeout state of the second controller and characterized by a first minimum Hamming distance from the first valid functional code word, and a second valid fault code word representing a functional state of the second controller. The system includes a valid functional code word, a second valid fault code word representing a fault state of the second controller and characterized by a second minimum Hamming distance from the second valid functional code word, a third valid functional code word representing a functional state of a first input coupled to the system, a third valid fault code word representing a fault state of the first input and characterized by a third minimum Hamming distance from the third valid functional code word, a fourth valid functional code word representing a functional state of the system, and a fourth valid fault code word representing a fault state of the system and characterized by a fourth minimum Hamming distance from the fourth valid functional code word.

[0022] This variation of method S100 further includes, during a first period of time, at the first controller, interrogating a first input register coupled to the second controller in block S140, detecting a first safety message including a second valid function code word from the second controller in the first input register in block S142, storing the first valid function code word in a first memory in response to detecting the first safety message in the first input register within the first amount of time in block S124, and storing a third valid function code word in a second memory in response to detecting a functional operation of the first input in block S122.

[0023] This variation of method S100 further includes, during a second period after the first period, outputting, at the first controller, in block S130, a second safety message including a fourth valid functional code word in response to detecting a match between the contents of the first memory and the first valid functional code word and in response to detecting functional operation of the first input.

[0024] This variation of method S100 further includes interrogating the first input register at the first controller during a third period after the second period, in block S140, detecting a third safety message including a second valid function code word from the second controller at the first input register, in block S142, storing the first valid function code word in a first memory in response to detecting the third safety message at the first input register within the second amount of time, in block S124, and storing the third valid function code word in a second memory in response to detecting a functional operation of the first input, in block S122.

[0025] This variation of method S100 further includes, during a fourth period after the third period, outputting, at the first controller, in block S130, a fourth safety message including a fourth valid fault code word in response to detecting a mismatch between the contents of the first memory and any code word in the first set of valid code words.

[0026] 1.4 Safety Controller Timeout by External Input As shown in FIGS. 1, 2A, and 2B, another variation of method S100 includes storing, at a first controller in a first safety module coupled to the system, a first set of valid code words in block S110, the first set of valid code words including a first valid functional code word representing a functional timeout state of a second controller in a second safety module in the system, a first valid fault code word representing a fault timeout state of the second controller and characterized by a first minimum Hamming distance from the first valid functional code word, and a first valid fault code word representing a functional state of the second controller. a second valid functional codeword, a second valid fault codeword representing a fault state of the second controller and characterized by a second minimum Hamming distance from the second valid functional codeword, a third valid functional codeword representing a functional state of a first input coupled to the system, a third valid fault codeword representing a fault state of the first input and characterized by a third minimum Hamming distance from the third valid functional codeword, a fourth valid functional codeword representing a functional state of the system, and a fourth valid fault codeword representing a fault state of the system and characterized by a fourth minimum Hamming distance from the fourth valid functional codeword.

[0027] This variation of method S100 further includes, during the first period, at the first controller, in response to detecting a first safety message including a second valid function code word from the second controller within the first amount of time, in block S126, storing a first valid function code word in a first memory, and in response to detecting a functional operation of the first input, in block S122, storing a third valid function code word in a second memory.

[0028] This variation of method S100 further includes, during a second period after the first period, outputting, at the first controller, in block S130, a second safety message including a fourth valid function code word in response to detecting a second valid function code word in the first safety message, in response to detecting a match between the contents of the first memory and the first valid function code word, and in response to detecting a functional operation of the first input.

[0029] This variation of method S100 further includes, during a third period after the second period, at the first controller, in response to detecting receipt of a third safety message including the second valid function code word from the second controller within the second amount of time, in block S126, storing a first valid function code word in a first memory, and in response to detecting a functional operation of the first input, in block S122, storing a third valid function code word in a second memory.

[0030] This variation of method S100 further includes, during a fourth period after the third period, outputting, at the first controller, in block S130, a fourth safety message including a fourth valid fault code word in response to detecting a mismatch between the contents of the first memory and any code word in the first set of valid code words.

[0031] 1.5 Safety Controller Timeout As shown in Figures 1, 2A, and 2B, another variation of method S100 includes storing, in block S110, a set of valid code words in a first controller in a first safety module in the system, the set of valid code words including a first valid functional code word representing a functional timeout state of a second controller in a second safety module in the system, a first valid fault code word representing a fault timeout state of the second controller and characterized by a first minimum Hamming distance from the first valid functional code word, a second valid functional code word representing a functional state of the system, and a second valid fault code word representing a fault state of the system and characterized by a second minimum Hamming distance from the second valid functional code word.

[0032] This variation of method S100 further includes, during the first period, storing, at the first controller, in memory in block S126, in response to detecting receipt of a first safety message from the second controller within the first amount of time.

[0033] This variation of method S100 further includes, during a second period after the first period, outputting, at the first controller, in block S130, a second safety message including a second valid function code word in response to detecting a match between the contents of the memory and the first valid function code word.

[0034] This variation of method S100 further includes, during a third period after the second period, storing, at the first controller, in memory in block S126, in response to detecting receipt of a third safety message from the second controller within the second amount of time.

[0035] This variation of method S100 further includes, during a fourth period after the third period, outputting, at the first controller, in block S130, a fourth safety message including the second valid fault code word in response to detecting a mismatch between the contents of the memory and any code word in the set of valid code words.

[0036] 2. Application In general, method S100 may be executed by the system to store a set of valid code words representing status information (e.g., function, fault) for various components (e.g., core infrastructure subsystems, inputs, data communications) of the safety module and characterized by a minimum Hamming distance from other valid code words, store the code words in memory based on detected conditions of the core infrastructure subsystems, inputs, and / or data communications during a monitoring period, and output a safety message based on (i) whether the code words stored in memory during the monitoring period match the valid code words and (ii) the detected conditions during an evaluation period.

[0037] In particular, method S100 may be performed by a safety module to encode state information as a unique code word exhibiting a certain minimum Hamming distance from other code words in an encoding scheme to mitigate instances of bit flips or software overwrites of state information stored in memory. For example, instances of unintended bit flips or software overwrites may occur over time and through unpredictable modes due to bugs, lack of memory, malicious attacks, erroneous algorithm design, bad memory, bit line errors, or alpha particle irradiation of memory, etc. Thus, the safety module may execute blocks of the method to detect a mismatch between the encoded state information (e.g., code words) stored in memory and the encoding scheme (e.g., valid code words), which indicates that the encoded state information has been overwritten, and selectively execute a fault, warning, and / or fault recovery process in response.

[0038] In one example, the safety module executes the blocks of method S100 to store valid code words that represent functional states of individual subsystems of the controller within the safety module, functional states of external inputs monitored by the safety module, and / or functional states for data communications and are characterized by a minimum Hamming distance from other valid code words. The safety module also executes the blocks of method S100 to detect functional states of the individual subsystems, external inputs, and / or data communications and store corresponding code words in memory. The safety module then executes the blocks of method S100 to detect a match between the stored code words and the valid code words and output a safety message indicative of a functional state in response to detecting the match. Thus, when implemented in an environment susceptible to interference, the safety module can output a safety message indicative of a low error rate and can meet functional safety standards.

[0039] Alternatively, in this example, if the safety module detects a mismatch between the stored code word and the valid code word, the safety module can output a safety message indicating a fault condition. Thus, since the safety module verifies the state of each subsystem based on a match between the stored code word and the valid code word encoding the functional state of these subsystems, the safety module can detect a fault based on the difference between the stored code word and the valid code word and send a fault message instead of a functional message in response to detecting the fault, thereby triggering the system to enter a safe mode due to a fault condition if the functionality of the safety module cannot be confirmed in this way.

[0040] In another example, the safety module executes the blocks of method S100 to store valid code words that represent the states (e.g., functional state, fault state) of individual subsystems in the controllers in the safety module, the states of external inputs monitored by the safety module, and / or the states for data communications and are characterized by a minimum Hamming distance from other valid code words. The safety module also executes the blocks of method S100 to detect the functional states of the individual subsystems, external inputs, and / or data communications and store in memory the code words that correspond to the detected states. The safety module then executes the blocks of method S100 to output a safety message including a code word that represents the overall state (e.g., functional state, fault state) of the controllers, inputs, and / or data communications based on (i) whether the code words stored in memory during the monitoring period match the valid code words and (ii) the detected states. Thus, when a safety module is implemented in a system that requires continuous communication with a large number of nodes (e.g., inputs, machines, etc.), the safety module can manage message traffic from a subgroup of nodes and send messages indicating the overall status of the subgroup, thereby streamlining communications in a large network and maintaining functional safety standards.

[0041] The method S100 described herein is performed by a safety module including a pair of controllers (e.g., microcontrollers fabricated according to 90 nanometer chip fabrication technology) and an application processor to implement 8-bit and 16-bit code words. However, a safety module including additional or fewer controllers connected to external logic and / or fabricated by any other fabrication technology can similarly perform the blocks of method S100 to store a set of valid code words representing status information (e.g., function, fault) for various components (e.g., core infrastructure subsystems, inputs, data communications) of the safety module and characterized by a minimum Hamming distance from other code words, store the code words in memory based on the detected status of the core infrastructure subsystems, inputs, and / or data communications during a monitoring period, and output a safety message during an evaluation period based on (i) whether the code words stored in memory during the monitoring period match the valid code words and (ii) the detected status.

[0042] Further, the method S100 described herein may be performed by a safety module including a controller pair and an application processor to implement 8-bit and 16-bit code words separated by a predetermined minimum Hamming distance (e.g., a minimum Hamming distance of "8" or "4"). However, a safety module implementing longer or shorter code words separated by a greater or lesser minimum Hamming distance from each other may similarly perform the blocks of method S100 to store a set of valid code words representing status information (e.g., function, fault) for various components (e.g., core infrastructure subsystems, inputs, data communications) of the safety module and characterized by a minimum Hamming distance from other code words, store the code words in memory based on the detected status of the core infrastructure subsystems, inputs, and / or data communications during a monitoring period, and output a safety message during an evaluation period based on (i) whether the code words stored in memory during the monitoring period match the valid code words and (ii) the detected status.

[0043] 3. System In general, the safety module includes a first controller, a second controller, an application processor, and a communication bus that supports bidirectional communication between the first controller and the second controller, between the first controller and the application processor, and between the second controller and the application processor.

[0044] In particular, the first controller executes the blocks of method S100 to store a first set of valid code words, store in memory a code word corresponding to the detected condition, and in response to detecting a match between the code word stored in memory and the set of valid code words, output a safety message including a code word representing a condition (e.g., functional condition, fault condition) based on the detected condition. The first controller also executes the blocks of method S100 to output a safety message including a code word representing a fault condition in response to detecting a mismatch between the code word stored in memory and the set of valid code words.

[0045] Similarly, the second controller executes the blocks of method S100 to store a second set of valid code words, store in memory a code word corresponding to the detected condition, and in response to detecting a match between the code word stored in memory and the set of valid code words, output a safety message including a code word representing a condition (e.g., functional condition, fault condition) based on the detected condition. The second controller also executes the blocks of method S100 to output a safety message including a code word representing a fault condition in response to detecting a mismatch between the code word stored in memory and the set of valid code words.

[0046] Additionally, the application processor executes the blocks of method S100 to send and receive safety messages to and from the first controller, send and receive safety messages to and from the second controller, and send and receive safety messages to and from other safety modules.

[0047] 3.1 First Controller In one implementation, the first controller includes an arithmetic logic unit (hereinafter "ALU"), a volatile memory (e.g., random access memory or "RAM"), and a non-volatile memory (e.g., flash memory). The ALU performs arithmetic and logic operations based on computer instructions executed by the first controller. The RAM temporarily stores data retrieved from the storage to perform the calculations. The flash memory stores data and instructions to be programmed into the first controller. The first controller may further include an input / output interface, an internal bus, and an internal oscillator. The first controller may include fewer or additional components.

[0048] In one variation, the first controller further includes a program flow monitor safety mechanism, a stack underflow safety monitor, and a stack overflow safety monitor.

[0049] In general, the program flow monitor safety mechanism detects errors in the sequence or other flow of software instructions being executed by the first controller. In one implementation, the program flow monitor safety mechanism indicates a faulty operation when such an error is detected.

[0050] In general, the stack overflow safety mechanism detects when a software program being executed by the first controller attempts to use more space than is available on the call stack. In one implementation, the stack overflow safety mechanism exhibits a faulty behavior when a stack overflow is detected.

[0051] In general, a stack underflow safety mechanism detects when a software program being executed by a controller attempts to pop an item from an empty stack in memory. In one implementation, the stack underflow safety mechanism exhibits a faulty behavior when a stack underflow is detected.

[0052] In one implementation, the first controller includes an input configured to connect to a safety sensor (eg, emergency stop button, broken wire sensor) external to the safety module.

[0053] In one implementation, the first controller includes an input coupled to an output of the second controller. For example, the first controller can include an input register coupled to an output of the second controller.

[0054] 3.1.1 The First Controller: Logic In general, the first controller includes logic (e.g., hardware and / or firmware modules, instructions stored in flash memory) configured to detect states of a set of subsystems within the first controller, inputs configured to connect to safety sensors, and inputs coupled to the second controller. For example, the set of subsystems within the first controller may include an ALU, a RAM, a flash memory, a program flow monitor safety mechanism, a stack overflow safety mechanism, and / or a stack underflow safety mechanism.

[0055] In one implementation, the first controller may include logic whereby the first controller individually monitors each subsystem in the set of subsystems and detects operation (e.g., functional operation, faulty operation) of each subsystem accordingly, as described below. In one example, the first controller may monitor an ALU and detect functional operation of the ALU based on diagnostic tests of the ALU. In another example, the first controller may monitor a stack overflow safety mechanism and detect faulty operation of the stack overflow safety mechanism in response / based on an instance of stack overflow.

[0056] In another implementation, the first controller detects functional operation in the absence of an error detected for the given subsystem, and the first controller detects faulty operation when one or more errors are detected for the given subsystem. For example, errors may be defined based on the nature of the given subsystem, a safety standard associated with the given subsystem, and / or any factor applicable to the given subsystem.

[0057] In another implementation, the first controller detects a state of the subsystem corresponding to the detected operation of the subsystem. In one example, the first controller detects a functional state of the ALU in response to detecting a functional operation of the ALU. In another example, the first controller detects a fault condition of the stack overflow safety mechanism in response to detecting a fault operation of the stack overflow safety mechanism.

[0058] In another implementation, as described below, the first controller further includes logic that enables the first controller to detect a state of an input configured to connect to a safety sensor. For example, the first controller can detect a functional operation of the input (e.g., an input circuit coupled to an emergency stop button is operating within a correct voltage / current range according to a configured mode of operation, etc.), in which case the first controller can detect a functional state of the input in response to detecting the functional operation of the input. Alternatively, the first controller can detect a fault operation of the input (e.g., an input circuit coupled to an emergency stop button is operating outside a correct voltage / current range according to a configured mode of operation, an internal hardware failure, etc.), in which case the first controller can detect a fault state of the input in response to detecting the fault operation of the input.

[0059] In another implementation, as described below, the first controller further includes logic that enables the first controller to detect a state of the second controller. In one example, the first controller can detect a functional timeout state of the second controller in response to detecting receipt of a safety message from the second controller within a predetermined amount of time. Alternatively, the first controller can detect a fault timeout state of the second controller in response to detecting non-reception of a safety message from the second controller within a predetermined amount of time. In another example, the first controller can detect a functional or fault state of the second controller based on the content of a safety message from the second controller.

[0060] In one variation, the first controller includes a communications infrastructure safety mechanism and a communications content safety mechanism to detect communications failures with the second controller and / or the application processor.

[0061] Similarly, in another implementation, as described below, the first controller further includes logic that enables the first controller to detect the state of other controllers in other safety modules.

[0062] In another implementation, as described below, the first controller further includes logic that enables the first controller to encode the detected state of the second controller. For example, the first controller can store a code word corresponding to the detected state in a memory (e.g., a flash memory, an external memory).

[0063] In another implementation, as described below, the first controller further includes logic that enables the first controller to detect whether the memory contents match a valid code word. For example, the first controller can detect a match between the memory contents and a valid code word, which indicates that the code word stored in the memory has not been overwritten. Alternatively, the first controller can detect a mismatch between the memory contents and any valid code word, which indicates that the code word stored in the memory has been overwritten.

[0064] In another implementation, as described below, the first controller further includes logic that enables the first controller to output a safety message. For example, the first controller can assemble and output a safety message to the second controller and / or the application processor via a communication bus.

[0065] 3.2 Secondary Controller In one implementation, the second controller includes similar (eg, similar, identical) components arranged in a similar format as the first controller, and is separate and distinct from the first controller.

[0066] In one example, the first controller and the second controller each include redundant inputs configured to be connected to the same safety sensor (e.g., two redundant outputs of an emergency stop button, two redundant open circuit sensor outputs), and the first controller and the second controller process each redundant input independently and generate separate safety messages.

[0067] 3.3 Application Processor In one implementation, the application processor is configured to receive safety messages from the first controller and the second controller, concatenate information in the safety messages from the first controller and the second controller into a new safety message, and output the new safety message (e.g., over a network to another safety module).

[0068] In another implementation, the application processor is further configured to receive a safety message (e.g., from another safety module over a network), separate information in the received safety message into a first safety message for the first controller and a second safety message for the second controller, and output the first safety message to the first controller and the second safety message to the second controller.

[0069] In another implementation, communication by the first controller and the second controller through the application processor is implemented in a black channel setting, where the application processor concatenates / separates information passed between the underlying controllers without otherwise parsing or manipulating that data.

[0070] In one variation, the application processor is configured to analyze the first safety message from the first controller and the second safety message from the second controller and output a new safety message based on the results of the analysis. In one example, the application processor can output a safety message indicating a functional state in response to receiving a first safety message indicating a functional state from the first controller and a second safety message indicating a functional state from the second controller. In another example, the application processor can output a safety message indicating a fault state in response to receiving a first safety message indicating a functional state from the first controller and a second safety message indicating a fault state from the second controller.

[0071] 4. Example 1: Emergency stop button In general, a safety module transmits safety messages and receives safety messages. One or more safety modules may be implemented within a given machine. A safety message may indicate (e.g., functional, safe, safe-with-failure) the machine (or its modules or subcomponents) and may instruct the machine to enter a safe state (e.g., stop performing a given task, release fuel supply, shut down, reboot) to prevent unsafe activity until a safe state can be adjusted.

[0072] In one example, as shown in Figures 2A and 2B, the system includes a safety module and a safety controller.

[0073] As described above, in one implementation, the safety module includes a first controller, a second controller, an application processor, and a communication bus. The first controller includes a first input coupled to an emergency stop button in the system, and the second controller includes a second input coupled to the emergency stop button.

[0074] In general, the first controller and the second controller independently process respective inputs coupled to the emergency stop button and output respective safety messages to the application processor. In particular, the first controller can output the first safety message based on the detected state of the first controller, the detected state of the first input, the detected state of the second controller, and the validity of a stored code word representing the detected state (e.g., detecting a match between the stored code word and a valid code word) (e.g., based on the detected state of a set of subsystems within the first controller). For example, the first controller can output the first safety message to the second controller and / or the application processor via a communication bus.

[0075] Similarly, the second controller may output a second safety message (e.g., based on the detected state of the second controller, the detected state of the second input, the detected state of the first controller, and the validity of a stored code word representing the detected state (e.g., detecting a match between a stored code word and a valid code word) (e.g., based on the detected state of a set of subsystems within the second controller). For example, the second controller may output the second safety message to the first controller and / or the application processor via a communication bus.

[0076] In one implementation, an application processor in the safety module receives the first safety message and the second safety message, concatenates the first safety message and the second safety message, and outputs the combined safety message to an application processor in the safety controller. For example, the application processor can transmit the combined safety message through a transmission medium (e.g., any network, Internet, WiFi, Bluetooth, LTE).

[0077] In one implementation, the application processor in the safety controller receives a safety message from the application processor in the safety module and separates the received safety message into a first safety message for a first controller in the safety controller and a second safety message for a second controller in the safety controller. In that case, the application processor in the safety controller outputs the first safety message to the first controller in the safety controller via the communication bus and outputs the second safety message to the second controller in the safety controller via the communication bus. Thus, the first controller in the safety controller can process the first safety message from the first controller in the safety module, and the second controller in the safety controller can process the second safety message from the second controller in the safety module.

[0078] In one example, a first controller and a second controller in the safety module generate and output a safety message based on a first input and a second input indicating a fault condition (e.g., an input circuit coupled to an emergency stop button is operating outside of a correct voltage / current range according to a configured mode of operation, an internal hardware fault, etc.). The safety message includes a code word representing the fault condition of the respective input. The safety message is passed to the safety controller and processed by the first controller and the second controller in the safety controller. The first controller and the second controller in the safety controller can agree on the fault condition of the first input and the second input (e.g., an emergency stop button coupled to the safety module). The first controller and the second controller in the safety controller can then output a safety message commanding the machine to enter a safe state. Further details of implementing two controllers to meet this threshold are further described in U.S. Patent Application No. 17 / 192,657, filed March 4, 2021, which is incorporated by reference in its entirety.

[0079] 5. Example 2: Zone Controller In one variation on the above example, as shown in Figures 2A and 2B, the system includes a safety module, a safety controller, and a zone controller.

[0080] In general, a safety controller is a safety module configured to receive safety messages from and transmit safety messages to a group of safety modules.

[0081] In one implementation, the safety controller 110 is configured to receive safety messages from and transmit safety messages to the safety modules 120 and 122. For example, the safety controller can instruct certain segments of other machines to change their safety state (e.g., enter a safe state) after the occurrence of a condition (e.g., a given machine enters a safe state, a given command affecting multiple machines is received).

[0082] Similarly, the safety controller 112 approximates the safety controller 110. For example, the safety controller 112 is configured to receive safety messages from the safety module 124 and the safety module 126 and to transmit safety messages to the safety module 124 and the safety module 126.

[0083] In one variation of this example, there can be more or fewer safety modules in the group of safety modules. Additionally or alternatively, safety modules can be dynamically assigned to different groups of safety modules.

[0084] In general, a zone controller is a safety module configured to receive safety messages from and transmit safety messages to a group of safety controllers and / or safety modules. For example, a zone controller may transmit safety messages across a "zone," which may be a logical subgrouping of machines within a facility.

[0085] In one implementation, the zone controller 130 is configured to receive safety messages from and transmit safety messages to the safety controller 110 and the safety controller 112. Additionally or alternatively, the zone controller 130 is further configured to receive safety messages from and transmit safety messages to the safety modules 120, 122, 124, 126.

[0086] In one variation on this example, the zone groupings may be cascaded into any number of tiers, in which case the zone controllers may interact with yet another controller that may be configured to send a safety message to all machines throughout the facility (e.g., emergency facility-wide shutdown). In this variation, a mapping table or other logical association may be used, in which a condition, type of command or state, or other trigger may be mapped to downstream machines and controllers that should receive a command if the condition is met.

[0087] In yet another variation to this example, each layer in the system can implement a timeout safety system. For example, communication between the safety module 120 and the safety controller 110 is an example communication layer. Additionally, communication between the safety controller 110 and the zone controller 130 is another communication layer. In this two-layer example, the safety controller 110 monitors the timeout status of the safety modules 120, 122, and the zone controller 130 monitors the timeout status of the safety controllers 110, 112. In a variation, there may be additional layers beyond either end of the system shown in Figures 2A and 2B.

[0088] In this example, a receiving module (e.g., safety controller, zone controller) stores the timeout status of multiple transmitting modules (e.g., safety modules, safety controllers) and uses the timeout status to determine safety actions when one or more transmitting modules indicate a bad timeout status. For example, if only a single transmitting module in a group indicates a failure, the receiving module can flag the bad transmitting module for inspection. In other cases, if more than a threshold number of transmitting modules go bad, the receiving module can take more aggressive measures, such as commanding one or more receiving modules to enter a safe mode or even shutting down part or all of the system. The timeout status of the transmitting modules is stored in a memory associated with the receiving module for further analysis to determine safety actions and procedures the system can take when one or more modules go bad.

[0089] In yet another variation to this example, the zone controller 130 receives a safety message (e.g., from the safety controller 110) that includes one or more valid fault code words, decodes the safety message, interprets the one or more valid fault code words as a system fault, and provides notification for a recovery mode.

[0090] 6.Safety Message In one example, the application processor transmits a concatenated secure message, as shown in FIG.

[0091] Generally, the application processor concatenates information from the first controller and the second controller. In one implementation, "AP Rx M1" refers to information the application processor receives from the first controller, and "AP Rx M2" refers to information the application processor receives from the second controller. In one variation, the application processor can concatenate information from additional or fewer controllers into a safety message.

[0092] In one implementation, the first two bytes of the safety message (e.g., "ID0", "ID1"; "ID0'", "ID1'") together comprise a byte that uniquely identifies the controller. The third byte of the safety message (e.g., "M0", "M1") indicates the state of the controller (e.g., functional state, fault state). In one implementation, the first controller generates the third byte ("M0") after detecting the state of the first controller, as described below. Similarly, the second controller generates the third byte ("M1") after detecting the state of the second controller.

[0093] In one implementation, the fourth through sixth bytes (e.g., "I1", "I2", "I3") refer to one or more inputs (e.g., emergency stop button, broken wire sensor) received by the first controller and the second controller. In one variation, any order of the bytes may be used.

[0094] In one implementation, the application processor concatenates the safety messages from the first controller and the second controller with an error code (e.g., a cyclic redundancy check (CRC) code). Further information regarding appending one or more error codes to the safety data of two or more microcontrollers and using the same to decode / verify the safety messages is also described with reference to U.S. Patent Application No. 17 / 192,657, filed March 4, 2021, which is incorporated by reference in its entirety.

[0095] In one implementation, the application processor may augment the controller's data with other information and may generate a cumulative error code (eg, a cumulative CRC) for the entire message.

[0096] In one implementation, the application processor of the input device sends the safety message after it is concatenated to a receiving device (e.g., a safety controller), which decodes the message. At the receiving device side, the application processor (e.g., in the safety controller) separates the messages from each controller. If M0 or M1 indicates a fault condition, all of the inputs I1-I3 are dropped. Systems and methods for decoding messages while ensuring functional safety standards are described with reference to U.S. Patent Application No. 17 / 192,657, filed March 4, 2021, which is incorporated by reference in its entirety.

[0097] 7. Store valid code words Block S110 of method S100 recites storing a first set of valid code words, the first set of valid code words including a first valid functional code word representing a functional state of a first subsystem of the first set of subsystems in the first controller, a first valid fault code word representing a fault state of the first subsystem and characterized by a first minimum Hamming distance from the first valid functional code word, a second valid functional code word representing a functional state of the first controller, and a third valid fault code word representing a fault state of the first controller. a second valid functional code word characterized by a second minimum Hamming distance from the second valid functional code word, a third valid functional code word representing a functional state of a first input coupled to the system, a third valid functional code word representing a fault state of the first input and characterized by a third minimum Hamming distance from the third valid functional code word, a fourth valid functional code word representing a functional state of the system, and a fourth valid functional code word representing a fault state of the system and characterized by a fourth minimum Hamming distance from the fourth valid functional code word.

[0098] Generally, in block S110, the first controller stores a first set of valid code words that represent states of subsystems within the first controller, inputs monitored by the first controller, and data communications associated with the first controller. In particular, as described below, a valid code word is a bit pattern that uniquely represents a state and is characterized by a minimum Hamming distance from other valid code words.

[0099] Similarly, in block S110, the second controller stores a second set of valid code words representing the states of subsystems within the second controller, inputs monitored by the second controller, and data communications associated with the second controller.

[0100] In one implementation, the first controller can store the first set of valid code words in a flash memory within the first controller. In one variation, the first controller can store the first set of valid code words in an external memory. In yet another example, the first controller can store different valid code words in the first set of valid code words across different memories.

[0101] Similarly, in one implementation, the second controller can store the second set of valid code words in a flash memory within the second controller. In one variation, the second controller can store the second set of valid code words in an external memory. In yet another example, the second controller can store different valid code words in the second set of valid code words across different memories.

[0102] In one variation, the first controller stores any valid code words stored and / or implemented by any other controllers in communication with the first controller. Similarly, the second controller stores any valid code words stored and / or implemented by any other controllers in communication with the first controller. Thus, as described below, the first controller can verify code words included in safety messages received from other controllers. In another variation, the first controller and the second controller can store more or fewer valid code words.

[0103] 7.1 Store valid codewords: First controller subsystem In general, in block S110, the first controller stores, for each subsystem in the set of subsystems in the first controller, a respective valid functional code word representing the functional state of the subsystem and a respective valid fault code word representing the fault state of the subsystem. In one example, the first controller can store a valid functional code word representing the functional state of an ALU and a valid fault code word representing the fault state of the ALU. In another example, the first controller can store a valid functional code word representing the functional state of a flash memory in the first controller and a valid fault code word representing the fault state of the ALU. In yet another example, the first controller can store a valid functional code word representing the functional state of a stack overflow safety mechanism and a valid fault code word representing the fault state of the stack overflow safety mechanism.

[0104] In one implementation, the first controller stores each valid codeword representing the state of its subsystem as a different bit pattern indicating a length of 16 bits (e.g., 1 word, 2 bytes, 4 nibbles). Each 16-bit word includes an upper byte and a lower byte. Each byte includes an upper nibble and a lower nibble.

[0105] In one example, a first controller may store valid function code words representing the functional state of an ALU in the first controller as "13, 14, 14, 13" (represented in binary as "1101111011101101"). The most significant nibble of the most significant byte is "13" (represented in binary as "1101") and the least significant nibble of the most significant byte is "14" (represented in binary as "1110"). Similarly, the most significant nibble of the least significant byte is "14" (represented in binary as "1110") and the least significant nibble of the least significant byte is "13" (represented in binary as "1101"). The most significant and least significant bytes indicate inverse nibble values ​​(e.g., "13, 14" vs. "14, 13").

[0106] In another example, a first controller may store a valid fault code word representing a fault condition of an ALU in the first controller as "8, 2, 2, 8" (represented in binary as "1000001000101000"). The most significant nibble of the most significant byte is "8" (represented in binary as "1000") and the least significant nibble of the most significant byte is "2" (represented in binary as "0010"). Similarly, the most significant nibble of the least significant byte is "2" (represented in binary as "0010") and the least significant nibble of the least significant byte is "8" (represented in binary as "1000"). The most significant and least significant bytes indicate inverse nibble values ​​(e.g., "8, 2" vs. "2, 8").

[0107] In one implementation, the first controller stores valid code words that include only odd values ​​(e.g., every half byte is an odd value). In one variation, the first controller stores valid code words that include only even values ​​(e.g., every half byte is an even value). In another variation, the first controller stores valid code words that are characterized by the upper byte of the valid fault code word using only odd values, the lower byte of the valid fault code word using only even values, the upper byte of the valid function code word using only even values, and the lower byte of the valid function code word using only odd values. In yet another variation, the first controller stores valid code words that are characterized by the upper byte of the valid fault code word using only even values, the lower byte of the valid fault code word using only odd values, the upper byte of the valid function code word using only odd values, and the lower byte of the valid function code word using only even values. Here, "odd" and "even" describe the number of bits, rather than the odd or even decimal values.

[0108] In one implementation, the first controller stores valid functional code words for a given subsystem in the first controller and valid fault code words for the given subsystem that are mutually characterized by a minimum Hamming distance of 8 from each other. In the above example, the valid functional code words representing the functional state of the ALU (e.g., "1101111011101101") and the valid fault code words representing the fault state of the ALU (e.g., "1000001000101000") are characterized by a Hamming distance of 8 from each other. In one variation, the first controller can store valid functional code words for a given subsystem and valid fault code words for the given subsystem that are mutually characterized by a Hamming distance of greater than 8 from each other.

[0109] In one implementation, the first controller stores valid function code words for a given subsystem within the first controller and valid function code words for different subsystems within the first controller that are mutually characterized by a minimum Hamming distance of four from each other.

[0110] In one implementation, the first controller stores valid function code words for a given subsystem within the first controller and valid fault code words for different subsystems within the first controller that are mutually characterized by a minimum Hamming distance of four from each other.

[0111] In one implementation, the first controller stores valid fault code words for a given subsystem within the first controller and valid function code words for different subsystems within the first controller that are mutually characterized by a minimum Hamming distance of four from each other.

[0112] In one implementation, the first controller stores valid fault code words for a given subsystem within the first controller and valid fault code words for different subsystems within the first controller that are mutually characterized by a minimum Hamming distance of four from each other.

[0113] In one variation of the above example, the first controller may further store valid functional code words representing the functional state of the flash memory in the first controller as "14, 13, 13, 14" (represented in binary as "1110110111011110") and valid fault code words representing the functional state of the flash memory in the first controller as "2, 8, 8, 2" (represented in binary as "0010100010000010").

[0114] In the above example, the valid functional code word representing the functional state of the ALU (e.g., "1101111011101101") and the valid functional code word representing the functional state of the flash memory (e.g., "1110110111011110") are characterized by a minimum Hamming distance of 4 from each other (e.g., a Hamming distance of 8 in this case).

[0115] In the above example, a valid functional code word representing the functional state of the ALU (e.g., “1101111011101101”) and a valid fault code word representing the fault state of the flash memory (e.g., “0010100010000010”) are characterized by a minimum Hamming distance of 4 from each other (e.g., a Hamming distance of 8 in this case).

[0116] In the above example, the valid fault code word representing the faulty state of the ALU (e.g., “1000001000101000”) and the valid functional code word representing the functional state of the flash memory (e.g., “1110110111011110”) are characterized by a minimum Hamming distance of 4 from each other (e.g., a Hamming distance of 12 in this case).

[0117] In the above example, the valid fault code word representing the ALU fault condition (e.g., “1000001000101000”) and the valid fault code word representing the flash memory fault condition (e.g., “0010100010000010”) are characterized by a minimum Hamming distance of 4 from each other (e.g., a Hamming distance of 8 in this case).

[0118] Thus, the first controller may store valid code words characterized by a sufficiently large minimum Hamming distance to detect the occurrence of a bit flip or software overwrite.

[0119] 7.2 Remembering the valid codeword: the second controller subsystem Generally, in block S110, the second controller stores, for each subsystem in the set of subsystems in the second controller, a respective valid functional code word representing the functional state of the subsystem and a respective valid fault code word representing the fault state of the subsystem.

[0120] In one implementation, the second controller stores valid function code words for a given subsystem in the second controller and valid fault code words for a given subsystem in the second controller that are mutually characterized by a minimum Hamming distance of 8 from each other, valid function code words for a given subsystem in the second controller and valid fault code words for a different subsystem in the second controller that are mutually characterized by a minimum Hamming distance of 4 from each other, valid function code words for a given subsystem in the second controller and valid fault code words for a different subsystem in the second controller that are mutually characterized by a minimum Hamming distance of 4 from each other, valid function code words for a given subsystem in the second controller and valid fault code words for a different subsystem in the second controller that are mutually characterized by a minimum Hamming distance of 4 from each other, and valid fault code words for a given subsystem in the second controller and valid fault code words for a different subsystem in the second controller that are mutually characterized by a minimum Hamming distance of 4 from each other.

[0121] In one implementation, the second controller stores valid function code words for a given subsystem in the second controller that are characterized by a minimum Hamming distance of 8 from valid function code words for similar subsystems in the first controller.

[0122] In a variation of the above example, the second controller may store a valid function code word "14, 13, 13, 14" (represented in binary as "1110110111011110") representing the functional state of the ALU in the second controller. The valid function code word representing the fault state of the ALU in the second controller (e.g., "1110110111011110") and the valid function code word representing the functional state of the ALU in the first controller (e.g., "1101111011101101") are characterized by a minimum Hamming distance of 8 from each other (e.g., a Hamming distance of 8 in this case).

[0123] Similarly, in one implementation, the second controller stores valid fault code words for a given subsystem in the second controller that are characterized by a minimum Hamming distance of 8 from the valid fault code words for similar subsystems in the first controller.

[0124] 7.2.1 Storing Valid Codewords: Example Subsystem In one example, a first controller (denoted as "MA" in FIG. 3) and a second controller (denoted as "MB" in FIG. 3) may each store the codewords as shown in FIG.

[0125] In one example, the first controller stores the following pairs of binary values ​​characterized by a Hamming distance of 8 or greater to each other: No-Fault Indicators (NFIs) (e.g., valid function codewords) and Fault Indicators (FIs) (e.g., valid fault codewords) for safety mechanisms [SMs] in the first controller: NFI and FI for ALU / core SM, NFI and FI for program flow monitor SM, NFI and FI for RAM SM, NFI and FI for flash SM, NFI and FI for stack underflow SM, and NFI and FI for stack overflow SM.

[0126] In another example, the first controller stores NFIs (eg, valid function codewords) within the first controller that are characterized by a Hamming distance of four or greater to each other. The pairs include: ALU / core SM NFI and Program Flow Monitor SM NFI, ALU / core SM NFI and RAM SM NFI, ALU / core SM NFI and flash SM NFI, ALU / core SM NFI and stack underflow SM NFI, ALU / core SM NFI and stack overflow SM NFI, Program Flow Monitor SM NFI and RAM SM NFI, Program Flow Monitor SM NFI and flash SM NFI, Program Flow Monitor SM NFI and stack underflow SM NFI, Program Flow Monitor SM NFI and stack overflow SM NFI, RAM SM NFI and flash SM NFI, RAM SM NFI and stack underflow SM NFI, RAM SM NFI and stack overflow SM NFI, flash SM NFI and stack underflow SM NFI, flash SM NFI and stack overflow SM NFI, and flash SM NFI and stack overflow SM NFI.

[0127] In yet another example, the first controller stores FIs (e.g., valid fault code words) within the first controller that are characterized by a Hamming distance to each other of 4 or greater. The pairs include an FI of an ALU / core SM and an FI of a program flow monitor SM, an FI of an ALU / core SM and an FI of a RAM SM, an FI of an ALU / core SM and an FI of a flash SM, an FI of an ALU / core SM and an FI of a stack underflow SM, an FI of an ALU / core SM and an FI of a stack overflow SM, an FI of an FI of a program flow monitor SM and an FI of a RAM SM, an FI of an FI of a program flow monitor SM and an FI of a flash SM, an FI of an FI of an FI of a program flow monitor SM and an FI of a stack underflow SM, an FI of an FI of an FI of a program flow monitor SM and an FI of a stack overflow SM, an FI of an FI of a RAM SM and an FI of a flash SM, an FI of an FI of an FI of a RAM SM and an FI of a stack underflow SM, an FI of an FI of an FI of a RAM SM and an FI of a stack overflow ... flash SM and an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an FI of an

[0128] In yet another example, the first controller stores NFIs (e.g., valid function code words) and other FIs (e.g., valid fault code words) within the first controller that are characterized by a Hamming distance of four or greater to each other. The pairs include: ALU / core SM NFI and Program Flow Monitor SM FI, ALU / core SM NFI and RAM SM FI, ALU / core SM NFI and flash SM FI, ALU / core SM NFI and stack underflow SM FI, ALU / core SM NFI and stack overflow SM FI, Program Flow Monitor SM NFI and RAM SM FI, Program Flow Monitor SM NFI and flash SM FI, Program Flow Monitor SM NFI and stack underflow SM FI, Program Flow Monitor SM NFI and stack overflow SM FI, RAM SM NFI and flash SM FI, RAM SM NFI and stack underflow SM FI, RAM SM NFI and stack overflow SM FI, flash SM NFI and stack underflow SM FI, flash SM NFI and stack overflow SM FI, flash SM FI and stack overflow SM FI.

[0129] In yet another example, the first controller stores FIs (e.g., valid fault code words) and other NFIs (e.g., valid function code words) within the first controller that are characterized by a Hamming distance of four or more to each other. The pairs include: ALU / core SM FI and Program Flow Monitor SM NFI, ALU / core SM FI and RAM SM NFI, ALU / core SM FI and flash SM NFI, ALU / core SM FI and stack underflow SM NFI, ALU / core SM FI and stack overflow SM NFI, Program Flow Monitor SM FI and RAM SM NFI, Program Flow Monitor SM FI and flash SM NFI, Program Flow Monitor SM FI and stack underflow SM NFI, Program Flow Monitor SM FI and stack overflow SM NFI, RAM SM FI and flash SM NFI, RAM SM FI and stack underflow SM NFI, RAM SM FI and stack overflow SM NFI, flash SM FI and stack underflow SM NFI, flash SM FI and stack overflow SM NFI, and flash SM FI and stack overflow SM NFI.

[0130] In yet another example, the second controller stores the following pairs of binary values ​​characterized by a Hamming distance of 8 or greater from each other: No-Fault Indicators (NFIs) (e.g., valid function codewords) and Fault Indicators (FIs) (e.g., valid fault codewords) for safety mechanisms [SMs] in the second controller: NFI and FI for ALU / core SM, NFI and FI for program flow monitor SM, NFI and FI for RAM SM, NFI and FI for flash SM, NFI and FI for stack underflow SM, and NFI and FI for stack overflow SM.

[0131] In yet another example, the second controller stores NFIs (eg, valid function codewords) within the second controller that are characterized by a Hamming distance of four or greater to each other. The pairs include: ALU / core SM NFI and Program Flow Monitor SM NFI, ALU / core SM NFI and RAM SM NFI, ALU / core SM NFI and flash SM NFI, ALU / core SM NFI and stack underflow SM NFI, ALU / core SM NFI and stack overflow SM NFI, Program Flow Monitor SM NFI and RAM SM NFI, Program Flow Monitor SM NFI and flash SM NFI, Program Flow Monitor SM NFI and stack underflow SM NFI, Program Flow Monitor SM NFI and stack overflow SM NFI, RAM SM NFI and flash SM NFI, RAM SM NFI and stack underflow SM NFI, RAM SM NFI and stack overflow SM NFI, flash SM NFI and stack underflow SM NFI, flash SM NFI and stack overflow SM NFI, and flash SM NFI and stack overflow SM NFI.

[0132] In yet another example, the second controller stores FIs (eg, valid fault code words) within the second controller that are characterized by a Hamming distance of four or greater to each other. The pairs include: ALU / core SM FI and Program Flow Monitor SM FI, ALU / core SM FI and RAM SM FI, ALU / core SM FI and flash SM FI, ALU / core SM FI and stack underflow SM FI, ALU / core SM FI and stack overflow SM FI, Program Flow Monitor SM FI and RAM SM FI, Program Flow Monitor SM FI and flash SM FI, Program Flow Monitor SM FI and stack underflow SM FI, Program Flow Monitor SM FI and stack overflow SM FI, RAM SM FI and flash SM FI, RAM SM NFI and stack underflow SM FI, RAM SM FI and stack overflow SM FI, flash SM FI and stack underflow SM FI, flash SM FI and stack overflow SM FI, and flash SM FI and stack overflow SM FI.

[0133] In yet another example, the second controller stores NFIs (eg, valid function codewords) and other fault indicators FIs within the second controller that are characterized by a Hamming distance of four or greater to each other. The pairs include: ALU / core SM NFI and Program Flow Monitor SM FI, ALU / core SM NFI and RAM SM FI, ALU / core SM NFI and flash SM FI, ALU / core SM NFI and stack underflow SM FI, ALU / core SM NFI and stack overflow SM FI, Program Flow Monitor SM NFI and RAM SM FI, Program Flow Monitor SM NFI and flash SM FI, Program Flow Monitor SM NFI and stack underflow SM FI, Program Flow Monitor SM NFI and stack overflow SM FI, RAM SM NFI and flash SM FI, RAM SM NFI and stack underflow SM FI, RAM SM NFI and stack overflow SM FI, flash SM NFI and stack underflow SM FI, flash SM NFI and stack overflow SM FI, flash SM NFI and stack overflow SM FI, flash SM NFI and stack overflow SM FI, and flash SM NFI and stack overflow SM FI.

[0134] In yet another example, the second controller stores FIs (e.g., valid fault code words) and other NFIs (e.g., valid fault code words) within the second controller that are characterized by a Hamming distance of four or greater to each other. The pairs include: ALU / core SM FI and Program Flow Monitor SM NFI, ALU / core SM FI and RAM SM NFI, ALU / core SM FI and flash SM NFI, ALU / core SM FI and stack underflow SM NFI, ALU / core SM FI and stack overflow SM NFI, Program Flow Monitor SM FI and RAM SM NFI, Program Flow Monitor SM FI and flash SM NFI, Program Flow Monitor SM FI and stack underflow SM NFI, Program Flow Monitor SM FI and stack overflow SM NFI, RAM SM FI and flash SM NFI, RAM SM FI and stack underflow SM NFI, RAM SM FI and stack overflow SM NFI, flash SM FI and stack underflow SM NFI, flash SM FI and stack overflow SM NFI, and flash SM FI and stack overflow SM NFI.

[0135] In yet another example, the second controller stores the following pairs of binary values, eight or more of which are spaced apart from each other: The pairs are: NFI of ALU / core SM of controller 1 (e.g., the first controller) and NFI of ALU / core SM of controller 2 (e.g., the second controller); FI of ALU / core SM of controller 1 and FI of ALU / core SM of controller 2; NFI of ALU / core SM of controller 1 and NFI of ALU / core SM of controller 2; FI of ALU / core SM of controller 1 and NFI of ALU / core SM of controller 2; NFI of Program Flow Monitor [PFM] SM of controller 1 and NFI of PFM SM of controller 2; FI of PFM SM of controller 1 and FI of PFM SM of controller 2; NFI of PFM SM of controller 1 and NFI of PFM SM of controller 2; FI of PFM SM of controller 1 and NFI of PFM SM of controller 2; NFI of RAM SM of controller 1 and NFI of RAM SM of controller 2; FI of RAM SM of controller 1 and FI of RAM SM of controller 2; NFI of SM and RAM of Controller 2 NFI of SM, RAM of Controller 1 FI of SM and RAM of Controller 2NFI of SM, NFI of flash SM of controller 1 and NFI of flash SM of controller 2, FI of flash SM of controller 1 and FI of flash SM of controller 2, NFI of flash SM of controller 1 and NFI of flash SM of controller 2, FI of flash SM of controller 1 and NFI of flash SM of controller 2, NFI of stack underflow SM of controller 1 and NFI of stack underflow SM of controller 2, FI of stack underflow SM of controller 1 and FI of stack underflow SM of controller 2, NF of stack underflow SM of controller 1 I and NFI of stack underflow SM of controller 2, FI of stack underflow SM of controller 1 and NFI of stack underflow SM of controller 2, NFI of stack underflow SM of controller 1 and NFI of stack underflow SM of controller 2, FI of stack underflow SM of controller 1 and FI of stack underflow SM of controller 2, NFI of stack underflow SM of controller 1 and NFI of stack underflow SM of controller 2, and FI of stack underflow SM of controller 1 and NFI of stack underflow SM of controller 2.

[0136] Thus, the first controller and the second controller implementing valid functional and fault code words exhibit freedom from interference (FFI) from each other.

[0137] 7.3 Remembering the valid codeword: global controller state In one implementation, in block S110, the first controller stores a valid function code word that represents a functional state of the first controller and a valid fault code word that represents a fault state of the first controller and is characterized by a minimum Hamming distance from the valid function code word that represents the functional state of the first controller. For example, the first controller may store a valid function code word and a valid fault code word that are characterized by a minimum Hamming distance of four from each other.

[0138] Similarly, in one implementation, in block S110, the second controller stores valid functional code words that represent the functional state of the second controller and valid fault code words that represent the fault state of the second controller and that are characterized by a minimum Hamming distance from the valid functional code words that represent the functional state of the second controller. For example, the second controller may store valid functional code words and valid fault code words that are characterized by a minimum Hamming distance of four from each other.

[0139] In one implementation, the valid code words representing the state of the controller each exhibit a length of 8 bits (eg, 1 byte).

[0140] In one example, a first controller may store a valid function code word representing the functional state of the first controller as "11110010" and a valid fault code word representing the fault state of the first controller as "10100100."

[0141] In another example, the second controller may store a valid function code word representing the functional state of the second controller as "00101111" and a valid fault code word representing the fault state of the second controller as "01001010."

[0142] In one implementation, the valid function code word for the first controller and the valid function code word indicate opposite nibble values ​​(e.g., "1111, 0010" vs. "0010, 1111"). Similarly, in one implementation, the valid fault code word for the first controller and the valid fault code word indicate opposite nibble values ​​(e.g., "1010, 0100" vs. "0100, 1010").

[0143] In one implementation, in block S110, the first controller stores a valid functional code word representing a functional state of the second controller and a valid fault code word representing a fault state of the second controller and characterized by a minimum Hamming distance (e.g., 4) from the valid functional code word representing the functional state of the second controller.

[0144] In one implementation, in block S110, the second controller stores a valid functional code word representing a functional state of the first controller and a valid fault code word representing a fault state of the first controller and characterized by a minimum Hamming distance (e.g., 4) from the valid functional code word representing the functional state of the first controller.

[0145] 7.4 Remembering valid codewords: external input In one implementation, in block S110, the first controller stores a valid functional code word representing a functional state of a first input coupled to the system and a valid fault code word representing a fault state of the first input and characterized by a minimum Hamming distance (e.g., 4) from the valid functional code word representing the functional state of the first input.

[0146] In one implementation, in block S110, the second controller stores a valid functional code word representing a functional state of a second input coupled to the system and a valid fault code word representing a fault state of the second input and characterized by a minimum Hamming distance (e.g., 4) from the valid functional code word representing the functional state of the second input.

[0147] In one variation, the first controller and the second controller can each store respective valid function / fault code words for a plurality of inputs. In one example, each valid function / fault code word pair can exhibit a minimum Hamming distance (e.g., 4) from each other. In another example, each valid code word can exhibit a minimum Hamming distance (e.g., 4) from other valid code words.

[0148] In one implementation, the valid codewords representing the states of the inputs each exhibit a length of 8 bits (eg, 1 byte).

[0149] 7.5 Remember Valid Codeword: Safety Module Timeout In one implementation, in block S110, the first controller stores a valid function code word representing a function timeout state of the second controller and a valid fault code word representing a fault timeout state of the second controller and characterized by a minimum Hamming distance (e.g., 8) from the valid function code word representing the function timeout state of the second controller.

[0150] In one implementation, the first controller stores these valid code words as different bit patterns that indicate a length of 16 bits (e.g., 1 word, 2 bytes, 4 nibbles). Each 16-bit word includes an upper byte and a lower byte. Each byte includes an upper nibble and a lower nibble.

[0151] For example, a first controller may store a valid function code word representing a function timeout condition of a second controller as "12, 5, 11, 7" (represented in binary as "1100010110110111") and a valid fault code word representing a fault timeout condition of the second controller as "7, 11, 5, 12" (represented in binary as "0111101101011100").

[0152] Similarly, in one implementation, the second controller stores a valid function code word representing a function timeout state of the first controller and a valid fault code word representing a fault timeout state of the first controller and characterized by a minimum Hamming distance (e.g., 8) from the valid function code word representing the function timeout state of the first controller.

[0153] For example, the second controller may store valid function code words representing a function timeout condition of the first controller as "5, 12, 7, 11" (represented in binary as "0101110001111011") and valid fault code words representing a fault timeout condition of the first controller as "11, 7, 12, 5" (represented in binary as "1011011111000101").

[0154] In one variation, the high byte of the valid fault codeword only indicates odd values, the low byte of the valid fault codeword only indicates even values, the high byte of the valid function codeword only indicates even values, and the low byte of the valid function codeword only indicates odd values. In another variation, the high byte of the valid fault codeword only indicates even values, the low byte of the valid fault codeword only indicates odd values, the high byte of the valid function codeword only indicates odd values, and the low byte of the valid function codeword only indicates even values, where "odd" and "even" describe the number of bits rather than the odd or even decimal values.

[0155] In one implementation, in block S110, the first controller stores a valid functional code word representing a functional state of the communication content from the second controller and a valid fault code word representing a fault state of the communication content from the second controller and characterized by a minimum Hamming distance (e.g., 8) from the valid functional code word representing the functional state of the communication content from the second controller.

[0156] Similarly, in one implementation, in block S110, the second controller stores a valid functional code word representing a functional state of the communication content from the first controller and a valid fault code word representing a fault state of the communication content from the first controller and characterized by a minimum Hamming distance (e.g., 8) from the valid functional code word representing the functional state of the communication content from the first controller.

[0157] In one implementation, in block S110, the first controller stores a valid functional code word representing a functional state of the communication content from the application processor and a valid fault code word representing a fault state of the communication content from the application processor and characterized by a minimum Hamming distance (e.g., 8) from the valid functional code word representing the functional state of the communication content from the application processor.

[0158] Similarly, in one implementation, in block S110, the second controller stores valid functional code words representing functional states of communication content from the application processor and valid fault code words representing fault states of communication content from the application processor and characterized by a minimum Hamming distance (e.g., 8) from the valid functional code words representing the functional states of communication content from the application processor.

[0159] In one implementation, the first controller stores these valid codewords, each characterized by a minimum Hamming distance (eg, 4) from other valid codewords.

[0160] For example, a first controller (denoted as "MA") and a second controller (denoted as "MB") may each store code words as shown in Figures 5A, 5B, 5C, 5D, and 6 (application processors denoted as "AP").

[0161] In this example, all four communication SM value NFI (e.g., valid function codeword) / FI (e.g., valid fault codeword) pairs in the first controller MA are characterized by a Hamming distance of 8 or more from each other. All four NFIs in the first controller MA are characterized by a Hamming distance of 4 or more from each other. All four FIs in the first controller MA are characterized by a Hamming distance of 4 or more from each other. Any of the four NFIs in the first controller MA are characterized by a Hamming distance of 4 or more from any of the four FIs in the first controller MA.

[0162] Similarly, all four communication SM value NFI (e.g., valid function codeword) / FI (e.g., valid fault codeword) pairs in the second controller MB are characterized by a Hamming distance of 8 or more from each other. All four NFIs in the second controller MB are characterized by a Hamming distance of 4 or more from each other. All four FIs in the second controller MB are characterized by a Hamming distance of 4 or more from each other. Any of the four NFIs in the second controller MB are characterized by a Hamming distance of 4 or more from any of the four FIs in the second controller MB.

[0163] 7.6 Remember Valid Codeword: Safety Controller Timeout In one implementation, in block S110, the first controller stores a valid function code word representing a functional timeout state of a third controller in a second safety module coupled to the system, a valid fault code word representing a fault timeout state of the third controller and characterized by a minimum Hamming distance (e.g., 8) from the valid function code word representing the functional timeout state of the third controller, a valid function code word representing a functional timeout state of a fourth controller in a third safety module coupled to the system, a valid fault code word representing a fault timeout state of the fourth controller and characterized by a minimum Hamming distance (e.g., 8) from the valid function code word representing the functional timeout state of the fourth controller, a ninth valid function code word representing a functional timeout state of a set of monitored controllers including the third controller and the fourth controller, and a ninth valid fault code word representing a fault timeout state of the set of monitored controllers and characterized by a minimum Hamming distance (e.g., 8) from the ninth valid function code word representing the functional timeout state of the set of monitored controllers.

[0164] In one variation, the first controller may store a greater or lesser number of valid function code words corresponding to a greater or lesser number of controllers of other safety modules that are monitored by the first controller and included in the set of monitored controllers.

[0165] In one implementation, the first controller stores these valid code words as different bit patterns each indicating a length of 16 bits (e.g., 1 word, 2 bytes, 4 nibbles). Each 16-bit word includes an upper byte and a lower byte. Each byte includes an upper nibble and a lower nibble. In one variation, the first controller stores valid functional code words representing functional timeout conditions of the set of monitored controllers and valid fault code words representing fault timeout conditions of the set of monitored controllers as different bit patterns each indicating a length of 8 bits (e.g., 1 byte).

[0166] In one implementation, the high byte of the valid fault codeword indicates only odd values, the low byte of the valid fault codeword indicates only even values, the high byte of the valid function codeword indicates only even values, and the low byte of the valid function codeword indicates only odd values. In one variation, the high byte of the valid fault codeword indicates only even values, the low byte of the valid fault codeword indicates only odd values, the high byte of the valid function codeword indicates only odd values, and the low byte of the valid function codeword indicates only even values.

[0167] In one implementation, the first controller stores valid function / fault code words that represent timeout conditions for a given controller that are characterized by a minimum Hamming distance from each other (e.g., 8). In one implementation, the first controller stores these valid code words that are each characterized by a minimum Hamming distance from other valid code words (e.g., 4).

[0168] In one variation, in block S110, the second controller may store a valid code word representing a timeout status of a controller in another safety module in a manner similar to that described above in relation to the first controller, as described in the example above.

[0169] 7.6.1 Remembering a Valid Codeword: Safety Controller Timeout Example In one example, a first controller (denoted as "MA") and a second controller (denoted as "MB") in a safety module can each store code words as shown in Figures 5A, 5B, 5C, 5D, and 6.

[0170] In this example, a first controller (MA) and a second controller (MB) in the safety module monitor timeout conditions for the MA and MB controllers in the devices D1-D12, respectively. In particular, the safety module is a safety controller for the devices D1-D12, and the devices D1-D12 are each a safety module.

[0171] In one implementation, a first controller monitors timeout conditions for the MA controller in device D1, the MA controller in device D2, the MA controller in device D3, etc. Similarly, a second controller monitors timeout conditions for the MB controller in device D1, the MB controller in device D2, the MB controller in device D3, etc.

[0172] In one implementation, the first controller stores valid function / fault code words each representing a respective state of the MA controllers in the devices D1-D12, and similarly, the second controller stores valid function / fault code words each representing a respective state of the MB controllers in the devices D1-D12.

[0173] In one implementation, the first controller and the second controller store these valid codewords as different bit patterns indicating a length of 16 bits (e.g., 1 word, 2 bytes, 4 nibbles). Each 16-bit word includes an upper byte and a lower byte. Each byte includes an upper nibble and a lower nibble. In one implementation, each byte (e.g., upper byte, lower byte) of each valid codeword includes an odd-valued nibble and an even-valued nibble.

[0174] For example, the first controller may store a valid fault code word representing a fault timeout state of a third controller (e.g., the MA of device D1) as "14, 3, 7, 5" (represented in binary as "1110001101110101") and a valid function code word representing a function timeout state of the third controller as "7, 5, 14, 3" (represented in binary as "0111010111100011").

[0175] In one variant, the upper byte of the valid function codeword and the lower byte of the valid fault codeword are equivalent to each other, and the upper byte of the valid fault codeword and the lower byte of the valid function codeword are equivalent to each other. For example, the upper byte of the valid function codeword (e.g., "7, 5") representing the function timeout state of the controller MA of the device D1 and the lower byte of the valid fault codeword (e.g., "7, 5") representing the fault timeout state of the controller MA of the device D1 are equivalent to each other. Furthermore, the upper byte of the valid fault codeword (e.g., "14, 3") and the lower byte of the valid function codeword (e.g., "14, 3") are equivalent to each other.

[0176] 7.7 Remembering valid codewords: system state In one implementation, in block S110, the first controller stores valid functional code words representing functional states of the system and valid fault code words representing fault states of the system and characterized by a minimum Hamming distance (e.g., 4) from the valid functional code words representing the functional states of the system.

[0177] In one implementation, in block S110, the second controller stores valid functional code words representing functional states of the system and valid fault code words representing fault states of the system and characterized by a minimum Hamming distance (e.g., 4) from the valid functional code words representing the functional states of the system.

[0178] In one example, each valid function / fault codeword pair may exhibit a minimum Hamming distance from each other (e.g., 4). In another example, each valid codeword may exhibit a minimum Hamming distance from other valid codewords (e.g., 4).

[0179] In one implementation, the valid codewords representing the state of the system each exhibit a length of 8 bits (eg, 1 byte).

[0180] 8. First controller: Subsystem monitoring Block S120 of method S100 recites storing a first valid functional code word in a first memory in response to detecting functional operation of a first subsystem during a first time period.

[0181] Generally, in block S120, during a monitoring period, the first controller individually monitors each subsystem in the set of subsystems in the first controller, detects an operation (e.g., functional operation, fault operation) for each subsystem based on the monitoring, detects a respective state of each subsystem corresponding to the detected operation of the subsystem, encodes the detected state into a code word corresponding to the detected state, and stores a valid code word (e.g., valid functional code word, valid fault code word) in a memory based on the detected state.

[0182] In one implementation, the first controller individually monitors each subsystem in the set of subsystems in the first controller. In one example, the first controller can individually monitor the ALU, the RAM, the flash memory, the program flow monitor safety mechanism, the stack overflow safety mechanism, and / or the stack underflow safety mechanism. In another example, the first controller runs diagnostic tests on each subsystem individually.

[0183] In one implementation, the first controller detects an operation (e.g., a functional operation, a faulty operation) for each subsystem based on the monitoring. In one example, the first controller can detect a functional operation of an ALU based on a result of executing a diagnostic test being error-free. In another example, the first controller can detect a faulty operation of a stack overflow safety mechanism based on an instance where a stack overflow is detected.

[0184] In one implementation, the first controller detects functional operation of the subsystem in the absence of an error being detected for the given subsystem, and the first controller detects faulty operation when one or more errors are detected for the given subsystem. For example, errors may be defined based on the nature of the given subsystem, a safety standard associated with the given subsystem, and / or any factor applicable to the given subsystem.

[0185] In general, the first controller detects a respective state of each subsystem corresponding to a detected operation of the subsystem. In one implementation, the first controller detects a functional state of the subsystem in response to detecting a functional operation of the subsystem and detects a fault state of the subsystem in response to detecting a fault operation of the subsystem. In one example, the first controller detects a functional state of the ALU in response to detecting a functional operation of the ALU. In another example, the first controller detects a fault state of a stack overflow safety mechanism in response to detecting a fault operation of the stack overflow safety mechanism.

[0186] In general, the first controller encodes the detected condition into a code word corresponding to the detected operation of the subsystem. In one implementation, the first controller selects a valid code word from a first set of valid code words corresponding to the detected condition. In one example, the first controller selects a valid functional code word representing the functional operation of the ALU in response to detecting a functional state of the ALU. In another example, the first controller selects a valid fault code word representing the fault operation of the stack overflow safety mechanism in response to detecting a fault condition of the stack overflow safety mechanism.

[0187] In general, the first controller stores in the memory a respective valid code word (e.g., valid functional code word, valid fault code word) for each subsystem in the set of subsystems. In one implementation, the first controller stores in the memory a valid functional code word representing the functional operation of the subsystem. In one variation, the first controller stores in the memory a valid fault code word representing the fault operation of the subsystem. In one example, the first controller stores in the first memory a valid functional code word representing the functional operation of an ALU. In another example, the first controller stores in the second memory a valid fault code word representing the fault operation of a stack overflow safety mechanism.

[0188] In one implementation, the first controller stores the valid code words in a flash memory within the first controller. In one variation, the first controller stores the valid code words in an external memory.

[0189] 9. First controller: Overall controller state Block S130 of method S100 recites outputting, during a second period after the first period, a first safety message including a second valid functional code word and a fourth valid functional code word in response to detecting a match between the contents of the first memory and the first valid functional code word and in response to detecting a functional operation of the first input, and outputting, during a fourth period after the third period, a second safety message including a second valid fault code word and a fourth valid fault code word in response to detecting a mismatch between the contents of the first memory and any code word in the first set of valid code words.

[0190] Generally, in block S130, during an evaluation period after the monitoring period, the first controller detects whether the code word stored in the memory during the monitoring period matches a valid code word, and detects an overall status of the first controller based on (i) whether the code word stored in the memory during the monitoring period matches a valid code word and (ii) the detected status, and outputs a safety message.

[0191] In one implementation, the first controller detects a match between the contents of the memory and a valid code word included in the set of valid code words. In one variation, the first controller detects a mismatch between the contents of the memory and any valid code word in the set of valid code words.

[0192] For example, if the contents of a memory associated with the ALU are "8, 1, 2, 8", the first controller detects a mismatch between the contents of the memory and any valid code word in the set of valid code words, because the valid functional code words for the ALU are "13, 14, 14, 13" and the valid faulty code words for the ALU are "8, 2, 2, 8", and because no valid code word in the set of valid code words is "8, 1, 2, 8".

[0193] In one implementation, the first controller indicates that the given subsystem is in a fault state in response to detecting a mismatch between contents of a memory associated with the given subsystem and every valid code word in the set of valid code words. For example, the first controller can store a valid fault code word in the memory in response to detecting the mismatch that represents the fault state of the given subsystem.

[0194] In one implementation, the first controller detects the overall state of the first controller based on a code word representing the detected state of the set of subsystems. In one implementation, the first controller detects the overall state of the first controller based on a set of rules. In one example, the first controller can detect the functional state of the first controller in response to detecting every subsystem in the set of subsystems being in a functional state and / or detecting a valid functional code word in the memory for every subsystem in the set of subsystems. In another example, the first controller can detect the fault state of the first controller in response to detecting a subsystem in the set of subsystems being in a fault state and / or detecting a valid fault code word in the memory for a subsystem in the set of subsystems.

[0195] In one implementation, the first controller, in response to detecting the functional state of the first controller, indicates a valid functional code word representing the functional state of the first controller. In one variation, the first controller, in response to detecting the fault state of the first controller, indicates a valid fault code word representing the fault state of the first controller. In one example, the first controller can store in memory a valid functional code word (e.g., "11110010") representing the functional state of the first controller. In another example, the first controller can store in memory a valid fault code word (e.g., "10100100") representing the fault state of the first controller.

[0196] In general, the first controller outputs a safety message including a valid code word representing the state of the first controller. In one implementation, the first controller outputs a safety message including a valid functional code word representing the functional state of the first controller in response to detecting a match between the contents of the memory and a set of valid code words and detecting a functional operation of the set of subsystems. In one variation, the first controller outputs a safety message including a valid fault code word representing a fault state of the first controller in response to detecting a mismatch between the contents of the memory and any valid code word in the set of valid code words. In another variation, the first controller outputs a safety message including a valid fault code word representing a fault state of the first controller in response to detecting a match between the contents of the memory and a set of valid code words and detecting a fault operation of at least one subsystem in the set of subsystems.

[0197] In one implementation, the first controller outputs a safety message including a valid functional codeword representing the functional state of the first controller in the third byte (e.g., "M0") of the safety message. In one variation, the first controller outputs a safety message including a valid fault codeword representing the fault state of the first controller in the third byte (e.g., "M0") of the safety message.

[0198] In that case, the first controller outputs a safety message to the second controller and / or to the application processor.

[0199] 10. External Input Block S122 of method S100 recites storing a third valid function code word in a second memory in response to detecting a functional operation of the first input during the first time period.

[0200] Generally, in block S122, during a monitoring period, the first controller monitors inputs coupled to the system (e.g., emergency stop button, open circuit sensor), detects operation (e.g., functional operation, fault operation) of the inputs based on the monitoring, detects a state of each of the inputs corresponding to the detected operation of the subsystem, encodes the detected state into a code word corresponding to the detected state, and stores a valid code word (e.g., valid functional code word, valid fault code word) in memory based on the detected state.

[0201] In one implementation, the first controller reads and converts an analog voltage at an analog input pin into a set of input counts, reads a digital power signal from the ADC as a set of reference counts, corrects (e.g., scales) the input counts based on the set of reference counts to calculate corrected input counts, and encodes the corrected input counts into a first encoded logic output value (e.g., a valid code word), as described in U.S. patent application Ser. No. 17 / 332,635, filed May 27, 2021, which is incorporated by reference in its entirety.

[0202] In one implementation, the first controller stores in the memory valid functional code words that represent the functional behavior of the inputs. In one variation, the first controller stores in the memory valid fault code words that represent the fault behavior of the inputs.

[0203] In one implementation, the first controller stores the valid code words in a flash memory within the first controller. In one variation, the first controller stores the valid code words in an external memory.

[0204] In one variation, the first controller executes block S122 for each additional input monitored by the first controller.

[0205] In one variation, in block S130, during an evaluation period following the monitoring period, the first controller outputs a safety message including a valid code word representing the state of the input in response to detecting an operation (e.g., functional operation, fault operation) of the input. For example, the first controller outputs a safety message including a valid functional code word representing the functional operation of the input in response to detecting a functional operation of the input. In another example, the first controller outputs a safety message including a valid fault code word representing the fault operation of the input in response to detecting a fault operation of the input. In yet another example, the first controller outputs a safety message including a valid functional code word representing the functional operation of the input in a fourth byte (e.g., "I1") of the safety message. In yet another example, the first controller outputs a safety message including a valid fault code word representing the fault operation of the input in a fourth byte (e.g., "I1") of the safety message.

[0206] 11.Inter-controller communication Blocks S124, S140, and S142 of method S100 recite interrogating, at the first controller, an input register coupled to the second controller during a first time period, detecting at the input register a fourth safety message including a sixth valid function code word from the second controller, interrogating, at the input register, at the first controller during a third time period, and storing a ninth valid fault code word in a fifth memory in response to detecting non-receipt of the third safety message from the input register within the first amount of time.

[0207] Generally, in blocks S124, S140, and S142, during a monitoring period, the first controller queries an input register coupled to the second controller, detects whether a safety message is present in the input register within a predetermined amount of time, detects a timeout condition of the second controller, encodes the detected condition into a code word corresponding to the detected condition, and stores a valid code word (e.g., a valid function code word, a valid fault code word) in memory based on the detected condition.

[0208] In one implementation, during the monitoring period, the first controller queries an input register coupled to the second controller, For example, the first controller can query an input of the first controller configured to receive a safety message from the second controller.

[0209] In one implementation, the first controller detects receipt of a safety message at an input register from the second controller within a predetermined amount of time. For example, the first controller can monitor the elapsed time since a most recent safety message was received from the second controller and detect receipt of the safety message within the predetermined amount of time in response to detecting that the elapsed time is within a threshold time.

[0210] In one implementation, the predetermined amount of time and / or the threshold time may be selected based on safety standards, timing requirements, communication protocols, and / or any other factors.

[0211] In one variation, the first controller detects non-receipt of a safety message at the input register from the second controller within a predetermined amount of time. For example, the first controller may monitor the elapsed time since the most recent safety message was received from the second controller and detect non-receipt of a safety message within the predetermined amount of time in response to detecting that the elapsed time exceeds a threshold time.

[0212] In one implementation, the first controller detects a functional timeout condition of the second controller in response to detecting receipt of a safety message at an input register coupled to the second controller within a predetermined amount of time. In one variation, the first controller detects a fault timeout condition of the second controller in response to detecting non-receipt of a safety message at an input register coupled to the second controller within a predetermined amount of time.

[0213] In general, the first controller encodes the detected timeout condition into a code word corresponding to the detected timeout condition. In one implementation, the first controller selects a valid code word corresponding to the detected condition from a first set of valid code words.

[0214] In general, the first controller stores valid code words (e.g., valid functional code words, valid fault code words) in the memory. In one implementation, the first controller stores valid functional code words in the memory that represent the functional timeout state of the second controller. In one variation, the first controller stores valid fault code words in the memory that represent the fault timeout state of the second controller.

[0215] In one variation, in response to detecting receipt of a safety message at the input register from the second controller within a predetermined amount of time, the first controller detects whether the content of the received safety message is valid. In one example, the first controller checks the content and format of the safety message to determine whether the safety message is erroneous. In another example, the first controller detects whether the safety message conforms to the data structure specified in Figure 3. In yet another example, the first controller detects a mismatch between a code word included in the safety message and any valid code word in a set of stored valid code words.

[0216] In one implementation, the first controller detects a functional state of the communication from the second controller in response to detecting an absence of errors in the content and / or format of the safety message. In one variation, the first controller detects a fault state of the communication from the second controller in response to detecting one or more errors in the content and / or format of the safety message (e.g., a mismatch between a code word included in the safety message and any valid code word in a set of stored valid code words).

[0217] In one implementation, the first controller stores a valid code word (e.g., a valid functional code word, a valid fault code word) in memory that represents a timeout and / or a content state of the second controller in memory. For example, the first controller stores a valid functional code word in memory that represents a functional timeout state of the second controller in response to detecting receipt of a safety message at an input register coupled to the second controller within a predetermined amount of time. In another example, the first controller stores a valid fault code word in memory that represents a fault timeout state of the second controller in response to detecting non-receipt of a safety message at an input register coupled to the second controller within a predetermined amount of time. In yet another example, the first controller stores a valid functional code word in memory that represents a functional communication content state of the second controller in response to detecting an absence of an error in the content and / or format of the safety message. In yet another example, the first controller stores a valid fault code word in memory that represents a fault communication content state of the second controller in response to detecting one or more errors in the content and / or format of the safety message. In yet another example, the first controller, in response to detecting non-receipt of a safety message at the input register from the second controller within a predetermined amount of time, refrains from content checking and stores in memory a valid fault code word representative of a fault communication content condition of the second controller.

[0218] In one implementation, the first controller stores the valid code words in a flash memory within the first controller. In one variation, the first controller stores the valid code words in an external memory.

[0219] Block S130 of method S100 recites outputting, during a second time period after the first time period, a second safety message including a second valid functional code word and a sixth valid functional code word in response to detecting a match between the contents of the first memory and the first valid functional code word, in response to detecting a match between the contents of the third memory and the fifth valid functional code word, and in response to detecting a functional operation of the first input, at the first controller; and outputting, during a fourth time period after the third time period, a fourth safety message including a second valid functional code word and a sixth valid fault code word in response to detecting a match between the contents of the first memory and the first valid functional code word, and in response to detecting a match between the contents of the third memory and the fifth valid fault code word.

[0220] Generally, in block S130, during an evaluation period after the monitoring period, the first controller detects whether the code word stored in the memory during the monitoring period matches a valid code word, and detects an overall status of the first controller based on (i) whether the code word stored in the memory during the monitoring period matches a valid code word and (ii) the detected status, and outputs a safety message.

[0221] In one implementation, the first controller detects a match between the contents of the memory (e.g., a code word representing the function timeout state of the second controller) and a valid code word included in a set of valid code words (e.g., a valid code word representing the function timeout state of the second controller, a valid code word representing the function communication content state of the second controller). In one variation, the first controller detects a mismatch between the contents of the memory (e.g., an overwritten code word representing the function timeout state of the second controller, an overwritten code word representing the function communication content state of the second controller) and any valid code word in the set of valid code words.

[0222] In one implementation, the first controller indicates that the second controller is in a fault timeout state in response to detecting a mismatch between the contents of the memory (e.g., an overwritten code word representing the functional timeout state of the second controller, an overwritten code word representing the functional communication content state of the second controller) and any valid code word in the set of valid code words. For example, the first controller can store a valid fault code word in the memory representing the fault timeout state of the second controller in response to detecting the mismatch.

[0223] In one variation, in block S130, during an evaluation period following the monitoring period, the first controller outputs a safety message including a valid code word representing the state of the second controller in response to detecting receipt / non-receipt of a safety message from the second controller within a predetermined amount of time. For example, the first controller outputs a safety message including a valid functional code word representing the functional operation of the second controller in response to detecting receipt of a safety message from the second controller (including a valid functional code word representing the functional operation of the second controller) within a predetermined amount of time. In another example, the first controller outputs a safety message including a valid functional code word representing the functional operation of the second controller in response to detecting the absence of an error in the content and / or format of the safety message from the second controller. In yet another example, the first controller outputs a safety message including a valid fault code word representing the fault operation of the second controller in response to detecting one or more errors in the content and / or format of the safety message. In yet another example, the first controller outputs a safety message including a valid fault code word representing faulty operation of the second controller in response to detecting a failure to receive a safety message from the second controller within a predetermined amount of time. In yet another example, the first controller outputs a safety message including a valid fault code word representing faulty operation of the second controller in response to detecting a mismatch between contents of a memory associated with the second controller (e.g., an overwritten code word representing a functional timeout condition of the second controller) and any valid code word in a set of valid code words.

[0224] In one variation, the first controller can detect communication failures with the application processor in a similar manner, in particular, the first controller and the application processor can monitor timeouts and detect communication content failures with each other in a similar manner as described above in connection with the first controller and the second controller.

[0225] In general, the first controller can detect the state of the second controller based on the content of the safety message received from the second controller. For example, the safety message from the second controller can include the state of the second controller (e.g., valid function codeword, valid fault codeword), such as in the third byte (e.g., "M1") of the safety message. Thus, the first controller can detect an infrastructure problem with the second controller.

[0226] Similarly, the first controller can detect the state of the input based on the contents of a safety message received from the second controller. For example, the safety message from the second controller can include the state of the input (e.g., valid function codeword, valid fault codeword) processed by the second controller, such as in the fourth byte (e.g., "I1") of the safety message.

[0227] In one implementation, in response to detecting a match between the state of the input detected by the first controller and the state of the input indicated in the safety message from the second controller, the first controller can detect that the condition is true. In one variation, in response to detecting a mismatch between the state of the input detected by the first controller and the state of the input indicated in the safety message from the second controller, the first controller can detect a fault condition of the input. Thus, the probability of an error in the message is reduced below a threshold maximum error value required by functional safety standards (e.g., IEC 61784), which is beneficial when communicating over a medium prone to interference (e.g., wireless communication, high availability wired communication).

[0228] 12.Safety Controller Block S126 of method S100 recites storing a seventh valid function code word in a fourth memory in response to detecting receipt of a fifth safety message from a third controller (e.g., in the second safety module) within a third amount of time during the first time period, and storing an eighth valid fault code word in a fifth memory in response to detecting non-receipt of a sixth safety message from a fourth controller (e.g., in the third safety module) within a fourth amount of time, and storing an eighth valid fault code word in a fifth memory in response to detecting non-receipt of a sixth safety message from a fourth controller (e.g., in the third safety module) within a fourth amount of time during the first time period. Outputting the safety message includes outputting a second safety message including the second valid functional code word, the sixth valid functional code word, and the ninth valid fault code word in response to detecting a match between the contents of the first memory and the first valid functional code word, in response to detecting a match between the contents of the third memory and the fifth valid functional code word, in response to detecting a functional operation of the first input, in response to detecting a match between the contents of the fourth memory and the seventh valid functional code word, and in response to detecting a match between the fifth memory and the eighth valid fault code word.

[0229] Generally, in block S126, during a monitoring period, the first controller detects receipt (or non-receipt) of a safety message from each controller in the set of monitored controllers in other safety modules within a predetermined amount of time, detects a respective timeout condition for each controller in the set of monitored controllers, encodes the detected condition into a code word corresponding to the detected condition, and stores a valid code word (e.g., a valid function code word, a valid fault code word) in memory based on the detected condition.

[0230] In one implementation, during a monitoring period, the first controller detects receipt (or non-receipt) of a safety message from each controller in a set of monitored controllers in other safety modules within a predetermined amount of time. In one example, the first controller can receive a safety message from an application processor.

[0231] In one implementation, the first controller independently detects receipt of a safety message from each controller in the set of monitored controllers in other safety modules within a predetermined amount of time. In one example, the first controller may independently monitor the elapsed time since a most recent safety message was received from a given controller in the set of monitored controllers and detect receipt of a safety message within the predetermined amount of time in response to detecting that the elapsed time is within a threshold time.

[0232] In one variation, the first controller may independently monitor the elapsed time since the most recent safety message was received from a given controller in the set of monitored controllers and, in response to detecting that the elapsed time exceeds a threshold time, detect non-reception of a safety message within a predetermined amount of time.

[0233] In some implementations, the first controller receives safety messages from the set of monitored controllers at different times.

[0234] In one implementation, the predetermined amount of time and / or threshold time may be selected based on safety standards, timing requirements, communication protocols, and / or any other factors. In one variation, the predetermined amount of time and / or threshold time may be selected individually for each controller in the set of monitored controllers.

[0235] In one implementation, the first controller detects a functional timeout condition for a given controller in the set of monitored controllers in response to detecting receipt of a safety message within a predetermined amount of time. In one variation, the first controller detects a fault timeout condition for a given controller in response to detecting non-reception of a safety message within a predetermined amount of time.

[0236] In general, the first controller encodes the detected timeout condition into a code word corresponding to the detected timeout condition, hi one implementation, selects a valid code word corresponding to the detected condition from a first set of valid code words.

[0237] In general, the first controller stores valid code words (e.g., valid functional code words, valid fault code words) in memory. In one implementation, the first controller stores valid functional code words in memory that represent a functional timeout state of a given controller in the set of monitored controllers. In one variation, the first controller stores valid fault code words in memory that represent a fault timeout state of a given controller.

[0238] In one variation, in response to detecting receipt of a safety message from a given controller in the set of monitored controllers within a predetermined amount of time, the first controller detects whether the content of the received safety message is valid. In one example, the first controller checks the content and format of the safety message to determine whether the safety message is erroneous. In another example, the first controller detects whether the safety message conforms to the data structure specified in FIG. 3. In yet another example, the first controller detects a mismatch between a code word included in the safety message and any valid code word in the set of stored valid code words.

[0239] In one implementation, the first controller detects a functional state of the communication from the given controller in response to detecting an absence of errors in the content and / or format of the safety message. In one variation, the first controller detects a fault state of the communication from the given controller in response to detecting one or more errors in the content and / or format of the safety message (e.g., a mismatch between a code word included in the safety message and any valid code word in a set of stored valid code words).

[0240] In one implementation, the first controller stores in memory a valid code word (e.g., a valid functional code word, a valid fault code word) representing a timeout and / or a content state of the given controller. For example, the first controller stores in memory a valid functional code word representing a functional timeout state of the given controller in response to detecting receipt of a safety message within a predetermined amount of time. In another example, the first controller stores in memory a valid fault code word representing a fault timeout state of the given controller in response to detecting non-receipt of a safety message within a predetermined amount of time. In yet another example, the first controller stores in memory a valid functional code word representing a functional communication content state of the given controller in response to detecting the absence of an error in the content and / or format of the safety message. In yet another example, the first controller stores in memory a valid fault code word representing a fault communication content state of the given controller in response to detecting one or more errors in the content and / or format of the safety message. In yet another example, the first controller, in response to detecting non-receipt of a safety message at the input register from the given controller within a predetermined amount of time, refrains from content checking and stores in memory a valid fault code word representative of a fault communication content condition of the given controller.

[0241] In one implementation, the first controller stores the valid code words in a flash memory within the first controller. In one variation, the first controller stores the valid code words in an external memory.

[0242] Blocks S126 and S130 of method S100 recite storing a seventh valid function code word in a fourth memory in response to detecting receipt of a fifth safety message from a third controller (e.g., in the second safety module) within a third amount of time during a first period of time, and storing an eighth valid fault code word in a fifth memory in response to detecting non-receipt of a sixth safety message from a fourth controller (e.g., in the third safety module) within a fourth amount of time, and storing a seventh valid fault code word in a fifth memory in response to detecting non-receipt of a sixth safety message from a fourth controller (e.g., in the third safety module) within a fourth amount of time during a second period of time. Outputting the safety message includes outputting a second safety message including the second valid functional code word, the sixth valid functional code word, and the ninth valid fault code word in response to detecting a match between the contents of the first memory and the first valid functional code word, in response to detecting a match between the contents of the third memory and the fifth valid functional code word, in response to detecting a functional operation of the first input, in response to detecting a match between the contents of the fourth memory and the seventh valid functional code word, and in response to detecting a match between the fifth memory and the eighth valid fault code word.

[0243] Generally, in block S130, during an evaluation period after the monitoring period, the first controller detects whether the code word stored in the memory during the monitoring period matches a valid code word, and detects an overall status of the first controller based on (i) whether the code word stored in the memory during the monitoring period matches a valid code word and (ii) the detected status, and outputs a safety message.

[0244] In one implementation, the first controller detects a match between the contents of the memory and a valid code word included in the set of valid code words. In one variation, the first controller detects a mismatch between the contents of the memory and any valid code word in the set of valid code words.

[0245] In one implementation, the first controller indicates that a given controller in the set of monitored controllers is in a fault timeout state in response to detecting a mismatch between contents of a memory associated with the given controller and any valid code word in the set of valid code words. For example, the first controller can store a valid fault code word in memory indicative of the fault timeout state of the given controller in response to detecting the mismatch.

[0246] In one implementation, the first controller detects an overall timeout condition of the set of monitored controllers based on a code word representing the detected condition of the set of subsystems. In one implementation, the first controller detects an overall timeout condition of the set of monitored controllers based on a set of rules. In one example, the first controller can detect a functional timeout condition of the set of monitored controllers in response to detecting every controller in the set of monitored controllers in a functional timeout condition and / or detecting in memory a valid functional code word for every controller in the set of monitored controllers. In another example, the first controller can detect a fault condition of the set of monitored controllers in response to detecting a controller in the set of monitored controllers in a fault timeout condition and / or detecting in memory a valid fault code word for a controller in the set of monitored controllers. In yet another example, the first controller can detect a fault condition of the set of monitored controllers in response to detecting two or more controllers in the set of monitored controllers in a fault timeout condition and / or detecting in memory two or more valid fault code words for two or more controllers in the set of monitored controllers.

[0247] In one implementation, the first controller, in response to detecting a functional timeout condition of the set of monitored controllers, stores in memory a valid functional code word representative of the functional timeout condition of the set of monitored controllers. In one variation, the first controller, in response to detecting a fault timeout condition of the set of monitored controllers, stores in memory a valid fault code word representative of the fault timeout condition of the set of monitored controllers.

[0248] In one implementation, the first controller stores the valid code words in a flash memory within the first controller. In one variation, the first controller stores the valid code words in an external memory.

[0249] In one variation, in block S130, during an evaluation period after the monitoring period, the first controller outputs a safety message including a valid code word representing a timeout condition of the set of monitored controllers. In one example, the first controller can output a safety message including a valid functional code word representing a functional timeout condition of the set of monitored controllers. In another example, the first controller can output a safety message including a valid fault code word representing a fault timeout condition of the set of monitored controllers.

[0250] 13. System Status In one variation, in block S130, the first controller may further detect a state (e.g., function, failure) of the system based on one or more dependencies. For example, the first controller may detect a state of the system based on a state of the first controller, a state of the inputs, a timeout state of the second controller, a state of the second controller, a timeout state of controllers in a set of monitored controllers in other safety modules, a communication content state of controllers in the set of monitored controllers, and / or a timeout state of the set of monitored controllers.

[0251] In one implementation, the controller detects the state of the system based on a set of rules. In one example, the first controller can detect the functional state of the system in response to detecting the functional state for any dependency (e.g., the state of the first controller, the state of the input, the timeout state of the second controller, the state of the second controller, the timeout state of the controller in the set of monitored controllers in other safety modules, the communication content state of the controller in the set of monitored controllers, and / or the timeout state of the set of monitored controllers). In another example, the first controller can detect the fault state of the system in response to detecting the fault state of any dependency. In yet another example, the first controller can detect the functional state of the system in response to detecting the fault timeout state for a controller in the set of monitored controllers and in response to detecting the functional state for any other dependency.

[0252] In one implementation, the first controller stores in the memory valid code words (e.g., valid functional code words, valid fault code words) that represent the state of the system in the memory. In one example, the first controller stores in the memory valid functional code words that represent the functional state of the system in response to detecting the functional state of the system. In another example, the first controller stores in the memory valid fault code words that represent the fault state of the system in response to detecting the fault state of the system.

[0253] In one implementation, the first controller stores the valid code words in a flash memory within the first controller. In one variation, the first controller stores the valid code words in an external memory.

[0254] In one variation, in block S130, during an evaluation period following the monitoring period, the first controller outputs a safety message including a valid code word representing a detected condition of the system as described above. In one example, the first controller can output a safety message including a valid functional code word representing a functional state of the system. In another example, the first controller can output a safety message including a valid fault code word representing a fault state of the system.

[0255] Thus, the first controller can streamline communications and maintain functional safety standards in a large network by reducing combinations of multiple states into a single state indicator.

[0256] 14. Second Controller In one implementation, the second controller performs blocks S110, S120, S122, S124, S126, S130, S140, S142 of method S100 in a similar (e.g., similar, identical) manner as described above in connection with the first controller.

[0257] 15. Application Processor Block S150 describes receiving the first safety message and the third safety message, and in response to detecting a fourth valid functionality code word in the first safety message and an eighth valid functionality code word in the third safety message, outputting a fifth safety message including a ninth valid functionality code word representing a functional state of the system; and during a sixth period after the fourth period, receiving, at the application processor, the second safety message and the fourth safety message, and in response to detecting a fourth valid fault code word in the second safety message and an eighth valid functionality code word in the fourth safety message, outputting a sixth safety message including a ninth valid fault code word representing a fault state of the system and characterized by a ninth minimum Hamming distance from the ninth valid functionality code word.

[0258] Generally, in block S150, after an evaluation period, the application processor receives safety messages from the first controller and the second controller, concatenates the safety messages from the first controller and / or the second controller into a concatenated safety message, and outputs the safety message (e.g., over a network to another safety module).

[0259] In one implementation, the application processor analyzes the first safety message from the first controller and the second safety message from the second controller and outputs a new safety message based on a result of the analysis.

[0260] In one implementation, the application processor outputs a safety message indicating the functional state in response to receiving a first safety message indicating the functional state from the first controller and a second safety message indicating the functional state from the second controller. For example, the application processor can output a safety message including a valid functional code word representing the functional state of the system in response to receiving a first safety message indicating the functional state (e.g., a valid functional code word) from the first controller and a second safety message indicating the functional state (e.g., a valid functional code word) from the second controller.

[0261] In one variation, the application processor may output a safety message indicating a fault condition in response to receiving a first safety message indicating a functional state from the first controller and a second safety message indicating a fault condition from the second controller. For example, the application processor may output a safety message including a valid fault code word representing a fault condition of the system in response to receiving a first safety message indicating a functional state (e.g., a valid functional code word) from the first controller and a second safety message indicating a fault condition (e.g., a valid fault code word) from the second controller.

[0262] In another variation, the application processor may output a safety message indicating a fault condition in response to detecting a failure to receive a safety message from the first controller and / or the second controller within a predetermined amount of time. For example, the application processor may output a safety message including a valid fault code word indicating a fault condition of the system in response to detecting a failure to receive a first safety message from the first controller within a first amount of time or a failure to receive a second safety message from the second controller within a second amount of time.

[0263] In one implementation, the application processor implements valid functional code words that represent functional states of the system and valid fault code words that represent fault states of the system and are characterized by a minimum Hamming distance (eg, 4) from each other.

[0264] In one implementation, the application processor receives a safety message (e.g., from another safety module over a network), separates information in the received safety message into a first safety message for a first controller and a second safety message for a second controller, and outputs the first safety message to the first controller and the second safety message to the second controller.

[0265] The systems and methods described herein may be implemented at least in part as a machine configured to accept a computer-readable medium that stores computer-readable instructions. The instructions may be executed by a computer-executable component integrated with an application, an applet, a host, a server, a network, a website, a communication service, a communication interface, a hardware / firmware / software element of a user computer or mobile device, a wristband, a smartphone, or any suitable combination thereof. Other systems and methods of the embodiments may be implemented at least in part as a machine configured to accept a computer-readable medium that stores computer-readable instructions. The instructions may be executed by a computer-executable component integrated with the above types of devices and networks. The computer-readable medium may be stored on any suitable computer-readable medium, such as a RAM, a ROM, a flash memory, an EEPROM, an optical device (CD or DVD), a hard drive, a floppy drive, or any suitable device. The computer-executable component may be a processor, although any suitable dedicated hardware device may execute the instructions (alternatively or additionally).

[0266] Those skilled in the art will recognize from the foregoing detailed description, and from the drawings and claims, that modifications and variations can be made to the embodiments of the invention without departing from the scope of the invention, which is defined in the following claims.

Claims

1. a first controller in a first safety module coupled to the system; a first valid function code word representing a function timeout status of a second controller in the first safety module; a first valid fault code word indicative of a fault timeout condition of the second controller and characterized by a first minimum Hamming distance from the first valid function code word; a second valid function codeword representing a function state of the second controller; and a second valid fault code word representing a fault condition of the second controller and characterized by a second minimum Hamming distance from the second valid function code word; a third valid function codeword representing a functional state of a first input coupled to the system; a third valid fault code word representing a fault condition of the first input and characterized by a third minimum Hamming distance from the third valid function code word; a fourth valid functionality code word representing a functionality state of the system; a fourth valid fault code word representing a fault condition of the system and characterized by a fourth minimum Hamming distance from the fourth valid function code word; storing a first set of valid code words including During a first period of time, the first controller interrogating a first input register coupled to the second controller; detecting a first safety message including the second valid function code word from the second controller at the first input register; storing the first valid function code word in a first memory in response to detecting the first safety message at the first input register within a first amount of time; storing the third valid function code word in a second memory in response to detecting a functional operation of the first input; outputting, during a second period of time after the first period of time, at the first controller in response to detecting a match between contents of the first memory and the first valid functional code word and in response to detecting functional operation of the first input, a second safety message including the fourth valid functional code word; During a third period of time after the second period of time, in the first controller, interrogating the first input register; detecting a third safety message including the second valid function code word from the second controller in the first input register; storing the first valid function code word in the first memory in response to detecting the third safety message in the first input register within a second amount of time; storing the third valid function code word in the second memory in response to detecting a functional operation of the first input; outputting, during a fourth period of time after the third period of time, a fourth safety message including the fourth valid fault code word in response to detecting, at the first controller, a mismatch between the contents of the first memory and any code word in the first set of valid code words; A method comprising:

2. The second controller, a fifth valid function code word representing a function timeout condition of the first controller; and a fifth valid fault code word indicative of a fault timeout condition of the first controller and characterized by a fifth minimum Hamming distance from the fifth valid function code word; a sixth valid function code word representing a function state of the first controller; a sixth valid fault code word representing a fault condition of the first controller and characterized by a sixth minimum Hamming distance from the sixth valid function code word; a seventh valid function codeword representing a functional state of a second input coupled to the system; and a seventh valid fault code word representing a fault condition of the second input and characterized by a seventh minimum Hamming distance from the seventh valid function code word; an eighth valid function code word representing a functional state of the system; and an eighth valid fault code word representing a fault condition of the system and characterized by an eighth minimum Hamming distance from the eighth valid functional code word; storing a second set of valid code words including During the first period, in the second controller, interrogating a second input register coupled to the first controller; detecting a fifth safety message including the sixth valid function code word from the first controller in the second input register; storing the fifth valid function code word in a third memory in response to detecting the fifth safety message in the second input register within a third amount of time; storing the seventh valid function code word in a fourth memory in response to detecting a functional operation of the second input; outputting, during the second time period, at the second controller, a sixth safety message including the eighth valid functional code word in response to detecting a match between the contents of the third memory and the fifth valid functional code word and in response to detecting a functional operation of the second input; During the third period, in the second controller, interrogating the second input register; detecting a seventh safety message including the sixth valid function code word from the first controller in the second input register; storing the fifth valid function code word in a third memory in response to detecting the seventh safety message in the second input register within a fourth amount of time; storing the seventh valid function code word in the fourth memory in response to detecting a functional operation of the second input; outputting, at the second controller, during the fourth time period, an eighth safety message including the eighth valid functional code word in response to detecting a match between the contents of the third memory and the fifth valid functional code word and in response to detecting a functional operation of the second input; during a fifth period of time after the second period of time, an application processor in the first secure module receiving the second safety message and the sixth safety message; outputting a ninth safety message including a ninth valid functionality code word representative of a functional status of the system in response to detecting the fourth valid functionality code word in the second safety message and the eighth valid functionality code word in the sixth safety message; During a sixth period after the fourth period, the application processor: receiving the fourth safety message and the eighth safety message; in response to detecting the fourth valid fault code word in the fourth safety message and the eighth valid functional code word in the eighth safety message, outputting a tenth safety message including a ninth valid fault code word indicative of a fault condition of the system and characterized by a ninth minimum Hamming distance from the ninth valid functional code word; The method of claim 1 further comprising:

3. The second controller, a fifth valid function code word representing a functional state of a first subsystem of the first set of subsystems within the second controller; and a fifth valid fault code word representing a fault condition of the first subsystem and characterized by a fifth minimum Hamming distance from the fifth valid function code word; the second valid function codeword; and the second valid fault code word; and a sixth valid function codeword representing a functional state of a second input coupled to the system; a sixth valid fault code word representing a fault condition of the second input and characterized by a sixth minimum Hamming distance from the sixth valid function code word; a seventh valid function code word representing a functional state of the system; and a seventh valid fault code word representing a fault condition of the system and characterized by a seventh minimum Hamming distance from the seventh valid function code word; storing a second set of valid code words including During the third period, in the second controller, storing the fifth valid functional code word in a third memory in response to detecting functional operation of the first subsystem; storing the seventh valid function code word in a fourth memory in response to detecting a functional operation of the second input; outputting, in response to detecting, during the fourth time period, at the second controller, a mismatch between the contents of the third memory and any code word in the second set of valid code words, a fifth safety message including the second valid fault code word and the seventh valid fault code word; During a fifth period of time after the fourth period of time, in the first controller, interrogating the first input register; detecting the fifth safety message including the second valid fault code word from the second controller at the first input register; storing the first valid function code word in a first memory in response to detecting the fifth safety message in the first input register within a third amount of time; outputting, during a sixth period of time after the fifth period of time, a sixth safety message including the fourth valid fault code word in response to detecting, at the first controller, a match between the contents of the first memory and a first valid functional code word and in response to detecting the second valid fault code word in the fifth safety message; The method of claim 1 further comprising:

4. during a seventh period after the second period, an application processor in the first secure module receiving the second safety message; in response to detecting receipt of the second safety message within a fourth amount of time and in response to detecting non-receipt of a seventh safety message from the second controller within a fifth amount of time, outputting an eighth safety message including an eighth valid fault code word representative of a fault condition of the system. The method of claim 3 further comprising:

5. The first controller, an eighth valid function code word representing a functional state of a first arithmetic logic unit within said first controller; an eighth valid fault code word representing a fault condition of the first arithmetic logic unit and characterized by a minimum Hamming distance of eight from the eighth valid function code word; storing the first set of valid code words further comprising: Further comprising: the fifth valid function code word represents a functional state of a second arithmetic logic unit within the second controller and is characterized by a minimum Hamming distance of eight from the eighth valid function code word; 4. The method of claim 3, wherein the fifth valid fault code word represents a fault condition of the second arithmetic logic unit in the second controller and is characterized by a minimum Hamming distance of 8 from the first valid fault code word and a minimum Hamming distance of 8 from the fifth valid function code word.

6. The first controller, a fifth valid function code word representing a functional communication content state of the second controller; a fifth valid fault code word representing a fault communication content state of the second controller and characterized by a fifth minimum Hamming distance from the fifth valid function code word; storing the first set of valid code words further comprising: storing the fifth valid functional code word in a third memory in response to detecting, at the first controller, a match between content of the first safety message and the second valid functional code word during the first time period; Further comprising:

2. The method of claim 1, wherein outputting, at the first controller, during the second period of time, the first safety message including the fourth valid function code word is further responsive to detecting a match between contents of the third memory and the fifth valid function code word.

7. The first controller, a fifth valid function code word representing a function timeout condition of a third controller in a second safety module in the system; a fifth valid fault code word indicative of a fault timeout condition of the third controller and characterized by a fifth minimum Hamming distance from the fifth valid function code word; storing the first set of valid code words further comprising: The second controller, a sixth valid function code word representing a function timeout condition of a fourth controller in the second safety module; a sixth valid fault code word representing a fault condition of the fourth controller and characterized by a sixth minimum Hamming distance from the sixth valid function code word; a seventh valid function code word representing a functional state of the system; and a seventh valid fault code word representing a fault condition of the system and characterized by a seventh minimum Hamming distance from the seventh valid function code word; storing a second set of valid code words including storing the fifth valid function code word in a third memory in response to detecting, during the first period, at the first controller, receipt of a fifth safety message from the third controller within a third amount of time; storing the sixth valid function code word in a fourth memory in response to detecting, during the first period, at the second controller, receipt of a sixth safety message from the fourth controller within a fourth amount of time; outputting, in response to detecting, during the second time period, at the second controller, a match between the contents of the fourth memory and the sixth valid function code word, a seventh safety message including the seventh valid function code word; Further comprising:

2. The method of claim 1, wherein outputting, at the first controller, during the second period of time, the first safety message including the fourth valid function code word is further responsive to detecting a match between contents of the third memory and the fifth valid function code word.

8. The first controller, a fifth valid function code word representing a functional state of a first subsystem of the first set of subsystems within the first controller; a fifth valid fault code word representing a fault condition of the first subsystem and characterized by a minimum Hamming distance of 8 from the fifth valid function code word; storing the first set of valid code words further comprising: storing the first valid functional code word in a third memory in response to detecting, by the first controller, functional operation of the first subsystem during the first time period; Further comprising:

2. The method of claim 1, wherein outputting, at the first controller, during the second period of time, the second safety message including the fourth valid function code word is further responsive to detecting that the contents of the third memory match the fifth valid function code word.

9. the first valid function code word and the first valid fault code word each exhibit a length of 2 bytes; the second valid function codeword, the second valid fault codeword, the third valid function codeword, the third valid fault codeword, the fourth valid function codeword, and the fourth valid fault codeword each exhibit a length of one byte; the first minimum Hamming distance is 8; the second minimum Hamming distance is 4; the third minimum Hamming distance is 4; The method of claim 1 , wherein the fourth minimum Hamming distance is four.

10. Storing the first set of valid code words at the first controller includes: storing a bit pattern of "1100010110110111" as the first valid function codeword; storing a bit pattern of "0111101101011100" as the first valid fault code word; The method of claim 1 , comprising:

11. a first controller in a first safety module coupled to the system; a first valid function code word representing a function timeout condition of a second controller in a second safety module in the system; a first valid fault code word indicative of a fault timeout condition of the second controller and characterized by a first minimum Hamming distance from the first valid function code word; a second valid function codeword representing a function state of the second controller; and a second valid fault code word representing a fault condition of the second controller and characterized by a second minimum Hamming distance from the second valid function code word; a third valid function codeword representing a functional state of a first input coupled to the system; a third valid fault code word representing a fault condition of the first input and characterized by a third minimum Hamming distance from the third valid function code word; a fourth valid functionality code word representing a functionality state of the system; a fourth valid fault code word representing a fault condition of the system and characterized by a fourth minimum Hamming distance from the fourth valid function code word; storing a first set of valid code words including During a first period of time, the first controller storing the first valid function code word in a first memory in response to detecting a first safety message including the second valid function code word from the second controller within a first amount of time; storing the third valid function code word in a second memory in response to detecting a functional operation of the first input; outputting, during a second time period after the first time period, at the first controller, a second safety message including the fourth valid functional code word in response to detecting the second valid functional code word in the first safety message, in response to detecting a match between contents of the first memory and the first valid functional code word, and in response to detecting a functional operation of the first input; During a third period of time after the second period of time, in the first controller, storing the first valid function code word in the first memory in response to detecting receipt of a third safety message including the second valid function code word from the second controller within a second amount of time; storing the third valid function code word in the second memory in response to detecting a functional operation of the first input; outputting, during a fourth period of time after the third period of time, a fourth safety message including the fourth valid fault code word in response to detecting, at the first controller, a mismatch between the contents of the first memory and any code word in the first set of valid code words; A method comprising:

12. The first controller, a fifth valid function code word representing a functional state of a first subsystem of the first set of subsystems within the first controller; a fifth valid fault code word representing a fault condition of the first subsystem and characterized by a minimum Hamming distance of 8 from the fifth valid function code word; a sixth valid function code word representing a function state of the first controller; a sixth valid fault code word representing a fault condition of the first controller and characterized by a minimum Hamming distance of 4 from the sixth valid function code word; storing the first set of valid code words further comprising: storing the first valid functional code word in a third memory in response to detecting, by the first controller, functional operation of the first subsystem during the first time period; Further comprising:

12. The method of claim 11, wherein outputting, at the first controller, during the second period of time, the second safety message including the fourth valid function code word is further responsive to detecting that contents of the third memory match the fifth valid function code word.

13. The first controller, a fifth valid function code word representing a functional communication content state of the second controller; a fifth valid fault code word representing a fault communication content state of the second controller and characterized by a minimum Hamming distance of 8 from the fifth valid function code word; storing the first set of valid code words further comprising: storing the fifth valid function code word in a third memory in response to detecting, during the first period, at the first controller, receipt of the first safety message from the second controller within the first amount of time and in response to detecting a match between content of the first safety message and the second valid function code word; storing the fifth valid fault code word in the third memory in response to detecting, during a fifth time period after the fourth time period, at the first controller receiving a fifth safety message from the second controller within a third amount of time, the fifth safety message including a sixth functional code word, and in response to detecting a mismatch between the sixth functional code word and any code word in the first set of valid code words; outputting, during a sixth period after the fifth period, a sixth safety message including the fourth valid fault code word, at the first controller, in response to detecting a match between the contents of the first memory and the first valid functional code word, in response to detecting a functional operation of the first input, and in response to detecting a match between the contents of the third memory and the fifth valid fault code word; Further comprising:

12. The method of claim 11, wherein outputting, at the first controller, during the second period of time, the second safety message including the fourth valid function code word is further responsive to detecting that contents of the third memory match the fifth valid function code word.

14. The first controller, a fifth valid function code word indicative of a function timeout condition of a third controller in a third secure module in the system and characterized by a minimum Hamming distance of 4 from the first valid function code word; a fifth valid fault code word indicative of a fault timeout condition of the third controller and characterized by a minimum Hamming distance of 4 from the first valid fault code word and a minimum Hamming distance of 8 from the fifth valid function code word; a sixth valid function code word representing a function timeout state of a set of monitored controllers including the second controller and the third controller; a sixth valid fault code word indicative of a fault timeout condition of the set of monitored controllers and characterized by a minimum Hamming distance of 8 from the sixth valid function code word; storing the first set of valid code words further comprising: storing the fifth valid fault code word in a third memory in response to detecting, during the first period, at the first controller, failure to receive a fifth safety message from the third controller within a third amount of time; Further comprising:

12. The method of claim 11, wherein outputting, at the first controller, the second safety message during the second time period comprises outputting the second safety message including the fourth valid functional code word and the sixth valid fault code word in response to detecting a match between contents of the first memory and the first valid functional code word, in response to detecting a match between contents of the third memory and the fifth valid fault code word, and in response to detecting a functional operation of the first input.

15. Storing the first set of valid code words at the first controller includes: storing a bit pattern of "0111010111100011" as the first valid function codeword; storing a bit pattern of "1110001101110101" as the first valid fault code word; storing a bit pattern of "1011001100100110" as the fifth valid function codeword; storing a bit pattern of "0010011010110011" as the fifth valid fault code word; 15. The method of claim 14, comprising:

16. the first valid function codeword includes a first most significant byte and a first least significant byte; the first valid fault code word includes a second most significant byte and a second least significant byte; the first most significant byte and the second least significant byte are equivalent to each other; 12. The method of claim 11, wherein the second most significant byte and the first least significant byte are equivalent to each other.

17. the first valid function codeword is characterized by a Hamming distance of 4 from the second valid function codeword and a Hamming distance of 4 from the second valid fault codeword; 12. The method of claim 11, wherein the first valid fault code word is characterized by a Hamming distance of 4 from the second valid function code word, a Hamming distance of 4 from the second valid fault code word, and a Hamming distance of 8 from the first valid function code word.

18. 12. The method of claim 11, wherein storing, at the first controller, the first set of valid code words includes storing the second valid fault code words characterized by a minimum Hamming distance of four from the second valid function code words.

19. The first controller, a fifth valid function code word representing a function timeout condition of a third controller in the first safety module; a fifth valid fault code word indicative of a fault timeout condition of the third controller and characterized by a minimum Hamming distance of 8 from the fifth valid function code word; a sixth valid function code word representing a function state of the third controller; and a sixth valid fault code word representing a fault condition of the third controller and characterized by a minimum Hamming distance of 4 from the sixth valid function code word; storing the first set of valid code words further comprising: During the first period, at the first controller, interrogating an input register coupled to the third controller; detecting a fifth safety message including the sixth valid function codeword from the third controller in the input register; storing the fifth valid function code word in a third memory in response to detecting the fifth safety message in the input register within a third amount of time; Further comprising:

12. The method of claim 11, wherein outputting, at the first controller, during the second period of time, the second safety message including the fourth valid function code word is further responsive to detecting that contents of the third memory match the fifth valid function code word.

20. a first controller in a first safety module in the system; a first valid function code word representing a function timeout condition of a second controller in a second safety module in the system; a first valid fault code word indicative of a fault timeout condition of the second controller and characterized by a first minimum Hamming distance from the first valid function code word; a second valid functionality codeword representing a functionality state of the system; and a second valid fault code word representing a fault condition of the system and characterized by a second minimum Hamming distance from the second valid functional code word; storing a set of valid code words including storing the first valid function code word in a memory in response to detecting, during a first period of time, at the first controller, receipt of a first safety message from the second controller within a first amount of time; outputting, during a second period of time after the first period of time, at the first controller, in response to detecting a match between contents of the memory and the first valid function code word, a second safety message including the second valid function code word; storing the first valid function code word in the memory in response to detecting, during a third time period after the second time period, at the first controller, receipt of a third safety message from the second controller within a second amount of time; outputting, during a fourth period of time after the third period of time, a fourth safety message including the second valid fault code word in response to detecting, at the first controller, a mismatch between contents of the memory and any code word in the set of valid code words; A method comprising:

21. a first controller in a safety module coupled to the system; a first valid function code word representing a functional state of a first subsystem of a first set of subsystems within the first controller; a first valid fault code word representing a fault condition of the first subsystem and characterized by a first minimum Hamming distance from the first valid function code word; a second valid function code word representing a function state of the first controller; a second valid fault code word representing a fault condition of the first controller and characterized by a second minimum Hamming distance from the second valid function code word; a third valid function codeword representing a functional state of a first input coupled to the system; a third valid fault code word representing a fault condition of the first input and characterized by a third minimum Hamming distance from the third valid function code word; a fourth valid functionality code word representing a functionality state of the system; a fourth valid fault code word representing a fault condition of the system and characterized by a fourth minimum Hamming distance from the fourth valid function code word; storing a first set of valid code words including During a first period of time, the first controller storing the first valid functional code word in a first memory in response to detecting functional operation of the first subsystem; storing the third valid function code word in a second memory in response to detecting a functional operation of the first input; outputting, during a second period of time after the first period of time, at the first controller in response to detecting a match between contents of the first memory and the first valid functional code word and in response to detecting a functional operation of the first input, a first safety message including the second valid functional code word and the fourth valid functional code word; During a third period of time after the second period of time, in the first controller, storing the first valid functional code word in the first memory in response to detecting functional operation of the first subsystem; storing the third valid function code word in the second memory in response to detecting a functional operation of the first input; outputting, during a fourth period of time after the third period of time, a second safety message including the second valid fault code word and the fourth valid fault code word in response to detecting, at the first controller, a mismatch between the contents of the first memory and any code word in the first set of valid code words; A method comprising:

22. a second controller in the safety module; a fifth valid function code word representing a functional state of a second subsystem of the second set of subsystems within the second controller; and a fifth valid fault code word representing a fault condition of the second subsystem and characterized by a fifth minimum Hamming distance from the fifth valid function code word; a sixth valid function code word representing a function state of the second controller; a sixth valid fault code word representing a fault condition of the second controller and characterized by a sixth minimum Hamming distance from the sixth valid function code word; a seventh valid function codeword representing a functional state of a second input coupled to the system; and a seventh valid fault code word representing a fault condition of the second input and characterized by a seventh minimum Hamming distance from the seventh valid function code word; an eighth valid function code word representing a functional state of the system; and an eighth valid fault code word representing a fault condition of the system and characterized by an eighth minimum Hamming distance from the eighth valid functional code word; storing a second set of valid code words including During the first period, in the second controller, storing the fifth valid functional code word in a third memory in response to detecting functional operation of the second subsystem; storing the seventh valid function code word in a fourth memory in response to detecting a functional operation of the second input; outputting, at the second controller, during the second time period, a third safety message including the sixth valid function code word and the eighth valid function code word in response to detecting a match between the contents of the third memory and the fifth valid function code word and in response to detecting a functional operation of the second input; During the third period, in the second controller, storing the fifth valid functional code word in the third memory in response to detecting functional operation of the second subsystem; storing the seventh valid function code word in the fourth memory in response to detecting a functional operation of the second input; outputting, during the fourth time period, at the second controller in response to detecting a match between the contents of the third memory and the fifth valid function code word and in response to detecting a functional operation of the second input, a fourth safety message including the sixth valid function code word and the eighth valid function code word; during a fifth period of time after the second period of time, an application processor in the secure module receiving the first safety message and the third safety message; outputting a fifth safety message including a ninth valid functionality code word representative of a functional status of the system in response to detecting the fourth valid functionality code word in the first safety message and the eighth valid functionality code word in the third safety message; During a sixth period after the fourth period, the application processor: receiving the second safety message and the fourth safety message; in response to detecting the fourth valid fault code word in the second safety message and the eighth valid functional code word in the fourth safety message, outputting a sixth safety message including a ninth valid fault code word indicative of a fault condition of the system and characterized by a ninth minimum Hamming distance from the ninth valid functional code word; 22. The method of claim 21 further comprising:

23. the first valid function code word represents a functional state of a first arithmetic logic unit within the first controller; the first valid fault code word represents a fault condition of the first arithmetic logic unit in the first controller and is characterized by a minimum Hamming distance of 8 from the first valid function code word; the fifth valid function code word represents a functional state of a second arithmetic logic unit within the second controller and is characterized by a minimum Hamming distance of 8 from the first valid function code word; 23. The method of claim 22, wherein the fifth valid fault code word represents a fault condition of the second arithmetic logic unit in the second controller and is characterized by a minimum Hamming distance of 8 from the first valid fault code word and a minimum Hamming distance of 8 from the fifth valid function code word.

24. a second controller in the safety module; a fifth valid function code word representing a functional state of a second subsystem of the second set of subsystems within the second controller; and a fifth valid fault code word representing a fault condition of the second subsystem and characterized by a fifth minimum Hamming distance from the fifth valid function code word; a sixth valid function code word representing a function state of the second controller; a sixth valid fault code word representing a fault condition of the second controller and characterized by a sixth minimum Hamming distance from the sixth valid function code word; a seventh valid function codeword representing a functional state of a second input coupled to the system; and a seventh valid fault code word representing a fault condition of the second input and characterized by a seventh minimum Hamming distance from the seventh valid function code word; an eighth valid function code word representing a functional state of the system; and an eighth valid fault code word representing a fault condition of the system and characterized by an eighth minimum Hamming distance from the eighth valid functional code word; storing a second set of valid code words including During the first period, in the second controller, storing the fifth valid functional code word in a third memory in response to detecting functional operation of the second subsystem; storing the seventh valid function code word in a fourth memory in response to detecting a functional operation of the second input; outputting, at the second controller, during the second time period, a third safety message including the sixth valid function code word and the eighth valid function code word in response to detecting a match between the contents of the third memory and the fifth valid function code word and in response to detecting a functional operation of the second input; During the first period, at the first controller, interrogating an input register coupled to the second controller; detecting in the input register a fourth safety message including the sixth valid function codeword from the second controller; Further comprising:

22. The method of claim 21, wherein outputting, at the first controller, during the second period of time, the first safety message including the third valid function codeword is further responsive to detecting the fourth safety message at the input register within a first amount of time.

25. during a fifth period of time after the second period of time, an application processor in the secure module receiving the first safety message and the third safety message; outputting a fifth safety message including a ninth valid functionality code word representative of a functional status of the system in response to detecting the fourth valid functionality code word in the first safety message and the eighth valid functionality code word in the third safety message; 25. The method of claim 24, further comprising:

26. The first controller, a ninth valid function code word representing a function timeout condition of the second controller; and a ninth valid fault code word representing a fault timeout condition of the second controller and characterized by a ninth minimum Hamming distance from the ninth valid function code word; storing the first set of valid code words further comprising: storing, during the first period, the ninth valid function code word in a fifth memory in response to detecting, at the first controller, the fourth safety message in the input register within the first amount of time; Further comprising:

25. The method of claim 24, wherein outputting, at the first controller, during the second period of time, the first safety message including the second valid function code word and the fourth valid function code word is further responsive to detecting a match between contents of the fifth memory and the ninth valid function code word.

27. a second controller in the safety module; a fifth valid function code word representing a functional state of a second subsystem of the second set of subsystems within the second controller; and a fifth valid fault code word representing a fault condition of the second subsystem and characterized by a fifth minimum Hamming distance from the fifth valid function code word; a sixth valid function code word representing a function state of the second controller; a sixth valid fault code word representing a fault condition of the second controller and characterized by a sixth minimum Hamming distance from the sixth valid function code word; a seventh valid function codeword representing a functional state of a second input coupled to the system; and a seventh valid fault code word representing a fault condition of the second input and characterized by a seventh minimum Hamming distance from the seventh valid function code word; an eighth valid function code word representing a functional state of the system; and an eighth valid fault code word representing a fault condition of the system and characterized by an eighth minimum Hamming distance from the eighth valid function code word; a ninth valid function code word representing a function timeout condition of the first controller; and a ninth valid fault code word indicative of a fault timeout condition of the first controller and characterized by a ninth minimum Hamming distance from the ninth valid function code word; storing a second set of valid code words including During the first period, in the second controller, storing the fifth valid functional code word in a third memory in response to detecting functional operation of the second subsystem; storing the seventh valid function code word in a fourth memory in response to detecting a functional operation of the second input; interrogating an input register coupled to the first controller; storing the ninth valid fault code word in a fifth memory in response to detecting a failure to receive a third safety message at the input register within a first amount of time; outputting, in response to detecting, during the second time period, at the second controller, a match between the contents of the fifth memory and the ninth valid fault code word, a fourth safety message including the eighth valid fault code word; 22. The method of claim 21 further comprising:

28. The first controller, a fifth valid function code word representing a functional state of a second subsystem of the first set of subsystems in the first controller and characterized by a minimum Hamming distance of four from the first valid function code word; a fifth valid fault code word representing a fault condition of the second subsystem and characterized by a minimum Hamming distance of 4 from the first valid fault code word and a minimum Hamming distance of 8 from the fifth valid function code word; storing the first set of valid code words further comprising: storing the fifth valid functional code word in a third memory in response to detecting, by the first controller, functional operation of the second subsystem during the first time period; Further comprising:

22. The method of claim 21, wherein outputting, at the first controller, during the second period of time, the first safety message including the second valid function code word and the fourth valid function code word is further responsive to detecting that contents of the third memory match the fifth valid function code word.

29. the first valid function code word and the first valid fault code word each exhibit a length of 2 bytes; the second valid function codeword, the second valid fault codeword, the third valid function codeword, the third valid fault codeword, the fourth valid function codeword, and the fourth valid fault codeword each exhibit a length of one byte; the first minimum Hamming distance is 8; the second minimum Hamming distance is 4; the third minimum Hamming distance is 4; 22. The method of claim 21, wherein the fourth minimum Hamming distance is four.

30. Storing the first set of valid code words at the first controller includes: storing a bit pattern of "1101111011101101" as the first valid function codeword; storing a bit pattern of "1000001000101000" as the first valid fault code word; 22. The method of claim 21 , comprising:

31. a first controller in a safety module coupled to the system; a first valid function code word representing a functional state of a first subsystem of a first set of subsystems within the first controller; a first valid fault code word representing a fault condition of the first subsystem and characterized by a first minimum Hamming distance from the first valid function code word; a second valid function code word representing a function state of the first controller; a second valid fault code word representing a fault condition of the first controller and characterized by a second minimum Hamming distance from the second valid function code word; a third valid function codeword representing a functional state of a first input coupled to the system; a third valid fault code word representing a fault condition of the first input and characterized by a third minimum Hamming distance from the third valid function code word; a fourth valid function code word representing a functional state of a second controller within the safety module; a fourth valid fault code word representing a fault condition of the second controller and characterized by a fourth minimum Hamming distance from the fourth valid function code word; a fifth valid function code word representing a function timeout condition of the second controller; and a fifth valid fault code word indicative of a fault timeout condition of the second controller and characterized by a fifth minimum Hamming distance from the fifth valid function code word; a sixth valid functionality code word representing a functionality state of the system; a sixth valid fault code word representing a fault condition of the system and characterized by a sixth minimum Hamming distance from the sixth valid function code word; storing a first set of valid code words including During a first period of time, the first controller storing the first valid functional code word in a first memory in response to detecting functional operation of the first subsystem; storing the third valid function code word in a second memory in response to detecting a functional operation of the first input; interrogating an input register coupled to the second controller; detecting a first safety message including the fourth valid function codeword from the second controller in the input register; storing the fifth valid function code word in a third memory in response to detecting the first safety message in the input register within a first amount of time; outputting, during a second period of time after the first period of time, at the first controller, a second safety message including the second valid function code word and the sixth valid function code word in response to detecting a match between the contents of the first memory and the first valid function code word, in response to detecting a match between the contents of the third memory and the fifth valid function code word, and in response to detecting a functional operation of the first input; During a third period of time after the second period of time, in the first controller, storing the first valid functional code word in the first memory in response to detecting functional operation of the first subsystem; storing the third valid function code word in the second memory in response to detecting a functional operation of the first input; interrogating said input register; storing the fifth valid fault code word in a third memory in response to detecting a failure to receive a third safety message at the input register within a second amount of time; outputting, during a fourth period of time after the third period of time, at the first controller, a fourth safety message including the second valid functional code word and the sixth valid fault code word in response to detecting a match between the contents of the first memory and the first valid functional code word and in response to detecting a match between the contents of the third memory and the fifth valid fault code word; A method comprising:

32. during a fifth time period after the second time period and before the third time period, at the first controller; storing the first valid functional code word in the first memory in response to detecting functional operation of the first subsystem; interrogating the input register coupled to the second controller; storing the fifth valid function code word in the third memory in response to detecting a fifth safety message from the second controller at the input register within a third amount of time; outputting, during a sixth time period after the fifth time period and before the third time period, at the first controller, a sixth safety message including the second valid functional code word and the sixth valid fault code word in response to detecting a match between the contents of the first memory and the first valid functional code word and in response to detecting a mismatch between the contents of the third memory and any code word in the first set of valid code words; 32. The method of claim 31 , further comprising:

33. The first controller, a seventh valid function code word representing a function timeout condition of a third controller in a second safety module coupled to the system; a seventh valid fault code word representing a fault timeout condition of the third controller and characterized by a minimum Hamming distance of 8 from the seventh valid function code word; storing the first set of valid code words further comprising: storing the seventh valid function code word in a fourth memory in response to detecting, during the first period, at the first controller, receipt of a fifth safety message from the third controller within a third amount of time; and further responsive to detecting, during the second time period, at the first controller a match between the contents of the fourth memory and the seventh valid function code word, outputting the second safety message including the second valid function code word and the sixth valid function code word.

32. The method of claim 31 , further comprising:

34. The first controller, a seventh valid function code word representing a function timeout condition of a third controller in a second safety module coupled to the system; a seventh valid fault code word indicative of a fault timeout condition of the third controller and characterized by a minimum Hamming distance of 8 from the seventh valid function code word; an eighth valid function code word indicative of a function timeout state of a fourth controller in a third secure module coupled to the system and characterized by a minimum Hamming distance of 4 from the seventh valid function code word; an eighth valid fault code word representing a fault timeout condition of the fourth controller and characterized by a minimum Hamming distance of 4 from the seventh valid fault code word and a minimum Hamming distance of 8 from the eighth valid function code word; a ninth valid function code word representing a function timeout state of a set of monitored controllers including the third controller and the fourth controller; a ninth valid fault code word representing a fault timeout condition of the set of monitored controllers and characterized by a minimum Hamming distance of 8 from the ninth valid function code word; storing the first set of valid code words further comprising: During the first period, at the first controller, storing the seventh valid function code word in a fourth memory in response to detecting receipt of a fifth safety message from the third controller within a third amount of time; storing the eighth valid fault code word in a fifth memory in response to detecting a failure to receive a sixth safety message from the fourth controller within a fourth amount of time; Further comprising:

32. The method of claim 31 , wherein outputting, at the first controller, during the second time period, the second safety message includes outputting the second safety message including the second valid functional code word, the sixth valid functional code word, and the ninth valid fault code word in response to detecting a match between the contents of the first memory and the first valid functional code word, in response to detecting a match between the contents of the third memory and the fifth valid functional code word, in response to detecting a functional operation of the first input, in response to detecting a match between the contents of the fourth memory and the seventh valid functional code word, and in response to detecting a match between the fifth memory and the eighth valid fault code word.

35. the first valid function codeword includes a high order byte and a low order byte; 32. The method of claim 31, wherein the high byte and the low byte are inverse nibble values.

36. the first valid function codeword is characterized by a Hamming distance of 4 from the second valid function codeword and a Hamming distance of 4 from the second valid fault codeword; 32. The method of claim 31 , wherein the first valid fault code word is characterized by a Hamming distance of 4 from the second valid function code word, a Hamming distance of 4 from the second valid fault code word, and a Hamming distance of 8 from the first valid function code word.

37. 32. The method of claim 31 , wherein storing, at the first controller, the first set of valid code words includes storing the second valid fault code words characterized by a minimum Hamming distance of four from the second valid function code words.

38. Storing the first set of valid code words at the first controller includes: storing the first valid function code word representing a functional state of an arithmetic logic unit within the first controller; storing said first valid fault code word representing a fault condition of said arithmetic logic unit and characterized by a minimum Hamming distance of 8 from said first valid function code word; storing a seventh valid functional code word representative of a functional state of a flash memory within said first controller and characterized by a minimum Hamming distance of 4 from said first valid functional code word and a minimum Hamming distance of 4 from said first valid fault code word; storing a seventh valid fault code word representative of a fault condition of the flash memory and characterized by a minimum Hamming distance of 4 from the first valid function code word, a minimum Hamming distance of 4 from the first valid fault code word, and a minimum Hamming distance of 8 from the seventh valid function code word; storing an eighth valid function code word representing a functional state of a stack overflow safety mechanism within the first controller and characterized by a minimum Hamming distance of four from the first valid function code word and a minimum Hamming distance of four from the seventh valid function code word; storing an eighth valid fault code word representing a fault condition of the stack overflow safety mechanism and characterized by a minimum Hamming distance of 4 from the first valid fault code word, a minimum Hamming distance of 4 from the seventh valid fault code word, and a minimum Hamming distance of 8 from the eighth valid function code word; 32. The method of claim 31 , comprising:

39. Storing the first set of valid code words at the first controller includes: storing a bit pattern of "1101111011101101" as the first valid function codeword; storing a bit pattern of "1000001000101000" as the first valid fault code word; storing a bit pattern of "1110110111011110" as the seventh valid function codeword; storing a bit pattern of "0010100010000010" as the seventh valid fault code word; storing a bit pattern of "1110101110111110" as the eighth valid function codeword; storing a bit pattern of "1101011101111101" as the eighth valid fault code word; 39. The method of claim 38, comprising:

40. a first controller in a safety module coupled to the system; a first valid function code word representing a functional state of a first subsystem of a first set of subsystems within the first controller; a first valid fault code word representing a fault condition of the first subsystem and characterized by a first minimum Hamming distance from the first valid function code word; a second valid function code word representing a function state of the first controller; a second valid fault code word representing a fault condition of the first controller and characterized by a second minimum Hamming distance from the second valid function code word; storing a first set of valid code words including storing the first valid functional code word in a first memory in response to detecting, at the first controller, functional operation of the first subsystem during a first time period; outputting, during a second period of time after the first period of time, at the first controller, in response to detecting a match between contents of the first memory and the first valid function code word, a first safety message including the second valid function code word; storing the first valid functional code word in the first memory in response to detecting, at the first controller, functional operation of the first subsystem during a third period of time subsequent to the second period of time; outputting, during a fourth period of time after the third period of time, a second safety message including the second valid fault code word in response to detecting, at the first controller, a mismatch between contents of the first memory and any code word in the first set of valid code words; A method comprising:

Images