Safety monitor for invalid image transformations

Abstract

A system, apparatus, and method for implementing a safety monitor framework for safety-critical computer vision (CV) applications are disclosed. The system includes a safety-critical CV application, a safety monitor, and a CV accelerator engine. The safety monitor receives an input image, test data, and a CV graph from the safety-critical CV application. The safety monitor generates a modified image by adding an additional object outside the input image. The safety monitor provides the modified image and the CV graph to a CV accelerator, which processes the modified image and provides an output to the safety monitor. The safety monitor determines the likelihood of erroneous processing of the original input image by comparing the output of the additional object with known good results. The safety monitor complements the overall fault coverage of the CV accelerator engine and covers faults observable only at the CV graph level.

Description

[Background technology]

[0001] Description of Related Art In a typical deployment of a computer vision algorithm, a software application supplies a computer vision (CV) graph to a CV accelerator hardware engine. The CV graph defines multiple image processing functions that must be executed to transform each frame of an input image or stream of video frames. In one implementation, these image processing functions are defined by nodes in a directed acyclic graph (DAG). The CV graph can be designed to conform to any of a variety of frameworks (e.g., the OpenVX framework). When a CV accelerator operates in a safety-critical environment, it is desirable to monitor the CV accelerator for abnormal behavior. A typical implementation for monitoring a CV accelerator involves inserting monitoring logic into the CV accelerator processing hardware sub-block. For example, a machine check architecture is a mechanism by which the processing hardware's monitoring logic checks for abnormal behavior. However, while this approach provides monitoring at a low level of hardware, it may miss faults that are only observable at the output of the CV accelerator. This approach also fails to detect random and intermittent faults at the CV graph level.

[0002] The advantages of the methods and mechanisms described herein may be better understood by referring to the following description in conjunction with the accompanying drawings. [Brief explanation of the drawings]

[0003] [Figure 1] FIG. 1 is a block diagram of one implementation of a computing system. [Figure 2] FIG. 1 is a block diagram of one embodiment of a safety-critical computer vision application running in a safety-critical system. [Figure 3]FIG. 1 is a block diagram of one embodiment of a computer vision obstacle detection framework. [Figure 4] 1 is an example of an image sent from a safety-critical application to a safety monitor framework, according to one embodiment. [Figure 5] 1 is a modified image generated by the safety monitor framework from an original image, according to one embodiment. [Figure 6] FIG. 1 is a generalized flow diagram illustrating one embodiment of a method for operating a safety monitor framework for a computer vision accelerator. [Figure 7] FIG. 1 is a generalized flow diagram illustrating one embodiment of a method for implementing a safety monitor framework. [Figure 8] FIG. 1 is a generalized flow diagram illustrating one embodiment of a method for generating confidence indicators for use by safety-critical applications. DETAILED DESCRIPTION OF THE INVENTION

[0004] In the following description, numerous specific details are set forth to provide a thorough understanding of the methods and mechanisms described herein. However, those skilled in the art should recognize that various implementations may be practiced without these specific details. In some instances, well-known structures, components, signals, computer program instructions, and techniques have not been shown in detail to avoid obscuring the approaches described herein. It should be understood that for simplicity and clarity of illustration, elements shown in the figures have not necessarily been drawn to scale. For example, the dimensions of some elements may be exaggerated relative to other elements.

[0005] Disclosed herein are systems, apparatus, and methods for implementing a safety monitor framework for safety-critical computer vision applications. In one embodiment, the system includes a safety-critical computer vision application, a safety monitor, and a computer vision accelerator engine. The safety monitor receives an input image, test data (e.g., test vectors), and a computer vision graph from the safety-critical computer vision application. In one embodiment, the test data includes a list of known images, corresponding output images, and meta information defined by output nodes of the computer vision graph. In one embodiment, the safety monitor modifies the input image to add additional objects outside the boundaries of the input image. In such an embodiment, the modified image is larger than the input image to accommodate the additional objects outside the boundaries of the original image. In one embodiment, the configuration of the modified image (i.e., the additional space and where the additional objects are inserted) is stored in a data structure (i.e., metadata) that is communicated through the system flow along with the modified image.

[0006] In one embodiment, the additional objects include one or more redundant objects that are identical to objects detected in a previous input image. In another embodiment, the additional objects include one or more objects provided in the test vector. The safety monitor provides the modified image to a computer vision accelerator. The computer vision accelerator processes the modified image and returns an output to the safety monitor. The safety monitor determines a likelihood of erroneous processing of the original input image based on the output produced by the computer vision accelerator. In one embodiment, the safety monitor compares known good results with outputs associated with the modifications to determine the likelihood of erroneous processing of the original input image. The safety monitor provides an indicator of the likelihood of erroneous processing to safety-critical applications. This approach allows the safety monitor to complement global fault coverage and protect against faults observable only at the level of the computer vision graph.

[0007] 1, a block diagram of one embodiment of computing system 100 is shown. In one embodiment, computing system 100 includes at least processor(s) 110A-110B, input / output (I / O) interface 120, bus 125, and memory subsystem 130. In other embodiments, computing system 100 may include other components and / or may be configured differently. In one embodiment, computer vision accelerator engine 105 is implemented on processor(s) 110B. Computer vision accelerator engine 105 represents any combination of software, firmware, and / or hardware for implementing various computer vision algorithms or models on processor(s) 110B.

[0008] The computer vision accelerator engine 105 may be used by any of a variety of different safety-critical applications, depending on the implementation. For example, in one embodiment, the computer vision accelerator engine 105 is used in an automotive application. For example, the computer vision accelerator engine 105 controls one or more functions of a self-driving vehicle (i.e., autonomous vehicle), a driver-assisted vehicle, or an advanced driver assistance system. In other embodiments, the computer vision accelerator engine 105 is trained and customized for other types of use cases. Depending on the embodiment, the computer vision accelerator engine 105 generates image-based or non-image-based output.

[0009] Processor(s) 110A-110B represent any number and type of processing unit (e.g., central processing unit (CPU), graphics processing unit (GPU), digital signal processor (DSP), field programmable gate array (FPGA), application specific integrated circuit (ASIC)). In one embodiment, at least a portion of the processing associated with computer vision accelerator engine 105 is performed by processor(s) 110B. Furthermore, computer vision accelerator engine 105 may be implemented using any of these types of processing units and / or other types of processing elements. Memory subsystem 130 includes any number and type of memory devices. For example, the type of memory in memory subsystem 130 may include high bandwidth memory (HBM), non-volatile memory (NVM), dynamic random access memory (DRAM), static random access memory (SRAM), NAND flash memory, NOR flash memory, ferroelectric random access memory (FeRAM), or other memory. Memory subsystem 130 is accessible by computer vision accelerator engine 105 and processor(s) 110A-110B. I / O interface 120 represents any number and type of I / O interface (e.g., Peripheral Component Interconnect (PCI) bus, PCI Extended (PCI-X), PCI Express (PCIE) bus, Gigabit Ethernet (GBE) bus, Universal Serial Bus (USB)). Various types of peripherals can be coupled to I / O interface 120. Such peripherals include (but are not limited to) displays, keyboards, mice, printers, scanners, joysticks and other types of game controllers, media recording devices, external storage devices, network interface cards, etc.

[0010] In various embodiments, computing system 100 is a computer, a laptop, a mobile device, a game console, a server, a streaming device, a wearable device, or various other types of computing systems or devices. In some embodiments, computing system 100 is integrated within a robotic system, a self-driving vehicle, an autonomous drone, a surgical tool, or other types of mechanical devices or systems. It should be noted that the number of components of computing system 100 may vary from embodiment to embodiment. For example, in other embodiments, there may be more or fewer components than those shown in FIG. 1 . It should also be noted that in other embodiments, computing system 100 includes other components not shown in FIG. 1 . Furthermore, in other embodiments, computing system 100 is configured in a manner other than that shown in FIG. 1 .

[0011] Referring to FIG. 2 , a block diagram of one embodiment of a safety-critical computer vision application 220 executing on a safety-critical system 200 is shown. In one embodiment, the safety-critical system 200 includes at least processing unit(s) 205, 210, which may represent any number and type of processing unit. Note that the safety-critical system 200 may also include any number of other components not shown to avoid obscuring the diagram. In one embodiment, the processing unit(s) 205 include one or more central processing units (CPUs). In other embodiments, the processing unit(s) 205 may include other types of processing units. In one embodiment, the processing unit(s) 210 include one or more graphics processing units (GPUs). In other embodiments, the processing unit(s) 210 may include other types of processing units (e.g., digital signal processors (DSPs), field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs)).

[0012] In one embodiment, safety-critical computer vision application 220 executes on processing unit(s) 205. Safety-critical computer vision application 220 represents any type of software application that executes in a hazardous environment where safety is critical. For example, in one embodiment, safety-critical computer vision application 220 controls an autonomous or driver-assisted automobile or other vehicle. In other embodiments, safety-critical computer vision application 220 operates within a robot, as an autopilot control mechanism for an airplane, or as part of other systems in a variety of challenging and high-risk environments.

[0013] In one embodiment, a first portion of safety monitor framework 230 (i.e., safety monitor framework 230A) executes on processing unit(s) 205, and a second portion of safety monitor framework 230 (i.e., safety monitor framework 230B) executes on processing unit(s) 210. In other embodiments, safety monitor framework 230 executes entirely on processing unit(s) 205 or entirely on processing unit(s) 210. Computer vision accelerator 240 represents any combination of software and / or hardware used to implement one or more computer vision algorithms and / or computer vision models. In one embodiment, computer vision accelerator 240 operates according to a computer vision (CV) graph provided by safety-critical computer vision application 220. In one embodiment, computer vision accelerator 240 is implemented using dedicated hardware (e.g., FPGA, ASIC, IP core). In another embodiment, computer vision accelerator 240 includes software instructions designed to execute on processing unit(s) 210. In other embodiments, computer vision accelerator 240 may be any suitable combination of software and / or hardware.

[0014] In one embodiment, safety-critical computer vision application 220 provides images that are processed by computer vision accelerator 240. In one embodiment, safety monitor framework 230 receives inputs sent from safety-critical computer vision application 220 to computer vision accelerator 240. In one embodiment, safety monitor framework 230 modifies one or more of these inputs and then sends the modified inputs to safety-critical computer vision application 220. After computer vision accelerator 240 processes the modified inputs, computer vision accelerator 240 sends the processing results to safety-critical computer vision application 220 via safety monitor framework 230. Safety monitor framework 230 analyzes the results to determine whether computer vision accelerator 240 is malfunctioning. In one embodiment, safety monitor framework 230 generates a confidence indicator that indicates how confident it is that computer vision accelerator 240 accurately processed the inputs generated by safety-critical computer vision application 220. Safety monitor framework 230 communicates the confidence indicator and a modified version of the processing result to safety-critical computer vision application 220. In one embodiment, safety-critical computer vision application 220 performs one or more corrective actions (e.g., shutting down, restarting the system, retrying the same image, generating a warning signal to the user, slowing the vehicle, changing the operating mode) if the confidence indicator does not meet a threshold. In some embodiments, not meeting the threshold means that the confidence indicator is below the threshold. In other embodiments, not meeting the threshold means that the confidence indicator is above the threshold.

[0015] Referring to FIG. 3 , a block diagram of one embodiment of a computer vision fault detection system (or “framework”) 300 is shown. In one embodiment, computing system 310 includes safety monitor framework 315 and computer vision accelerator hardware 350. In various embodiments, computer vision accelerator hardware 350 includes specialized hardware and / or software for accelerating computer vision processing tasks. In other embodiments, general-purpose hardware and / or software can be used (e.g., added to the system) to speed up the processing of computer vision-related processing tasks. In one embodiment, safety monitor framework 315 includes test generation unit 320, pass-through unit 325, result filter 330, test validation unit 335, computer vision stack 340, and computer vision driver 345. In other embodiments, safety monitor framework 315 includes other components and / or is configured in other suitable manners. In one embodiment, safety monitor framework 315 is designed to comply with the Autonomous Safety Integrity Level (ASIL) risk classification scheme. In other embodiments, the safety monitor framework 315 may be designed to conform to other risk classification schemes in other types of environments.

[0016] In one embodiment, the safety-critical computer vision application 305 communicates computer image-related data to the safety monitor framework 315. In various embodiments, such image-related data includes images, test vectors, and computer vision (CV) graphs. In other embodiments, it may include different and / or other data. In one embodiment, the safety-critical computer vision application 305 describes a computer vision algorithm in the form of a binary graph for execution by the computer vision accelerator hardware 350. In one embodiment, the computer vision accelerator hardware 350 includes hardware primitives that accelerate the processing of a particular computer vision algorithm. The algorithm transforms an input image according to the particular binary graph. In various embodiments, the output of the algorithm is a transformed image and / or metadata describing features detected in the input image.

[0017] In one embodiment, test vectors are received and used by the test generation unit 320 to determine objects to add to the original image. The test vectors are also used to determine whether the results generated by the computer vision accelerator hardware 350 are accurate. In one embodiment, redundant objects are added to the original image, where the redundant objects are identical to objects present in the previous image. In another embodiment, predetermined objects that were not present in the previous image are added to the original image. For example, in one embodiment, the predetermined objects are objects identified in the test vectors as known-good objects in one or more test images. As used herein, a "known-good object" is defined as an object that is likely to be correctly identified or processed in a consistent manner by the computer vision accelerator hardware 350. Known-good objects and their corresponding objects, collectively known as test vectors, are typically generated by a tester and / or domain expert to provide adequate coverage for the specific algorithm or use case being implemented. These test vectors are used to verify the accuracy of the algorithm from both a hardware and software perspective in a controlled environment. Failures detected in these known-good test vectors indicate problems with the software / hardware installation and / or overall flow caused by software / hardware malfunctions or other issues. In one embodiment, the predetermined objects added to the original image are selected based at least in part on their likelihood of occurring in the image being processed. Test generation unit 320 adds one or more additional predetermined objects to the original image to generate the modified image. Computer vision stack 340 communicates the modified image and the CV graph to computer vision accelerator hardware 350. In one embodiment, the modified image and the CV graph are communicated to computer vision accelerator hardware 350 via computer vision driver 345.

[0018] The computer vision accelerator hardware 350 processes the modified image according to the provided CV graph, and then the computer vision accelerator hardware 350 returns the processed results to the computer vision stack 340. In various embodiments, the computer vision accelerator hardware 350 performs various functions, including (but not limited to) image color conversion, pixel-wise image operations, image scaling and filtering, Gaussian and Laplacian pyramids, histogram and statistical operations, tensor operations, classification, feature detection, tracking, control flow operations, convolution, deconvolution, fully connected layers, max pooling, average pooling, activation, local response normalization, softmax, region of interest pooling, etc. In one embodiment, these functions are specified as nodes in a computation graph that is dispatched from the safety-critical computer vision application 305 to the computer vision accelerator hardware 350. The computer vision accelerator hardware 350 organizes its hardware and / or firmware to optimize a particular graph. The hardware may include one or more digital signal processors, blocks optimized for each of the above operations, dedicated vector calculation units, and / or other units.

[0019] In one embodiment, result filter 330 analyzes the results and filters the results to remove additional objects that were added to the original image. Result filter 330 communicates the filtered results and meta information to application 305. The meta information can include any type of data, which can be of different types depending on the embodiment. For example, in one embodiment, if application 305 is looking for the number of objects in the original image, the meta information includes the number of objects in the original image and their locations. In other embodiments, other data can be communicated in the meta information depending on what application 305 is looking for in the original image or the type of transformation being performed on the original image.

[0020] In one embodiment, results from the computer vision accelerator hardware 350 are analyzed by a test verification unit 335. The test verification unit 335 determines whether the additional object(s) added to the original image were correctly processed and / or classified by the computer vision accelerator hardware 350. In one embodiment, for image output nodes, the test verification unit 335 compares the transformed test image with known good results. For non-image output nodes, the test verification unit 335 uses at least one of the following techniques, according to one or more embodiments: For histograms, the test verification unit 335 uses histogram test vectors to determine the likelihood of error for a bin of results and returns the adjusted histogram (without the test vector effect) to the application. For remap operations, the test verification unit 335 uses the remap test vectors and the corresponding known remap function to verify whether the remapped image is correct. In the case of optical flow, the test verification unit 335 uses optical flow test vectors for the two input frames to verify whether the calculated optical flow is correct. In the case of an integration operation, the test verification unit 335 performs verification by subtracting the integral of the main image from the modified image and comparing it to the expected output provided as part of the test data. In the case of a feature extraction operation, the test verification unit 335 returns the adjusted feature set (without the test vector effect) to the application. In other embodiments, the test verification unit 335 can use other suitable techniques to verify the results of various types of output nodes.

[0021] If the test verification unit 335 determines that the computer vision accelerator hardware 350 processed the known good object correctly, the test verification unit 335 returns a passing test result indicator to the application 305. For example, in one embodiment, if the area padded with the known good object converts to the expected test vector output or equivalent metadata, the calculations by the computer vision accelerator hardware 350 are deemed correct. Otherwise, if the known good object was not processed correctly, the test verification unit 335 returns a failing test result indicator to the application 305. In response to receiving a failing test result indicator, the application 305 can take any of a variety of corrective actions (e.g., restarting, generating an error, replaying the same image).

[0022] Referring to FIG. 4, an example of an image 400A sent from a safety-critical application to a safety monitor framework is shown, according to one embodiment. In the example shown in FIG. 4, image 400A includes a truck 402, a person 404, a dog 406, a horse 408, and another person 410. It should be understood that this example of image 400A including these objects merely illustrates one particular embodiment. The likelihood of detection and correct identification is also displayed above the dashed box surrounding each identified object. In one embodiment, these probabilities are determined during the training phase of the target computer vision accelerator engine. In one embodiment, these probabilities are provided in test data that the safety-critical application provides to the safety monitor framework of the target computer vision accelerator engine that is processing a particular CV graph and / or image.

[0023] Referring to FIG. 5, a modified image 400B is shown generated by a safety monitor framework from an original image 400A, according to one embodiment. The modified image 400B is intended to represent the image 400A (of FIG. 4) after it has been modified by a safety monitor framework (e.g., the safety monitor framework 315 of FIG. 3). As shown, the modified image 400B includes the original image 400A, along with a known good object region 505 that has been added to the modified image 400B outside (to the right) of the boundary of the original image 400A. The region of the original image 400A to the left of the modified image 400B remains unchanged. Thus, the portion of the original image 400A in the modified image 400B includes all of the original objects that appear in the image 400A (of FIG. 4).

[0024] In one embodiment, known good object region 505 includes a person 510 representing a known good object found in one test vector image. In other embodiments, known good object region 505 may include other numbers and / or types of objects. Depending on the embodiment, the objects shown in known good object region 505 may include redundant objects that are exact duplicates of objects in the original image and / or new objects not included as part of original image 400A. Furthermore, while known good object region 505 is shown on the right side of modified image 400B, it should be understood that this is intended to represent only one particular embodiment. In other embodiments, known good object region 505 may be added to the top, left, and / or bottom of original image 400A. In some embodiments, a portion of the original image is used as known good object region 505. For example, if a portion of the image is deemed non-essential for some reason (e.g., if the image content of a particular region is determined to have no functional impact on the processing results), that particular region may be used as the known good object region.

[0025] After generating modified image 400B, the safety monitor framework communicates modified image 400B to a computer vision accelerator engine (e.g., computer vision accelerator hardware 350 of FIG. 3). The computer vision accelerator engine processes modified image 400B and then communicates output based on this processing to the safety monitor framework. The safety monitor framework determines whether the objects added to known good object region 505 were identified and / or processed according to the previously provided test data. If these added objects were correctly identified and / or properly processed, the safety monitor framework provides a pass indicator to the safety-critical application. The safety monitor framework also filters the processing results associated with original image 400A by excluding objects within known good object region 505. The safety monitor framework then provides these filtered results to the safety-critical application.

[0026] On the other hand, if the added object is incorrectly identified and / or incorrectly processed, the safety monitor framework provides a failure indicator to the safety-critical application. In response to receiving the failure indicator, the safety-critical application performs one or more corrective actions. For example, in one embodiment, the safety-critical application terminates in response to receiving the failure indicator. In another embodiment, in response to receiving the failure indicator, the safety-critical application generates the same frame to be reprocessed by the computer vision accelerator engine. In other embodiments, the safety-critical application performs other actions in response to receiving the failure indicator.

[0027] Referring to FIG. 6, one embodiment of a method 600 for operating a safety monitor framework for a computer vision accelerator is shown. For purposes of explanation, the steps of this embodiment and the steps of FIGS. 7-8 are shown sequentially. However, it should be noted that in various embodiments of the described method, one or more of the described elements may be performed simultaneously, in a different order than shown, or omitted entirely. Other additional elements may also be performed as needed. Any of the various systems or devices described herein may be configured to perform method 600.

[0028] The safety monitor framework receives test data and a computer vision (CV) graph from the safety-critical computer vision application (block 605). The test data may include training information, test vectors, and / or other metadata. In some cases, the test data is pre-supplied or received by the safety monitor framework before the start of method 600. In one embodiment, the test vectors include objects that have been previously identified and / or are likely to be identified in the image being processed. The safety monitor framework also receives an input image from the safety-critical computer vision application (block 610). In one embodiment, the input image is an actual image that needs to be processed for the real-time application. The safety monitor framework then generates a modified image from the input image based on the test data (block 615). In one embodiment, the modified image includes the input image with one or more additional objects added outside the boundary of the input image. For example, in one embodiment, the safety monitor framework detects a first object in a previous input image. In this embodiment, if a first object is identified in the test data such that the probability of the first object being identified by the computer vision accelerator engine exceeds a threshold, the safety monitor framework adds the first object to a space outside the original input image. In this example, the modified image includes not only the first object but also the original input image. Note that any number of objects can be added to the area outside the original input image. The modified image is generated from a combination of the original input image and the additional area.

[0029] The safety monitor framework then communicates the modified image to the computer vision accelerator engine (block 620). The computer vision accelerator engine then processes the modified image (block 625). Note that the computer vision accelerator engine is unaware that the original image was modified. Thus, the computer vision accelerator engine performs normal processing as if the image had been received directly from the safety-critical application without modification. The computer vision accelerator engine then communicates output from processing the modified image to the safety monitor framework (block 630). The safety monitor framework checks the output to determine whether the computer vision accelerator engine is operating normally or malfunctioning (block 635). For example, if the additional object(s) added to the modified image are processed as expected, the safety monitor framework concludes that the computer vision accelerator engine is operating normally. Otherwise, if the results from the computer vision accelerator engine processing the additional object(s) are unexpected and / or inconsistent with the results from the same object(s) in the original image portion of the modified image, the safety monitor framework concludes that the computer vision accelerator engine is malfunctioning.

[0030] If the safety monitor framework determines that the computer vision accelerator engine is malfunctioning (conditional block 640: "Yes"), the safety monitor framework generates and communicates an error message to the safety-critical computer vision application (block 645). The safety monitor framework may also provide other outputs from the computer vision accelerator engine to the safety-critical application in block 645. In response to receiving the error message, the safety-critical application performs one or more corrective actions (block 650). Note that the safety-critical application may optionally decide to continue sending subsequent images to the computer vision accelerator engine for processing, possibly depending on the type of error detected and / or the current status of the safety-critical application. Alternatively, the safety-critical application may decide to terminate in response to receiving the error message. If the safety monitor framework determines that the computer vision accelerator engine is functioning normally (conditional block 640: "No"), the safety monitor framework generates and communicates a no-error message to the safety-critical application (block 655). The safety monitor framework may also provide other output (e.g., filtered results) from the computer vision accelerator engine to the safety-critical application in block 655. In response to receiving a no-error message, the safety-critical application provides another image to the safety monitor framework, and then method 600 returns to block 610.

[0031] Referring to FIG. 7, one embodiment of a method 700 for implementing a safety monitor framework is shown. The safety monitor framework receives an input image and test data from a safety-critical application (block 705). The safety monitor framework determines whether any objects identified in the test data were present in a previous image (block 710). For purposes of this description, it is assumed that the input image is part of a continuous sequence of images, such as a camera input stream. If one or more objects identified by the test data were present in the previous image (conditional block 715: "yes"), the safety monitor framework modifies the input image by adding redundant copies of one or more of these identified objects outside the boundaries of the original image (block 720). The safety monitor framework then communicates the modified image to a computer vision accelerator engine (block 725). If none of the objects identified by the test data were present in the previous image (conditional block 715: "no"), the safety monitor framework passes the input image to the computer vision accelerator engine, where processing is performed in a conventional manner (block 730). After block 730, the method 700 ends.

[0032] After block 725, the computer vision accelerator engine processes the modified image and returns a first set of processing results to the safety monitor framework (block 735). The safety monitor framework analyzes the first set of processing results and generates an error status message (block 740). Note that the error status message indicates the error status or likelihood of the computer vision accelerator engine. In one embodiment, the error status message is a single bit indicating whether the computer vision accelerator engine is functioning normally or malfunctioning. The safety monitor framework also converts the first set of processing results into a second set of processing results (block 745). In one embodiment, the safety monitor framework converts the first set of processing results into the second set of processing results by removing result data related to the modifications made to the original image from the first set of processing results. In other words, the second set of processing results appears to be what the processing results would be if the original image, rather than the modified image, were processed by the computer vision accelerator engine. The safety monitor framework then communicates the error status message and the second set of processing results to the safety-critical application (block 750). After block 750, the method 700 ends.

[0033] Referring to FIG. 8, one embodiment of a method 800 for generating a confidence indicator for use by a safety-critical application is illustrated. A safety monitor framework intercepts an image transmitted from the safety-critical application to a computer vision accelerator engine (block 805). In one embodiment, the safety monitor framework is interposed between the safety-critical application and the computer vision accelerator engine. In one embodiment, neither the safety-critical application nor the computer vision accelerator engine is aware that the safety monitor framework is interposed between them. However, in other embodiments, the safety-critical application and / or the computer vision accelerator engine are aware that the safety monitor framework is interposed between them. The safety monitor framework applies one or more modifications to the image and then communicates the modified image to the computer vision accelerator engine (block 810). In one embodiment, the one or more modifications include adding one or more additional objects to a space outside the original image. In the case of video streams, one way to improve the confidence level in case of object identification is to embed one similar object and one dissimilar object into the additional space of the next video frame (assuming the objects are in a temporally close distance in the next captured frame).

[0034] After the computer vision accelerator engine processes the modified image, the safety monitor framework intercepts results sent from the computer vision accelerator engine to the safety-critical application (block 815). The safety monitor framework analyzes the results to determine the likelihood that the computer vision accelerator engine correctly processed the image (block 820). For example, in one embodiment, the safety monitor framework determines whether the results indicate that an invalid transformation or invalid feature extraction was performed. If the results of the modified processing on the image do not match the results provided in the test data, the safety monitor framework concludes that there is a relatively high likelihood that the computer vision accelerator incorrectly processed the original input image. In one embodiment, a relatively high likelihood that the computer vision accelerator incorrectly processed the image is represented by a relatively low confidence indicator (i.e., close to zero).

[0035] The safety monitor framework then generates a confidence indicator to specify the probability that the computer vision accelerator engine correctly processed the image (block 825). The safety monitor framework also modifies the results by filtering out results associated with modifications made to the original image (block 830). The safety monitor framework then communicates the confidence indicator and modified results back to the safety-critical application (block 835). After block 835, the method 800 ends.

[0036] In various embodiments, program instructions of a software application are used to implement the methods and / or mechanisms described herein. For example, program instructions executable by a general-purpose processor or a special-purpose processor are contemplated. In various embodiments, such program instructions may be expressed in a high-level programming language. In other embodiments, the program instructions may be compiled from the high-level programming language into a binary, intermediate, or other format. Alternatively, program instructions may be written that describe the operation or design of hardware. Such program instructions may be expressed in a high-level programming language such as C. Alternatively, a hardware design language (HDL) such as Verilog may be used. In various embodiments, the program instructions are stored on various non-transitory computer-readable storage media. The storage media are accessible by a computing system during use to provide the program instructions to the computing system for program execution. Generally, such a computing system includes at least one memory or memories and one or more processors configured to execute the program instructions.

[0037] It should be emphasized that the above-described embodiments are merely non-limiting examples of embodiments. Numerous variations and modifications will become apparent to those skilled in the art once the above disclosure is fully appreciated. It is intended that the following claims be interpreted to embrace all such variations and modifications.

Claims

1. Computer vision hardware and a safety monitor; The safety monitor receiving an input image and test data from a safety-critical application, the test data including indications of one or more objects previously correctly identified in image data by the computer vision hardware; generating a modified image by combining the one or more objects with the input image; communicating the modified image to the computer vision hardware; receiving results generated by the computer vision hardware in response to the computer vision hardware performing an object identification process on the modified image; generating a confidence indicator based on an analysis of the results, the confidence indicator representing a probability that the results are accurate; and configured to: system.

2. the system is configured to perform one or more corrective actions in response to the confidence indicator failing a threshold. The system of claim 1.

3. the one or more corrective actions include terminating the safety-critical application. The system of claim 2.

4. the safety monitor is configured to analyze the results to determine whether the one or more objects were correctly processed. The system of claim 1.

5. The safety monitor analyzing a previous input image to detect at least one object; adding the at least one object to an additional space outside the original boundary of the input image; generating the modified image from the input image and the additional space; configured to: The system of claim 1.

6. the input image is captured by a camera and corresponds to a stream of image data; The system of claim 1.

7. the confidence indicator indicates whether the computer vision hardware passed validation of the results, and the one or more objects are selected based on test data received from the safety-critical application. The system of claim 1.

8. a safety monitor receiving input images and test data from a safety-critical application, the test data including indications of one or more objects previously correctly identified in the image data by the computer vision hardware; generating a modified image by combining the one or more objects with the input image; communicating the modified image to the computer vision hardware; receiving results generated by the computer vision hardware in response to the computer vision hardware performing an object identification process on the modified image; the safety monitor generating a confidence indicator based on an analysis of the result, the confidence indicator representing a probability that the result is accurate. method.

9. the safety-critical application performing one or more corrective actions in response to the confidence indicator being below a threshold.

9. The method of claim 8.

10. the one or more corrective actions include terminating the safety-critical application.

10. The method of claim 9.

11. the safety monitor further analyzing the results to determine whether the one or more objects were processed correctly.

9. The method of claim 8.

12. the safety monitor analyzing a previously input image to detect at least one object; the safety monitor adding the at least one object to an additional space outside the original boundary of the input image; the safety monitor further generating the modified image from the input image and the additional space.

9. The method of claim 8.

13. the safety monitor receiving a first set of output data from the computer vision hardware; the safety monitor converting the first set of output data into a second set of output data; the safety monitor communicating the second set of output data to the safety-critical application.

9. The method of claim 8.

14. the confidence indicator indicates whether the computer vision hardware passed validation of the results, and the one or more objects are selected based on test data received from the safety-critical application.

9. The method of claim 8.

15. a memory for storing program instructions; at least one processor coupled to the memory; The program instructions, when executed by the at least one processor, receiving input images and test data from a safety-critical application running on one or more processing units, the test data including indications of one or more objects previously correctly identified in the image data by computer vision hardware; generating a modified image by combining the one or more objects with the input image; communicating the modified image to the computer vision hardware; receiving results generated by the computer vision hardware in response to the computer vision hardware performing an object identification process on the modified image; generating a confidence indicator based on an analysis of the results, the confidence indicator representing a probability that the results are accurate; and causing the at least one processor to execute Device.

16. the program instructions cause the at least one processor to perform one or more corrective actions in response to the confidence indicator being below a threshold.

16. The apparatus of claim 15.

17. the one or more corrective actions include terminating a safety-critical application; 17. The apparatus of claim 16.

18. the program instructions cause the at least one processor to analyze the results to determine whether the one or more objects were successfully processed.

16. The apparatus of claim 15.

19. The program instructions include: analyzing a previous input image to detect at least one object; adding the at least one object to an additional space outside the original boundary of the input image; generating the modified image from the input image and the additional space; causing the at least one processor to execute 16. The apparatus of claim 15.

20. The program instructions include: receiving a first set of output data from the computer vision hardware; transforming the first set of output data into a second set of output data; causing the at least one processor to execute 16. The apparatus of claim 15.

Images