34 results about "Safety critical application" patented technology

A method of executing a safety-critical application (130) on a hardware platform (100) is proposed. The method includes executing, on the hardware platform (100), a hypervisor (115); instantiating, by the hypervisor (115), an execution environment (120); executing, in the execution environment (120), an operating system having a kernel (125, 125a); executing, in the execution environment (120), on the operating system, the safety-critical application (130) on a privilege level that is lower than that of the kernel (125, 125a); executing, by the safety-critical application (130), a system call instruction of the kernel (125, 125a) that diverts the control flow to a first-level handler (127) in the kernel (125, 125a) with the goal of invoking, by a particular intended system call, a functionality provided by the kernel (125, 125a); further diverting, by the processor core (112a, 112b), the control flow to a second-level handler (119) in the hypervisor (115); passing, by the second-level handler (119), the intended system call to a supervisor component (150); and checking, by the supervisor component (150), operations to be performed by the intended system call against a predetermined ruleset, so as to allow or disallow the system call.

Aspects of the disclosure relate to an integrated circuit that operates temperature or fault monitoring of one or more electronic components. An apparatus may include a first temperature sensor and a second temperature sensor at different locations. The first temperature sensor and the second temperature sensor may be positioned at different locations in order to have a comparative numeric relationship that is indicative of whether there is a fault in an electronic component during a baseline period.

Aspects of the disclosure are directed to voltage sensing for safety-critical applications. In accordance with one aspect, the disclosure includes a multi-phase ring oscillator (RO) configured to operate in a first voltage domain; a frequency counter coupled to the multi-phase RO, the frequency counter configured to accumulate a plurality of phase cycles from the multi-phase RO over a time duration to generate a digital count word; an alarm processor coupled to the frequency counter, the alarm processor configured to receive an alarm state signal from the frequency counter; and a heartbeat detector coupled to the multi-phase RO, the heartbeat detector configured to operate in a second voltage domain and configured to detect a periodic recurrence of a heartbeat pulse to determine an integrity of the sensor function as a whole and alarm state signal in particular.

The invention discloses an ambiguity deviation vector classification and probability decoupling collaborative protection level construction method and device, and belongs to the technical field of integrity monitoring. The method comprises the following steps: firstly, constructing a model of a positioning error under a fixed solution, then constructing an initial protection level model based on a Bayesian formula, then performing protection level parameter decoupling by utilizing an ambiguity deviation vector probability, classifying deviation vectors according to a modulus length, calculating a modulus length boundary value, and finally obtaining a protection level parameter; and finally, calculating a final protection level based on decoupling and classification results. According to the method, the influence of ambiguity error fixation on the protection level can be quantified, and the requirements of safety critical applications on reliability and interpretability are met.

Methods and articles of manufacture for hosting a safety critical application on an uncontrolled data processing device are provided. Various checks and combinations of checks including installation, functional, host integrity, coexistence, interoperability, power management, and environment checks are performed at various times to determine if the safety critical application operates properly on the device. The operation of the SCA on the UDPD may be controlled accordingly.

A method of executing a safety-critical application (150) on a hardware platform (100) is proposed. The method includes executing, on the hardware platform (100), a hypervisor (120) with a monitoring component (130) for the safety-critical application (150), instantiating, by the hypervisor (120), at least one virtual machine (140) on a lower privilege level of the hardware platform than a privilege level of the hypervisor (120), providing a list of one or more predefined actions that, when executed by the processor core (112a, 112b), have a relevancy for an integrity and / or a functioning of the safety-critical application (150). The method further includes instructing, by the hypervisor (120), the processor core (112a, 112b) to when about to execute a to-be-performed action on the list, divert the control flow towards a respective handler (132) for this to-be-performed action in the monitoring component (130), and executing, in the at least one virtual machine (140), at least the safety-critical application (150) on top of a guest operating system (142). Further, a check whether to allow or disallow the action can be performed and / or at least one preparation for the to-be-performed action may be performed.

A system and method for integrity monitoring on a heterogeneous system-on-a-chip (SoC) processing environment provides sets of dynamic input data to integrity applications running on one or more application cores (e.g., where safety critical applications are hosted) which generate an integrity output according to function / instruction sets. The dynamic input data is also provided to an integrity monitor running on a dissimilar integrity core (e.g., different architecture and / or other core type than the application cores) which receives the integrity output from the application cores and generates its own integrity result based on the same function sets and the same dynamic input data. The integrity monitor compares the local integrity result to the integrity outputs received from the application cores. If the integrity outputs deviate from the integrity result, the integrity core initiates a fault response, which may include resetting the deviant application core, all application cores, or the full SoC environment.

Embodiments of the present invention provide automated robotic system identification and stopping time and distance estimation, significantly improving on existing ad-hoc methods of robotic system identification. Systems and methods in accordance herewith can be used by end users, system integrators, and the robot manufacturers to estimate the dynamic parameters of a robot on an application-by-application basis.

The invention relates to chip temperature monitoring for safety critical applications. Aspects of the present disclosure relate to an integrated circuit that operates temperature or fault monitoring of one or more electronic components. An apparatus may include a first temperature sensor and a second temperature sensor at different locations. The first temperature sensor and the second temperature sensor may be positioned at different locations so as to have a comparison value relationship indicating whether there is a fault in the electronic component during a baseline period.

The invention relates to a computer-implemented method for operating a vehicle system (1), comprising the following steps: - Calling (S2) a security mechanism when a security objective is violated (S1), - If an error is detected (S4) in the execution of the security mechanism, calling a backup security mechanism associated with the security objective; - If a fault is detected in the backup safety mechanism, bring the vehicle system into a safe state; - Preventing (S12) the invocation of the backup security mechanism depending on an activation limit specification associated with the violated security objective.

A method of executing a safety-critical application (130) on a hardware platform (100) is proposed. The method includes executing, on the hardware platform (100), a hypervisor (115); instantiating, by the hypervisor (115), an execution environment (120); executing, in the execution environment (120), an operating system having a kernel (125, 125a); executing, in the execution environment (120), on the operating system, the safety-critical application (130) on a privilege level that is lower than that of the kernel (125, 125a); executing, by the safety-critical application (130), a system call instruction of the kernel (125, 125a) that diverts the control flow to a first-level handler (127) in the kernel (125, 125a) with the goal of invoking, by a particular intended system call, a functionality provided by the kernel (125, 125a); further diverting, by the processor core (112a, 112b), the control flow to a second-level handler (119) in the hypervisor (115); passing, by the second-level handler (119), the intended system call to a supervisor component (150); and checking, by the supervisor component (150), operations to be performed by the intended system call against a predetermined ruleset, so as to allow or disallow the system call.

In some aspects, a device includes: a first processing unit; a first power distribution network coupled to the first processing unit; a first decoupling capacitor coupled to the first power distribution network; a second processing unit configured to be the same as the first processing unit; a second power distribution network coupled to the second processing unit; and a second decoupling capacitor coupled to the second power distribution network, wherein the second decoupling capacitor is configured to have an effect on the second power distribution network that is different from the effect of the first decoupling capacitor on the first power distribution network.

Aspects of the disclosure are directed to voltage sensing for safety-critical applications. In accordance with one aspect, the disclosure includes a multi-phase ring oscillator (RO) configured to operate in a first voltage domain; a frequency counter coupled to the multi-phase RO, the frequency counter configured to accumulate a plurality of phase cycles from the multi-phase RO over a time duration to generate a digital count word; an alarm processor coupled to the frequency counter, the alarm processor configured to receive an alarm state signal from the frequency counter; and a heartbeat detector coupled to the multi-phase RO, the heartbeat detector configured to operate in a second voltage domain and configured to detect a periodic recurrence of a heartbeat pulse to determine an integrity of the sensor function as a whole and alarm state signal in particular.

A system-on-chip may include application processing cores which execute safety critical applications and an integrity application. The system-on-chip may also include integrity processing cores which execute an integrity monitor. The integrity monitor may compare integrity application outputs and integrity monitor outputs to detect if the processing cores have experienced a common mode fault. The integrity processing cores may perform temporal monitoring to accommodate time-asynchronization's between the application processing cores and the integrity processing cores.

The present invention relates to a computer-implemented method for operating a vehicle system (1), the method comprising the following steps: - when a security objective (S1) is violated, a security mechanism (S2) is invoked; - when a fault (S4) is detected during the execution of the security mechanism, a backup security mechanism assigned to the security objective is invoked; - when a fault is detected in the backup security mechanism, the vehicle system is brought into a safe state; - according to an activation restriction description associated with the violated security objective, the invocation of the backup security mechanism is prevented (S12).

A method of executing a security critical application (150) on a hardware platform (100) is presented. The method comprises: executing a virtual machine monitoring program (120) having a monitoring component (130) for a security critical application (150) on a hardware platform (100); instantiating at least one virtual machine (140) by a privilege level of the virtual machine monitoring program (120) hardware platform that is lower than the privilege level of the virtual machine monitoring program (120); a list of one or more predefined actions is provided that, when executed by the processor core (112a, 112b), have relevance to the integrity and / or operation of the safety critical application (150). The method further comprises instructing, by the virtual machine monitoring program (120), the processor core (112a, 112b) to divert the control flow towards a respective handler (132) in the monitoring component (130) for the action to be performed when the action to be performed is about to be performed on the list; and executing at least the security critical application (150) over the guest operating system (142) in the at least one virtual machine (140). Further, a check of whether the action is allowed or not allowed may be performed, and / or at least one preparation for the action to be performed may be performed.

The invention relates to a computer-implemented method for operating a vehicle system (1), comprising the following steps: - invoking (S2) a safety mechanism if a safety objective is violated (S1); - if an error in the execution of the safety mechanism is detected (S4), invoking a backup safety mechanism associated with the safety objective; - if an error in the backup safety mechanism is detected, bringing the vehicle system into a safe state; - preventing (S12) the backup safety mechanism from being invoked depending on an activation limit specification associated with the violated safety objective.

Disclosed is a multi-core processor with first 202, second cores 204 and a comparator 210. Each core is capable of running both safety-critical and non-safety-critical applications and each core has

The present invention relates to a sensor system for safety-critical applications comprising at least one sensor device, which includes a sensor for measuring a physical parameter and generating a corresponding signal, a signal processing chain for processing this signal, and an interface for handling an external synchronization signal. The device also features a transient signal generator that produces a transient and a coupling element for introducing the transient signal into the signal processing chain's input such that the transient signal which is coupled to the signal processing chain has a predetermined relation with the synchronization signal. This configuration allows for the detection of errors within the sensor device and / or calibration of the sensor system by measuring the time difference between the synchronization signal and the detection moment of the transient signal.

A system and method for integrity monitoring on a heterogeneous system-on-a-chip (SoC) processing environment provides sets of dynamic input data to integrity applications running on one or more application cores (e.g., where safety critical applications are hosted) which generate an integrity output according to function / instruction sets. The dynamic input data is also provided to an integrity monitor running on a dissimilar integrity core (e.g., different architecture and / or other core type than the application cores) which receives the integrity output from the application cores and generates its own integrity result based on the same function sets and the same dynamic input data. The integrity monitor compares the local integrity result to the integrity outputs received from the application cores. If the integrity outputs deviate from the integrity result, the integrity core initiates a fault response, which may include resetting the deviant application core, all application cores, or the full SoC environment.

A method of executing a security critical application on a hardware platform (100) is presented. The method comprises: executing a safety critical application (130) in a first execution environment (120); executing a supervisor component (150) for the safety critical application in a second execution environment (140); at least a transition of control flow between the safety critical application (130) and other software (125, 125a, 125b) running in the first execution environment (120) is detected by the supervisor component (150). The method further includes, in response to detecting that the control flow is transitioning from the security critical application (130) to the other software (125, 125a, 125b), disabling, by the supervisor component (150), at least one mode of access to and / or capturing a state of at least one resource (114), and, in response to detecting that the control flow is transitioning from the other software (125, 125a, 125b), disabling, by the supervisor component (150), at least one mode of access to and / or capturing a state of the at least one resource (114). 125b) back to the security critical application (130), allowing re-access to the at least one resource (114) and / or verifying the state.

Aspects of the disclosure are directed to voltage sensing for safety-critical applications. In accordance with one aspect, the disclosure includes generating an alarm state signal from a digital count word and a comparator state signal; generating a heartbeat signal by dividing down one of a plurality of multi-phase ring oscillator (RO) output waveforms; and generating an error interrupt signal and a warning interrupt signal in a voltage domain based on the alarm state signal and the heartbeat signal.

A method of executing a safety-critical application (150) on a hardware platform (100) is proposed. The method includes executing, on the hardware platform (100), a hypervisor (120) with a monitoring component (130) for the safety-critical application (150), instantiating, by the hypervisor (120), at least one virtual machine (140) on a lower privilege level of the hardware platform than a privilege level of the hypervisor (120), providing a list of one or more predefined actions that, when executed by the processor core (112a, 112b), have a relevancy for an integrity and / or a functioning of the safety-critical application (150). The method further includes instructing, by the hypervisor (120), the processor core (112a, 112b) to when about to execute a to-be-performed action on the list, divert the control flow towards a respective handler (132) for this to-be-performed action in the monitoring component (130), and executing, in the at least one virtual machine (140), at least the safety-critical application (150) on top of a guest operating system (142). Further, a check whether to allow or disallow the action can be performed and / or at least one preparation for the to-be-performed action may be performed.

The invention discloses a heterogeneous V2X real-time SM2 authentication method, a heterogeneous V2X real-time SM2 authentication system and heterogeneous V2X real-time SM2 authentication equipment based on GPU acceleration. According to the method, kernel resources are statically partitioned, 22-core CPU / GPU computing units are distributed to a safety-critical application layer and a non-safety-critical application layer respectively, and equivalent resource isolation and load balancing are achieved. And an SM2 signature and verification module is independently deployed in each isolation domain, so that core competition and cache interference are avoided, and respective time delay controllability and throughput stability are improved. According to the method, an independent security processing framework of security-critical and non-security-critical messages in a V2X system is realized by hatching a non-security-critical application sub-layer in a WAVE application layer, combining an SM2 / SM3 algorithm and applying a static kernel division technology. On the premise of ensuring the safety and the real-time performance, the requirements of two scenes of low time delay and high throughput are effectively considered, and a practical reference is provided for the large-scale deployment of the SM2 signature technology for the Internet of Vehicles.

The invention discloses an integrated circuit. The integrated circuit can operate voltage monitoring of one or more electronic components using a grading technique. An apparatus may include a digital controller implemented in a hierarchical structure that may be instantiated closer to a set of sensors that are then indirectly monitored by other digital controllers.

Methods and articles of manufacture for hosting a safety critical application on an uncontrolled data processing device are provided. Various combinations of installation, functional, host integrity, coexistence, interoperability, power management, and environment checks are performed at various times to determine if the safety critical application operates properly on the device. The operation of the SCA on the UDPD may be controlled accordingly.

A system-on-chip may include application processing cores which execute safety critical applications and an integrity application. The system-on-chip may also include integrity processing cores which execute an integrity monitor. The integrity monitor may compare integrity application outputs and integrity monitor outputs to detect if the processing cores have experienced a common mode fault. The integrity processing cores may perform temporal monitoring to accommodate time-asynchronization's between the application processing cores and the integrity processing cores.

The invention relates to a control unit having a secure software component (12a) and a hardware component (14) for carrying out control and / or monitoring functions for security-critical applications in automation technology, wherein the hardware component (14) is designed to output functional and diagnostic information. The hardware component (14) is not secure, in particular is not certified or checked, wherein the secure software component (12a) has a secure interface (16) and secure functional modules (FB-s) in order to communicate with the non-secure hardware component (14) and to read out the functional and diagnostic information, wherein the secure functional modules (FB-s) are designed to check the functional information for errors using the diagnostic information and to output security-related functional information in order to form a security controller (15a) for securely carrying out the control and / or monitoring functions.