13 results about "Safety critical application" patented technology

Methods and articles of manufacture for hosting a safety critical application on an uncontrolled data processing device are provided. Various checks and combinations of checks including installation, functional, host integrity, coexistence, interoperability, power management, and environment checks are performed at various times to determine if the safety critical application operates properly on the device. The operation of the SCA on the UDPD may be controlled accordingly.

Embodiments of the present invention provide automated robotic system identification and stopping time and distance estimation, significantly improving on existing ad-hoc methods of robotic system identification. Systems and methods in accordance herewith can be used by end users, system integrators, and the robot manufacturers to estimate the dynamic parameters of a robot on an application-by-application basis.

The present invention relates to a computer-implemented method for operating a vehicle system (1), the method comprising the following steps: - when a security objective (S1) is violated, a security mechanism (S2) is invoked; - when a fault (S4) is detected during the execution of the security mechanism, a backup security mechanism assigned to the security objective is invoked; - when a fault is detected in the backup security mechanism, the vehicle system is brought into a safe state; - according to an activation restriction description associated with the violated security objective, the invocation of the backup security mechanism is prevented (S12).

A method of executing a security critical application (150) on a hardware platform (100) is presented. The method comprises: executing a virtual machine monitoring program (120) having a monitoring component (130) for a security critical application (150) on a hardware platform (100); instantiating at least one virtual machine (140) by a privilege level of the virtual machine monitoring program (120) hardware platform that is lower than the privilege level of the virtual machine monitoring program (120); a list of one or more predefined actions is provided that, when executed by the processor core (112a, 112b), have relevance to the integrity and / or operation of the safety critical application (150). The method further comprises instructing, by the virtual machine monitoring program (120), the processor core (112a, 112b) to divert the control flow towards a respective handler (132) in the monitoring component (130) for the action to be performed when the action to be performed is about to be performed on the list; and executing at least the security critical application (150) over the guest operating system (142) in the at least one virtual machine (140). Further, a check of whether the action is allowed or not allowed may be performed, and / or at least one preparation for the action to be performed may be performed.

A method of executing a security critical application on a hardware platform (100) is presented. The method comprises: executing a safety critical application (130) in a first execution environment (120); executing a supervisor component (150) for the safety critical application in a second execution environment (140); at least a transition of control flow between the safety critical application (130) and other software (125, 125a, 125b) running in the first execution environment (120) is detected by the supervisor component (150). The method further includes, in response to detecting that the control flow is transitioning from the security critical application (130) to the other software (125, 125a, 125b), disabling, by the supervisor component (150), at least one mode of access to and / or capturing a state of at least one resource (114), and, in response to detecting that the control flow is transitioning from the other software (125, 125a, 125b), disabling, by the supervisor component (150), at least one mode of access to and / or capturing a state of the at least one resource (114). 125b) back to the security critical application (130), allowing re-access to the at least one resource (114) and / or verifying the state.

Aspects of the disclosure are directed to voltage sensing for safety-critical applications. In accordance with one aspect, the disclosure includes generating an alarm state signal from a digital count word and a comparator state signal; generating a heartbeat signal by dividing down one of a plurality of multi-phase ring oscillator (RO) output waveforms; and generating an error interrupt signal and a warning interrupt signal in a voltage domain based on the alarm state signal and the heartbeat signal.

Methods and articles of manufacture for hosting a safety critical application on an uncontrolled data processing device are provided. Various combinations of installation, functional, host integrity, coexistence, interoperability, power management, and environment checks are performed at various times to determine if the safety critical application operates properly on the device. The operation of the SCA on the UDPD may be controlled accordingly.

The invention relates to a control unit having a secure software component (12a) and a hardware component (14) for carrying out control and / or monitoring functions for security-critical applications in automation technology, wherein the hardware component (14) is designed to output functional and diagnostic information. The hardware component (14) is not secure, in particular is not certified or checked, wherein the secure software component (12a) has a secure interface (16) and secure functional modules (FB-s) in order to communicate with the non-secure hardware component (14) and to read out the functional and diagnostic information, wherein the secure functional modules (FB-s) are designed to check the functional information for errors using the diagnostic information and to output security-related functional information in order to form a security controller (15a) for securely carrying out the control and / or monitoring functions.

A method of executing a safety-critical application (150) on a hardware platform (100) is proposed. The method includes executing, on the hardware platform (100), a hypervisor (120) with a monitoring component (130) for the safety-critical application (150), instantiating, by the hypervisor (120), at least one virtual machine (140) on a lower privilege level of the hardware platform than a privilege level of the hypervisor (120), providing a list of one or more predefined actions that, when executed by the processor core (112a, 112b), have a relevancy for an integrity and / or a functioning of the safety-critical application (150). The method further includes instructing, by the hypervisor (120), the processor core (112a, 112b) to when about to execute a to-be-performed action on the list, divert the control flow towards a respective handler (132) for this to-be-performed action in the monitoring component (130), and executing, in the at least one virtual machine (140), at least the safety-critical application (150) on top of a guest operating system (142). Further, a check whether to allow or disallow the action can be performed and / or at least one preparation for the to-be-performed action may be performed.

Each core of a multi-core processor is capable of running both safety-critical and non-safety-critical applications. The first core is configured to send a request to the second core to enter into a lock mode to execute the safety-critical application in parallel with the first core. A comparator receives inputs from the first core and the second core and compares the inputs. The second core drives the comparator into a transition state; stops execution of a first application running on the second core; saves data from the second core to memory associated with the second core; and sends an acknowledgment back to the first core in response to the request. The first core, in response to receiving the acknowledgement signal, is further configured to enable the execution of the safety-critical application by both cores in lock mode by configuring the memory and the comparator.

A system and method for creating a verifiable, non-repudiable audit log of an autonomous system's ethical decision-making, solving the “black-box” problem for safety-critical applications. The system integrates a Trusted Execution Environment (TEE) with a Hierarchical Constraint Logic Processor (HCLP). The TEE's integrity is verified using a decentralized remote attestation (RA) state measurement incorporating a measurement from an intrinsic Physically Unclonable Function (PUF), which provides a hardware root of trust. The HCLP applies tiered constraints to select a control maneuver with the lowest calculated harm score from a set of potential outcomes. The system generates a novel, verifiable log entry that cryptographically binds the RA state measurement to the calculated harm scores of all rejected control maneuvers. This counterfactual log is immutably anchored into a Cryptographic Audit Log Service using a Merkle Tree, generating a non-repudiable Cryptographic Audit Certificate (CAC) for definitive, post-facto regulatory verification.