Passenger Conveyor Safety Controller With Secure Software Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing safety devices in building-related passenger conveyor systems face challenges in maintaining a simple structure while ensuring secure software updates and protecting against unauthorized access.
Innovation Solution
A safety device with a microcontroller having separate processor cores and memory regions for safety and update modules, along with a hypervisor to manage access and communication, ensures secure software updates by allowing only the update module to modify the safety module, using encryption and authentication to verify the source and integrity of software packages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an external interface is added to allow remote software updates, then the ability to update software externally is improved, but the security risk of unauthorized access increases
Solution Approach 1:
The microcontroller is divided into separate processor cores: a first processor core for executing safety module code and a second processor core for executing update module code. This segmentation isolates the update function from safety-critical operations, allowing external updates while protecting safety functions from unauthorized access or corruption during the update process.
Solution Approach 2:
A hypervisor is introduced as an intermediary layer between the external communication interface and the safety module. The hypervisor manages access requests, validates update packages through authentication and decryption, and controls the update process, thereby preventing unauthorized direct access to safety-critical code while enabling legitimate remote updates.
2Object-affected harmful factors
If security measures such as authentication and encryption are implemented, then the protection against unauthorized access is improved, but the device complexity increases
Solution Approach 1:
Multiple security functions (authentication, encryption/decryption, integrity verification) are merged into the update module that runs on a separate processor core. This consolidation allows comprehensive security measures to be implemented without adding separate complex security subsystems, as all security operations are handled by a single dedicated module with access to necessary cryptographic keys and algorithms.
3Reliability
If separate processor cores and memory regions are used for safety and update modules, then the security and reliability of safety functions are improved, but the device complexity increases
Solution Approach 1:
The microcontroller architecture is segmented into distinct processor cores and memory regions: a first processor core exclusively for safety module execution, a second processor core for update module execution, separate memory regions for safety module code and update module code, and protected storage for cryptographic keys. This segmentation ensures that update operations cannot interfere with or compromise safety-critical code, providing strong isolation guarantees.
Solution Approach 2:
The patent introduces a new dimension of isolation by using multiple processor cores running in parallel, rather than relying on time-multiplexing or software-based protection on a single core. This spatial separation in the processor dimension provides hardware-level guarantees that update operations cannot corrupt safety module execution, enhancing reliability while maintaining a manageable architectural complexity through systematic organization.
Data Source
AI summary
A safety device for a building-related passenger transport system includes a microcontroller having a memory, a processor and a communication interface. A safety module is stored in the memory and, when it is executed on the processor, receives safety-relevant signals from components of the passenger conveyor system, evaluates the signals with regard to a safety problem and transmits a warning signal to a controller of the passenger conveyor system in the event of a safety problem. An update module is stored in the memory and, when it is executed on the processor, receives a software package via the communication interface and updates at least parts of the safety module with the software package. The microcontroller is configured such that the safety module is able to be amended only by the update module.