Distributed Decider Mutex for Safety-Critical System Reliability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional safety-critical computer systems with decider devices are prone to failures, which can lead to overall system failure and violate safety objectives due to the decider device being logically connected in series with the channels, thereby increasing the error rate.
Innovation Solution
A method and computer system architecture where each channel has a separate decider device with a distributed mutex algorithm using a token to ensure only one channel's results are output, and the deciders are implemented as redundant systems to tolerate critical errors and maintain low error rates, with monitoring functions to detect health status and switch outputs accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single decider device is used to process results from redundant channels, then the system structure is simplified, but the overall system reliability deteriorates because the decider becomes a critical failure point
Solution Approach 1:
The patent divides the single decider device into multiple decider devices, with each decider responsible for a specific redundant channel. This segmentation eliminates the single point of failure in the decider, as each decider operates independently and can fail without affecting the other channels. The segmentation directly resolves the contradiction by improving reliability through distribution while maintaining manageable complexity.
Solution Approach 2:
The patent introduces a token-based mutex mechanism as an intermediary to coordinate between multiple deciders. The token acts as a mediator that ensures only one decider outputs results at a time, preventing concurrent errors while allowing the distributed architecture to function. This intermediary enables the system to achieve both distributed reliability and coordinated operation.
2Ease of operation
If decider devices are implemented in series with channels, then the control logic is simplified, but the error rate increases due to the cumulative effect of decider failures
Solution Approach 1:
The patent segments the series connection into parallel connections, where each channel has its own decider operating independently. This eliminates the cumulative error effect of series connection, as failures in one decider do not propagate to other channels. The segmentation transforms the error accumulation mechanism while maintaining clear control logic through independent decision-making units.
Solution Approach 2:
The patent implements preliminary health status monitoring and token-based coordination before results are output. Each decider checks the health status of its channel and coordinates with other deciders through the token mechanism before activating output. This preliminary action prevents faulty results from being propagated, reducing the effective error rate while maintaining straightforward control logic.
3Speed
If multiple channels output results concurrently, then the system responsiveness is improved, but the risk of concurrent errors increases
Solution Approach 1:
The patent introduces a token-based mutex mechanism as an intermediary to control concurrent access to the output. The token ensures that only one decider can output results at a time, eliminating the risk of concurrent errors while maintaining the ability to switch between channels quickly. This intermediary enables safe serialization of output operations without sacrificing the underlying parallel processing capability.
Solution Approach 2:
The patent implements periodic token passing between deciders, creating a structured sequence of output opportunities. Instead of allowing truly concurrent output, the system uses periodic token transfer to enable alternating output from different deciders. This periodic action maintains system responsiveness by ensuring frequent output opportunities while preventing concurrent error risks through structured sequential access.
Data Source
AI summary
A method for operating a safety-critical computer system which has at least two redundant channels for processing a calculation task. The channels generate results for the calculation task independently of one another. The health status of each individual channel is monitored separately. A separate decider for enabling or blocking output of the results is connected downstream of each channel. Depending on the health status of the channels, at most one of these channels is enabled for output of the results. It is ensured with the aid of a token that output of the results is blocked for all other channels.