Dual Runtime System for Safety-Critical Application Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for safety-critical applications in machine environments face challenges in allowing parallel and independent operation of normal and secure programs without mutual interference, especially when changes are needed, which often require costly and cumbersome certification processes.
Innovation Solution
A dual run-time system structure is implemented, comprising a secure LZS and a normal LZS, each meeting specific safety requirements, allowing them to operate independently without a separate operating system, with the secure LZS activating the normal LZS and controlling priority levels to prevent safety compromises.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single certified secure run-time system is used for safety-critical applications, then safety reliability is improved, but system flexibility and ease of modification deteriorate due to costly re-certification requirements
Solution Approach 1:
The system is divided into two independent run-time systems: a secure LZS for safety-critical tasks and a normal LZS for non-critical tasks. Each run-time system operates independently with its own memory space and execution context, allowing modifications to the normal LZS without affecting the certified secure LZS. This segmentation enables flexibility in the normal system while maintaining safety certification for the critical system.
Solution Approach 2:
A monitoring component acts as an intermediary between the normal LZS and secure LZS, overseeing task switching and ensuring that the secure LZS maintains its safety integrity. The monitoring component verifies task identifiers and manages the transition between normal and secure execution modes, preventing unauthorized access or interference while allowing both systems to coexist on the same hardware platform.
2Reliability
If separate hardware systems are used for secure and normal applications, then safety isolation is improved, but device complexity and cost increase
Solution Approach 1:
Both the secure LZS and normal LZS are merged into a single microcontroller unit, sharing common hardware resources such as CPU cores, memory, and I/O interfaces. The secure LZS and normal LZS operate on the same physical platform but maintain logical separation through distinct memory spaces, task identifiers, and execution contexts. This merging reduces device complexity and cost while maintaining safety isolation through software-based security mechanisms.
3Device complexity
If a normal run-time system operates without a separate operating system, then device complexity is reduced, but ease of operation and control deteriorate
Solution Approach 1:
The secure LZS serves multiple functions: it executes safety-critical application programs, manages task scheduling for both secure and normal operations, controls task switching between normal and secure modes, and provides system monitoring capabilities. This multi-functional design eliminates the need for a separate operating system while maintaining ease of operation through the secure LZS's comprehensive control capabilities.
Data Source
AI summary
An apparatus and a method for the parallel and independent operation of a normal program and a secure program on the basis of a runtime system structure have all components that are relevant to the control integrated on a hardware component with a specific hardware architecture and be isolated from one another by a runtime system structure for two dual runtime systems for making changes to non-security-relevant components without restriction. The isolation can be provided by prioritizing one of the runtime systems. Such a runtime system structure or hardware architecture eliminates the need for follow-up certification of user-programmable controllers and the certification of the security-critical component is valid even when changes to the non-security-relevant components are made.