Module Health Circuit for Safety-Critical System Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Fault-tolerant failsafe computer systems in safety-critical applications, such as railway systems, face challenges in validating instructions to prevent erroneous actions due to faulty components, necessitating a robust validation mechanism to ensure safety standards are met.
Innovation Solution
A module health system that includes a hardware register, application register, and watchdog timer register, which are initialized and updated based on system tests and health determinations, allowing the CPU to de-assert a module health signal only if all registers indicate a healthy state, thereby preventing unsafe instructions from being executed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a fault-tolerant failsafe computer system is implemented with multiple validation layers, then system safety and reliability are improved, but device complexity increases
Solution Approach 1:
The validation mechanism is segmented into three distinct registers: a hardware register for POST validation, an application register for safety critical system validation, and a watchdog timer register for operational monitoring. Each register independently tracks specific aspects of system health, allowing the CPU to validate instructions through a structured multi-layer approach rather than a monolithic complex system.
Solution Approach 2:
The module health circuit acts as an intermediary between the CPU and safety critical hardware/software. It mediates instruction execution by checking the status of multiple registers and controlling the module health signal, thereby preventing erroneous instructions from reaching safety critical components without requiring the CPU to directly implement complex validation logic.
2Measurement precision
If multiple registers and validation checks are implemented, then measurement precision of system health status is improved, but device complexity increases
Solution Approach 1:
System health monitoring is divided into three distinct measurement domains, each represented by a separate register: hardware-level POST results, application-level safety critical system status, and operational-level watchdog timer state. This segmentation allows precise monitoring of each layer independently while maintaining a manageable overall structure.
Solution Approach 2:
The system uses multiple register copies to track system health status from different perspectives. Each register contains a simplified status indicator (first value or second value) that mirrors the state of its corresponding validation layer, allowing the CPU to make validation decisions based on these copied status representations rather than directly analyzing complex system states.
3Loss of information
If the system validates all instructions before execution, then loss of information from faulty components is prevented, but productivity decreases due to validation overhead
Solution Approach 1:
Validation actions are performed preliminarily during system initialization and operation. The hardware register is set during POST before the system begins normal operation, the application register is configured when safety critical systems are initialized, and the watchdog timer is started upfront. This preliminary setup allows rapid validation during instruction execution without repeated complex checks.
Solution Approach 2:
The module health circuit and registers operate autonomously to validate instructions. The CPU sets the registers based on validation results, and the module health circuit automatically monitors register values and controls the module health signal without requiring continuous CPU intervention. This self-service mechanism reduces the validation overhead on the CPU and maintains high instruction execution speed.
Data Source
AI summary
A module health system includes a module health circuit comprising a hardware register that is set to a first value in response to the system starting, an application register that is set to the first value in response to the system starting and a watchdog timer register that is set to the first value in response to the system starting. The system further includes a power on self-test that determines whether the system has passed a plurality of tests and that selectively sets the hardware register to a second value based on the determination, an external software application that determines whether a safety critical system is healthy and selectively sets the application register based on the determination, a watchdog timer application that selectively sets the watchdog timer register, a central processing unit that determines whether to de-assert a module health signal.