Redundant Computer Safety Protocol for Divergent Output Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Redundant processing systems in transportation, such as automatic urban trains, face safety issues due to potential inconsistencies between backup computers, which can lead to unsafe conditions if the backup computer takes over, as it may not have a consistent view of the environment and can issue more permissive outputs than the primary computer.
Innovation Solution
A secure redundancy management protocol that detects contextual inconsistencies between two intrinsically safe computers, allowing only one computer to take over if the other issues more permissive outputs, ensuring safety by maintaining restrictive states for critical outputs and allowing flexible safety checks primarily downstream of the application level, eliminating the need for input equality checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a redundant configuration with two computers is implemented to tolerate faults, then system availability is improved, but safety problems arise due to potential inconsistency between the primary and backup computers
Solution Approach 1:
The patent implements a feedback mechanism where the primary computer continuously monitors the backup computer's outputs. When the primary computer detects that the backup computer has issued more permissive outputs than calculated, it triggers a safety response by preventing the backup computer from taking over, thus maintaining system safety while preserving redundancy benefits
Solution Approach 2:
The patent introduces an intermediary safety mechanism that acts as a mediator between the primary and backup computers. This intermediary monitors contextual inconsistencies and controls the takeover authorization, ensuring that the backup computer can only take over when safety conditions are met, thereby resolving the contradiction between availability and safety
2Reliability
If strict equality checks are performed on inputs and outputs between redundant computers, then safety is improved, but system complexity and operational constraints increase
Solution Approach 1:
The patent applies local quality by performing verification only on critical safety outputs rather than all outputs uniformly. The system focuses verification efforts on outputs that have safety implications, while allowing flexibility in non-critical outputs, thus reducing overall verification complexity while maintaining safety
Solution Approach 2:
The patent implements partial verification by checking only the necessary safety-critical aspects of computer outputs rather than performing complete equality checks on all outputs. This partial action approach maintains safety guarantees for critical functions while reducing the burden of verification complexity
Data Source
AI summary
A secure system has two computers that are intrinsically safe and implements a method for verifying the redundancy for the outputs where a very high level of safety is required. The method makes it possible to handle inconsistencies in the outputs of the two computers when they are working in redundant mode. Each computer receives the output states determined by the other computer and compares them to states calculated. A state of divergent operation is detected if the computers have determined two different states for a single output. If a divergence is detected for at least one output, the state of that output is determined by preventing any transition from a restrictive state to a permissive state.