Safety Controller Memory Protection for Mixed-Criticality Cores
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multicore processors pose a challenge in isolating safety and non-safety tasks in industrial controllers due to shared memory structures, which increases the risk of non-safety tasks corrupting safety tasks, limiting the effective use of multicore processors in integrated control systems.
Innovation Solution
A two-step runtime memory management unit (MMU) evaluation is implemented, where the non-safety core attempts to write to protected safety memory and reports failures to the safety core for final evaluation, using hardware interrupts and predetermined values to ensure accurate reporting and prevent corruption, thus placing the responsibility for MMU configuration and evaluation under the safety core.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multicore processors are used to execute both safety and non-safety tasks in an integrated control system, then productivity and processing capability are improved, but the risk of non-safety tasks corrupting safety tasks increases due to shared memory structures
Solution Approach 1:
The shared memory space is segmented into protected regions using hardware memory management units (MMUs) with page tables. Each core (safety and non-safety) is assigned specific memory regions it can access, while other regions are protected through hardware-enforced access control bits in the page tables. This segmentation allows both tasks to run concurrently on the same physical memory infrastructure while maintaining strict isolation boundaries.
Solution Approach 2:
The hardware memory management unit acts as an intermediary between the non-safety core and the safety memory regions. The MMU intercepts memory access requests, checks page table entries, and enforces access control policies. This intermediary mechanism prevents direct corruption of safety tasks by non-safety tasks while allowing controlled communication through designated shared memory regions.
2Reliability
If fully redundant hardware is provided to isolate safety and non-safety tasks, then reliability is improved, but device complexity and cost increase significantly
Solution Approach 1:
A single shared memory infrastructure serves both safety and non-safety tasks, eliminating the need for completely separate physical memory systems. The hardware memory management unit provides multi-functional access control, allowing the same physical memory to be securely shared between different task types through software-configurable protection mechanisms rather than requiring dedicated hardware for each task type.
Solution Approach 2:
Physical hardware isolation (mechanical separation of memory systems) is replaced with software-based memory management and hardware-enforced access control. Instead of using separate physical memory modules for safety and non-safety tasks, the system uses virtual memory management with page tables and access control bits that provide equivalent isolation guarantees through logical rather than physical separation.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
Hardware memory management units are used in an integrated safety/non-safety industrial computer to allow shared memory architecture processors to implement safety and non-safety reduced risk of memory corruption. Testing of the memory management unit of the non-safety processor may provide a periodic writing to protected memory to invoke a protection fault providing a report to the safety processor.