Variable Memory Diagnostics Without Reboot in Safety-Critical Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for diagnostic checking of variable memory in safety critical systems, such as fire safety systems, are inadequate as they either require system reboot or fail to diagnose all memory regions due to occupied memory spaces by the operating system and applications, not meeting standards like Safety Integrity Level (SIL) according to IEC 61508.
Innovation Solution
A method that suspends the operating system's scheduler and switches the CPU execution context to internal volatile memory to check all memory spaces of external volatile memory, allowing uninterrupted operation and compliance with safety standards by using a memory checking algorithm with diagnostic code and data in internal volatile memory, enabling full memory space diagnosis without system interruption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If memory diagnostics are run from outside the operating system (e.g., MemTest86), then complete memory coverage is achieved, but system reboot is required which interrupts safety critical applications
Solution Approach 1:
The diagnostic code is loaded into internal volatile memory before the diagnostic check begins, preparing the execution environment in advance. This allows the CPU to switch to internal memory for executing diagnostics without requiring external memory access during the actual diagnostic operation, enabling uninterrupted diagnostics during system operation.
Solution Approach 2:
The internal volatile memory acts as an intermediary execution environment between the external variable memory being tested and the CPU. By switching CPU execution context to internal memory, the system can run diagnostics on external memory regions that would otherwise be occupied by operating system or application data, achieving complete coverage without system interruption.
2Productivity
If memory diagnostics use the operating system environment (e.g., COMeT), then system availability is maintained, but complete memory coverage is not achieved due to occupied memory regions
Solution Approach 1:
The CPU execution context is dynamically switched between external and internal memory based on diagnostic requirements. During normal operation, the CPU uses external memory for operating system and applications. During diagnostics, the CPU switches to internal memory for execution while testing external memory regions, allowing complete coverage without sacrificing system availability.
Solution Approach 2:
The memory system is segmented into external volatile memory for data storage and internal volatile memory for diagnostic code execution. This segmentation allows the diagnostic code to reside in internal memory while testing all regions of external memory, including those occupied by operating system and applications, thereby achieving complete coverage while maintaining system operation.
3Reliability
If memory address spaces are modified for diagnostic purposes, then diagnostic capability is improved, but special handling requirements increase system complexity
Solution Approach 1:
Instead of modifying external memory address spaces, the diagnostic code and test data are copied to internal volatile memory. The CPU then executes diagnostics from internal memory against external memory regions, avoiding the need to modify or specially handle external memory address spaces while still achieving complete diagnostic coverage.
Data Source
AI summary
A method is provided for diagnostic checking of a variable memory 14 in a safety critical system in order to detect variable memory failures; wherein the safety critical system comprises a central processing unit (CPU) with an operating system, an internal volatile memory 12 and an external volatile memory 14 including the variable memory 14; and the CPU can access a plurality of address spaces including one or more address spaces of the external volatile memory 14 that are utilised by the operating system and/or by a safety critical application of the safety critical system during normal use of the safety critical system.