Verification Circuit for Critical Software Execution Faults
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing fault detection mechanisms in critical software execution units are limited by resource allocation, interdependence issues, and delayed failure detection, as well as inability to detect defects in execution sequences defined by high-level properties, leading to potential failures in deterministic execution.
Innovation Solution
A circuit that verifies the temporal progress of task execution using a synchronization signal and an execution graph, maintaining a time base for reference, checking compliance with deadlines, and generating error messages for invalid paths or excessive execution times, allowing for independent operation and dynamic granularity in fault detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a software module is implemented within the execution unit to detect failures, then failure detection capability is improved, but processing and memory resources are consumed from the execution unit
Solution Approach 1:
The system is divided into two independent parts: the execution unit that runs applications and a separate verification circuit that monitors execution. The verification circuit has its own resources independent of the execution unit, so it can perform failure detection without consuming processing or memory resources from the execution unit.
Solution Approach 2:
A separate verification circuit acts as an intermediary between the execution unit and the monitoring function. This intermediary captures execution information through interfaces without directly interfering with the execution unit's resource allocation, enabling failure detection while preserving execution unit resources.
2Reliability
If a detection module is implemented within the execution unit, then failure detection is enabled, but failure detection time is delayed due to interdependence
Solution Approach 1:
The verification circuit is segmented as a separate entity from the execution unit, with independent operation and resource allocation. This independence allows the verification circuit to monitor execution and detect failures without being affected by execution unit performance variations, ensuring timely failure detection.
3Reliability
If execution unit register errors occur, then both application and detection module read bad values, but the patent uses separate verification circuit to avoid this
Solution Approach 1:
The verification circuit serves as an intermediary that obtains execution information through controlled interfaces rather than directly accessing execution unit registers. This intermediary approach prevents propagation of register errors from the execution unit to the detection system, as the verification circuit processes information through verified channels.
Solution Approach 2:
The verification circuit creates a separate copy of execution information through interfaces rather than sharing the same physical registers. This copying mechanism ensures that errors in execution unit registers do not directly affect the verification circuit's reading capability, as it operates on replicated or interfaced data.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
The subject of the invention is a circuit (601) for verifying the temporal running of the execution of at least one task by an execution unit (600) operating in tempo with a synchronization signal and independent of said circuit, the normal execution of the at least one task being described by an execution graph comprising nodes representing the states of execution of the task and transition arcs. The verifying circuit comprises a mechanism for maintaining a time base Te up to date, serving as reference for the temporal verification, said signal being representative of the tempo of the synchronization signal, the circuit furthermore comprising a mechanism verifying that the path through the graph resulting from the execution of at least one task is valid, an error message being generated if such is not the case.