Functional Safety Execution via Virtual Processor Redundancy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing functional safety techniques for electronic systems, particularly in industrial robotics and automotive applications, face challenges in achieving high diagnostic coverage without modifying hardware, especially on complex multiprocessor architectures, where prior methods are limited in detecting processor failures and require significant design efforts or hardware modifications.
Innovation Solution
The method involves decomposing programs into parallel sub-programs and partitioning self-testing operations into diagnostic-self-testing, system-value monitoring, and intermediate result comparison, generating self-test data, and exchanging it via a message protocol with an independent control module to optimize failure-probability targets, thereby reducing the need for hardware modifications and enhancing diagnostic coverage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware modifications are made to implement processor redundancy for functional safety, then diagnostic coverage and reliability are improved, but device complexity and manufacturing cost increase
Solution Approach 1:
The patent creates virtual copies of processor execution through virtual machines that run identical or mirrored versions of safety-critical code. Instead of duplicating physical hardware, the system uses software-based virtualization to produce multiple execution paths that can be compared for consistency, achieving redundancy without additional physical processors
Solution Approach 2:
The patent replaces mechanical/hardware redundancy with software-based monitoring and comparison mechanisms. The system uses software agents, message protocols, and logical comparison of execution results to achieve safety validation that would traditionally require duplicate physical processor hardware
2Reliability
If watchdog-based monitoring is used to detect processor failures, then some failures are detected, but diagnostic coverage remains limited to only failures causing substantial program flow differences
Solution Approach 1:
The patent implements continuous feedback loops where virtual machines monitor each other's execution states, intermediate results, and output messages. This multi-level feedback mechanism detects deviations at various stages of program execution, not just at final output, enabling detection of subtle failures that watchdog timers would miss
Solution Approach 2:
The patent divides the monitoring function into multiple independent components: individual virtual machines monitoring specific program segments, separate message protocols for different types of data, and distributed agents checking intermediate results. This segmentation allows comprehensive coverage of different failure modes without requiring a single complex monitoring system
3Reliability
If programs are decomposed into parallel sub-programs for safety validation, then diagnostic coverage and failure detection improve, but program complexity and execution coordination increase
Solution Approach 1:
The patent creates universal communication protocols and message formats that work across different virtual machines and processor architectures. The same message protocol structure handles various types of data exchange (intermediate results, status updates, error reports), simplifying the coordination complexity despite parallel execution
Solution Approach 2:
The patent introduces intermediary components including message queues, protocol translators, and coordination agents that mediate between parallel sub-programs. These intermediaries standardize communication interfaces and handle synchronization, reducing the direct coordination complexity between decomposed program components
4Reliability
If self-testing operations are carried out periodically with high cycle frequency, then functional safety targets are met, but execution time and processing overhead increase
Solution Approach 1:
The patent implements periodic self-testing operations where virtual machines and monitoring agents execute safety checks at defined intervals rather than continuously. This periodic action maintains diagnostic coverage while allowing normal program execution to proceed uninterrupted between test cycles, reducing overall time loss
Solution Approach 2:
The patent applies different levels of testing intensity based on risk assessment and execution context. Not all virtual machines or program segments undergo full self-testing at every cycle; instead, the system applies partial testing to lower-risk components and excessive (comprehensive) testing only to critical paths, optimizing the balance between safety validation and execution time
Data Source
AI summary
A method for executing programs (P) in an electronic system for applications provided with functional safety that includes a single-processor or multiprocessor processing system and a further independent control module, the method comprising: performing an operation of breaking-down of a program (P) into a plurality of parallel sub-programs (P1, . . . , Pn); assigning execution of each parallel sub-program (P1, . . . , Pn) to a respective processing module of the system, periodically performing self-test operations (Astl, Asys, Achk) associated to each of said sub-programs (P1, . . . , Pn).