Cryptographic Watchdog Control for Safe Machine Fallback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Controllable machines such as AGVs, robots, and energy storage devices face hazards due to malfunctions or tampering, making it difficult for operators to intervene and bring them into a safe state remotely.
Innovation Solution
Implementing a cryptographically secured watchdog that periodically resets and switches to alternative control functions, ensuring the machine transitions to a safe mode if the reset command fails, with parameters and commands managed by an external, virtualized control unit.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If the machine is controlled using virtualized control functions executed by external control units via wireless communication, then automation and remote operation are improved, but the ability to intervene in case of malfunction is worsened
Solution Approach 1:
The patent implements a watchdog timer that is reset in advance by authentication commands from the external control unit. If the watchdog is not reset before expiration, the machine automatically switches to a safe operating mode. This preliminary action ensures that even if communication is lost or the external control unit fails, the machine can autonomously protect itself by transitioning to a predetermined safe state without requiring operator intervention.
2Reliability
If the machine switches to safe mode automatically when watchdog reset fails, then safety is improved, but operational continuity is worsened
Solution Approach 1:
The patent implements a dynamic response system where the machine's operating mode is not fixed but can change based on watchdog status. When the watchdog expires, the machine transitions from normal operation to a safe operating mode with restricted functions. This dynamic adaptation allows the system to balance safety and productivity by automatically adjusting its operational state according to the detected fault condition, rather than always maintaining full operation or complete shutdown.
Data Source
Figure 1~2
AI summary
Method for operating a controllable machine (100) comprising: a controllable machine unit (110) with a sensor (111) and/or an actuator (112); an internal machine control unit (120) for controlling the machine unit (110), which in normal operation is controlled by the machine control unit (120) with a first machine control function (MF1), whose parameters (P_MF1) and/or control commands (C_MF1) the internal machine control unit (120) receives from an external control unit (200); and a watchdog (130) whose reset command is cryptographically secured. The watchdog (130) is reset at predetermined time intervals by the reset command (AWRC) in the normal operation of the machine (100) in order to control the machine in normal operation.If the reset command (AWRC) from the first machine control function (MF1) is not received, the system switches to a second machine control function (MF2), selecting its parameters (P_MF2) and/or control commands (C_MF2) to operate the machine unit (110) in a safe emergency mode.