Computer system and method for safety-critical applications

Patent metadata

Field	Value
Publication number	US-10241858-B2
Application number	US-201515508924-A
Country	US
Kind code	B2
Filing date	Sep 3, 2015
Priority date	Sep 5, 2014
Publication date	Mar 26, 2019
Grant date	Mar 26, 2019

Abstract

The invention relates to a computer system for carrying out safety-critical applications, said computer system comprising a plurality of node computers and a communications system. Sensor data are supplied in parallel to one or more node computers, the node computers calculating an optimized result, preferably using an optimization algorithm, in order to solve a given problem, and transmitting said optimized result, preferably for checking the safety, to a node computer which is designed as an SCFCU, said SCFCU being directly connected to the actuator controller, and the SCFCU furthermore calculating from the sensor data a simple result, which preferably meets all safety requirements, and an envelope of the simple result, and the SCFCU checking whether the resulting values, particularly those relevant to safety, of the optimized result lie within the envelope of the simple result, and, if this is the case, directly forwarding the optimized result to the actuator controller, and, if this is not the case, forwarding the simple result calculated by the SCFCU directly to the actuator control.

First claim

The invention claimed is:

1. A computer system for carrying out safety-critical applications, the computer system comprising:
a plurality of node computers, and
a communication system,
wherein sensor data are routed in parallel to one or more not self-checking node computers which are configured to calculate an optimized result using an optimization algorithm in order to solve a given problem, and transmitting this optimized result for checking safety to a node computer which is designed as a self-checking fault containment unit (“SCFCU”), and the SCFCU being directly connected to an actuator controller, and
wherein the SCFCU is configured (i) to calculate from the sensor data a simple result, which meets all safety requirements, and an envelope of the simple result, and (ii) to check whether result values relevant to safety of the optimized result lie within the envelope of the simple result, and if this is the case, to directly relay the optimized result to the actuator controller, and if this is not the case, to relay the simple result calculated by the SCFCU directly to the actuator controller.

2. The computer system of claim 1 , wherein the communication system is a time-triggered communication system.

3. The computer system of claim 1 , wherein the communication between the node computers is based on the TTEthernet protocol.

4. The computer system of claim 1 , wherein the SCFCU is made up of two components and a comparator, and wherein the two components are configured to calculate two results in parallel based on the input data or sensor data, and the comparator is configured to subsequently check whether the two results are identical, and if this is not the case, the SCFCU does not produce output data.

5. A method for carrying out safety-critical applications in a computer system, the computer system comprising a plurality of node computers and a communication system, wherein sensor data are processed in parallel by one or more not self-checking node computers, the method comprising:
using the non self-checking node computers, using an optimization algorithm, to calculate an optimized result for solving an assigned problem,
transmitting this optimized result, for checking safety, to a node computer that is designed as a self-checking fault containment unit (“SCFCU”), the SCFCU being directly connected to-an actuator controller,
using the SCFCU to calculate from the sensor data a simple result, which meets all safety requirements, and an envelope of the simple result, using an algorithm that is available from formal analysis, and
using the SCFCU to check whether the optimized result lies within the envelope of the simple result, and if this is the case, directly relaying the optimized result to the actuator controller, and if this is not the case, relaying the simple result calculated by the SCFCU directly to the actuator controller.

6. The method of claim 5 , wherein the SCFCU periodically sends a message to the actuator controller.

7. The method of claim 5 , wherein the SCFCU periodically sends a message to the actuator controller at points in time that are fixed a priori.

8. The method of claim 5 , wherein the actuator controller autonomously places actuators in a safe state when the periodic message from the SCFCU is absent at the actuator controller.

9. The method of claim 5 , wherein the SCFCU sends a message to a node computer, which is designed as a monitor node, when the optimized result lies outside the envelope of the simple result.

Assignees

• Fts Computertechnik Gmbh
• Tttech Computertechnik Ag

Inventors

• Kopetz Hermann

Classifications

• G06F11/0796 Primary

  Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element · CPC title

• G06F2201/805

  Real-time · CPC title

• G06F11/1641

  where the comparison is not performed by the redundant processing components · CPC title

• G06F11/0739

  in a data processing system embedded in automotive or aircraft systems · CPC title