Software handling of errors

Patent metadata

Field	Value
Publication number	US-11036575-B2
Application number	US-201916570044-A
Country	US
Kind code	B2
Filing date	Sep 13, 2019
Priority date	Sep 29, 2016
Publication date	Jun 15, 2021
Grant date	Jun 15, 2021

Abstract

A method to detect hardware and software errors in an embedded system is disclosed. The method includes: detecting or measuring, by a plurality of sensors, an operating state of the embedded system; operating a plurality of replicated computation engines in group synchrony, wherein the plurality of replicated computation engines are replicated instances of a single computation engine and wherein the plurality of replicated computation engines are grouped into one or more groups such that, for each group, each member of the group starts in a same processing logic state and processes same events in the same order; intercepting output of the plurality of sensors and transmitting the output to each replicated computation engine of a group in a defined order; and actuating selected computation engines of the plurality of replicated computation engines and arbitrating between outputs of the selected computation engines.

First claim

The invention claimed is:

1. A method to detect hardware and software errors in an embedded system, the method comprising:
detecting or measuring, by a plurality of sensors, an operating state of the embedded system;
operating a plurality of replicated computation engines in group synchrony, wherein the plurality of replicated computation engines are replicated instances of a single computation engine and wherein the plurality of replicated computation engines are grouped into one or more groups such that, for each group, each member of the group starts in a same processing logic state and processes same events in a same order;
intercepting output of the plurality of sensors and transmitting the output to each replicated computation engine of a group in a defined order; and
actuating selected computation engines of the plurality of replicated computation engines and arbitrating between outputs of the selected computation engines.

2. The method of claim 1 , further comprising placing the embedded system in a design safe state.

3. The method of claim 1 , further comprising detecting a hardware error and isolating the hardware error.

4. The method of claim 1 , wherein the plurality of replicated computation engines are physically distinct and executed by different processors but appear to a plurality of actuators that activate or control another mechanism as a single unit.

5. The method of claim 1 , wherein the replicated computation engines that belong to a group are synchronized.

6. The method of claim 1 , further comprising requesting, by one or more actuators that activate or control another mechanism, only a portion of a selected output generated by the plurality of replicated computation engines.

7. The method of claim 1 , further comprising receiving, by a plurality of active monitors, same sensor output as the plurality of replicated computation engines.

8. The method of claim 7 , further comprising arbitrating between outputs generated by the plurality of replicated computation engines and outputs of the plurality of active monitors.

9. The method of claim 1 , further comprising actuating a mechanical device in response to the act of arbitrating.

10. A non-transitory computer readable medium storing processor-executable instructions for detecting hardware and software errors in an embedded system, comprising:
first computer program code for detecting or measuring an operating state of the embedded system;
second computer program code for activating or controlling another mechanism;
third computer program code for causing a plurality of replicated computation engines to perform a specific task, wherein the plurality of replicated computation engines are replicated instances of a single computation engine and wherein the plurality of replicated computation engines are grouped into one or more groups such that, for each group, each member of the group starts in a same processing logic state and processes same events in a same order; and
fourth computer program code for actuating selected computation engines of the plurality of replicated computation engines and arbitrating between outputs of the selected computation engines, wherein the fourth computer program code is for intercepting output of sensors detecting or measuring an operating state of the embedded system and transmitting the output of the sensors to each replicated computation engine of a group in a defined order.

11. The computer readable medium of claim 10 , wherein the arbitration executed by the fourth computer program code places an embedded system in a design safe state.

12. The computer readable medium of claim 10 , wherein the fourth computer program code is for detecting a hardware error and isolating the hardware error.

13. The computer readable medium of claim 10 , wherein the plurality of replicated computation engines are physically distinct and executed by different processors.

14. The computer readable medium of claim 10 , wherein the replicated computation engines that belong to a group are synchronized.

15. The computer readable medium of claim 10 , further comprising computer program code associated with a plurality of active monitors for monitoring the plurality of replicated computation engines to an automotive integrity level.

16. The computer readable medium of claim 15 , wherein the plurality of active monitors calculate a same output as the plurality of replicated computation engines but process a different combination of sensor outputs.

17. The computer readable medium of claim 15 , wherein the active monitors are compliant with a safety standard such that a number of the plurality of replicated computation engines that are non-compliant with the safety standard become compliant by a monitoring executed by the plurality of active monitors.

18. The computer readable medium of claim 15 , wherein the fourth computer program code is for arbitrating between outputs generated by the plurality of replicated computation engines and outputs of the plurality of active monitors.

19. The computer readable medium of claim 15 , wherein the plurality of replicated computation engines and the plurality of active monitors operate in a virtual synchrony model, respectively.

20. A vehicle, comprising:
a plurality of sensors that detect or measure a state of the vehicle;
a plurality of actuators that activate or control another mechanism in the vehicle;
a plurality of replicated computation engines in communication with the plurality of sensors and the plurality of actuators that perform a specific task, wherein the plurality of replicated computation engines are replicated instances of a single computation engine and wherein the plurality of replicated computation engines are grouped into one or more groups such that, for each group, each member of the group starts in a same processing logic state and processes same events in a same order; and
middleware executed by a processor for actuating selected computation engines of the plurality of replicated computation engines and arbitrating between outputs of the selected computation engines.

21. The vehicle of claim 20 , wherein the arbitration executed by the middleware places an embedded system in a design safe state.

22. The vehicle of claim 20 , wherein the middleware is for detecting a hardware error and isolating the hardware error.

23. The vehicle of claim 20 , wherein the plurality of replicated computation engines are physically distinct and executed by different processors.

24. The vehicle of claim 20 , wherein the replicated computation engines that belong to a group are synchronized.

25. The vehicle of claim 20 , further comprising computer program code associated with a plurality of active monitors for monitoring the plurality of replicated computation engines to an automotive integrity level.

26. The vehicle of claim 25 , wherein the plurality of active monitors calculate a same output as the plurality of replicated computation engines but process a different combination of sensor outputs.

27. The vehicle of claim 25 , wherein the active monitors are compliant with a safety standard such that a number of the plurality of replicated computation engines that are non-compliant with the safety standard become compliant by a monitoring executed by the plurality of active monitors.

28. The vehicle of claim 25 , wherein the middle

Assignees

• Ontario Inc 2236008
• Blackberry Ltd

Inventors

• Hobbs Christopher William Lewis
• Johnson Kerry Wayne

Classifications

• G06F11/0796 Primary

  Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element · CPC title

• G06F11/1482

  using middleware or operating system [OS] functionalities · CPC title

• G06F11/079 Primary

  Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36) · CPC title

• G06F11/0721

  within a central processing unit [CPU] · CPC title

• G06F11/0739

  in a data processing system embedded in automotive or aircraft systems · CPC title