Security device for building-related passenger conveyor system

Patent metadata

Field	Value
Publication number	US-12434942-B2
Application number	US-202017593300-A
Country	US
Kind code	B2
Filing date	Mar 3, 2020
Priority date	Mar 18, 2019
Publication date	Oct 7, 2025
Grant date	Oct 7, 2025

Abstract

A safety device for a building-related passenger transport system includes a microcontroller having a memory, a processor and a communication interface. A safety module is stored in the memory and, when it is executed on the processor, receives safety-relevant signals from components of the passenger conveyor system, evaluates the signals with regard to a safety problem and transmits a warning signal to a controller of the passenger conveyor system in the event of a safety problem. An update module is stored in the memory and, when it is executed on the processor, receives a software package via the communication interface and updates at least parts of the safety module with the software package. The microcontroller is configured such that the safety module is able to be amended only by the update module.

First claim

The invention claimed is:

1. A safety device for a building-related passenger transport system, the safety device comprising:
a microcontroller having a memory, a processor and a communication interface;
a safety module stored in the memory and, when executed on the processor, the safety module receives safety-relevant signals from components of the passenger transport system, evaluates the safety-related signals with regard to a predetermined safety problem, and transmits a warning signal to a controller of the passenger transport system when the safety-related signals indicate the safety problem;
an update module stored in the memory and, when executed on the processor, the update module receives a software package via the communication interface and updates at least parts of the safety module with the software package;
wherein the microcontroller is configured such that the safety module is only able to be amended by the update module;
wherein the processor has a first processor core on which the safety module is executed;
wherein the processor has a second processor core on which the update module is executed; and
wherein the microcontroller restricts access of the second processor core to regions of the memory in which the safety module is stored.

2. The safety device according to claim 1 wherein the microcontroller includes a hypervisor that restricts access of the executed update module and the executed safety module to the memory and restricts access of the update module to the regions of the memory in which the safety module is stored.

3. The safety device according to claim 2 wherein the hypervisor is a hardware component of the microcontroller.

4. The safety device according to claim 2 wherein the hypervisor is a software module stored in the memory.

5. The safety device according to claim 2 wherein the hypervisor forwards the safety-relevant signals from components of the passenger transport system to the safety module and forwards the software package to the update module.

6. The safety device according to claim 1 wherein the update module receives the safety-relevant signals via the communication interface and forwards the safety-relevant signals to the safety module.

7. The safety device according to claim 1 including a plurality of the safety module stored in the memory and wherein the update module updates each of the safety modules.

8. The safety device according to claim 1 wherein the memory includes a non-volatile memory and a volatile memory.

9. The safety device according to claim 8 wherein the update module is stored in the non-volatile memory in encrypted form, and including a boot loader module stored in the non-volatile memory that, when executed on the processor, decrypts the update module and loads the decrypted update module into the volatile memory.

10. The safety device according to claim 1 including at least one of a private key stored in a protected non-volatile memory of the microcontroller and a public key of a provider of the software package stored in the protected non-volatile memory of the microcontroller.

11. The safety device according to claim 10 wherein the microcontroller uses the private key to decrypt the update module and uses the public key to authenticate a provider of the software package.

12. A method for updating software of the safety device according to claim 1 , the method comprising the steps of:
authenticating a provider of the software package via the communication interface by the update module;
receiving the software package via the communication interface by the update module; and
updating at least a part of the safety module with the software package by the update module.

13. The method according to claim 12 including a step of decrypting the software package by the update module.

14. The method according to claim 13 wherein the software package is at least partially encrypted using a symmetric encryption method.

15. The method according to claim 12 including the update module making regular requests for a software package for updating the safety module to the provider.

Assignees

• Inventio Ag

Inventors

• Michel David

Classifications

• G06F2009/45583

  Memory management, e.g. access or allocation · CPC title

• G06F2009/4557

  Distribution of virtual machine instances; Migration and load balancing · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• B66B5/0037

  Performance analysers · CPC title

• B66B5/0031

  for safety reasons · CPC title