Safety level specific error response scheme for mixed criticality systems

Patent metadata

Field	Value
Publication number	US-9672095-B2
Application number	US-201514859457-A
Country	US
Kind code	B2
Filing date	Sep 21, 2015
Priority date	Sep 21, 2015
Publication date	Jun 6, 2017
Grant date	Jun 6, 2017

Abstract

An error response method for a mixed criticality system includes assigning a safety level to an application executed by a processor. Executing the application includes a transaction between the processor and a resource. The safety level is stored at the resource. The safety level and a fault indication are transmitted from the resource to a fault collection and control unit (FCCU). The fault indication is responsive to a fault from the resource. The FCCU responds to the fault indication with an action determined by the safety level.

First claim

What is claimed is:

1. An error response method for a mixed criticality system comprising:
assigning a safety level to an application executed by a processor, wherein executing the application comprises a transaction between the processor and a resource;
storing the safety level at the resource;
transmitting the safety level and a fault indication from the resource to a Fault Collection and Control Unit (FCCU), the fault indication responsive to a fault from the resource; and
responding by the FCCU to the fault indication with an action determined in part by the safety level.

2. The method of claim 1 further comprising:
assigning a second safety level to a second application executed by a second processor, wherein
the second application comprises a second transaction between the second processor and the resource, and
the second transaction terminates after the transaction;

replacing the safety level of the application with the second safety level of the second application at the resource; and
responding, by the FCCU, to a fault indication associated with the second transaction with a second action determined by the second safety level.

3. The method of claim 1 further comprising:
assigning a second safety level to a second application executed by the processor, wherein
the second application comprises a second transaction between the processor and the resource, and
the second transaction terminates after the transaction;

replacing the safety level of the application with the second safety level of the second application at the resource; and
responding, by the FCCU, to the fault indication associated with the second transaction with a second action determined by the second safety level.

4. The method of claim 1 wherein assigning the safety level to the application further comprises assigning a safety level to each of a plurality of application channels, each application channel transacting with a corresponding channel of the resource.

5. The method of claim 1 wherein the safety level is an Automotive Safety Integrity Level.

6. The method of claim 1 wherein the safety level is specific to the application.

7. The method of claim 1 wherein the fault from the resource is a failure of the transaction between the processor and the resource.

8. The method of claim 1 wherein the fault from the resource is a failure from a subsequent operation of the resource.

9. The method of claim 1 wherein the resource is a memory and the action includes at least one of ignoring the fault, correcting the fault, and logging the fault.

10. The method of claim 1 wherein the resource is one of a state machine, a peripheral and an input/output device and the action includes a predetermined task.

11. A mixed criticality system comprising:
a processor configured to execute an application having an associated safety level;
a resource coupled to the processor by a system bus;
a storage device associated with the resource and configured to store the safety level received from the processor; and
a Fault Collection and Control Unit (FCCU) coupled to the resource, wherein the FCCU is configured to perform an action determined in part by the safety level in response to a fault from the resource.

12. The system of claim 11 wherein the resource is coupled to the processor with a sideband path separate from the system bus.

13. The system of claim 11 wherein the resource is coupled to the processor with a time interleaved signal on the system bus.

14. The system of claim 11 wherein the storage device is a register coupled to the resource.

15. The system of claim 11 wherein the system is an automotive vehicle network.

16. The system of claim 11 wherein the fault from the resource is a failure of the transaction between the processor and the resource.

17. The system of claim 11 wherein the fault from the resource is a failure from a subsequent operation of the resource.

18. The system of claim 11 wherein the safety level is an Automotive Safety Integrity Level.

19. The system of claim 11 wherein the safety level is specific to the application.

20. An error response method for a mixed criticality system comprising:
assigning an Automotive Safety Integrity Level (ASIL) to an application executed by a processor, wherein executing the application comprises a transaction between the processor and a resource;
transmitting the ASIL and a fault indication, from the resource to a Fault Collection and Control Unit (FCCU) for the application, wherein the fault indication is responsive to a fault from the resource; and
responding by the FCCU to the fault indication with an action determined in part by the safety level.

Assignees

• Freescale Semiconductor Inc
• Nxp Usa Inc

Inventors

• Robertson Alistair Paul
• Birnie Andrew Edward
• Young Alison

Classifications

• G06F11/0739

  in a data processing system embedded in automotive or aircraft systems · CPC title

• G06F11/0751

  Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06) · CPC title

• G06F11/0793 Primary

  Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40) · CPC title

• G06F11/0781

  Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level · CPC title

• G06F11/0724

  in a multiprocessor or a multi-core unit (multiprocessors per se G06F15/80) · CPC title