Apparatus and method for communications in a safety critical system

Patent metadata

Field	Value
Publication number	US-RE49043-E
Application number	US-201916295975-A
Country	US
Kind code	E1
Filing date	Mar 7, 2019
Priority date	Jun 18, 2014
Publication date	Apr 19, 2022
Grant date	Apr 19, 2022

Abstract

A safety communication scheme for a safety-critical system which includes two or more higher level units that have voting capabilities and one or two sets of lower level units that do not have voting capabilities, involves using one channel between the high and low level units for safety and two channels for redundancy.

First claim

What is claimed is:

1. A method executed by at least one processor, the method comprising:
generating a first message and a first data protection code corresponding to the first message by a first high level unit, the first high level unit being coupled to a second high level unit by at least one comparison channel, the first message comprising content agreed upon between the first high level unit and the second high level unit through a first voting process;
communicating the first message and the first data protection code from the a first high level unit to a first low level unit coupled to the first high level unit by a first channel, the first message comprising content agreed upon between the first high level unit and a second high level unit, the first message being communicated from the first high level unit to the first low level unit by way of the first channel;
generating a second message and a second data protection code corresponding to the second message by the first high level unit, the second message comprising content agreed upon between the first high level unit and the second high level unit through a second voting process;
communicating the second message and the second data protection code from the first high level unit to a second low level unit coupled to the first low level unit by a forwarding channel, the second message comprising content agreed upon between the first high level unit and the second high level unit, the second message being communicated from the first high level unit to the second low level unit by way of the first channel, the first low level unit, and the forwarding channel;
communicating a first response message from the first low level unit to the first high level unit by way of the first channel, the first response message being generated by the first low level unit in response to the first message;
communicating a second response message from the second low level unit to the first high level unit in response to the second message, the second response message being generated by the second low level unit and communicated from the second low level unit to the first high level unit by way of the forwarding channel, the first low level unit, and the first channel; and
comparing the first response message and the second response message based, at least in part, on a determination that the first high level unit and the second high level unit have voting capabilities,
wherein the first data protection code and the second data protection code prevent unauthorized alteration of the first message or and the second message, respectively.

2. The method of claim 1 , wherein the first data protection code is further configured to correspond with the first response message, the second data protection code is further configured to correspond with the second response message, and the first data protection code and the second data protection code prevent unauthorized generation of the first response message or and the second response message, respectively.

3. The method of claim 1 , wherein
the first message and the second message are similar and communicated as a single message to the first low level unit and to the second low level unit by way of at least the first low level unit, and
the first data protection code and the second data protection code are communicated with the single message to secure communications between the first low level unit and the first high level unit, and between the second low level unit and the first high level unit.

4. The method of claim 1 , wherein the first message is different from the second message, the first message and the first data protection code are communicated together, and the second message and the second data protection code are communicated together.

5. The method of claim 1 , further comprising:
polling the second low level unit to conduct a performance test of the second low level unit;
determining the first channel is in a failure mode based on a result of a performance test of the second low level unit; and
reversing communications between the first high level unit, the second high level unit, the first low level unit, and the second low level unit to flow through a second channel, the second channel being configured to couple the second high level unit to the second low level unit.

6. The method of claim 1 , wherein the first low level unit is divided into two or more first subunits and the second low level unit is divided into two or more second subunits, the first high level unit is configured to communicate with the first subunits by way of the first channel, the second high level unit is configured to communicate with the second subunits by way of a second channel, a first portion of the first subunits is coupled to a first portion of the second subunits by the forwarding channel, and a second portion of the first subunits is coupled to a second portion of the second subunits by another forwarding channel, the method further comprising:
polling the first portion of the first subunits and the second subunits to conduct a performance test;
determining one of the first channel or the second channel is inoperable based on the performance test; and
communicating the first message or the second message to the first low level unit or the second low level unit by way of the other of the first channel or the second channel determined to be operable based on the performance test.

7. The method of claim 1 , wherein the first low level unit is divided into two or more first subunits and the second low level unit is divided into two or more second subunits, the first high level unit is configured to communicate with a first portion of the first subunits by way of the first channel, the second high level unit is configured to communicate with a second portion of the first subunits by way of a second channel, the first portion of the first subunits is coupled to a first portion of the second subunits by the forwarding channel, the second portion of the first subunits is coupled to a second portion of the second subunits by another forwarding channel, and a third high level unit is coupled to the first portion of the second subunits and the second portion of the second subunits by a third channel, the method further comprising:
relaying communications between the first high level unit, the second high level unit, the first low level unit, and the second low level unit by way of the third high level unit, the third channel, and one or more additional comparison channels coupling the third high level unit to one or more of the first high level unit or the second high level unit based on a determination that one of the first channel or the second channel is inoperable based on a performance test.

8. An apparatus, comprising:
at least one processor; and
at least one memory including computer program code for one or more programs,
the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to:
generate a first message and a first data protection code corresponding to the first message by a first high level unit, the first high level unit being coupled to a second high level unit by at least one comparison channel, the first message comprising content agreed upon between the first high level unit and the second high level unit through a first voting process;
communicate the first message and the first data protection code from the a first high level unit to a first low level unit coupled to the first high level unit by a first channel, the first message comprising content agreed upon between the first high level unit and a second high level unit, the first message being communicated from the first high level unit to th

Assignees

• Thales Canada Inc

Inventors

• Schwellnus Carl
• Krieger Martin

Classifications

• G06F21/606 Primary

  by securing the transmission between two devices or processes · CPC title

• G06F11/181

  Eliminating the failing redundant component · CPC title

• G06F21/60 Primary

  Protecting data · CPC title

• G06F11/184

  where the redundant components implement processing functionality · CPC title

• G06F11/1654

  where the output of only one of the redundant processing components can drive the attached hardware, e.g. memory or I/O · CPC title