IP Library › Granted Patent US 9,589,142
Granted Patent B2
US 9,589,142 · App. 14/308,005 · Granted Mar 7, 2017

Apparatus and method for communications in a safety critical system

Inventors: Carl Schwellnus (York, CA); Martin Krieger (Toronto, CA)
Assignee: Thales Canada Inc
G06F21/60G06F11/1629G06F11/1654G06F11/181G06F11/184G06F21/606
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,589,142
App. No.
14/308,005
Granted
Mar 7, 2017
Kind
B2
Abstract

A safety communication scheme for a safety-critical system which includes two or more higher level units that have voting capabilities and one or two sets of lower level units that do not have voting capabilities, involves using one channel between the high and low level units for safety and two channels for redundancy.

Claims (69)

1. A method executed by at least one processor, the method comprising:

generating a first message and a first data protection code corresponding to the first message by a first high level unit, the first high level unit being coupled to a second high level unit by at least one comparison channel, the first message comprising content agreed upon between the first high level unit and the second high level unit through a first voting process;

communicating the first message and the first data protection code from the first high level unit to a first low level unit coupled to the first high level unit by a first channel, the first message being communicated from the first high level unit to the first low level unit by way of the first channel;

generating a second message and a second data protection code corresponding to the second message by the first high level unit, the second message comprising content agreed upon between the first high level unit and the second high level unit through a second voting process;

communicating the second message and the second data protection code from the first high level unit to a second low level unit coupled to the first low level unit by a forwarding channel, the second message being communicated from the first high level unit to the second low level unit by way of the first channel, the first low level unit, and the forwarding channel;

communicating a first response message from the first low level unit to the first high level unit by way of the first channel, the first response message being generated by the first low level unit in response to the first message;

communicating a second response message from the second low level unit to the first high level unit in response to the second message, the second response message being generated by the second low level unit and communicated from the second low level unit to the first high level unit by way of the forwarding channel, the first low level unit, and the first channel; and

comparing the first response message and the second response message based, at least in part, on a determination that the first high level unit and the second high level unit have voting capabilities,

wherein the first data protection code and the second data protection code prevent unauthorized alteration of the first message or the second message.

2. The method of claim 1 , wherein the first data protection code is further configured to correspond with the first response message, the second data protection code is further configured to correspond with the second response message, and the first data protection code and the second data protection code prevent unauthorized generation of the first response message or the second response message.

3. The method of claim 1 , wherein

the first message and the second message are similar and communicated as a single message to the first low level unit and to the second low level unit by way of at least the first low level unit, and

the first data protection code and the second data protection code are communicated with the single message to secure communications between the first low level unit and the first high level unit, and between the second low level unit and the first high level unit.

4. The method of claim 1 , wherein the first message is different from the second message, the first message and the first data protection code are communicated together, and the second message and the second data protection code are communicated together.

5. The method of claim 1 , further comprising:

polling the second low level unit to conduct a performance test of the second low level unit;

determining the first channel is in a failure mode; and

reversing communications between the first high level unit, the second high level unit, the first low level unit, and the second low level unit to flow through a second channel, the second channel being configured to couple the second high level unit to the second low level unit.

6. The method of claim 1 , wherein the first low level unit is divided into two or more first subunits and the second low level unit is divided into two or more second subunits, the first high level unit is configured to communicate with the first subunits by way of the first channel, the second high level unit is configured to communicate with the second subunits by way of a second channel, a first portion of the first subunits is coupled to a first portion of the second subunits by the forwarding channel, and a second portion of the first subunits is coupled to a second portion of the second subunits by another forwarding channel, the method further comprising:

polling the first portion of the first subunits and the second subunits to conduct a performance test;

determining one of the first channel or the second channel is inoperable based on the performance test; and

communicating the first message or the second message to the first low level unit or the second low level unit by way of the other of the first channel or the second channel determined to be operable based on the performance test.

7. The method of claim 1 , wherein the first low level unit is divided into two or more first subunits and the second low level unit is divided into two or more second subunits, the first high level unit is configured to communicate with a first portion of the first subunits by way of the first channel, the second high level unit is configured to communicate with a second portion of the first subunits by way of a second channel, the first portion of the first subunits is coupled to a first portion of the second subunits by the forwarding channel, the second portion of the first subunits is coupled to a second portion of the second subunits by another forwarding channel, and a third high level unit is coupled to the first portion of the second subunits and the second portion of the second subunits by a third channel, the method further comprising:

relaying communications between the first high level unit, the second high level unit, the first low level unit, and the second low level unit by way of the third high level unit, the third channel, and one or more additional comparison channels coupling the third high level unit to one or more of the first high level unit or the second high level unit based on a determination that one of the first channel or the second channel is inoperable based on a performance test.

8. An apparatus comprising:

at least one processor; and

at least one memory including computer program code for one or more programs,

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to:

generate a first message and a first data protection code corresponding to the first message by a first high level unit, the first high level unit being coupled to a second high level unit by at least one comparison channel, the first message comprising content agreed upon between the first high level unit and the second high level unit through a first voting process;

communicate the first message and the first data protection code from the first high level unit to a first low level unit coupled to the first high level unit by a first channel, the first message being communicated from the first high level unit to the first low level unit by way of the first channel;

generate a second message and a second data protection code corresponding to the second message by the first high level unit, the second message comprising content agreed upon between the first high level unit and the second high level unit through a second voting process;

communicate the second message and the second data protection code from the first high level unit to a second low level unit coupled to the first low level unit by a forwarding channel, the second message being communicated from the first high level unit to the second low level unit by way of the first channel, the first low level unit, and the forwarding

communicate a first response message from the first low level unit to the first high level unit by way of the first channel, the first response message being generated by the first low level unit in response to the first message;

communicate a second response message from the second low level unit to the first high level unit in response to the second message, the second response message being generated by the second low level unit and communicated from the second low level unit to the first high level unit by way of the forwarding channel, the first low level unit, and the first channel; and

compare the first response message and the second response message based, at least in part, on a determination that the first high level unit and the second high level unit have voting capabilities,

wherein the first data protection code and the second data protection code prevent unauthorized alteration of the first message or the second message.

9. The apparatus of claim 8 , wherein the first data protection code is further configured to correspond with the first response message, the second data protection code is further configured to correspond with the second response message, and the first data protection code and the second data protection code prevent unauthorized generation of the first response message or the second response message.

10. The apparatus of claim 8 , wherein

the first message and the second message are similar and communicated as a single message to the first low level unit and to the second low level unit by way of at least the first low level unit, and

the first data protection code and the second data protection code are communicated with the single message to secure communications between the first low level unit and the first high level unit, and between the second low level unit and the first high level unit.

11. The apparatus of claim 8 , wherein the first message is different from the second message, the first message and the first data protection code are communicated together, and the second message and the second data protection code are communicated together.

12. The apparatus of claim 8 , wherein the apparatus is further caused to:

poll the second low level unit to conduct a performance test of the second low level unit;

determine the first channel is in a failure mode; and

reverse communications between the first high level unit, the second high level unit, the first low level unit, and the second low level unit to flow through a second channel, the second channel being configured to couple the second high level unit to the second low level unit.

13. The apparatus of claim 8 , wherein the first low level unit is divided into two or more first subunits and the second low level unit is divided into two or more second subunits, the first high level unit is configured to communicate with the first subunits by way of the first channel, the second high level unit is configured to communicate with the second subunits by way of a second channel, a first portion of the first subunits is coupled to a first portion of the second subunits by the forwarding channel, and a second portion of the first subunits is coupled to a second portion of the second subunits by another forwarding channel, and the apparatus is further caused to:

poll the first portion of the first subunits and the second subunits to conduct a performance test;

determine one of the first channel or the second channel is inoperable based on the performance test; and

communicate the first message or the second message to the first low level unit or the second low level unit by way of the other of the first channel or the second channel determined to be operable based on the performance test.

14. The apparatus of claim 8 , wherein the first low level unit is divided into two or more first subunits and the second low level unit is divided into two or more second subunits, the first high level unit is configured to communicate with a first portion of the first subunits by way of the first channel, the second high level unit is configured to communicate with a second portion of the first subunits by way of a second channel, the first portion of the first subunits is coupled to a first portion of the second subunits by the forwarding channel, the second portion of the first subunits is coupled to a second portion of the second subunits by another forwarding channel, and a third high level unit is coupled to the first portion of the second subunits and the second portion of the second subunits by a third channel, and the apparatus is further caused to:

relay communications between the first high level unit, the second high level unit, the first low level unit, and the second low level unit by way of the third high level unit, the third channel, and one or more additional comparison channels coupling the third high level unit to one or more of the first high level unit or the second high level unit based on a determination that one of the first channel or the second channel is inoperable based on a performance test.

15. A method executed by at least one processor, the method comprising:

generating a first message and protecting the first message with a first protection scheme corresponding to the first message by a first high level unit, the first high level unit being coupled to a second high level unit by at least one comparison channel, the first message comprising content agreed upon between the first high level unit and the second high level unit through a first voting process;

communicating the first message and the first protection scheme from the first high level unit to a first low level unit coupled to the first high level unit by a first channel, the first message being communicated from the first high level unit to the first low level unit by way of the first channel;

generating a second message and protecting the second message with a second protection scheme corresponding to the second message by the first high level unit, the second message comprising content agreed upon between the first high level unit and the second high level unit through a second voting process;

communicating the second message and the second protection scheme from the first high level unit to a second low level unit coupled to the first low level unit by a forwarding channel, the second message being communicated from the first high level unit to the second low level unit by way of the first channel, the first low level unit, and the forwarding channel;

polling the second low level unit to conduct a performance test of the second low level unit;

determining the first channel is in a failure mode; and

reversing communications between the first high level unit, the second high level unit, the first low level unit, and the second low level unit to flow through a second channel, the second channel being configured to couple the second high level unit to the second low level unit,

wherein the first protection scheme and the second protection scheme prevent unauthorized alteration of the first message or the second message.

16. The apparatus of claim 8 , wherein the first data protection code is different from the second data protection code.

17. The apparatus of claim 16 , wherein the first low-level unit is unable to generate the second data protection code or a third data protection code, and the inability of the first low-level unit to generate the second data protection code or the third data protection code prevents the first low-level unit from generating a false message to be communicated to or processed by one or more of the second low-level unit or the second high-level unit.

18. The method of claim 1 , wherein the first low-level unit and the second low-level unit are free from having voting capabilities.

19. The method of claim 8 , wherein the first low-level unit and the second low-level unit are free from having voting capabilities.

20. The method of claim 15 , wherein the first low-level unit and the second low-level unit are free from having voting capabilities.

21. The method of claim 15 , further comprising:

communicating a first response message from the first low level unit to the first high level unit by way of the first channel, the first response message being generated by the first low level unit in response to the first message;

communicating a second response message from the second low level unit to the first high level unit in response to the second message, the second response message being generated by the second low level unit and communicated from the second low level unit to the first high level unit by way of the forwarding channel, the first low level unit, and the first channel; and

comparing the first response message and the second response message based, at least in part, on a determination that the first high level unit and the second high level unit have voting capabilities.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 13, 2016
From: SCHWELLNUS, CARL; KRIEGER, MARTIN
To: THALES CANADA INC.
Reel/Frame 040003/0161 →
Continuity (1)
Related Publication 20150371048A1 · Dec 24, 2015