FPGA mismatched packet stop for a safety system
A fault-tolerant failsafe computer voting system including a first voting module that generates a first key based on a comparison between a first data packet and a copy of a second data packet. The first voting module determines whether the first key and a second key are valid keys. The second data packet is a copy of the first data packet. A second voting module generates the second key based on a comparison between the second data packet and a copy of the first data packet. A processing module generates an outgoing data packet based on the first data packet in response to determining whether the first key and the second key are valid keys. The first voting module is inhibited from generating the second key and the second voting module is inhibited from generating the first key.
1. A fault-tolerant failsafe computer voting system comprising:
a first voting module that generates a first key based on a comparison between a first data packet and a copy of a second data packet and that determines whether the first key and a second key are valid keys, wherein the second data packet is a copy of the first data packet;
a second voting module that generates the second key based on a comparison between the second data packet and a copy of the first data packet; and
a processing module that, in response to determining whether the first key and the second key are valid keys, generates an outgoing data packet based on the first data packet, and
wherein the first voting module is inhibited from generating the second key and the second voting module is inhibited from generating the first key.
2. The system of claim 1 wherein the first voting module includes a first incoming voting module and an outgoing voting module and wherein the second voting module includes a second incoming voting module.
3. The system of claim 2 wherein the first incoming voting module generates the first key in response to the first incoming voting module determining that the first data packet is identical to the copy of the second data packet and wherein the first incoming voting module communicates the first data packet and the first key to the outgoing voting module.
4. The system of claim 3 wherein the second incoming voting module generates the second key in response to the second incoming voting module determining that the second data packet is identical to the copy of the first data packet and wherein the second incoming voting module communicates the second data packet and the second key to the outgoing voting module.
5. The system of claim 4 wherein the incoming voting module also communicates to the outgoing voting module a sequence number determined in accordance with the second data packet.
6. The system of claim 5 wherein the outgoing voting module determines if the first data packet is valid based on the first key and the second key.
7. The system of claim 5 wherein the outgoing voting module determines if the first data packet is valid based also on the sequence number.
8. The system of claim 7 wherein the outgoing voting module determines whether the first key is a valid key based on a determination that the first key is a complex key and wherein the outgoing voting module determines whether the second key is a valid key based on a determination that the second key is a complex key.
9. The system of claim 4 wherein the outgoing voting module determines if the first data packet is valid based on the first key and the second key.
10. The system of claim 9 wherein the outgoing voting module determines if the first data packet is valid also based on a sequence number.
11. The system of claim 10 wherein the outgoing voting module determines whether the first key is a valid key based on a determination that the first key is a complex key and wherein the outgoing voting module determines whether the second key is a valid key based on a determination that the second key is a complex key.
12. The system of claim 1 wherein the processing module communicates the outgoing data packet to at least one safety relevant component of a safety application.
13. The system of claim 12 wherein the outgoing data packet is the second data packet.
14. The system of claim 12 wherein the at least one component operates according to one or more data elements associated with the outgoing data packet.
15. The system of claim 1 wherein the first voting module discards the first data packet and generates a fault indication based on the first voting module determining that the first data packet and the copy of the second data packet are not identical.
16. The system of claim 1 wherein the second voting module discards the second data packet and generates a fault indication based on the second voting module determining that the second data packet and the copy of the first data packet are not identical.
17. The system of claim 1 wherein the first voting module discards the first data packet and generates a fault indication based on the first voting module determining that one of the first and second keys is not a valid key.
18. A method for fault-tolerant failsafe computer comprising:
receiving a first data packet and generating a second data packet based on a copy of the first data packet;
generating a first key based on a comparison between the first data packet and a copy of the second data packet and determining whether the first key and a second key are valid keys;
generating the second key based on a comparison between the second data packet and a copy of the first data packet; and
in response to the determination of whether the first key and the second key are valid keys, generating an outgoing data packet based on the first data packet.
19. A method of claim 18 further comprising inhibiting generation of the first key based on the first data packet and a copy of the second data packet and inhibiting generating the second key based on the second data packet and a copy of the first data packet.
20. The method of claim 18 further comprising generating the first key in response to determining that the first data packet is identical to the copy of the second data packet and communicating the first data packet and the first key.
21. The method of claim 20 further comprising generating the second key in response to determining that the second data packet is identical to the copy of the first data packet and communicating the second data packet and the second key.
22. The method of claim 21 further comprising communicating to the outgoing voting module a sequence number determined in accordance with the second data packet.
23. The method of claim 22 further comprising determining whether the first data packet is valid based on the first key and the second key.
24. The method of claim 23 further comprising determining if the first data packet is valid based also on the sequence number.
25. The method of claim 24 further comprising determining whether the second key is a valid key based on a determination that the second key is a complex key and wherein the outgoing voting module determines whether the second key is a valid key based on a determination that the second key is a complex key.
26. The method of claim 21 further comprising determining whether the first data packet is valid based on the first key and the second key.
27. The method of claim 26 further comprising determining if the first data packet is valid based also on the sequence number.
28. The method of claim 27 further comprising determining whether the second key is a valid key based on a determination that the second key is a complex key and wherein the outgoing voting module determines whether the second key is a valid key based on a determination that the second key is a complex key.
29. The method of claim 21 further comprising determining whether the first key is a valid key based on a determination that the first key is a complex key and determining whether the second key is a valid key based on a determination that the second key is a complex key.
30. The method of claim 18 further comprising communicating the outgoing data packet to a switch module and wherein the switch module communicates the outgoing data packet to at least one safety relevant component of a safety application.
31. The method of claim 30 further comprising operating at least one component according to one or more data elements associated with the outgoing data packet.
32. The method of claim 31 wherein the outgoing data packet is the second data packet.
33. The method of claim 18 further comprising disregarding the first data packet and generating a fault indication based on determining that the first data packet and the copy of the second data packet are not identical.
34. The method of claim 18 further comprising disregarding the second data packet and generating a fault indication based on determining that the second data packet and the copy of the first data packet are not identical.
35. The method of claim 18 further comprising disregarding the first data packet and generating a fault indication based on determining that one of the first and second keys is not a valid key.
36. A fault-tolerant failsafe computer voting system comprising:
a switch module that receives a first data packet and generates a second data packet based on a copy of the first data packet;
a first voting module that generates a first key based on a comparison between the first data packet and a copy of the second data packet and that determines whether the first key and a second key are valid keys;
a second voting module that generates the second key based on a comparison between the second data packet and a copy of the first data packet; and
a processing module that, in response to determining whether the first key and the second key are valid keys, generates an outgoing data packet based on the first data packet.
37. The system of claim 36 wherein the first voting module is inhibited from generating the second key and the second voting module is inhibited from generating the first key.
38. The system of claim 36 wherein the first voting module includes a first incoming voting module and an outgoing voting module and wherein the second voting module includes a second incoming voting module.
39. The system of claim 38 wherein the first incoming voting module generates the first key in response to the first incoming voting module determining that the first data packet is identical to the copy of the second data packet and wherein the first incoming voting module communicates the first data packet and the first key to the outgoing voting module.
40. The system of claim 39 wherein the second incoming voting module generates the second key in response to the second incoming voting module determining that the second data packet is identical to the copy of the first data packet and wherein the second incoming voting module communicates the second data packet and the second key to the outgoing voting module.
41. The system of claim 40 wherein the incoming voting module also communicates to the outgoing voting module a sequence number determined in accordance with the second data packet.
42. The system of claim 41 wherein the outgoing voting module determines if the first data packet is valid based on the first key and the second key.
43. The system of claim 41 wherein the outgoing voting module determines if the first data packet is valid based also on the sequence number.
44. The system of claim 43 wherein the outgoing voting module determines whether the first key is a valid key based on a determination that the first key is a complex key and wherein the outgoing voting module determines the second key is a valid key based on a determination that the second key is a complex key.
45. The system of claim 40 wherein the outgoing voting module determines if the first data packet is valid based on the first key and the second key.
46. The system of claim 45 wherein the outgoing voting module determines if the first data packet is valid also based on the sequence number.
47. The system of claim 46 wherein the outgoing voting module determines whether the first key is a valid key based on a determination that the first key is a complex key and wherein the outgoing voting module determines whether the second key is a valid key based on a determination that the second key is a complex key.
48. The system of claim 36 wherein the processing module communicates the outgoing data packet to the switch module and wherein the switch module communicates the outgoing data packet to at least one safety relevant component of a safety application.
49. The system of claim 48 wherein the outgoing data packet is the second data packet.
50. The system of claim 36 wherein the at least one component operates according to one or more data elements associated with the outgoing data packet.
51. The system of claim 36 wherein the first voting module discards the first data packet and generates a fault indication based on the first voting module determining that the first data packet and the copy of the second data packet are not identical.
52. The system of claim 36 wherein the second voting module discards the second data packet and generates a fault indication based on the second voting module determining that the second data packet and the copy of the first data packet are not identical.
53. The system of claim 36 wherein the first voting module discards the first data packet and generates a fault indication based on the first voting module determining that one of the first and second keys is not a valid key.