HARDWARE IMPLEMENTATION FOR DETECTING FUNCTIONAL SAFETY STATES USING TERNARY STATE TRANSLATION

1 . A method comprising:

receiving, from a device, by a first microcontroller, an input signal having a value;

generating an adjusted value by adjusting the value to an adjusted value within a range of tolerance of a state determination system;

determining a first range of the adjusted value, the first range being within one of an asserted range, an unasserted range, or a fault range;

comparing the first range to a second range, the second range derived based on one or more of a different input signal or a different microcontroller;

determining a result of the comparison, the result being an asserted state where the first range and the second range both are within an asserted range, the result being an unasserted state where the first range and the second range are both within an unasserted range, and the result otherwise being a fault state; and

outputting the result to an output controller.

2 . The method of claim 1 , wherein the second range is derived based on a second microcontroller, wherein the comparing of the first range to the second range is a first comparison, and wherein the method further comprises:

performing a second comparison by comparing the first range to a third range derived based on the different input signal;

performing a third comparison by comparing the first range to a fourth range derived from a different application across the first microcontroller; and

performing a fourth comparison by comparing the second range to a fifth range derived from a different application across the second microcontroller.

3 . The method of claim 2 , further comprising:

generating a first fault indicator based on the first comparison;

generating a second fault indicator based on the second comparison;

generating a third fault indicator based on the third comparison; and

generating a fourth fault indicator based on the third comparison.

4 . The method of claim 3 , further comprising:

comparing each fault indicator to encoded fault indicator values, the encoded fault indicator values each having a hamming distance of 4 from one another;

determining whether a fault indicator does not match an encoded fault indicator value; and

in response to determining that a fault indicator does not match an encoded fault indicator value:

determining that an error has occurred by way of overwrite of a value; and

assigning the result output to the controller to be a safe state.

5 . The method of claim 4 , wherein the input signal corresponds to an emergency stop control, and wherein the fault range is a safety range known to correspond to a safety state.

6 . The method of claim 1 , wherein the fault range is an undefined range that indicates an error.

7 . The method of claim 1 , wherein the device is a vehicle having a voltage converted to a ternary state using thresholds corresponding to each range of the ternary state.

8 . The method of claim 1 , wherein the adjusted value has an analog value, and wherein the method further comprises using a hardware abstraction layer to convert the analog value into a ternary value.

9 . The method of claim 1 , wherein different candidate ranges of values ensures diversity when performing comparisons between microcontrollers.

10 . A non-transitory computer-readable medium comprising memory with instructions encoded thereon, the instructions, when executed by one or more processors, causing the one or more processors to perform operations, the instructions comprising instructions to:

receive, from a device, by a first microcontroller, an input signal having a value;

generate an adjusted value by adjusting the value to an adjusted value within a range of tolerance of a state determination system;

determine a first range of the adjusted value, the first range being within one of an asserted range, an unasserted range, or a fault range;

compare the first range to a second range, the second range derived based on one or more of a different input signal or a different microcontroller;

determine a result of the comparison, the result being an asserted state where the first range and the second range both are within an asserted range, the result being an unasserted state where the first range and the second range are both within an unasserted range, and the result otherwise being a fault state; and

output the result to an output controller.

11 . The non-transitory computer-readable medium of claim 10 , wherein the second range is derived based on a second microcontroller, wherein the comparing of the first range to the second range is a first comparison, and wherein the instructions further comprise instructions to:

perform a second comparison by comparing the first range to a third range derived based on the different input signal;

perform a third comparison by comparing the first range to a fourth range derived from a different application across the first microcontroller; and

perform a fourth comparison by comparing the second range to a fifth range derived from a different application across the second microcontroller.

12 . The non-transitory computer-readable medium of claim 11 , the instructions further comprising instructions to:

generate a first fault indicator based on the first comparison;

generate a second fault indicator based on the second comparison;

generate a third fault indicator based on the third comparison; and

generate a fourth fault indicator based on the third comparison.

13 . The non-transitory computer-readable medium of claim 12 , the instructions further comprising instructions to:

compare each fault indicator to encoded fault indicator values, the encoded fault indicator values each having a hamming distance of 4 from one another;

determine whether a fault indicator does not match an encoded fault indicator value; and

in response to determining that a fault indicator does not match an encoded fault indicator value:

determine that an error has occurred by way of overwrite of a value; and

assign the result output to the controller to be a safe state.

14 . The non-transitory computer-readable medium of claim 13 , wherein the input signal corresponds to an emergency stop control, and wherein the fault range is a safety range known to correspond to a safe state.

15 . The non-transitory computer-readable medium of claim 10 , wherein the fault range is an undefined range that indicates an error.

16 . The non-transitory computer-readable medium of claim 10 , wherein the device is a vehicle having a voltage converted to a ternary state using thresholds corresponding to each range of the ternary state.

17 . The non-transitory computer-readable medium of claim 10 , wherein the adjusted value has an analog value, and wherein the instructions further comprise instructions to use a hardware abstraction layer to convert the analog value into a ternary value.

18 . The non-transitory computer-readable medium of claim 10 , wherein different candidate ranges of values ensures diversity when performing comparisons between microcontrollers.

19 . A system comprising:

memory with instructions encoded thereon; and

one or more processors that, when executing the instructions, are caused to perform operations comprising:

receiving, from a device, by a first microcontroller, an input signal having a value;

generating an adjusted value by adjusting the value to an adjusted value within a range of tolerance of a state determination system;

determining a first range of the adjusted value, the first range being within one of an asserted range, an unasserted range, or a fault range;

comparing the first range to a second range, the second range derived based on one or more of a different input signal or a different microcontroller;

determining a result of the comparison, the result being an asserted state where the first range and the second range both are within an asserted range, the result being an unasserted state where the first range and the second range are both within an unasserted range, and the result otherwise being a fault state; and

outputting the result to an output controller.

20 . The system of claim 19 , wherein the second range is derived based on a second microcontroller, wherein the comparing of the first range to the second range is a first comparison, and wherein the operations further comprise:

performing a second comparison by comparing the first range to a third range derived based on the different input signal;

performing a third comparison by comparing the first range to a fourth range derived from a different application across the first microcontroller; and

performing a fourth comparison by comparing the second range to a fifth range derived from a different application across the second microcontroller.