System and method for safety message latency characterization
A method comprising: accessing a response mapping defining a set of safety-critical functions associated with a safety-critical latency threshold and a set of safety responses, each safety response corresponding to a safety-critical function; executing a time-synchronization protocol with a transmitting system to calculate a clock reference; accessing a safety message schedule indicating an expected arrival time for each safety message in a series of safety messages based on the clock reference; for each safety message in the series of safety messages, calculating a latency of the safety message based on an arrival time of the safety message and the expected arrival time; and in response to a latency of a current safety message in the series of safety messages exceeding the safety-critical latency threshold, initiating the safety response corresponding to the safety-critical function for each safety-critical function in the set of safety-critical functions.
1. A method comprising, at a receiving system in communication with a transmitting system via a communication link:
accessing a response mapping for the receiving system defining:
a set of safety-critical functions of the receiving system associated with a safety-critical latency threshold; and
a set of safety responses, each safety response in the set of safety responses corresponding to a safety-critical function in the set of safety-critical functions;
accessing a safety message schedule indicating an expected arrival time for each safety message in a series of safety messages based on a clock reference for the transmitting system;
for each safety message in the series of safety messages:
calculating an arrival time of the safety message; and
calculating a latency of the safety message based on the arrival time of the safety message and the expected arrival time of the safety message; and
in response to a latency of a current safety message in the series of safety messages exceeding the safety-critical latency threshold, initiating the safety response corresponding to the safety-critical function for each safety-critical function in the set of safety-critical functions.
2. The method of claim 1 , wherein accessing the safety message schedule comprises accessing the safety message schedule indicating the expected arrival time for each safety message in the series of safety messages based on:
the clock reference; and
a safety message period greater than the safety-critical latency threshold.
3. The method of claim 2 , wherein calculating the latency of the safety message comprises, for each safety message in the series of safety messages:
calculating the expected arrival time of the safety message based on a sum of the safety message period and an arrival time of a preceding safety message; and
calculating a current latency of the safety message based on a difference of the expected arrival time of the safety message and the arrival time of the safety message.
4. The method of claim 2 , wherein calculating the latency of the safety message comprises, for each safety message in the series of safety messages, calculating a cumulative latency over a set of preceding safety messages equal to a window size.
5. The method of claim 4 , wherein calculating the cumulative latency comprises:
calculating a current latency for each preceding safety message in the set of preceding safety messages based on a difference between the safety message period and a measured safety message period for the preceding safety message; and
summing the current latency for each preceding safety message in the set of preceding safety messages.
6. The method of claim 1 :
wherein accessing the response mapping comprises accessing the response mapping for the receiving system defining:
a set of real-time-response-critical functions of the receiving system associated with a real-time-response-critical latency threshold;
the set of safety-critical functions of the receiving system associated with the safety-critical latency threshold less than the real-time-response-critical latency threshold; and
the set of safety responses; and
further comprising, in response to the latency of the current safety message exceeding the real-time-response-critical latency threshold, halting the set of real-time-response-critical functions.
7. The method of claim 1 :
wherein accessing the response mapping for the receiving system comprises accessing the response mapping for the receiving system defining:
a set of response-critical functions of the receiving system;
the set of safety-critical functions; and
the set of safety responses; and
further comprising, in response to the latency of the current safety message exceeding a safety message period, halting the set of response-critical functions.
8. The method of claim 1 , wherein executing the time-synchronization protocol comprises:
transmitting a latency measurement request message to the transmitting system;
receiving a latency measurement response message comprising a local clock reference of the transmitting system; and
generating the clock reference for the transmitting based on the local clock reference of the transmitting system and a departure time of the latency measurement request message.
9. The method of claim 1 , further comprising:
executing a time-synchronization protocol with the transmitting system to calculate the clock reference; and
in response to the latency of the current safety message exceeding the safety-critical latency threshold:
invalidating the clock reference; and
reinitiating the time-synchronization protocol.
10. The method of claim 1 , wherein initiating the safety response comprises, for a safety-critical function in the set of safety-critical functions, transitioning the safety-critical function into a safety mode.
11. The method of claim 10 , wherein transitioning the safety-critical function into the safety mode comprises:
selecting the safety mode from a set of safety modes based on an operational state of the receiving system; and
transitioning the safety-critical function into the safety mode.
12. The method of claim 1 , wherein initiating the safety response comprises transitioning to an alternative communication link between the receiving system and the transmitting system.
13. The method of claim 1 :
wherein accessing the response mapping comprises accessing the response mapping for the receiving system defining:
a set of real-time-response-critical functions of the receiving system associated with a real-time-response-critical latency threshold;
a set of restricted modes, each restricted mode in the set of restricted modes corresponding to a real-time-response-critical function in the set of real-time-response-critical functions;
the set of safety-critical functions of the receiving system associated with the safety-critical latency threshold less than the real-time-response-critical latency threshold; and
the set of safety responses; and
further comprising, in response to the latency of the current safety message exceeding the safety-critical latency threshold and the real-time-response-critical latency threshold, initiating the restricted mode corresponding to the real-time-response-critical function for each real-time-response-critical function in the set of real-time-response-critical functions.
14. The method of claim 13 :
wherein accessing the response mapping comprises accessing the response mapping for the receiving system defining:
the set of real-time-response-critical functions;
the set of restricted modes, each restricted mode in the set of restricted modes defining a series of restriction levels, each restriction level corresponding to a latency range;
the set of safety-critical functions of the receiving system associated with the safety-critical latency threshold less than the real-time-response-critical latency threshold; and
the set of safety responses; and
wherein initiating the restricted mode comprises:
selecting a restriction level in the series of restriction levels for the restricted mode corresponding to the real-time-response-critical function based on the latency of the current safety message and the latency range corresponding to each restriction level in the series of restriction level; and
initiating the restricted mode characterized by the restriction level.
15. A method comprising, at a receiving system in communication with a transmitting system via a communication link:
accessing a response mapping for the receiving system defining:
a set of real-time-response-critical functions of the receiving system associated with a real-time-response latency threshold; and
a set of restricted modes, each restricted mode in the set of restricted modes corresponding to a real-time-response-critical function in the set of real-time-response-critical functions;
accessing a safety message schedule indicating an expected arrival time for each safety message in a series of safety messages based on a clock reference for the transmitting system;
for each safety message in the series of safety messages:
calculating an arrival time of the safety message; and
calculating a latency of the safety message based on the arrival time and the expected arrival time; and
in response to a latency of a current safety message in the series of safety messages exceeding the real-time-response-critical latency threshold, initiating the restricted mode corresponding to the real-time-response-critical function for each real-time-response-critical function in the set of real-time-response-critical functions.
16. The method of claim 15 :
wherein accessing the response mapping comprises accessing the response mapping for the receiving system defining:
the set of real-time-response-critical functions; and
the set of restricted modes, each restricted mode in the set of restricted modes defining a series of restriction levels, each restriction level corresponding to a latency range; and
wherein initiating the restricted mode comprises:
selecting a restriction level in the series of restriction levels for the restricted mode corresponding to the real-time-response-critical function based on the latency of the current safety message and the latency range corresponding to each restriction level in the series of restriction level; and
initiating the restricted mode characterized by the restriction level.
17. The method of claim 15 , further comprising:
executing a time-synchronization protocol with the transmitting system to calculate the clock reference; and
in response to the latency of the current safety message exceeding the safety-critical latency threshold:
invalidating the clock reference; and
reinitiating the time-synchronization protocol.
18. The method of claim 15 , wherein accessing the safety message schedule comprises generating the safety message schedule based on configuration parameters received from the transmitting system.
19. A method comprising, at a receiving system in communication with a transmitting system via a communication link:
accessing a safety message schedule indicating an expected arrival time for each safety message in a series of safety messages based on a clock reference for the transmitting system;
for each safety message in the series of safety messages:
calculating an arrival time of the safety message; and
calculating a latency of the safety message based on the arrival time of the safety message and the expected arrival time of the safety message; and
in response to a latency of a current safety message in the series of safety messages exceeding a safety-critical latency threshold associated with a safety function of the receiving system, initiating a safety response corresponding to the safety-critical function.
20. The method of claim 19 , further comprising halting a real-time-response-critical function of the receiving system in response to the latency of the current safety message exceeding a real-time-response-critical latency threshold associated with the real-time-response-critical function.