# US 10,372,579 B2 · FPGA mismatched packet stop for a safety system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,372,579 B2
- Document ID: US10372579B2
- Status: Granted
- Kind: B2
- Application number: 15/455,619
- Filed: 2017-03-10
- Published: 2018-09-13
- Granted: 2019-08-06
- Earliest claimed: 2017-03-10
- Assignees: Artesyn Embedded Computing, Inc.
- Applicants: Artesyn Embedded Computing, Inc.
- Inventors: Gary Perkins; Malcolm J. Rush; Andrew Porter
- Web page: https://patentgrep.com/patent/US10372579B2

## CPC

- G06F 11/3409: {for performance assessment}
- G06F 11/0739: {in a data processing system embedded in automotive or aircraft systems}
- G06F 11/0796: {Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element}
- G06F 11/1641: {where the comparison is not performed by the redundant processing components}
- G06F 11/277: with comparison between actual response and known fault-free response
- G06F 11/3013: {where the computing system is an embedded system, i.e. a combination of hardware and software dedicated to perform a certain function in mobile devices, printers, automotive or aircraft systems (testing or monitoring of control systems or parts thereof G05B23/02)}
- G06F 11/3055: {Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available (error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction of the data by redundancy in operations G06F11/14; error detection or correction by redundancy in hardware G06F11/16)}
- G06F 11/3495: {for systems}
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L 69/22: Parsing or analysis of headers
- H04L 69/40: for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A fault-tolerant failsafe computer voting system including a first voting module that generates a first key based on a comparison between a first data packet and a copy of a second data packet. The first voting module determines whether the first key and a second key are valid keys. The second data packet is a copy of the first data packet. A second voting module generates the second key based on a comparison between the second data packet and a copy of the first data packet. A processing module generates an outgoing data packet based on the first data packet in response to determining whether the first key and the second key are valid keys. The first voting module is inhibited from generating the second key and the second voting module is inhibited from generating the first key.

## Claims

### Claim 1

A fault-tolerant failsafe computer voting system comprising:
a first voting module that generates a first key based on a comparison between a first data packet and a copy of a second data packet and that determines whether the first key and a second key are valid keys, wherein the second data packet is a copy of the first data packet;
a second voting module that generates the second key based on a comparison between the second data packet and a copy of the first data packet; and
a processing module that, in response to determining whether the first key and the second key are valid keys, generates an outgoing data packet based on the first data packet, and
wherein the first voting module is inhibited from generating the second key and the second voting module is inhibited from generating the first key.

### Claim 2 (depends on 1)

The system of claim 1 wherein the first voting module includes a first incoming voting module and an outgoing voting module and wherein the second voting module includes a second incoming voting module.

### Claim 3 (depends on 2)

The system of claim 2 wherein the first incoming voting module generates the first key in response to the first incoming voting module determining that the first data packet is identical to the copy of the second data packet and wherein the first incoming voting module communicates the first data packet and the first key to the outgoing voting module.

### Claim 4 (depends on 3)

The system of claim 3 wherein the second incoming voting module generates the second key in response to the second incoming voting module determining that the second data packet is identical to the copy of the first data packet and wherein the second incoming voting module communicates the second data packet and the second key to the outgoing voting module.

### Claim 5 (depends on 4)

The system of claim 4 wherein the incoming voting module also communicates to the outgoing voting module a sequence number determined in accordance with the second data packet.

### Claim 6 (depends on 5)

The system of claim 5 wherein the outgoing voting module determines if the first data packet is valid based on the first key and the second key.

### Claim 7 (depends on 5)

The system of claim 5 wherein the outgoing voting module determines if the first data packet is valid based also on the sequence number.

### Claim 8 (depends on 7)

The system of claim 7 wherein the outgoing voting module determines whether the first key is a valid key based on a determination that the first key is a complex key and wherein the outgoing voting module determines whether the second key is a valid key based on a determination that the second key is a complex key.

### Claim 9 (depends on 4)

The system of claim 4 wherein the outgoing voting module determines if the first data packet is valid based on the first key and the second key.

### Claim 10 (depends on 9)

The system of claim 9 wherein the outgoing voting module determines if the first data packet is valid also based on a sequence number.

### Claim 11 (depends on 10)

The system of claim 10 wherein the outgoing voting module determines whether the first key is a valid key based on a determination that the first key is a complex key and wherein the outgoing voting module determines whether the second key is a valid key based on a determination that the second key is a complex key.

### Claim 12 (depends on 1)

The system of claim 1 wherein the processing module communicates the outgoing data packet to at least one safety relevant component of a safety application.

### Claim 13 (depends on 12)

The system of claim 12 wherein the outgoing data packet is the second data packet.

### Claim 14 (depends on 12)

The system of claim 12 wherein the at least one component operates according to one or more data elements associated with the outgoing data packet.

### Claim 15 (depends on 1)

The system of claim 1 wherein the first voting module discards the first data packet and generates a fault indication based on the first voting module determining that the first data packet and the copy of the second data packet are not identical.

### Claim 16 (depends on 1)

The system of claim 1 wherein the second voting module discards the second data packet and generates a fault indication based on the second voting module determining that the second data packet and the copy of the first data packet are not identical.

### Claim 17 (depends on 1)

The system of claim 1 wherein the first voting module discards the first data packet and generates a fault indication based on the first voting module determining that one of the first and second keys is not a valid key.

### Claim 18

A method for fault-tolerant failsafe computer comprising:
receiving a first data packet and generating a second data packet based on a copy of the first data packet;
generating a first key based on a comparison between the first data packet and a copy of the second data packet and determining whether the first key and a second key are valid keys;
generating the second key based on a comparison between the second data packet and a copy of the first data packet; and
in response to the determination of whether the first key and the second key are valid keys, generating an outgoing data packet based on the first data packet.

### Claim 19 (depends on 18)

A method of claim 18 further comprising inhibiting generation of the first key based on the first data packet and a copy of the second data packet and inhibiting generating the second key based on the second data packet and a copy of the first data packet.

### Claim 20 (depends on 18)

The method of claim 18 further comprising generating the first key in response to determining that the first data packet is identical to the copy of the second data packet and communicating the first data packet and the first key.

### Claim 21 (depends on 20)

The method of claim 20 further comprising generating the second key in response to determining that the second data packet is identical to the copy of the first data packet and communicating the second data packet and the second key.

### Claim 22 (depends on 21)

The method of claim 21 further comprising communicating to the outgoing voting module a sequence number determined in accordance with the second data packet.

### Claim 23 (depends on 22)

The method of claim 22 further comprising determining whether the first data packet is valid based on the first key and the second key.

### Claim 24 (depends on 23)

The method of claim 23 further comprising determining if the first data packet is valid based also on the sequence number.

### Claim 25 (depends on 24)

The method of claim 24 further comprising determining whether the second key is a valid key based on a determination that the second key is a complex key and wherein the outgoing voting module determines whether the second key is a valid key based on a determination that the second key is a complex key.

### Claim 26 (depends on 21)

The method of claim 21 further comprising determining whether the first data packet is valid based on the first key and the second key.

### Claim 27 (depends on 26)

The method of claim 26 further comprising determining if the first data packet is valid based also on the sequence number.

### Claim 28 (depends on 27)

The method of claim 27 further comprising determining whether the second key is a valid key based on a determination that the second key is a complex key and wherein the outgoing voting module determines whether the second key is a valid key based on a determination that the second key is a complex key.

### Claim 29 (depends on 21)

The method of claim 21 further comprising determining whether the first key is a valid key based on a determination that the first key is a complex key and determining whether the second key is a valid key based on a determination that the second key is a complex key.

### Claim 30 (depends on 18)

The method of claim 18 further comprising communicating the outgoing data packet to a switch module and wherein the switch module communicates the outgoing data packet to at least one safety relevant component of a safety application.

### Claim 31 (depends on 30)

The method of claim 30 further comprising operating at least one component according to one or more data elements associated with the outgoing data packet.

### Claim 32 (depends on 31)

The method of claim 31 wherein the outgoing data packet is the second data packet.

### Claim 33 (depends on 18)

The method of claim 18 further comprising disregarding the first data packet and generating a fault indication based on determining that the first data packet and the copy of the second data packet are not identical.

### Claim 34 (depends on 18)

The method of claim 18 further comprising disregarding the second data packet and generating a fault indication based on determining that the second data packet and the copy of the first data packet are not identical.

### Claim 35 (depends on 18)

The method of claim 18 further comprising disregarding the first data packet and generating a fault indication based on determining that one of the first and second keys is not a valid key.

### Claim 36

A fault-tolerant failsafe computer voting system comprising:
a switch module that receives a first data packet and generates a second data packet based on a copy of the first data packet;
a first voting module that generates a first key based on a comparison between the first data packet and a copy of the second data packet and that determines whether the first key and a second key are valid keys;
a second voting module that generates the second key based on a comparison between the second data packet and a copy of the first data packet; and
a processing module that, in response to determining whether the first key and the second key are valid keys, generates an outgoing data packet based on the first data packet.

### Claim 37 (depends on 36)

The system of claim 36 wherein the first voting module is inhibited from generating the second key and the second voting module is inhibited from generating the first key.

### Claim 38 (depends on 36)

The system of claim 36 wherein the first voting module includes a first incoming voting module and an outgoing voting module and wherein the second voting module includes a second incoming voting module.

### Claim 39 (depends on 38)

The system of claim 38 wherein the first incoming voting module generates the first key in response to the first incoming voting module determining that the first data packet is identical to the copy of the second data packet and wherein the first incoming voting module communicates the first data packet and the first key to the outgoing voting module.

### Claim 40 (depends on 39)

The system of claim 39 wherein the second incoming voting module generates the second key in response to the second incoming voting module determining that the second data packet is identical to the copy of the first data packet and wherein the second incoming voting module communicates the second data packet and the second key to the outgoing voting module.

### Claim 41 (depends on 40)

The system of claim 40 wherein the incoming voting module also communicates to the outgoing voting module a sequence number determined in accordance with the second data packet.

### Claim 42 (depends on 41)

The system of claim 41 wherein the outgoing voting module determines if the first data packet is valid based on the first key and the second key.

### Claim 43 (depends on 41)

The system of claim 41 wherein the outgoing voting module determines if the first data packet is valid based also on the sequence number.

### Claim 44 (depends on 43)

The system of claim 43 wherein the outgoing voting module determines whether the first key is a valid key based on a determination that the first key is a complex key and wherein the outgoing voting module determines the second key is a valid key based on a determination that the second key is a complex key.

### Claim 45 (depends on 40)

The system of claim 40 wherein the outgoing voting module determines if the first data packet is valid based on the first key and the second key.

### Claim 46 (depends on 45)

The system of claim 45 wherein the outgoing voting module determines if the first data packet is valid also based on the sequence number.

### Claim 47 (depends on 46)

The system of claim 46 wherein the outgoing voting module determines whether the first key is a valid key based on a determination that the first key is a complex key and wherein the outgoing voting module determines whether the second key is a valid key based on a determination that the second key is a complex key.

### Claim 48 (depends on 36)

The system of claim 36 wherein the processing module communicates the outgoing data packet to the switch module and wherein the switch module communicates the outgoing data packet to at least one safety relevant component of a safety application.

### Claim 49 (depends on 48)

The system of claim 48 wherein the outgoing data packet is the second data packet.

### Claim 50 (depends on 36)

The system of claim 36 wherein the at least one component operates according to one or more data elements associated with the outgoing data packet.

### Claim 51 (depends on 36)

The system of claim 36 wherein the first voting module discards the first data packet and generates a fault indication based on the first voting module determining that the first data packet and the copy of the second data packet are not identical.

### Claim 52 (depends on 36)

The system of claim 36 wherein the second voting module discards the second data packet and generates a fault indication based on the second voting module determining that the second data packet and the copy of the first data packet are not identical.

### Claim 53 (depends on 36)

The system of claim 36 wherein the first voting module discards the first data packet and generates a fault indication based on the first voting module determining that one of the first and second keys is not a valid key.