Back to results
US 10,585,412 B2Granted
Safety controller using hardware memory protection
AssigneeRockwell Automation Technologies, Inc.
InventorsJoseph P. Izzo, Nicholas L. Stay
Life of this patent
Estimating the term…
Abstract
Hardware memory management units are used in an integrated safety/non-safety industrial computer to allow shared memory architecture processors to implement safety and non-safety reduced risk of memory corruption. Testing of the memory management unit of the non-safety processor may provide a periodic writing to protected memory to invoke a protection fault providing a report to the safety processor.
Claims20
A safety industrial controller comprising:
- a first core including a first processing unit and a first hardware memory management unit;
- a second core including a second processing unit and a second hardware memory management unit;
- an electronic memory having a plurality of addresses electronically addressable by both the first and second processing units and holding a first and second program executable by the first and second processing, respectively;
- and
- I/O circuitry adapted to communicate between industrial actuators and sensors and the safety industrial controller including at least one of the first and second cores;
- wherein the first hardware memory management unit includes a first memory protection table and the second hardware memory management unit includes a second memory protection table, each of the first and second memory management units having entries mapping to addresses of the electronic memory and wherein the entries hold protection flags which when set block a writing to addresses of the entries;
- wherein the first processing unit executes the first program to:
- set protection flags in the first memory protection table to permit writing by the first processing unit to the electronic memory in a first region holding the first program,
- set protection flags in the first memory protection table to prohibit writing by the first processing unit to the electronic memory in a second region holding the second program, and
- periodically attempt to write to the second region;
- and
- wherein the second processing unit executes the second program to:
- set protection flags in the second memory protection table to permit writing by the second processing unit to the electronic memory in the second region holding the second program,
- set protection flags in the second memory protection table to prohibit writing by the second processing unit to the electronic memory in the first region holding the first program, and
- confirm that the first processing unit is blocked by its memory management unit from writing in the second region.
12 more elements
A method of providing integrated safety and non-safety control using a safety industrial controller having:
- a first core including a first processing unit and a first hardware memory management unit;
- a second core including a second processing unit and a second hardware memory management units;
- an electronic memory having a plurality of addresses electronically addressable by both the first and second processing units and holding a first and second program executable by the first and second processing units respectively;
- and
- I/O circuitry adapted to communicate between industrial actuators and sensors and the safety industrial controller including at least one of the first and second cores;
- wherein the first hardware memory management unit includes a first memory protection table and the second hardware memory management unit includes a second memory protection table, each of the first and second memory management units having entries mapping to addresses of the electronic memory and wherein the entries hold protection flags which once set up block a writing to addresses of the entries;
- the method including the steps of:
- operating the first core to:
- set protection flags in the first memory protection table to permit writing by the first processing unit to the electronic memory in a first region holding the first program,
- set protection flags in the first memory protection table to prohibit writing by the first processing unit to the electronic memory in a second region holding the second program, and
- periodically attempt to write to the second region;
- and
- operating the second core to:
- set protection flags in the second memory protection table to permit writing by the second processing unit to the electronic memory in the second region holding the second program,
- set protection flags in the second memory protection table to prohibit writing by the second processing unit to the electronic memory in the first region holding the first program, and
- confirm that the first core is blocked by its memory management unit from writing in the second region.
13 more elements
A computer architecture for a safety industrial controller:
- a first and second processor each including hardware memory management units;
- an electronic memory having a plurality of addresses electronically addressable by both the first and second processor and holding a first and second program executable by the first and second processors respectively;
- wherein the hardware memory management unit corresponding to the first processor manages a first memory protection table and the hardware memory management unit corresponding to the second processor manages a second memory protection table, each of the first and second memory management units having entries mapping to addresses of the electronic memory and wherein the entries hold protection flags which when set block a writing to addresses of the entries;
- wherein the first processor is configured to:
- (i) set protection flags in the first memory protection table to permit writing by the first processor to the electronic memory in a first region holding the first program and to prohibit writing by the first processor to the electronic memory in a second region holding the second program;
- and
- (ii) periodically attempt to write to the second region;
- and
- wherein the second processor is configured to:
- (i) set protection flags in the second memory protection table to permit writing by the second processor to the electronic memory in the second region holding the second program and to prohibit writing by the second processor to the electronic memory in the first region holding the first program;
- and
- (ii) confirm that the first processor is blocked by its memory management unit from writing in the second region.
9 more elements
Dependencies are inferred from the claim text.