# US 11,443,039 B2 · Controller computing system for preventing malicious control of a controlled machinery system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,443,039 B2 - Document ID: US11443039B2 - Status: Granted - Kind: B2 - Application number: 16/999,390 - Filed: 2020-08-21 - Published: 2022-02-24 - Granted: 2022-09-13 - Earliest claimed: 2020-08-21 - Assignees: Fathom5 Corporation - Applicants: Fathom5 Corporation - Inventors: Zachary Hayden Staples; David Alexander Burke; Jeffrey Ryan Latham - Web page: https://patentgrep.com/patent/US11443039B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/567: {using dedicated hardware} - H03K 19/003: Modifications for increasing the reliability {for protection} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H03K: PULSE TECHNIQUE (measuring pulse characteristics G01R; modulating sinusoidal oscillations with pulses H03C; transmission of digital information H04L; discriminator circuits detecting phase difference between two signals by counting or integrating cycles of oscillation H03D3/04; automatic control, starting, synchronisation or stabilisation of generators of electronic oscillations or pulses where the type of generator is irrelevant or unspecified H03L; coding, decoding or code conversion, in general H03M) ## Abstract A controller computing system, including a plurality of controllers, each controller configured to i) calculate a respective output based on a current set point and ii) output a timer signal; a cyber security manager (CSM) computing module configured to: output a nominal signal indicating that the current set point is a non-malicious set point when the CSM computing module receives each of the timer signals from each of the plurality of controllers; and output a reset signal indicating that the current set point is a malicious set point when the CSM computing module receives less than each of the timer signals from the plurality of controllers. ## Claims ### Claim 1 A controller computing system, including: a first controller configured to i) calculate a first output based on a current set point and ii) output a first timer signal; a second controller configured to i) calculate a second output based on the current set point and ii) output a second timer signal; a third controller configured to i) calculate a third output based on the current set point and ii) output a third timer signal; a fourth controller configured to i) calculate a fourth output based on a previous set point and ii) output a fourth timer signal; an enhanced time delay buffer configured to delay reception of the current set point by the fourth controller; a cyber security manager (CSM) computing module configured to: when each of the first timer signal, the second timer signal, and the third timer signal are received, output a nominal signal; and when two or less of the first timer signal, the second timer signal, and the third timer signal are received, output a reset signal; an enhanced voter computing module configured to: when the nominal signal is received from the CSM computing module, i) identify a majority based on the first output, the second output, and the third output, and ii) generate a voter output based on the identified majority; and when the reset signal is received from the CSM computing module, generate the voter output based on the fourth output. ### Claim 2 (depends on 1) The controller computing system of claim 1, wherein the CSM computing module is further configured to, when two or less of the first timer signal, the second timer signal, and the third timer signal are received, output an out of band signal, wherein the enhanced time delay buffer is further configured to receive the out of band signal, and in response, drop a time delay of the fourth controller such that the fourth controller outputs the fourth output to the enhanced voter computing module. ### Claim 3 (depends on 2) The controller computing system of claim 2, wherein each of the first controller, the second controller, and the third controller are further configured to receive the out of band signal, and in response, restart one or more of the first controller, the second controller, and the third controller. ### Claim 4 (depends on 3) The controller computing system of claim 3, wherein when the CSM computing module receives only the first and the second timer signal, the CSM computing module is configured to output the out of band signal to command the third controller to restart. ### Claim 5 (depends on 3) The controller computing system of claim 3, wherein when the CSM computing module receives only the first timer signal, the CSM computing module is configured to output the out of band signal to command the first controller to restart. ### Claim 6 (depends on 2) The controller computing system of claim 2, wherein the fourth controller stores the fourth output in a queue, and provides the fourth output in response to the drop time delay signal from the enhanced time delay buffer. ### Claim 7 (depends on 1) The controller computing system of claim 1, wherein the first controller includes a first memory diversification, the second controller includes a second memory diversification, the third controller includes a third memory diversification, and the fourth controller includes a fourth memory diversification, wherein each of the first memory diversification, the second memory diversification, the third memory diversification, and the fourth memory diversification are different. ### Claim 8 (depends on 7) The controller computing system of claim 7, wherein, when the CSM computing module outputs the nominal signal, the first output, the second output, and the third output are all substantially the same. ### Claim 9 (depends on 1) The controller computing system of claim 1, wherein the first controller generates the first timer signal i) in response to generating the first output and ii) within a time threshold. ### Claim 10 A controller computing system, including: a plurality of controllers, each controller configured to i) calculate a respective output based on a current set point and ii) output a timer signal; an additional controller configured to i) calculate an additional output based on a previous set point and ii) output an additional timer signal; a cyber security manager (CSM) computing module configured to: output a nominal signal indicating that the current set point is a non-malicious set point when the CSM computing module receives each of the timer signals from each of the plurality of controllers, and the additional output from the additional controller; and output a reset signal indicating that the current set point is a malicious set point when the CSM computing module receives less than each of the timer signals from the plurality of controllers; an enhanced voter computing module configured to: when the nominal signal is received from the CSM computing module, i) identify a majority based on each of the outputs of the respective controllers and the additional output of the additional controller, and ii) generate a voter output based on the identified majority, and when the reset signal is received from the CSM computing module, generate the voter output based on the additional output. ### Claim 11 (depends on 10) The controller computing system of claim 10, wherein the CSM computing module is further configured to, when each of the timer signals is not received from each of the plurality of controllers, output an out of band signal. ### Claim 12 (depends on 11) The controller computing system of claim 11, wherein each of the plurality of controllers are further configured to receive the out of band signal, and in response, restart one or more of each of the plurality of controllers. ### Claim 13 (depends on 10) The controller computing system of claim 10, wherein a memory diversification of each of the plurality of controllers is substantially different. ### Claim 14 A controller computing system, including: a first controller configured to calculate a first output based on a current set point; a second controller configured to calculate a second output based on the current set point; a third controller configured to calculate a third output based on the current set point; a fourth controller configured to calculate a fourth output based on a previous set point; an enhanced time delay buffer configured to delay reception of the current set point by the fourth controller; an enhanced voter computing module configured to: when a nominal set point is detected i) identify a majority based on the first output, the second output, and the third output, and ii) generate a voter output based on the identified majority; and when a malicious set point is detected, generate the voter output based on the fourth output. ### Claim 15 (depends on 14) The controller computing system of claim 14, the enhanced time delay buffer further configured to receive an out of band signal and in response, drop a time delay of the fourth controller such that the fourth controller outputs the fourth output to the enhanced voter computing module. ### Claim 16 (depends on 15) The controller computing system of claim 15, wherein each of the first controller, the second controller, and the third controller are further configured to receive the out of band signal, and in response, restart one or more of the first controller, the second controller, and the third controller. ### Claim 17 (depends on 15) The controller computing system of claim 15, wherein the fourth controller stores the fourth output in a queue, and provides the fourth output in response to the drop time delay signal from the enhanced time delay buffer. ### Claim 18 (depends on 14) The controller computing system of claim 14, wherein the first controller includes a first memory diversification, the second controller includes a second memory diversification, the third controller includes a third memory diversification, and the fourth controller includes a fourth memory diversification, wherein each of the first memory diversification, the second memory diversification, the third memory diversification, and the fourth memory diversification are different. ### Claim 19 (depends on 18) The controller computing system of claim 18, wherein the first output, the second output, and the third output are all substantially the same.