Back to results
US 11,556,113 B2Granted
Safety industrial controller providing diversity in single multicore processor
AssigneeRockwell Automation Technologies, Inc.
InventorsJoseph P. Izzo, Michael J. Viste
Life of this patent
Estimating the term…
Abstract
Different cores of a multicore processor are used to provide diagnostics of sophisticated hardware without full redundancy by static assignment of the cores during individual cycles of the control program and comparison of the outputs. A method of automatically generating diverse programs for execution by these cores may modify one program to compile two different instructions without functionally changing that program through the use of DeMorgan equivalents and diverse compiler optimizations.
Claims20
A safety industrial controller for an industrial system comprising:
- a memory configured to store a first version of a control program for control of the industrial system and a second version of the control program for control of the industrial system;
- a first processing unit in communication with the memory and configured to execute the first version of the control program;
- and
- a second processing unit in communication with the memory and configured to execute the second version of the control program, wherein:
- the first and second processing units are configured to execute the first and second versions of the control program in parallel,
- the first version of the control program includes a first set of sequentially executing machine code instructions,
- the second version of the control program includes a second set of sequentially executing machine code instructions,
- both the first and second sets of sequentially executing machine code instructions include operators and operands,
- either the operators or the operands in the first set of sequentially executing machine code instructions is different than the operators or the operands in the second set of sequentially executing machine code instructions,
- the first set of sequentially executing machine code instructions is configured to generate a first set of output data for each cycle through the first set of sequentially executing machine code instructions,
- the second set of sequentially executing machine code instructions is configured to generate a second set of output data for each cycle through the second set of sequentially executing machine code instructions,
- the first set of output data is identical to the second set of output data for each cycle of execution, and
- the first processing unit or the second processing unit is configured to compare the first set of output data to the second set of output data for each cycle of execution to detect a failure of the safety industrial controller.
10 more elements
A method of operating a safety industrial controller for an industrial system, the method comprising the steps of:
- generating a first version of a control program for control of the industrial system;
- generating a second version of the control program for control of the industrial system,
- storing the first version and the second version of the control program in a memory, wherein:
- the first version of the control program includes a first set of sequentially executing machine code instructions,
- the second version of the control program includes a second set of sequentially executing machine code instructions,
- both the first and second sets of sequentially executing machine code instructions include operators and operands, and
- either the operators or the operands in the first set of sequentially executing machine code instructions is different than the operators or the operands in the second set of sequentially executing machine code instructions;
- reading the first version of the control program from the memory with a first processing unit;
- executing the first version of the control program on the first processing unit to generate a first set of output data for each cycle through the first version of the control program;
- reading the second version of the control program from the memory with a second processing unit;
- executing the second version of the control program on the second processing unit to generate a second set of output data for each cycle through the first version of the control program, wherein:
- the first and second processing units execute the first and second versions of the control program in parallel, and
- the first set of output data is identical to the second set of output data for each cycle through the first and second versions of the control program;
- and
- comparing the first set of output data to the second set of output data to detect a failure of the safety industrial controller for each cycle through the first and second versions of the control program.
12 more elements
A method of operating an industrial controller for an industrial system, the method comprising the steps of:
- generating a first version of a control program;
- generating a second version of the control program, wherein the first and second versions of the control program are diverse from each other such that operators and operands in the first and second control programs are different;
- storing each of the first and second versions of the control program in a memory of the industrial controller;
- reading the first version of the control program from the memory with a first processing unit;
- reading the second version of the control program from the memory with a second processing unit;
- executing the first and second versions of the control program in parallel on the first and second processing units to generate a first and second set of output data, respectively, wherein the first set of output data is identical to the second set of output data for each cycle of execution of the first and second versions of the control program;
- and
- comparing the first set of output data to the second set of output data to detect a failure of the industrial controller for each cycle of execution of the first and second versions of the control program.
5 more elements
Dependencies are inferred from the claim text.