Back to results
US RE49,043 E1Granted
Apparatus and method for communications in a safety critical system
AssigneeThales Canada Inc.
InventorsCarl Schwellnus, Martin Krieger
Life of this patent
Estimating the term…
Abstract
A safety communication scheme for a safety-critical system which includes two or more higher level units that have voting capabilities and one or two sets of lower level units that do not have voting capabilities, involves using one channel between the high and low level units for safety and two channels for redundancy.
Claims25
A method executed by at least one processor, the method comprising:
- generating a first message and a first data protection code corresponding to the first message by a first high level unit, the first high level unit being coupled to a second high level unit by at least one comparison channel, the first message comprising content agreed upon between the first high level unit and the second high level unit through a first voting process;
- communicating the first message and the first data protection code from the a first high level unit to a first low level unit coupled to the first high level unit by a first channel, the first message comprising content agreed upon between the first high level unit and a second high level unit, the first message being communicated from the first high level unit to the first low level unit by way of the first channel;
- generating a second message and a second data protection code corresponding to the second message by the first high level unit, the second message comprising content agreed upon between the first high level unit and the second high level unit through a second voting process;
- communicating the second message and the second data protection code from the first high level unit to a second low level unit coupled to the first low level unit by a forwarding channel, the second message comprising content agreed upon between the first high level unit and the second high level unit, the second message being communicated from the first high level unit to the second low level unit by way of the first channel, the first low level unit, and the forwarding channel;
- communicating a first response message from the first low level unit to the first high level unit by way of the first channel, the first response message being generated by the first low level unit in response to the first message;
- communicating a second response message from the second low level unit to the first high level unit in response to the second message, the second response message being generated by the second low level unit and communicated from the second low level unit to the first high level unit by way of the forwarding channel, the first low level unit, and the first channel;
- and
- comparing the first response message and the second response message based, at least in part, on a determination that the first high level unit and the second high level unit have voting capabilities,
- wherein the first data protection code and the second data protection code prevent unauthorized alteration of the first message or and the second message, respectively.
6 more elements
An apparatus, comprising:
- at least one processor;
- and
- at least one memory including computer program code for one or more programs,
- the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to:
- generate a first message and a first data protection code corresponding to the first message by a first high level unit, the first high level unit being coupled to a second high level unit by at least one comparison channel, the first message comprising content agreed upon between the first high level unit and the second high level unit through a first voting process;
- communicate the first message and the first data protection code from the a first high level unit to a first low level unit coupled to the first high level unit by a first channel, the first message comprising content agreed upon between the first high level unit and a second high level unit, the first message being communicated from the first high level unit to the first low level unit by way of the first channel;
- generate a second message and a second data protection code corresponding to the second message by the first high level unit, the second message comprising content agreed upon between the first high level unit and the second high level unit through a second voting process;
- communicate the second message and the second data protection code from the first high level unit to a second low level unit coupled to the first low level unit by a forwarding channel, the second message comprising content agreed upon between the first high level unit and the second high level unit, the second message being communicated from the first high level unit to the second low level unit by way of the first channel, the first low level unit, and the forwarding channel;
- communicate a first response message from the first low level unit to the first high level unit by way of the first channel, the first response message being generated by the first low level unit in response to the first message;
- communicate a second response message from the second low level unit to the first high level unit in response to the second message, the second response message being generated by the second low level unit and communicated from the second low level unit to the first high level unit by way of the forwarding channel, the first low level unit, and the first channel;
- and
- compare the first response message and the second response message based, at least in part, on a determination that the first high level unit and the second high level unit have voting capabilities,
- wherein the first data protection code and the second data protection code prevent unauthorized alteration of the first message or and the second message, respectively.
10 more elements
A method executed by at least one processor, the method comprising:
- generating a first message and protecting the first message with a first protection scheme corresponding to the first message by a first high level unit, the first high level unit being coupled to a second high level unit by at least one comparison channel, the first message comprising content agreed upon between the first high level unit and the second high level unit through a first voting process;
- communicating the first message and the first protection scheme from the a first high level unit to a first low level unit coupled to the first high level unit by a first channel, the first message comprising content agreed upon between the first high level unit and a second high level unit, the first message being communicated from the first high level unit to the first low level unit by way of the first channel;
- generating a second message and protecting the second message with a second protection scheme corresponding to the second message by the first high level unit, the second message comprising content agreed upon between the first high level unit and the second high level unit through a second voting process;
- communicating the second message and the second protection scheme from the first high level unit to a second low level unit coupled to the first low level unit by a forwarding channel, the second message comprising content agreed upon between the first high level unit and the second high level unit, the second message being communicated from the first high level unit to the second low level unit by way of the first channel, the first low level unit, and the forwarding channel;
- polling the second low level unit to conduct a performance test of the second low level unit;
- determining the first channel is in a failure mode;
- and
- reversing communications between the first high level unit, the second high level unit, the first low level unit, and the second low level unit to flow through a second channel, the second channel being configured to couple the second high level unit to the second low level unit,
- wherein the first protection scheme and the second protection scheme prevent unauthorized alteration of the first message or and the second message, respectively.
6 more elements
Dependencies are inferred from the claim text.