US5920715A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System architecture permitting verified and unverified programs to execute safely on one processor
Assignee: Pilz GmbH and Co KG
•
Filing: 1996-02-01
•
Granted: 1999-07-06
•
Expires: 2016-02-01
Abstract
Abstract A system architecture uses at least two processors (2, 3), which jointly control a process and constantly compare their data with each other. A program complex which has been checked with respect to the possible errors, as well as a non-checked program complex, runs on one of the two processors (2). In order to rule out interference in the checked program complex by the non-checked one, the peripheral hardware (12) which interact with the checked program complex are provided with inhibit inputs (16), and the tested program complex, via the inhibit inputs (16), blocks the peripheral hardware (12) which are reserved for it before it gives up command to the non-checked program complex.
Inventors
- 👤 Andreas Heckel
- 👤 Roland Rupp
- 👤 Christoph Weishaar
- 👤 Klaus Wohnhaas
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-03 10:47
CPC Classifications
G; G06; G06F; G06F11/00; G06F11/07; G06F11/16; G06F11/1629; G06F11/1637; G05; G05B; G05B19/00; G05B19/02; G05B19/04; G05B19/042; G05B19/0428; G05B19/18; G05B19/406; G05B19/4063; G06F11/0796
Claims Analysis
Total Claims: 23
Claim 1
Independent Claim
289 words
A system architecture having a first processor, having first storage means assigned to the first processor, having first peripheral means which are assigned to the first processor and have inputs/outputs and inhibit inputs connected to the first processor said inhibit inputs being used to block the first peripheral means from receiving information from the inputs when an inhibit signal has been transmitted to the inhibit inputs, having a first program complex which runs on the first processor, which is verified with respect to freedom from errors, which interacts at least predominantly with the first storage means of the first processor, and operates in such a way that, when it is running on the first processor, when defined conditions are reached, the first program complex emits an inhibit signal to the peripheral means assigned to the first program complex and releases the first processor, and withdraws or clears the inhibit signal as soon as a the first program complex obtains the first processor back, having second storage means assigned to the first processor, having second peripheral means which are assigned to the first processor and have inputs/outputs connected to the first processor, having a second program complex which runs on the first processor, the active running of the second program complex being nested in time with the active running of the first program complex, on which lower requirements with respect to freedom from errors are placed than on the first program complex, which interacts at least predominantly with the second storage means of the first processor, given error-free running then makes only read access, if at all, to the inputs/outputs of the peripheral means assigned to the first program complex, and when defined conditions are reached, releases the first processor.
Claim 2
Independent Claim
289 words
A system architecture having a first processor, having first storage means assigned to the first processor, having first peripheral means which are assigned to the first processor and have inputs/outputs and inhibit inputs connected to the first processor said inhibit inputs being used to block the first peripheral means from receiving information from the inputs when an inhibit signal has been transmitted to the inhibit inputs, having a first program complex which runs on the first processor, which is verified with respect to freedom from errors, which interacts at least predominantly with the first storage means of the first processor, and operates in such a way that, when it is running on the first processor, when defined conditions are reached, the first program complex emits an inhibit signal to the peripheral means assigned to the first program complex and releases the first processor, and withdraws or clears the inhibit signal as soon as a the first program complex obtains the first processor back, having second storage means assigned to the first processor, having second peripheral means which are assigned to the first processor and have inputs/outputs connected to the first processor, having a second program complex which runs on the first processor, the active running of the second program complex being nested in time with the active running of the first program complex, on which lower requirements with respect to freedom from errors are placed than on the first program complex, which interacts at least predominantly with the second storage means of the first processor, given error-free running then makes only read access, if at all, to the inputs/outputs of the peripheral means assigned to the first program complex, and when defined conditions are reached, releases the first processor.
Claim 3
Dependent Claim
27 words
The system architecture as claimed in claim 1, wherein there is among the first peripheral means at least one which is reserved for the first program complex.
Claim 4
Dependent Claim
42 words
The system architecture as claimed in claim 1, wherein there is among the first peripheral means at least one to which it is permissible to have write and/or read access both from the first program complex and from the second program complex.
Claim 5
Dependent Claim
26 words
The system architecture as claimed in claim 1, wherein there is a storage area via which the first and second program complexes communicate with each other.
Claim 6
Dependent Claim
44 words
The system architecture as claimed in claim 4, wherein the storage area via which the first and the second program complex communicate with each other is located in the first and/or the second storage means or in only one of the two storage means.
Claim 7
Dependent Claim
20 words
The system architecture as claimed in claim 1, wherein the first storage means are reserved for the first program complex.
Claim 8
Dependent Claim
49 words
The system architecture as claimed in claim 1, wherein the first and the second storage means are realized in hardware terms in a common store, and wherein a first group of storage addresses forms the first storage means and a second group of addresses forms the second storage means.
Claim 9
Dependent Claim
24 words
The system architecture as claimed in claim 1, wherein the first and the second storage means are realized in hardware terms in separate stores.
Claim 10
Dependent Claim
42 words
The system architecture as claimed in claim 1, wherein the first program complex, when the first processor is obtained back, checks whether the inhibit signal is still present or has not been withdrawn in the meantime, before clearing or withdrawing said signal.
Claim 11
Dependent Claim
22 words
The system architecture as claimed in claim 1, wherein the first program complex is a program complex which has a safety function.
Claim 12
Dependent Claim
45 words
The system architecture as claimed in claim 1, wherein the first processor has an interrupt controller to which a timer is connected, and wherein a condition which leads to the first program complex obtaining the first processor back is an interrupt triggered by the timer.
Claim 13
Dependent Claim
33 words
The system architecture as claimed in claim 1, wherein the condition for the release of the first processor by the relevant program complex is an appropriate program instruction in the relevant program complex.
Claim 14
Dependent Claim
35 words
The system architecture as claimed in claim 1, wherein the commands which form the first program complex and/or data which is assigned exclusively to the first program complex are stored in the first storage means.
Claim 15
Dependent Claim
35 words
The system architecture as claimed in claim 1, wherein the commands which form the second program complex and/or data which is assigned exclusively to the second program complex are stored in the second storage means.
Claim 16
Dependent Claim
63 words
The system architecture as claimed in claim 1, further comprising a second processor, third storage means assigned to the second processor, third peripheral means which are assigned to the second processor and have inputs/outputs connected to the second processor, and a third program complex, running on the second processor, which interacts with the third storage means and communicates with the third peripheral means.
Claim 17
Dependent Claim
20 words
The system architecture as claimed in claim 15, wherein the first and the second processor are different from each other.
Claim 18
Dependent Claim
62 words
The system architecture as claimed in claim 15, wherein the third program complex behaves, from the point of view of the third peripheral means, predominantly or exactly as does the first program complex from the point of view of the peripheral means of the first program complex, to the extent that the latter coincide in functional terms with the third peripheral means.
Claim 19
Dependent Claim
33 words
The system architecture as claimed in claim 15, wherein the first and the third program complex, apart from any possible communication with the second program complex, are intended to furnish the same function.
Claim 20
Dependent Claim
26 words
The system architecture as claimed in claim 15, wherein the first and the third program complex communicate with each other at least from time to time.
Claim 21
Dependent Claim
38 words
The system architecture as claimed in claim 15, wherein the communication comprises the comparison of data calculated by each of the two program complexes, and of data which is or has been supplied by the associated peripheral means.
Claim 22
Dependent Claim
18 words
The system architecture as claimed in claim 15, wherein there are still further processors and program complexes present.
Claim 23
Dependent Claim
19 words
The system architecture as claimed in claim 1, wherein the system architecture is implemented in a machine control system.
References Cited (Backward Citations)
US4484270A
Cited
US4568866A
Cited
EP0298396A2
Cited
US4953074A
Cited
US5386360A
Cited
US5774721A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-07-05 | 2003-01-04 | 2003-07-06 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-07-05 | 2007-01-04 | 2007-07-06 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-07-05 | 2011-01-04 | 2011-07-06 | $7700.00 | Window Closed / Lapsed |