Safety level specific error response scheme for mixed criticality systems

• US 9,672,095 B2
• Filed: 09/21/2015
• Issued: 06/06/2017
• Est. Priority Date: 09/21/2015
• Status: Active Grant

• Current Assignee: NXP USA, Inc. (NXP Semiconductors NV)
• Original Assignee: NXP USA, Inc. (NXP Semiconductors NV)
• Inventors: Robertson, Alistair Paul, Birnie, Andrew Edward, Young, Alison
• Primary Examiner(s): BUTLER, SARAI E
• Application Number:
  US14/859,457
• Publication Number:
  US 20170083391A1
• Time in Patent Office: 624 Days
• Field of Search: 714 381
• CPC Class Codes: G06F 11/0724 in a multiprocessor or a multi-core unit multiprocessors per se G06F15/80
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40

Abstract

An error response method for a mixed criticality system includes assigning a safety level to an application executed by a processor. Executing the application includes a transaction between the processor and a resource. The safety level is stored at the resource. The safety level and a fault indication are transmitted from the resource to a fault collection and control unit (FCCU). The fault indication is responsive to a fault from the resource. The FCCU responds to the fault indication with an action determined by the safety level.

Claims

1. An error response method for a mixed criticality system comprising:

assigning a safety level to an application executed by a processor, wherein executing the application comprises a transaction between the processor and a resource;

storing the safety level at the resource;

transmitting the safety level and a fault indication from the resource to a Fault Collection and Control Unit (FCCU), the fault indication responsive to a fault from the resource; and

responding by the FCCU to the fault indication with an action determined in part by the safety level.

2. The method of claim 1 further comprising:

assigning a second safety level to a second application executed by a second processor, wherein

the second application comprises a second transaction between the second processor and the resource, and

the second transaction terminates after the transaction;

replacing the safety level of the application with the second safety level of the second application at the resource; and

responding, by the FCCU, to a fault indication associated with the second transaction with a second action determined by the second safety level.

3. The method of claim 1 further comprising:

assigning a second safety level to a second application executed by the processor, wherein

the second application comprises a second transaction between the processor and the resource, and

the second transaction terminates after the transaction;

replacing the safety level of the application with the second safety level of the second application at the resource; and

responding, by the FCCU, to the fault indication associated with the second transaction with a second action determined by the second safety level.

4. The method of claim 1 wherein assigning the safety level to the application further comprises assigning a safety level to each of a plurality of application channels, each application channel transacting with a corresponding channel of the resource.

5. The method of claim 1 wherein the safety level is an Automotive Safety Integrity Level.

6. The method of claim 1 wherein the safety level is specific to the application.

7. The method of claim 1 wherein the fault from the resource is a failure of the transaction between the processor and the resource.

8. The method of claim 1 wherein the fault from the resource is a failure from a subsequent operation of the resource.

9. The method of claim 1 wherein the resource is a memory and the action includes at least one of ignoring the fault, correcting the fault, and logging the fault.

10. The method of claim 1 wherein the resource is one of a state machine, a peripheral and an input/output device and the action includes a predetermined task.

11. A mixed criticality system comprising:

a processor configured to execute an application having an associated safety level;

a resource coupled to the processor by a system bus;

a storage device associated with the resource and configured to store the safety level received from the processor; and

a Fault Collection and Control Unit (FCCU) coupled to the resource, wherein the FCCU is configured to perform an action determined in part by the safety level in response to a fault from the resource.

12. The system of claim 11 wherein the resource is coupled to the processor with a sideband path separate from the system bus.

13. The system of claim 11 wherein the resource is coupled to the processor with a time interleaved signal on the system bus.

14. The system of claim 11 wherein the storage device is a register coupled to the resource.

15. The system of claim 11 wherein the system is an automotive vehicle network.

16. The system of claim 11 wherein the fault from the resource is a failure of the transaction between the processor and the resource.

17. The system of claim 11 wherein the fault from the resource is a failure from a subsequent operation of the resource.

18. The system of claim 11 wherein the safety level is an Automotive Safety Integrity Level.

19. The system of claim 11 wherein the safety level is specific to the application.

20. An error response method for a mixed criticality system comprising:

assigning an Automotive Safety Integrity Level (ASIL) to an application executed by a processor, wherein executing the application comprises a transaction between the processor and a resource;

transmitting the ASIL and a fault indication, from the resource to a Fault Collection and Control Unit (FCCU) for the application, wherein the fault indication is responsive to a fault from the resource; and

responding by the FCCU to the fault indication with an action determined in part by the safety level.