Methods and articles of manufacture for hosting a safety critical application on an uncontrolled data processing device

• US 8,601,465 B2
• Filed: 09/07/2010
• Issued: 12/03/2013
• Est. Priority Date: 09/08/2009
• Status: Active Grant

• Current Assignee: Abbott Diabetes Care Incorporated (Abbott Laboratories Incorporated)
• Original Assignee: Abbott Diabetes Care Incorporated (Abbott Laboratories Incorporated)
• Inventors: Bernstein, Daniel M., Nekoomaram, Saeed, Sloan, Mark K.
• Primary Examiner(s): Khatri, Anil
• Application Number:
  US12/876,840
• Publication Number:
  US 20110126188A1
• Time in Patent Office: 1,183 Days
• Field of Search: 717168-178, 709203-204
• US Class Current: 717/174
• CPC Class Codes: G06F 1/3203 Power management, i.e. event-based initiation of a power-saving mode
• CPC Class Codes: G06F 1/3287 by switching off individual functional units in the computer system
• CPC Class Codes: G06F 11/004 Error avoidance G06F11/07 and subgroups take precedence
• CPC Class Codes: G06F 11/0721 within a central processing unit [CPU]
• CPC Class Codes: G06F 11/0736 in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function testing or monitoring of automated control systems G05B23/02
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/3668 Software testing software testing in telephone exchanges H04M3/242, testing of hardware G06F11/22
• CPC Class Codes: G06F 11/3688 for test execution, e.g. scheduling of test suites
• CPC Class Codes: G06F 11/3692 for test results analysis
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/656 while running
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: G06F 9/5011 the resources being hardware resources other than CPUs, Servers and Terminals
• CPC Class Codes: G06F 9/546 Message passing systems or structures, e.g. queues
• CPC Class Codes: G16H 40/40 for the management of medical equipment or devices, e.g. scheduling maintenance or upgrades
• CPC Class Codes: Y02D 10/00 Energy efficient computing, e.g. low power processors, power management or thermal management

Abstract

Methods and articles of manufacture for hosting a safety critical application on an uncontrolled data processing device are provided. Various combinations of installation, functional, host integrity, coexistence, interoperability, power management, and environment checks are performed at various times to determine if the safety critical application operates properly on the device. The operation of the SCA on the UDPD may be controlled accordingly.

Claims

1. A method for hosting a safety critical application (SCA) on an uncontrolled data processing device (UDPD), the method comprising:

installing a SCA on a UDPD;

determining, with a UDPD, whether the SCA is installed properly on the UDPD;

determining, with the UDPD, whether the SCA is functioning properly on the UDPD;

preventing, with the UDPD, the SCA from operating freely on the UDPD when;

a verification that the SCA did not install properly on the UDPD is made;

or

a verification that the SCA does not function properly on the UDPD is made,

wherein the preventing of the SCA from operating freely on the UDPD comprises;

disabling, with the UDPD, safety critical features of the SCA from being executed on the UDPD; and

enabling, with the UDPD, non-safety critical features of the SCA to be executed on the UDPD; and

permitting, with the UDPD, the SCA to operate freely on the UDPD when the SCA is determined to operate properly on the UDPD, wherein a determination that the SCA operates properly on the UDPD requires;

a verification that the SCA installed properly on the UDPD; and

a verification that the SCA functions properly on the UDPD.

2. The method of claim 1, wherein the determining whether the SCA installed properly on the UDPD comprises:

identifying, with the UDPD, an image of an installed SCA component on the UDPD; and

comparing, with the UDPD, the image of the installed SCA component with reference installation data.

3. The method of claim 2, wherein the comparing of the image of the installed SCA component with the reference installation data comprises:

comparing, with the UDPD, error detection or correction data associated with the installed SCA component with a corresponding error detection or correction data in the reference installation data;

comparing, with the UDPD, a filename associated with the installed SCA component with a corresponding filename in the reference installation data;

or

comparing, with the UDPD, a version number associated with the installed SCA component with corresponding version number in the reference installation data.

4. The method of claim 1, wherein the determining whether the SCA functions properly on the UDPD comprises:

initiating, with the UDPD, a computation using reference computational input; and

comparing, with the UDPD, a result of the computation with reference computational data.

5. The method of claim 4, wherein the determining whether the SCA functions properly on the UDPD further comprises:

determining, with the UDPD, a time to perform a computation using the reference computational input; and

comparing, with the UDPD, the time to perform the computation with reference timing data.

6. The method of claim 1, wherein the determining whether the SCA functions properly on the UDPD comprises:

determining, with the UDPD, a time to perform an activity; and

comparing, with the UDPD, the time to perform the activity with reference timing data.

7. The method of claim 6, wherein the determining whether the SCA functions properly on the UDPD further comprises:

initiating, with the UDPD, an image to be displayed on a display of the UDPD;

determining, with the UDPD, an actual image displayed on the display; and

comparing, with the UDPD, the actual image displayed with reference display data.

8. The method of claim 7, wherein the determining whether the SCA functions properly on the UDPD further comprises:

determining, with the UDPD, whether the SCA communicates properly on the UDPD with an external device.

9. The method of claim 8, comprising:

identifying, with the UDPD, a first current environment of the UDPD, the first current environment associated with a time when SCA is permitted to operate freely on the UDPD.

10. The method of claim 9, comprising:

identifying, with the UDPD, a second current environment of the UDPD, the second current environment associated with a time after the SCA is permitted to operate freely on the UDPD;

comparing, with the UDPD, the second current environment with the first current environment to determine whether a change in environment occurred;

determining, with the UDPD, whether the SCA functions properly on the UDPD after a determination that a change in environment occurred;

preventing, with the UDPD, the SCA from operating freely on the UDPD when determined that SCA does not function properly on the UDPD after the determination that a change in environment occurred; and

permitting, with the UDPD, the SCA to operate freely on the UDPD when determined that SCA functions properly on the UDPD after the determination that a change in environment occurred.

11. The method of claim 1, wherein the determining whether the SCA functions properly on the UDPD comprises:

initiating, with the UDPD, an image to be displayed on a display of the UDPD;

determining, with the UDPD, an actual image displayed on the display; and

comparing, with the UDPD, the actual image displayed with reference display data.

12. The method of claim 11, wherein the determining of the actual image displayed on the display comprises initiating, with the UDPD, a screen capture, wherein the screen capture is the actual image displayed.

13. The method of claim 11, wherein the determining of the actual image displayed on the display comprises receiving, with the UDPD, user input identifying the actual image displayed.

14. The method of claim 1, wherein the determining whether the SCA functions properly on the UDPD comprises:

initiating, with the UDPD, an image to be displayed on a display of the UDPD, the image in the form of a verification inquiry;

receiving, with the UDPD, user input in response to the verification inquiry; and

comparing, with the UDPD, the user input received with reference display data.

15. The method of claim 1, wherein the determining whether the SCA functions properly on the UDPD comprises:

determining, with the UDPD, whether the SCA communicates properly on the UDPD with an external device.

16. The method of claim 15, wherein the determining whether the SCA communicates properly on the UDPD comprises:

initiating, with the UDPD, the SCA to establish a communication link between the UDPD and the external device; and

determining, with the UDPD, whether the communication link is properly established.

17. The method of claim 15, wherein the determining whether the SCA communicates properly on the UDPD comprises:

initiating, with the UDPD, a communication between the SCA and the external device; and

comparing, with the UDPD, a result of the communication with reference communication data.

18. The method of claim 17, wherein the determining whether the SCA communicates properly on the UDPD further comprises:

determining, with the UDPD, a time to perform the communication; and

comparing, with the UDPD, the time to perform the communication with reference timing data.

19. The method of claim 1, comprising:

identifying, with the UDPD, a first current environment of the UDPD, the first current environment associated with a time when SCA is permitted to operate freely on the UDPD.

20. The method of claim 19, wherein the first current environment takes into account:

applications installed on the UDPD;

drivers on the UDPD;

a last installation on the UDPD;

or

configuration settings.

21. The method of claim 19, comprising:

identifying, with the UDPD, a second current environment of the UDPD, the second current environment associated with a time after the SCA is permitted to operate freely on the UDPD;

comparing, with the UDPD, the second current environment with the first current environment; and

determining, with the UDPD, whether an environment change has occurred.

22. The method of claim 21, comprising:

determining, with the UDPD, whether the SCA functions properly on the UDPD after a determination that a change in environment occurred;

preventing, with the UDPD, the SCA from operating freely on the UDPD when determined that SCA does not function properly on the UDPD after the determination that the change in environment occurred; and

permitting, with the UDPD, the SCA to operate freely on the UDPD when determined that SCA functions properly on the UDPD after the determination that the change in environment occurred.

23. The method of claim 22, wherein the identifying of the second current environment of the UDPD and the determining whether the SCA functions properly on the UDPD after the determination that the change in environment occurred are performed in a background of the UDPD.

24. The method of claim 22, wherein the identifying of the second current environment of the UDPD and the determining whether the SCA functions properly on the UDPD after the determination that the change in environment occurred are performed when the SCA is initiated to run on the UDPD.

25. The method of claim 22, wherein the identifying of the second current environment of the UDPD and the determining whether the SCA functions properly on the UDPD after the determination that the change in environment occurred are performed after a predetermined amount of time since the time when SCA is permitted to operate freely on the UDPD.

26. The method of claim 21, wherein when a determination that an environment change occurred, the method further comprises:

preventing, with the UDPD, the SCA from operating freely on the UDPD after the determination that the change in environment occurred;

determining, with the UDPD, whether the SCA functions properly on the UDPD after a determination that the change in environment occurred;

preventing, with the UDPD, the SCA from operating freely on the UDPD when determined that SCA does not function properly on the UDPD after the determination that the change in environment occurred; and

permitting, with the UDPD, the SCA to operate freely on the UDPD when determined that SCA functions properly on the UDPD after the determination that the change in environment occurred.

27. The method of claim 1, comprising:

determining, with the UDPD, whether the SCA is corrupted; and

preventing, with the UDPD, the SCA from operating freely on the UDPD when a determination that the SCA is corrupted is made;

wherein the determination that the SCA operates properly on the UDPD further requires a determination that the SCA is not corrupted.

28. The method of claim 1, comprising:

determining, with the UDPD, whether the SCA is incompatible with any nonrelated program on the UDPD; and

preventing, with the UDPD, the SCA from operating freely on the UDPD when a determination that the SCA is incompatible with a nonrelated program is made;

wherein the determination that the SCA operates properly on the UDPD further requires a determination that the SCA is not incompatible with any nonrelated program.

29. The method of claim 28, wherein the determining whether the SCA is incompatible with any nonrelated program on the UDPD comprises:

determining whether the SCA is properly accessing a shared resource with priority over lower priority nonrelated programs that have access to the shared resource.

30. The method of claim 1, comprising:

determining, with the UDPD, whether the SCA interoperates properly with related programs on the UDPD; and

preventing, with the UDPD, the SCA from operating freely on the UDPD when a determination that the SCA does not interoperate properly with a related program is made;

wherein the determination that the SCA operates properly on the UDPD further requires a determination that the SCA interoperates properly with the related programs.

31. The method of claim 1, comprising:

determining, with the UDPD, whether the UDPD has sufficient power capabilities to run the SCA safely on the UDPD; and

preventing, with the UDPD, the SCA from operating freely on the UDPD when a determination that the UDPD does not have sufficient power capabilities to run the SCA safely on the UDPD is made;

wherein the determination that the SCA operates properly on the UDPD further requires a determination that the UDPD has sufficient power capabilities to run the SCA safely on the UDPD.

32. The method of claim 1, wherein the SCA is an analyte monitoring application.

33. The method of claim 32, wherein the analyte is glucose or a ketone.

34. The method of claim 1, wherein the UDPD is a handheld data processing device.

35. The method of claim 34, wherein the UDPD is a mobile phone, personal digital assistant (PDA), or digital music player.

36. A method for hosting a safety critical application (SCA) on an uncontrolled data processing device (UDPD), the method comprising:

installing a SCA on a UDPD;

permitting, with the UDPD, a SCA to operate freely on a UDPD at a first time, the first time associated with a determination that SCA operates properly on the UDPD;

identifying, with the UDPD, a current environment for the UDPD, the current environment associated with a second time, the second time after the first time;

determining, with the UDPD, whether a change in environment occurred on the UDPD since the first time;

determining, with the UDPD, whether the SCA functions properly on the UDPD when determined that a change in environment occurred;

preventing, with the UDPD, the SCA from operating freely on the UDPD when a determination that the SCA does not function properly on the UDPD is made, wherein the preventing of the SCA from operating freely on the UDPD comprises;

disabling, with the UDPD, safety critical features of the SCA from being executed on the UDPD; and

enabling, with the UDPD, non-safety critical features of the SCA to be executed on the UDPD; and

permitting, with the UDPD, the SCA to continue to operate freely on the UDPD when the SCA is determined to still operate properly on the UDPD, wherein a determination that the SCA still operates properly on the UDPD requires a verification that the SCA functions properly on the UDPD.

37. The method of claim 36, wherein the determining whether a change in environment occurred on UDPD since the first time comprises:

comparing, with the UDPD, the current environment of the UDPD with a previous environment associated with the first time;

wherein a non-match between the current environment and the previous environment indicates a change in environment occurred; and

wherein a match between the current environment and the previous environment indicates a change in environment did not occur.

38. The method of claim 36, wherein the change in environment takes into account:

applications installed on the UDPD;

drivers on the UDPD;

a last installation on the UDPD;

or

configuration settings.

39. The method of claim 36, wherein the determining whether the SCA functions properly on the UDPD comprises:

initiating, with the UDPD, a computation using reference computational input; and

comparing, with the UDPD, a result of the computation with reference computational data.

40. The method of claim 39, wherein the determining whether the SCA functions properly on the UDPD further comprises:

determining, with the UDPD, a time to perform a computation using the reference computational input; and

comparing, with the UDPD, the time to perform the computation with reference timing data.

41. The method of claim 36, wherein the determining whether the SCA functions properly on the UDPD comprises:

determining, with the UDPD, a time to perform an activity; and

comparing, with the UDPD, the time to perform the activity with reference timing data.

42. The method of claim 41, wherein the determining whether the SCA functions properly on the UDPD further comprises:

initiating, with the UDPD, an image to be displayed on a display of the UDPD;

determining, with the UDPD, an actual image displayed on the display; and

comparing, with the UDPD, the actual image displayed with reference display data.

43. The method of claim 42, wherein the determining whether the SCA functions properly on the UDPD further comprises:

determining, with the UDPD, whether the SCA communicates properly on the UDPD with an external device.

44. The method of claim 43, comprising:

identifying, with the UDPD, a new environment of the UDPD, the new environment associated with a time when SCA is permitted to continue to operate freely on the UDPD.

45. The method of claim 36, wherein the determining whether the SCA functions properly on the UDPD comprises:

initiating, with the UDPD, an image to be displayed on a display of the UDPD;

determining, with the UDPD, an actual image displayed on the display; and

comparing, with the UDPD, the actual image displayed with reference display data.

46. The method of claim 45, wherein the determining of the actual image displayed on the display comprises initiating, with the UDPD, a screen capture, wherein the screen capture is the actual image displayed.

47. The method of claim 45, wherein the determining of the actual image displayed on the display comprises receiving, with the UDPD, user input identifying the actual image displayed.

48. The method of claim 36, wherein the determining whether the SCA functions properly on the UDPD comprises:

initiating, with the UDPD, an image to be displayed on a display of the UDPD, the image in the form of a verification inquiry;

receiving, with the UDPD, user input in response to the verification inquiry; and

comparing, with the UDPD, the user input received with reference display data.

49. The method of claim 36, wherein the determining whether the SCA functions properly on the UDPD comprises:

determining, with the UDPD, whether the SCA communicates properly on the UDPD with an external device.

50. The method of claim 49, wherein the determining whether the SCA communicates properly on the UDPD comprises:

initiating, with the UDPD, the SCA to establish a communication link between the UDPD and the external device; and

determining, with the UDPD, whether the communication link is properly established.

51. The method of claim 49, wherein the determining whether the SCA communicates properly on the UDPD comprises:

initiating, with the UDPD, a communication between the SCA and the external device; and

comparing a result of the communication with reference communication data.

52. The method of claim 51, wherein the determining whether the SCA communicates properly on the UDPD further comprises:

determining, with the UDPD, a time to perform the communication; and

comparing, with the UDPD, the time to perform the communication with reference timing data.

53. The method of claim 36, comprising:

identifying, with the UDPD, a new environment of the UDPD, the new environment associated with a time when SCA is permitted to continue to operate freely on the UDPD.

54. The method of claim 53, wherein the new current environment takes into account:

applications installed on the UDPD;

drivers on the UDPD;

a last installation on the UDPD;

or

configuration settings.

55. The method of claim 36, wherein the identifying of the current environment of the UDPD and the determining whether the SCA functions properly on the UDPD when determined that the change in environment occurred are performed in a background of the UDPD.

56. The method of claim 36, wherein the identifying of the current environment of the UDPD and the determining whether the SCA functions properly on the UDPD when determined that the change in environment occurred are performed when the SCA is initiated to run on the UDPD.

57. The method of claim 36, wherein the identifying of the current environment of the UDPD and the determining whether the SCA functions properly on the UDPD when determined that the change in environment occurred are performed after a predetermined amount of time since the time when SCA is permitted to operate freely on the UDPD.

58. The method of claim 36, comprising:

preventing, with the UDPD, the SCA from operating freely on the UDPD after a determination that a change in environment occurred.

59. The method of claim 36, comprising:

determining, with the UDPD, whether the SCA is corrupted when determined that the change in environment occurred; and

preventing, with the UDPD, the SCA from operating freely on the UDPD when a determination that the SCA is corrupted is made;

wherein the determination that the SCA still operates properly on the UDPD further requires a determination that the SCA is not corrupted.

60. The method of claim 36, comprising:

determining, with the UDPD, whether the SCA is incompatible with any nonrelated program on the UDPD when determined that the change in environment occurred; and

preventing, with the UDPD, the SCA from operating freely on the UDPD when a determination that the SCA is incompatible with a nonrelated program is made;

wherein the determination that the SCA still operates properly on the UDPD further requires a determination that the SCA is not incompatible with any nonrelated program.

61. The method of claim 60, wherein the determining whether the SCA is incompatible with any nonrelated program on the UDPD comprises:

determining whether the SCA is properly accessing a shared resource with priority over lower priority nonrelated programs that have access to the shared resource.

62. The method of claim 36, comprising:

determining, with the UDPD, whether the SCA interoperates properly with related programs on the UDPD when determined that the change in environment occurred; and

preventing, with the UDPD, the SCA from operating freely on the UDPD when a determination that the SCA does not interoperate properly with a related program is made;

wherein the determination that the SCA still operates properly on the UDPD further requires a determination that the SCA interoperates properly with the related programs.

63. The method of claim 36, comprising:

determining, with the UDPD, whether the UDPD has sufficient power capabilities to run the SCA safely on the UDPD when determined that the change in environment occurred; and

preventing, with the UDPD, the SCA from operating freely on the UDPD when a determination that the UDPD does not have sufficient power capabilities to run the SCA safely on the UDPD is made;

wherein the determination that the SCA still operates properly on the UDPD further requires a determination that the UDPD has sufficient power capabilities to run the SCA safely on the UDPD.

64. The method of claim 36, wherein the SCA is an analyte monitoring application.

65. The method of claim 64, wherein the analyte is glucose or a ketone.

66. The method of claim 36, wherein the UDPD is a handheld data processing device.

67. The method of claim 66, wherein the UDPD is a mobile phone, personal digital assistant (PDA), or digital music player.