Intel Corporation

Yogitech S.p.a.

Riccardo Mariani

Nabajit Deka

Asad Azam

Rajesh Banginwar

Ramkumar Jayaraman

John Charles Weast

Dean A Mulla

Kevin Safford

Bahaa Fahim

Peter Lachner

Michael Paulitsch

Umberto Santoni

Robert Steven Gottlieb

Roger May

Prashanth R Gadila

Giuseppe Capodanno

Michele Borgatti

Jyotika A Athavale

Stefano Lorenzini

Silvano Motto

Monia Chiavacci

Wenjun Zhang

Riccardo Cagnacci

Riccardo Locatelli

An automated driving system includes a security companion subsystem to access data generated at a compute subsystem of the automated driving system, which indicates a determination by the compute subsystem associated with an automated driving task. The security companion subsystem determines whether the determination is safe based on the data. The security companion subsystem is configured to realize a higher safety integrity level than the compute subsystem.

Independent safety monitoring of an automated driving system

An apparatus comprising a first processor core to execute a first instance of an application; a second processor core to execute a second instance of the application concurrent with the execution of the first instance of the application; and processing circuitry to direct an interrupt to the first processor core based on an indication that an execution state of the first processor core is ahead of an execution state of the second processor core.

Computing system for mitigating execution drift

Methods, systems and apparatuses may provide for technology that includes a chip having a first die including a first processing logic to execute a first application instance and generate a first output of the first application instance, and a second processing logic to execute a second application instance and generate a second output of the second application instance. The chip may also include a second die coupled to the first die, wherein the second die includes a safety monitor detect a condition associated with one or more of an error in the first output, an error in the second output, or a discrepancy between the first output and the second output. The safety monitor may also initiate a transition of the chip into a safe state in response to the condition.

Single chip multi-die architecture having safety-compliant cross-monitoring capability

Methods and apparatus relating to enhancing diagnostic capabilities of computing systems by combining variable patrolling Application Program Interface (API) and comparison mechanism of variables are described. In one embodiment, a first processor core executes a first instance of a workload to generate a first set of safety variables. A second processor core executes a second instance of the workload to generate a second set of safety variables. A third processor core generates a signal in response to comparison of the first set of safety variables and the second set of safety variables. Other embodiments are also disclosed and claimed.

Enhancing diagnostic capabilities of computing systems by combining variable patrolling API and comparison mechanism of variables

Soft error data describing soft errors predicted to affect at least a particular hardware component of a computing system are used to determine functional safety metric values. The computing system is to control at least a portion of physical functions of a machine using the particular hardware component. Respective soft error rates are determined for each of a set of classifications based on the soft errors described in the soft error data. Derating of the soft error rates are performed based on a set of one or more vulnerability factors to generate derated error rate values for each of the set of classifications. The functional safety metric value is determined from the derated error rate values to perform a functional safety analysis of the computing system.

Functional safety controls based on soft error information

An apparatus of a System on Chip (SoC) to implement a one out of two diagnostics (1oo2D) safety system comprises a memory comprising firmware to provide monitoring of the SoC and a second SoC, and a communication interface to provide cross-monitoring between the SoC and the second SoC. The firmware and the communication interface enable the SoC and the second SoC to implement the 1oo2D safety system without significant hardware or software external to the SoC.

SoC architecture to integrate with one out of two diagnostics platforms

Methods and apparatus relating to provision of core tightly coupled lockstep for high functional safety are described. In an embodiment, a master core, coupled to a slave core, executes one or more operations to support Advanced Driver Assistance Systems (ADA) or autonomous driving. The master core and the slave core receive the same input signal and core tightly couple logic causes generation of a signal in response to comparison of a first output from the master core and a second output from the slave core. The generated signal causes an interruption of the one or more operations in response to a mismatch between the first output and the second output. Other embodiments are also disclosed and claimed.

Core tightly coupled lockstep for high functional safety

A method for performing safety analysis includes determination of diagnostic coverage of safety mechanisms. The method includes considering the estimation of failure rapture for different scenario and potential sources of failure. The method includes considering and quantifying the effect of dependent failures that arise from other errors that may be already accounted for by existing safety mechanisms.

Systems and methods for safety analysis including consideration of dependent failures

A system to evaluate functional safety in an integrated circuit. The system includes a first circuit to execute an operation to cause to system to perform a function, where the function associated with a specified safety integrity level. The system also includes second circuit to capture trace data at an interface to the first circuit or at internal signals without inhibiting performance of the function, where the trace data comprising information that is used to determine whether the system can perform the function with an indicated level of functional safety and transmit the trace data to a safety evaluation circuit.

Functional safety over trace-and-debug

A method for executing programs (P) in an electronic system for applications with functional safety that comprises a single-processor or multiprocessor processing system () and a further independent control module (), including: carrying out a decomposition of a program (P) that includes a safety function (SF) to be executed via said system () into a plurality of parallel subprograms (P, . . . , Pn); assigning execution of each parallel subprogram (P, . . . , Pn) to a respective processing module () of the system, in particular a processor (C, . . . , Cm) of said multiprocessor architecture () or a virtual machine (V, . . . , Vn) associated to one of said processors (C, . . . , Cm); carrying out in the system (), periodically according to a cycle frequency (f) of the program (P) during normal operation of said system (), in the context of said safety function (SF), self-test operations (A, A, A) associated to each of said subprograms (P, . . . , Pn) and to the corresponding processing modules () on which they are executed, said self-test operations (A, A, A) including: diagnostic-self-test operations (A), which carry out diagnostic self-tests; operations (A) of self-testing of system values measured on the architecture (); applicational self-test operations (A), which include operations of checking execution of conditions of use (A) and/or execution of LBISTs (Logic Built-in Self-Tests) (A), and including: generating respective self-test data (D, D, D) corresponding to the self-test operations (A, A, A) and carrying out checking operations () on said self-test data (D, D, D); exchanging said self-test data (D, D, D) continuously via a protocol (PL) of messages (MC) with the further independent control module (); carrying out at least part of said checking operations () in said further control module (); and executing said operation of decomposition of the program (P) into a plurality of parallel subprograms (P, . . . , Pn) to achieve a coverage target (A, A, A) for each of said self-test operations (A, A, A) associated to a respective subprogram (P, . . . , Pn) or processing module () in such a way that it respects a given failure-probability target (g12).

Method for executing programs in an electronic system for applications with functional safety comprising a plurality of processors, corresponding system and computer program product

A method for executing programs (P) in an electronic system for applications provided with functional safety that includes a single-processor or multiprocessor processing system and a further independent control module, the method comprising: performing an operation of breaking-down of a program (P) into a plurality of parallel sub-programs (P, . . . , Pn); assigning execution of each parallel sub-program (P, . . . , Pn) to a respective processing module of the system, periodically performing self-test operations (A, A, A) associated to each of said sub-programs (P, . . . , Pn).

Method of executing programs in an electronic system for applications with functional safety comprising a plurality of processors, corresponding system and computer program product

A method for measuring the effect of microscopic hardware faults in high-complexity applications includes carrying out on a processing system a step of simulation of an electronic system that executes a software instance of the application. The simulation step includes injecting faults at a microscopic level and measuring a corresponding final effect. The operation of injecting faults includes selecting a microscopic fault to be injected, selecting a mutant corresponding to the microscopic fault, applying the selected mutant to the software instance to obtain a mutated instance, simulating the electronic system that executes the mutated instance, and measuring the corresponding effect.

Method for measuring the effect of microscopic hardware faults in high-complexity applications implemented in a hardware electronic system, and corresponding system and computer program product

A method for performing failure mode and effects analysis (FMEA) on integrated circuits including preparing a FMEA database of an integrated circuit under design and computing FMEA results from the FMEA database. Information is automatically extracted from an integrated circuit description. The extraction of information includes reading integrated circuit information, partitioning the circuit in invariant and elementary sensitive zones (SZ), using the information in the preparation step of a FMEA database. Optionally a FMEA validation stage may be performed with which FMEA computed results are compared with FMEA measured results to obtain FMEA validated results.

Method for performing failure mode and effects analysis of an integrated circuit and computer program product therefor

A microcontroller comprising a central processing unit and a further fault processing unit suitable for performing validation of operations of said central processing unit. The further fault processing unit is external and different with respect to said central processing unit and said further fault processing unit comprises at least a module for performing validation of operations of said central processing unit and one or more modules suitable for performing validation of operations of other functional parts of said microcontroller. Validation of operations of said central processing unit is performed by using one or more of the following fault tolerance techniques: data shadowing; code&flow signature; data processing legality check; addressing legality check; ALU concurrent integrity checking; concurrent mode/interrupt check. The proposed microcontroller is particularly suitable for application in System On Chip (SoC) and was developed by paying specific attention to the possible use in automotive System On Chip. The invention also includes a method for designing and verify such fault-robust system on chip, and a fault-injection technique based on e-language.

Growing community of inventors

Pisa, Italy

Riccardo Mariani